joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180155750
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0xc0
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, qword [rsp + 0x118]
mov r12, qword [rsp + 0x128]
mov rbx, rcx
mov rcx, rsi
mov dword [rsp + 0x3c], r9d
mov qword [rsp + 0x48], r8
mov edi, edx
mov dword [rsp + 0x34], 1
call fcn.1800b94f0
mov ebp, eax
mov dword [rsp + 0x38], eax
test eax, eax
jns 0x1801557b6
xor eax, eax
jmp 0x1801559d6
mov qword [rsp + 0xb8], r13
call fcn.180113400
mov r13, rax
test rax, rax
je 0x1801559ce
mov qword [rsp + 0xa8], r15
mov r15d, dword [rsp + 0x120]
test rbx, rbx
jne 0x1801557ef
lea rbx, [0x18020cbb0]
xor edi, edi
jmp 0x180155806
cmp edi, 0xffffffff
jne 0x180155806
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov r9, rsi
mov r8d, edi
mov rdx, rbx
mov rcx, r13
mov qword [rsp + 0x20], 0
call fcn.180112e60
test eax, eax
je 0x180155831
call fcn.180113400
mov rsi, rax
test rax, rax
jne 0x180155840
mov rcx, r13
call fcn.1801131b0
xor eax, eax
jmp 0x1801559c6
mov qword [rsp + 0xb0], r14
test r15d, r15d
je 0x1801559a9
mov r14d, dword [rsp + 0x110]
mov ecx, dword [rsp + 0x34]
nop dword [rax]
mov eax, ecx
mov byte [rsp + 0x33], cl
mov edi, r15d
cmp r15d, ebp
mov rdx, r13
cmovg edi, ebp
shr eax, 0x18
mov byte [rsp + 0x30], al
mov eax, ecx
mov dword [rsp + 0x40], edi
shr eax, 0x10
mov byte [rsp + 0x31], al
mov eax, ecx
mov rcx, rsi
shr eax, 8
mov byte [rsp + 0x32], al
call fcn.180113310
mov rcx, rsi
test eax, eax
je 0x180155998
movsxd r8, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x48]
call fcn.1801130d0
test eax, eax
je 0x180155995
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rsi
call fcn.1801130d0
test eax, eax
je 0x180155995
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call fcn.180113100
test eax, eax
je 0x180155995
movsxd rbp, edi
lea rdx, [rsp + 0x50]
mov rcx, r12
mov r8, rbp
call fcn.180183a80
mov ebx, 1
cmp r14d, ebx
jle 0x18015597a
nop dword [rax]
mov rdx, r13
mov rcx, rsi
call fcn.180113310
mov rcx, rsi
test eax, eax
je 0x180155998
movsxd r8, dword [rsp + 0x38]
lea rdx, [rsp + 0x50]
call fcn.1801130d0
test eax, eax
je 0x180155995
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call fcn.180113100
test eax, eax
je 0x180155995
test rbp, rbp
jle 0x18015596f
lea rdi, [rsp + 0x50]
mov rcx, r12
mov rdx, rbp
sub rdi, r12
nop dword [rax]
movzx eax, byte [rdi + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x180155960
inc ebx
cmp ebx, r14d
jl 0x180155910
mov edi, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x34]
add r12, rbp
inc ecx
sub r15d, edi
mov dword [rsp + 0x34], ecx
je 0x1801559a9
mov ebp, dword [rsp + 0x38]
jmp 0x180155860
mov rcx, rsi
call fcn.1801131b0
mov rcx, r13
call fcn.1801131b0
xor eax, eax
jmp 0x1801559be
mov rcx, rsi
call fcn.1801131b0
mov rcx, r13
call fcn.1801131b0
mov eax, 1
mov r14, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180183a50
add rsp, 0xc0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180169cd0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r10, rdx
test rcx, rcx
je 0x180169cec
test byte [rcx + 0x5c], 2
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x180169cf3
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r9d, r9d
jle 0x180169ddf
inc r8
nop
movzx ecx, byte [r8 - 1]
cmp r9d, 3
jl 0x180169d63
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 2], al
movzx eax, byte [rdx + r11]
mov byte [r10 + 3], al
jmp 0x180169dbb
shl ecx, 0x10
cmp r9d, 2
jne 0x180169d75
movzx eax, byte [r8]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 1], al
cmp r9d, 1
jne 0x180169da6
lea eax, [r9 + 0x3c]
jmp 0x180169db2
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r11]
mov byte [r10 + 2], al
mov byte [r10 + 3], 0x3d
sub r9d, 3
add r10, 4
add ebx, 4
add r8, 3
test r9d, r9d
jg 0x180169d00
mov byte [r10], 0
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
mov byte [rdx], bl
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x180169df0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.180188f30
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.180169cd0

Function at 0x18017a4e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x18017a50c
mov rbx, r8
jmp 0x18017a512
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
call fcn.1800d3d80
test rax, rax
jne 0x18017a52f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x18017a564
mov r9d, r8d
nop dword [rax + rax]
mov rax, qword [rsi]
mov rcx, qword [rbx]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x18017a540
movsxd rdx, r8d
cmp r8d, dword [rbx + 8]
jge 0x18017a58d
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x18017a571
mov eax, dword [rbx + 8]
mov rcx, rdi
mov dword [rdi + 8], eax
call fcn.1800d3620
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180184304
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x18018432e
call fcn.18018b670
and dword [rax], 0
call fcn.18018b650
mov ebx, reloc.WS2_32.dll_shutdown
mov dword [rax], ebx
call fcn.18018d7e8
mov eax, ebx
jmp 0x18018437e
test edx, 0xfffffff9
jne 0x180184311
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180184357
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18018b690
call fcn.18018b650
mov eax, dword [rax]
jmp 0x18018437e
test al, 0x10
jne 0x18018437c
test al, 1
je 0x18018437c
test bl, 2
je 0x18018437c
call fcn.18018b670
mov dword [rax], 5
call fcn.18018b650
mov dword [rax], ntohs
jmp 0x18018434e
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180184ce0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x180184cf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180184cf8
xor eax, eax
test eax, eax
je 0x180184d08
mov ecx, eax
call fcn.18018b690
or eax, 0xffffffff
jmp 0x180184d0a
xor eax, eax
add rsp, 0x28
ret

Function at 0x18018c49f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180237160]
jne 0x180183a6a
rol rcx, 0x10
test cx, 0xffff
jne 0x180183a66
repz ret
ror rcx, 0x10
jmp 0x18018c3f8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180241340]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180241438]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18018c47d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180241340]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18018c49f
mov rax, qword [rsp + 0x88]
mov qword [0x180241438], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1802413d8], rax
mov rax, qword [0x180241438]
mov qword [0x1802412b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1802413c0], rax
mov dword [0x1802412a0], 0xc0000409
mov dword [0x1802412a4], 1
mov rax, qword [0x180237160]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180237168]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180241338], eax
mov ecx, 1
call fcn.180198fe0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18020a390]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180241338], 0
jne 0x18018c526
mov ecx, 1
call fcn.180198fe0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180199b10
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18018d174
xor ebx, ebx
cmp qword [0x180242340], rbx
mov rdi, rax
jne 0x180199c23
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180199cfa
lea rdx, [0x18020ca70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180199cfa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180242340], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180242348], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x18020ca28]
mov rcx, rsi
mov qword [0x180242350], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180242360], rax
test rax, rax
je 0x180199c1a
lea rdx, [0x18020ca10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180242358], rax
jmp 0x180199c2a
mov rax, qword [0x180242358]
jmp 0x180199c31
mov rax, qword [0x180242358]
mov r11, qword [0x180242360]
cmp rax, rdi
je 0x180199c98
cmp r11, rdi
je 0x180199c98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180242360]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180199c98
test rax, rax
je 0x180199c98
call rsi
test rax, rax
je 0x180199c92
lea rcx, [rsp + 0x30]
mov r9d, ntohs
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180199c92
test byte [rsp + 0x40], 1
jne 0x180199c98
bts ebp, 0x15
jmp 0x180199cd8
mov rcx, qword [0x180242348]
cmp rcx, rdi
je 0x180199cd8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180199cd8
call rax
mov rbx, rax
test rax, rax
je 0x180199cd8
mov rcx, qword [0x180242350]
cmp rcx, rdi
je 0x180199cd8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180199cd8
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180242340]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180199cfa
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180199cfc
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400033f0
Capabilities:
Prepare http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
cmp qword [r8 + 0x18], 8
mov rbx, r8
mov rsi, qword [0x1400385a0]
mov rdi, rdx
jb 0x140003419
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x140003423
mov rdx, qword [rdx]
xor r14d, r14d
xor r9d, r9d
mov dword [rsp + 0x30], r14d
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbp, rax
test rax, rax
jne 0x1400034f8
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [0x140038598]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400034a2
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000349d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400035a4
mov rcx, r8
call fcn.14002203c
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400034f1
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400034ec
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400035a4
mov rcx, r8
call fcn.14002203c
xor eax, eax
jmp 0x140003581
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003533
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000352e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400035a4
mov rcx, r8
call fcn.14002203c
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000357e
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003579
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400035a4
mov rcx, r8
call fcn.14002203c
mov rax, rbp
mov rbp, qword [rsp + 0x78]
mov word [rbx], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001cd60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14001cf04
cmp r9, 4
jb 0x14001cdaa
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14001cd90
xor r11d, r11d
test r9, r9
je 0x14001cf04
cmp r9, 8
jb 0x14001cede
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14001cddc
cmp rdx, r8
jae 0x14001cede
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14001cdf1
cmp rdx, r10
jae 0x14001cede
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x14001ce9b
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x14001ce30
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x14001ced0
mov rbx, r9
lea rax, [r11 + r8]
and rbx, 0xfffffffffffffff8
mov rdi, rcx
sub rdi, r8
nop dword [rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x14001ceb0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x14001cf04
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop dword [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14001cef0
add rsp, 8
ret

Function at 0x140022b2c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140022b76
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140022b76
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140022b76
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140022b76
cmp dword [rcx + 0x84], 0xe
jbe 0x140022b76
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140022b78
xor al, al
add rsp, 0x28
ret
Function at 0x140002750
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400027ad
lea rbx, [0x140037f80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002794
cmp r10, 2
jb 0x140002794
cmp byte [r9], r8b
jne 0x140002794
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002770
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400027ef
lea rbx, [0x140037f80]
cmp r8b, 0x23
jne 0x1400027d3
cmp byte [r9], r8b
jne 0x1400027d3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400027c0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x1400046b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x1f0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x1400046e8
mov r8d, 0x4f0
lea rdx, str.C:UsersikusimpriDesktopmenu_sourseimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0x1f0]
mov rax, qword [rbx + 0x1f8]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140037f80]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3c]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3d]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3e]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3f]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14026ec80]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1a3c], edx
jne 0x1400047aa
mov dword [rax + 0x1a44], edx
cmp dword [rax + 0x1a40], edx
jne 0x1400047b9
mov byte [rax + 0x1a50], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x140006e30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
cmp byte [rcx], 0
mov rbx, rcx
jne 0x140006e4b
cmp byte [rcx + 0x2eac], 0
je 0x140006e65
mov r8d, 0xe05
lea rdx, str.C:UsersikusimpriDesktopmenu_sourseimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
lea r8, [0x140036389]
mov dword [rsp + 0x2c], eax
lea r11, [0x140037f80]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x140006ea9
cmp byte [r8], r9b
jne 0x140006ea9
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140006e96
mov ecx, dword [rbx + 0x2ecc]
lea rax, [0x140013a90]
mov edi, dword [rbx + 0x2ec8]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x140013b10]
mov qword [rsp + 0x38], rax
lea rax, [0x140013bf0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x140006faf
inc edi
test ecx, ecx
je 0x140006f15
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140006f1a
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x140006faf
mov rax, qword [0x14026ec80]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
test rax, rax
je 0x140006f43
inc dword [rax + 0x3b0]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, qword [rbx + 0x2ed0]
mov rbp, rax
test rsi, rsi
je 0x140006f98
movsxd rcx, dword [rbx + 0x2ec8]
mov rdx, rsi
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [0x14026ec80]
test rax, rax
je 0x140006f8f
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x2ed0], rbp
mov rbp, qword [rsp + 0x60]
mov dword [rbx + 0x2ecc], edi
movsxd rax, dword [rbx + 0x2ec8]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2ed0]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2ec8]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140008b20
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140008b70
lea r11, [0x140037f80]
nop dword [rax]
cmp r9b, 0x23
jne 0x140008b53
cmp byte [r8], r9b
jne 0x140008b53
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140008b40
mov rcx, qword [0x14026ec80]
not eax
movsxd rdx, dword [rcx + 0x19f8]
mov r9, qword [rcx + 0x1a00]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x140008bd1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x140008bc9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x140008bcc
mov rdx, r8
test rdx, rdx
jne 0x140008ba0
cmp r9, r10
je 0x140008be0
cmp dword [r9], eax
jne 0x140008be0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret