joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039990
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.mfc140u.dll_CMFCColorButton::OnFillBackground]
mov rcx, rdi
call fcn.140039af0
mov edx, 0x6be
mov rcx, rdi
call qword [sym.imp.mfc140u.dll_CMFCRibbonGallery::GetCompactSize]
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CMFCRibbonSlider::SetACCData]
mov qword [0x140081a80], rdi
xor ebx, ebx
call qword [sym.imp.mfc140u.dll_AfxFieldText]
xor r9d, r9d
lea rdx, [0x140039c60]
lea ecx, [rbx + 0xd]
mov r8, qword [rax + 0x10]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
test rax, rax
mov qword [0x14007bcc0], rax
mov ecx, 1
cmovne ebx, ecx
mov dword [rdi + 0x1d8], ebx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003d710
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140079008]
xor rax, rsp
mov qword [rsp + 0x280], rax
test dword [rcx + 0x26c], 0x1000
mov rbx, rcx
movsd qword [rcx + 0x280], xmm1
jne 0x14003d74b
call fcn.14003de20
mov ecx, dword [rbx + 0x26c]
movsd xmm1, qword [rbx + 0x280]
test cl, 0x40
je 0x14003d776
movsd xmm0, qword [rbx + 0x2a0]
ucomisd xmm0, qword [0x14005e470]
jp 0x14003d772
je 0x14003d776
mulsd xmm1, xmm0
mov r8d, dword [rbx + 0x2b0]
test r8d, r8d
jne 0x14003d799
cvttsd2si ecx, xmm1
mov r8d, 0xa
lea rdx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
jmp 0x14003d7ee
mov eax, ecx
shr eax, 0xf
not eax
and eax, 1
cmp r8d, 6
jne 0x14003d7b4
bt ecx, 0x10
mov ecx, 0x2711
jb 0x14003d7ba
mov ecx, dword [rbx + 0x2c0]
movsd xmm3, qword [rbx + 0x298]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x30]
call qword [sym.imp.CrlUtl.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_UNITConvToUnitAndStringEx_double__int__double__unsigned_int__int_]
lea rcx, [rsp + 0x40]
mov rdx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rbx, qword [rbx + 0x328]
test rbx, rbx
je 0x14003d7fe
mov rbx, qword [rbx + 0x40]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdi, eax
cmp rdi, 0x200
ja 0x14003d847
mov r8d, 0x100
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, edi
jne 0x14003d847
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14003d855
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140047b30
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret
Function at 0x140042df0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov r8b, 1
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.CrlUtils.dll_public:_void___cdecl_CrlUtils::CommandLine::SetCommandLine_wchar_t_const____ptr64__bool____ptr64]
mov rcx, rbx
call fcn.140042f40
mov rcx, rbx
call fcn.140043070
mov rcx, qword [rbx + 8]
mov rax, qword [rcx]
lea rdx, vtable.CaptureStartupInit.0
cmp rax, rdx
je 0x140042e4d
call qword [rax + 0xb8]
test al, al
je 0x140042e4d
mov rcx, rbx
call fcn.140043130
mov al, 1
jmp 0x140042e53
add rsp, 0x30
pop rbx
ret

Function at 0x140043b20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], rbx
mov eax, dword [0x140081bb4]
test eax, eax
je 0x140043b61
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140081bb4]
test eax, eax
jne 0x140043b6a
call fcn.140043960
test eax, eax
je 0x140043b80
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1400790e0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140043b84
xor eax, eax
jmp 0x140043bca
lea rcx, str.crlutl.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov qword [rsp + 0x20], rax
mov esi, ebx
test rax, rax
sete sil
test esi, esi
je 0x140043bae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test esi, esi
je 0x140043bc7
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140043e30
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rbx, rcx
jne 0x140043ef6
add rcx, 0x38
call fcn.140043f00
cmp qword [rbx + 0x68], 0
jne 0x140043e90
mov rax, qword [rbx + 0x48]
cmp dword [rax - 0x10], 0
jne 0x140043e62
xor eax, eax
jmp 0x140043e87
mov rcx, qword [rbx + 8]
lea rdx, str.GetUILang
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140043e87
call rax
mov rdx, qword [rbx + 0x48]
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x78]
mov qword [rbx + 0x68], rax
test rax, rax
je 0x140043ef6
lea rcx, [rbx + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
movzx eax, byte [rbx + 0xb0]
xor r9d, r9d
xor r8d, r8d
mov byte [rbx + 0x10], al
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x28], rax
mov r9, rbx
lea r8, [0x140043fe0]
xor edx, edx
lea rax, [rbx + 0x30]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x28]
or edx, 0xffffffff
mov qword [rbx + 0x20], rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
lodsb al, byte [esi]
xchg ebp, eax
mov ah, 0x28
sub byte [rdx - 0x1448d11], bh
Function at 0x1400461e0
Capabilities:
Get file size
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x60
mov rax, qword [0x140079008]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x40], ebp
lea r8d, [rbp + 1]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140046358
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 0xe]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140046264
lea rcx, str.Error_reading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x1400462e0
mov eax, dword [rsp + 0x4a]
test eax, eax
jne 0x14004627b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x4a], eax
cmp dword [rsp + 0x40], 0xe
jne 0x140046347
mov ecx, 0x4d42
cmp word [rsp + 0x48], cx
jne 0x140046347
mov qword [rsp + 0x78], rsi
mov edx, 1
lea esi, [rax - 0xe]
mov qword [rsp + 0x80], rdi
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
jne 0x1400462fb
lea rcx, str.Out_of_memory_loading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140047b30
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140046339
lea rcx, str.Error_reading_welcome_bitmap_file__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400462d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
jmp 0x1400462d3
lea rcx, str.Invalid_welcome_bitmap_file_format__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x1400462e0
lea rcx, str.Welcome_bitmap_file_does_not_exist__n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
jmp 0x1400462e0
Function at 0x1400463e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x40
mov rdi, r8
mov rsi, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x68], rbx
mov eax, dword [0x140081bb4]
test eax, eax
je 0x140046427
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140081bb4]
test eax, eax
jne 0x140046430
call fcn.140043960
test eax, eax
je 0x140046446
lea rdx, [rsp + 0x68]
mov rcx, qword [0x1400790e0]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x14004644a
xor eax, eax
jmp 0x1400464a0
mov qword [rsp + 0x20], rbx
lea r9, [0x140044780]
mov r8, rdi
mov edx, 0x6d47
mov rcx, rsi
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rsi, rax
mov qword [rsp + 0x30], rax
mov edi, ebx
test rax, rax
sete dil
test edi, edi
je 0x140046484
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14004649d
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14004838c
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14004841d
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14004841d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004841d
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140048401
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1400483fb
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140048403
add rdx, 0x28
jmp 0x1400483e0
xor edx, edx
test rdx, rdx
jne 0x14004840c
xor al, al
jmp 0x140048423
test dword [rdx + 0x24], 0x80000000
je 0x140048419
xor al, al
jmp 0x140048423
mov al, 1
jmp 0x140048423
xor al, al
jmp 0x140048423
add rsp, 0x18
ret
Function at 0x140002c60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002cbd
lea rbx, [0x1400e65a0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002ca4
cmp r10, 2
jb 0x140002ca4
cmp byte [r9], r8b
jne 0x140002ca4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002c80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002cff
lea rbx, [0x1400e65a0]
cmp r8b, 0x23
jne 0x140002ce3
cmp byte [r9], r8b
jne 0x140002ce3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002cd0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140005b40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rbx, rcx
mov edi, edx
jg 0x140005b76
mov r8d, 0x6d5
lea rdx, [0x1400e03c0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x1400e65a0]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140102580]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1d6c], edx
jne 0x140005bf0
mov dword [rax + 0x1d70], edx
cmp dword [rax + 0x1da8], edx
jne 0x140005bff
mov byte [rax + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x1400127d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x140102580]
mov edi, ecx
mov rbx, qword [rax + 0x1d18]
cmp dword [rbx + 0x108], 0
jg 0x140012811
mov r8d, 0x6d5
lea rdx, [0x1400e03c0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x108]
lea r9, [0x1400e65a0]
mov rax, qword [rbx + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx eax, dil
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x31]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x32]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
movzx eax, byte [rsp + 0x33]
xor r8d, dword [r9 + rcx*4]
lea rcx, [rbx + 0x108]
movzx edx, r8b
xor rdx, rax
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
lea rdx, [rsp + 0x30]
not r8d
mov dword [rsp + 0x30], r8d
call fcn.140028b40
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140013cb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140102580]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x140013d10
cmp byte [rbx + 0x20d6], 0
jne 0x140013d10
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140002be0
test dil, 1
je 0x140013e36
jmp 0x140013d9f
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400ede94]
xor eax, eax
mulss xmm1, dword [0x1400ede7c]
addss xmm0, dword [rbx + 0x120]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400eddec]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140002be0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140013df0
lea r11, [0x1400e65a0]
nop
cmp r9b, 0x23
jne 0x140013dd3
cmp byte [r8], r9b
jne 0x140013dd3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140013dc0
not ecx
call fcn.14000b490
test rax, rax
je 0x140013e36
cmp byte [rax + 0xcf], 0
je 0x140013e36
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.140002be0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14000e500
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400cdf90
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140019d30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r9d, 0xffffffff
mov rsi, rcx
mov ebx, r9d
test r8b, r8b
je 0x140019d90
lea r10, [0x1400e65a0]
nop
cmp r8b, 0x23
jne 0x140019d73
cmp byte [rdx], r8b
jne 0x140019d73
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140019d60
mov rax, qword [0x140102580]
lea rdi, [rax + 0x3220]
mov rax, qword [rax + 0x3228]
test rax, rax
je 0x140019dc6
add rax, 4
je 0x140019dc6
not ebx
cmp dword [rax], ebx
je 0x140019dce
mov rdx, rax
mov rcx, rdi
call fcn.140027d50
test rax, rax
jne 0x140019db2
mov rcx, rsi
call fcn.140019c40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e630
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001e86e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400e65a0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001e836
mov rcx, rbp
call fcn.14001d930
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001e701
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001e6f1
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001e6e9
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001e6ec
mov rdx, rcx
test rdx, rdx
jne 0x14001e6c0
cmp r8, r10
je 0x14001e701
cmp dword [r8], r9d
jne 0x14001e701
mov rcx, qword [r8 + 8]
jmp 0x14001e703
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14001e797
cmp qword [rcx + 0x18], 0
jne 0x14001e78c
mov qword [rcx + 0x18], rbx
jmp 0x14001e797
cmp qword [rcx + 0x20], 0
jne 0x14001e797
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov rcx, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14001e7cc
nop
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001e7c0
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_sendto
call fcn.140002be0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001e828
cmp r9b, 0x23
jne 0x14001e80b
cmp byte [r8], r9b
jne 0x14001e80b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001e7f8
not ecx
call fcn.14000b490
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001e680
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400cdf90
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14004c030
Capabilities:
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
test r8, r8
je 0x14004c0e2
test dword [rcx + 0x10], 0x100000
jne 0x14004c065
mov r8d, 0x1d18
lea rdx, [0x1400ec670]
lea rcx, str.tab_bar__Flags__ImGuiTabBarFlags_DockNode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movzx r9d, byte [rsi]
lea r8, [rsi + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x14004c0b2
lea r11, [0x1400e65a0]
cmp r9b, 0x23
jne 0x14004c095
cmp byte [r8], r9b
jne 0x14004c095
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14004c082
mov rcx, qword [0x140102580]
not eax
cmp dword [rcx + 0x1d6c], eax
jne 0x14004c0c9
mov dword [rcx + 0x1d70], eax
cmp dword [rcx + 0x1da8], eax
jne 0x14004c168
mov byte [rcx + 0x1dac], 1
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140102580]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rbx + 0x1d18]
cmp dword [rdi + 0x108], 0
jg 0x14004c124
mov r8d, 0x6d5
lea rdx, [0x1400e03c0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x140102580]
movsxd rcx, dword [rdi + 0x108]
xor edx, edx
mov rax, qword [rdi + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, rsi
call fcn.140002c60
mov rdi, qword [rsp + 0x38]
cmp dword [rbx + 0x1d6c], eax
jne 0x14004c154
mov dword [rbx + 0x1d70], eax
cmp dword [rbx + 0x1da8], eax
jne 0x14004c163
mov byte [rbx + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x14004f740
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x58
movdqa xmm0, xmmword [0x1400ee5b0]
xor eax, eax
movdqa xmm1, xmmword [0x1400ee060]
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x40], 1
movdqu xmmword [rsp + 0x30], xmm1
nop word [rax + rax]
lea ecx, [rax - 0x27]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x1f
jb 0x14004f770
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x40], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x58
ret
Function at 0x140057490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x1400574b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x27]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x1400574a0
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x1400574c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x1400574e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x27]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x1400574d0
mov byte [rcx + 0x1f], 0
mov rax, rcx
ret

Function at 0x1400574f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x140057513
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x27]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x140057500
mov byte [rcx + 0x22], 0
mov rax, rcx
ret

Function at 0x140057520
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140057543
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x27]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140057530
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x140057550
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140057573
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x27]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x140057560
mov byte [rcx + 0x16], 0
mov rax, rcx
ret

Function at 0x140057580
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x1400575a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x27]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x140057590
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret