joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005bc40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
movups xmm0, xmmword [rdx]
mov rbx, qword [rcx + 0x30]
mov r14, r9
mov rdi, qword [rcx + 0x38]
mov ebp, r8d
movaps xmmword [rsp + 0x20], xmm0
mov rsi, rcx
cmp rbx, rdi
je 0x14005bc9e
nop dword [rax + rax]
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x20]
call fcn.140032ac0
test al, al
jne 0x14005bc9e
add rbx, 0x98
cmp rbx, rdi
jne 0x14005bc80
cmp rbx, qword [rsi + 0x38]
jne 0x14005bcab
mov eax, 1
jmp 0x14005bcfa
mov eax, dword [rbx + 0x80]
cmp eax, ebp
jne 0x14005bcde
cmp qword [rbx + 0x30], 8
lea rcx, [rbx + 0x18]
jb 0x14005bcc3
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov edx, 1
shr ecx, 3
and ecx, 2
cmp eax, 0xffffffff
cmove ecx, edx
jmp 0x14005bced
mov ecx, 1
mov edx, 4
cmp eax, ecx
cmove ecx, edx
test ecx, ecx
jne 0x14005bcf8
mov byte [rsi + 0x28], 1
mov qword [r14], rbx
mov eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14005e3f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, r8
mov rbx, rdx
xor edi, edi
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x58], edi
call fcn.140059cf0
lea rcx, [rsp + 0x20]
mov rsi, qword [rax]
mov qword [rsp + 0x58], rsi
mov qword [rax], rdi
call fcn.140059980
test rsi, rsi
jne 0x14005e43e
lea edi, [rsi + 3]
jmp 0x14005e4b9
movups xmm0, xmmword [rbx]
mov rbx, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x38]
movaps xmmword [rsp + 0x20], xmm0
cmp rbx, rdi
je 0x14005e47e
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x20]
call fcn.140032ac0
test al, al
jne 0x14005e47e
add rbx, 0x98
cmp rbx, rdi
jne 0x14005e460
cmp rbx, qword [rsi + 0x38]
jne 0x14005e48b
mov edi, 1
jmp 0x14005e4b9
cmp qword [rbx + 0x30], 8
lea rcx, [rbx + 0x18]
jb 0x14005e499
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14005e484
shr edi, 3
and edi, 2
jne 0x14005e4b9
mov rdx, rbx
mov rcx, rbp
call fcn.140059bd0
lea rcx, [rsp + 0x58]
call fcn.140059980
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14005e4e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, r8
mov rbx, rdx
lea r8, [rdx + 0x10]
lea rdx, [rsp + 0x58]
call fcn.140059cf0
lea rcx, [rsp + 0x58]
mov rsi, qword [rax]
mov qword [rsp + 0x68], rsi
mov qword [rax], 0
call fcn.140059980
test rsi, rsi
jne 0x14005e523
lea edi, [rsi + 3]
jmp 0x14005e599
movups xmm0, xmmword [rbx]
mov rbx, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x38]
movaps xmmword [rsp + 0x20], xmm0
cmp rbx, rdi
je 0x14005e55e
nop dword [rax + rax]
lea rcx, [rbx + 4]
lea rdx, [rsp + 0x20]
call fcn.140032ac0
test al, al
jne 0x14005e55e
add rbx, 0x98
cmp rbx, rdi
jne 0x14005e540
cmp rbx, qword [rsi + 0x38]
jne 0x14005e56b
mov edi, 1
jmp 0x14005e599
cmp qword [rbx + 0x30], 8
lea rcx, [rbx + 0x18]
jb 0x14005e579
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x14005e564
shr edi, 3
and edi, 2
jne 0x14005e599
mov rdx, rbx
mov rcx, rbp
call fcn.140059bd0
lea rcx, [rsp + 0x68]
call fcn.140059980
mov rbx, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140079760
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x160
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov ebx, 0xff
cmp eax, ebx
jbe 0x1400797dc
lea r9d, [rbx - 0x41]
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_system_snapshot_win.cc
lea rdx, str.unsigned_char___cdecl_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea rcx, [rsp + 0x60]
call fcn.14002d900
mov rcx, rax
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
call fcn.140009610
lea rcx, [rsp + 0x60]
call fcn.14002dc50
mov eax, dword [rsp + 0x50]
cmp eax, ebx
jbe 0x1400797dc
movzx ecx, al
xor edx, edx
test dl, dl
cmovne ebx, ecx
movzx eax, bl
add rsp, 0x160
pop rbx
ret
movzx ecx, al
mov dl, 1
test dl, dl
cmovne ebx, ecx
movzx eax, bl
add rsp, 0x160
pop rbx
ret
Function at 0x140079800
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
lea rcx, [rsp + 0x30]
mov r13, r8
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
mov ebx, 0xff
cmp eax, ebx
jbe 0x140079879
lea r9d, [rbx - 0x41]
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_system_snapshot_win.cc
lea rdx, str.unsigned_char___cdecl_crashpad::internal::SystemSnapshotWin::CPUCount_void__const
lea rcx, [rsp + 0x60]
call fcn.14002d900
mov rcx, rax
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
call fcn.140009610
lea rcx, [rsp + 0x60]
call fcn.14002dc50
mov eax, dword [rsp + 0x50]
cmp eax, ebx
mov qword [rsp + 0x190], rsi
cmovbe ebx, eax
xor ebp, ebp
movzx r14d, bl
mov edi, ebp
mov ebx, ebp
mov r15d, ebp
test r14, r14
je 0x14007990d
lea rax, [r14 + r14*2]
lea rsi, [rax*8]
cmp rsi, 0x1000
jb 0x1400798e0
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x140079a23
call fcn.1400d4a10
mov rcx, rax
test rax, rax
je 0x140079a1c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov rbx, rax
mov qword [rax - 8], rcx
lea rdi, [rax + rsi]
jmp 0x1400798fd
test rsi, rsi
je 0x1400798f6
mov rcx, rsi
call fcn.1400d4a10
mov rbx, rax
lea rdi, [rax + rsi]
jmp 0x1400798fd
mov rax, rbp
lea rdi, [rsi + rbp]
mov r8, rsi
xor edx, edx
mov rcx, rax
mov r15, rdi
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea eax, [r14 + r14*2]
shl eax, 3
mov r9, rbx
xor r8d, r8d
mov dword [rsp + 0x20], eax
lea ecx, [rdx + 0xb]
call sub.POWRPROF.dll_CallNtPowerInformation
test eax, eax
je 0x140079932
mov qword [r12], rbp
jmp 0x14007999f
mov rdx, rbx
cmp rbx, rdi
je 0x140079963
lea rcx, [rbx + 0x18]
cmp rcx, rdi
je 0x140079963
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx + 8]
cmp dword [rdx + 8], eax
cmovb rdx, rcx
add rcx, 0x18
cmp rcx, rdi
jne 0x140079950
mov eax, dword [rdx + 8]
mov rdx, rbx
imul rcx, rax, 0xf4240
mov qword [r12], rcx
cmp rbx, rdi
je 0x140079995
lea rcx, [rbx + 0x18]
cmp rcx, rdi
je 0x140079995
mov eax, dword [rcx + 4]
cmp dword [rdx + 4], eax
cmovb rdx, rcx
add rcx, 0x18
cmp rcx, rdi
jne 0x140079982
mov eax, dword [rdx + 4]
imul rbp, rax, 0xf4240
mov qword [r13], rbp
test rbx, rbx
je 0x1400799f7
sub r15, rbx
movabs rax, 0x2aaaaaaaaaaaaaab
imul r15
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
cmp rdx, 0x1000
jb 0x1400799ef
mov rcx, qword [rbx - 8]
add rdx, 0x27
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140079a1c
mov rbx, rcx
mov rcx, rbx
call fcn.1400d4a4c
mov rsi, qword [rsp + 0x190]
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008bc0
int3
Function at 0x14007e320
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
mov rsi, r8
add rcx, 0x20
mov rbp, rdx
call fcn.1400da900
lea r9, [rsp + 0x130]
mov r8d, 0x40
mov rdx, rax
mov rcx, rbx
call fcn.14007f5e0
test al, al
jne 0x14007e3cf
mov r9d, 0x154
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_pe_image_reader.cc
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS64__struct__IMAGE_NT_HEADERS64__unsigned___int64___const
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.could_not_read_dos_header_from
mov rcx, rax
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14007e3b2
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rcx, [rsp + 0x30]
call fcn.14002dc50
xor al, al
jmp 0x14007e4b0
mov eax, 0x5a4d
cmp word [rsp + 0x130], ax
je 0x14007e40d
mov r9d, 0x15a
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_pe_image_reader.cc
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS64__struct__IMAGE_NT_HEADERS64__unsigned___int64___const
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x14007e39d
lea rcx, [rbx + 0x20]
call fcn.1400da900
movsxd rdi, dword [rsp + 0x16c]
mov r9, rbp
add rdi, rax
mov r8d, 0x108
mov rdx, rdi
mov rcx, rbx
call fcn.14007f5e0
test al, al
jne 0x14007e46b
mov r9d, 0x162
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_pe_image_reader.cc
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS64__struct__IMAGE_NT_HEADERS64__unsigned___int64___const
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14007e39d
cmp dword [rbp], 0x4550
je 0x14007e4a6
mov r9d, 0x168
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_pe_image_reader.cc
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS64__struct__IMAGE_NT_HEADERS64__unsigned___int64___const
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.invalid_signature_in_nt_headers_of
jmp 0x14007e39d
test rsi, rsi
je 0x14007e4ae
mov qword [rsi], rdi
mov al, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400d4b20
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007e4e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
mov rsi, r8
add rcx, 0x20
mov rbp, rdx
call fcn.1400da900
lea r9, [rsp + 0x130]
mov r8d, 0x40
mov rdx, rax
mov rcx, rbx
call fcn.14007f5e0
test al, al
jne 0x14007e58f
mov r9d, 0x154
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_pe_image_reader.cc
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS__struct__IMAGE_NT_HEADERS__unsigned___int64___const
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.could_not_read_dos_header_from
mov rcx, rax
call fcn.140009610
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14007e572
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000a0e0
lea rcx, [rsp + 0x30]
call fcn.14002dc50
xor al, al
jmp 0x14007e670
mov eax, 0x5a4d
cmp word [rsp + 0x130], ax
je 0x14007e5cd
mov r9d, 0x15a
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_pe_image_reader.cc
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS__struct__IMAGE_NT_HEADERS__unsigned___int64___const
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.invalid_e_magic_in_dos_header_of
jmp 0x14007e55d
lea rcx, [rbx + 0x20]
call fcn.1400da900
movsxd rdi, dword [rsp + 0x16c]
mov r9, rbp
add rdi, rax
mov r8d, 0xf8
mov rdx, rdi
mov rcx, rbx
call fcn.14007f5e0
test al, al
jne 0x14007e62b
mov r9d, 0x162
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_pe_image_reader.cc
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS__struct__IMAGE_NT_HEADERS__unsigned___int64___const
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14007e55d
cmp dword [rbp], 0x4550
je 0x14007e666
mov r9d, 0x168
mov dword [rsp + 0x20], 1
lea r8, str..._.._.._snapshot_win_pe_image_reader.cc
lea rdx, str.bool___cdecl_crashpad::PEImageReader::ReadNtHeaders_struct__IMAGE_NT_HEADERS__struct__IMAGE_NT_HEADERS__unsigned___int64___const
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.invalid_signature_in_nt_headers_of
jmp 0x14007e55d
test rsi, rsi
je 0x14007e66e
mov qword [rsi], rdi
mov al, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400d4b20
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x140083b30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x130
mov rdi, rcx
mov ebx, 1
nop word [rax + rax]
mov rax, qword [0x140147490]
nop
test rax, rax
jne 0x140083b67
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140083b50
cmp eax, 2
jne 0x140083b97
mov r9d, 0x83
mov dword [rsp + 0x20], eax
lea r8, str..._.._.._client_crashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.crash_server_failed_to_launch__self_terminating
jmp 0x140083c0f
lock xadd qword [0x1401474c0], rbx
lea rax, [rbx + 1]
cmp rax, 1
jle 0x140083bb7
xor edx, edx
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [0x1401110d8]
mov dword [0x140147470], eax
mov qword [0x140147468], rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0xaf
mov dword [rsp + 0x20], 2
lea r8, str..._.._.._client_crashpad_client_win.cc
lea rdx, str.long___cdecl_crashpad::_anonymous_namespace::UnhandledExceptionHandler_struct__EXCEPTION_POINTERS__
lea rcx, [rsp + 0x30]
call fcn.14002d900
lea rdx, str.crash_server_did_not_respond__self_terminating
mov rcx, rax
call fcn.140009610
lea rcx, [rsp + 0x30]
call fcn.14002dc50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xffff7001
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x140]
xor eax, eax
add rsp, 0x130
pop rdi
ret
Function at 0x1400d60b0
Capabilities:
Copy file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1401114a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov rsi, r8
lea rdx, [rsp + 0x40]
mov rdi, rcx
call fcn.14002c6b0
mov r8, rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002c430
lea rcx, [rsp + 0x40]
call fcn.14002c3c0
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
cmovae rdx, qword [rsp + 0x20]
cmp qword [rdi + 0x18], 8
jb 0x1400d610f
mov rdi, qword [rdi]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400d6143
lea rdx, str.Copied_dmp_file_to_target_directory.
lea rcx, str.server
call fcn.1400700c0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14002c3d0
mov bl, 1
jmp 0x1400d6161
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_copy_dmp_file_to_target_directory_due_to__d.
lea rcx, str.server
call fcn.1400700c0
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.14002c3c0
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d4b20
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400db210
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, ax
shr dx, 8
cmp al, 6
jb 0x1400db2c8
jne 0x1400db23d
cmp dx, 1
jbe 0x1400db2c8
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401476c0]
mov edx, 0x80
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x140147cd0], eax
jg 0x1400db2dc
xor edx, edx
mov r8d, 0x10000000
mov rcx, rbx
call qword [0x140147cc8]
test eax, eax
jne 0x1400db2d1
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x28], eax
lea r8, str..._.._.._util_win_critical_section_with_debug_info.cc
mov r9d, 0x21
mov dword [rsp + 0x20], 2
lea rdx, str.bool___cdecl_crashpad::_anonymous_namespace::CrashpadInitializeCriticalSectionEx_struct__RTL_CRITICAL_SECTION__unsigned_long_unsigned_long_
lea rcx, [rsp + 0x30]
call fcn.14002db60
mov rcx, rax
lea rdx, str.InitializeCriticalSectionEx
call fcn.140009610
lea rcx, [rsp + 0x30]
call fcn.14002df10
xor al, al
add rsp, 0x140
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov al, 1
add rsp, 0x140
pop rbx
ret
lea rcx, [0x140147cd0]
call fcn.1400d4f04
cmp dword [0x140147cd0], 0xffffffff
jne 0x1400db260
mov r8b, 1
lea rdx, str.::InitializeCriticalSectionEx
lea rcx, [0x1400e1d38]
call fcn.14003e120
lea rcx, [0x140147cd0]
mov qword [0x140147cc8], rax
call fcn.1400d4ea4
jmp 0x1400db260
Function at 0x180002560
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800025bd
lea rbx, [0x18004a2d0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800025a4
cmp r10, 2
jb 0x1800025a4
cmp byte [r9], r8b
jne 0x1800025a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180002580
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800025ff
lea rbx, [0x18004a2d0]
cmp r8b, 0x23
jne 0x1800025e3
cmp byte [r9], r8b
jne 0x1800025e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800025d0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180002870
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x18000289f
mov r8d, 0x599
lea rdx, str.C:UsersplebDesktop_freememoryImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x1800028ab
mov qword [rdi], 0
lea rdx, [0x180049f80]
mov rcx, rbx
call fcn.180002610
mov rbx, rax
test rax, rax
jne 0x1800028cd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800029a4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800029a4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800029a4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800029a4
cmp rsi, 0xffffffffffffffff
je 0x1800029a4
mov rax, qword [0x180059ae8]
test rax, rax
je 0x180002941
inc dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1800029a4
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x180002991
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180059ae8]
test rax, rax
je 0x180002986
dec dword [rax + 0x3bc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800029ad
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x18000299f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1800029af
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180004de0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc0], 0
mov rbx, rcx
mov edi, edx
jg 0x180004e16
mov r8d, 0x502
lea rdx, str.C:UsersplebDesktop_freememoryImGui_DirectX_11_Kiero_Hookimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xc8]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x18004a2d0]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x180059ae8]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1a60], edx
jne 0x180004e90
mov dword [rax + 0x1a64], edx
cmp dword [rax + 0x1a9c], edx
jne 0x180004e9f
mov byte [rax + 0x1aa0], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x180007b30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp byte [rcx], 0
mov rbx, rcx
jne 0x180007b4b
cmp byte [rcx + 0x2ef4], 0
je 0x180007b65
mov r8d, 0xed0
lea rdx, str.C:UsersplebDesktop_freememoryImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
lea r8, [0x1800486d9]
mov dword [rsp + 0x2c], eax
lea r11, [0x18004a2d0]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x180007ba9
cmp byte [r8], r9b
jne 0x180007ba9
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x180007b96
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x180014770]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1800147f0]
mov qword [rsp + 0x38], rax
lea rax, [0x1800148d0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x180007cab
inc edi
test ecx, ecx
je 0x180007c15
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x180007c1a
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x180007cab
mov rax, qword [0x180059ae8]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x180007c3e
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, qword [rbx + 0x2f18]
mov rsi, rax
test rdx, rdx
je 0x180007c99
movsxd rcx, dword [rbx + 0x2f10]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2f18]
test rcx, rcx
je 0x180007c93
mov rax, qword [0x180059ae8]
test rax, rax
je 0x180007c93
dec dword [rax + 0x3bc]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2f18], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180009290
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1800092e0
lea r11, [0x18004a2d0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800092c3
cmp byte [r8], r9b
jne 0x1800092c3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800092b0
mov rcx, qword [0x180059ae8]
not eax
movsxd rdx, dword [rcx + 0x1a00]
mov r9, qword [rcx + 0x1a08]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180009341
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180009339
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000933c
mov rdx, r8
test rdx, rdx
jne 0x180009310
cmp r9, r10
je 0x180009350
cmp dword [r9], eax
jne 0x180009350
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret