joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400872d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
movzx ebx, r8b
mov rdi, rdx
mov rsi, rcx
mov r11, qword [rcx]
mov r10, qword [r11 + 8]
mov r8b, 1
nop dword [rax]
cmp byte [r10 + 0x19], 0
jne 0x140087370
mov r11, r10
test bl, bl
je 0x14008733a
mov rax, qword [r10 + 0x20]
mov rcx, qword [r9]
cmp rax, rcx
jae 0x14008731f
mov r8b, 1
jmp 0x140087334
jbe 0x140087326
xor r8b, r8b
jmp 0x140087334
movzx eax, word [r9 + 8]
cmp word [r10 + 0x28], ax
setl r8b
xor r8b, 1
jmp 0x140087360
mov rax, qword [r9]
mov rcx, qword [r10 + 0x20]
cmp rax, rcx
jae 0x14008734b
mov r8b, 1
jmp 0x140087360
jbe 0x140087352
xor r8b, r8b
jmp 0x140087360
movzx eax, word [r10 + 0x28]
cmp word [r9 + 8], ax
setl r8b
test r8b, r8b
je 0x14008736a
mov r10, qword [r10]
jmp 0x14008736e
mov r10, qword [r10 + 0x10]
jmp 0x140087300
mov rax, r11
mov qword [rsp + 0x30], rax
test r8b, r8b
je 0x140087416
mov rcx, qword [rsi]
cmp r11, qword [rcx]
jne 0x1400873bf
movzx eax, byte [rsp + 0x80]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r9
mov r9, r11
mov r8b, 1
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140086d30
mov rcx, qword [rax]
mov qword [rdi], rcx
mov byte [rdi + 8], 1
mov rax, rdi
jmp 0x14008746e
cmp byte [r11 + 0x19], 0
je 0x1400873cc
mov rax, qword [r11 + 0x10]
jmp 0x140087411
mov rcx, qword [r11]
cmp byte [rcx + 0x19], 0
jne 0x1400873f0
mov rax, rcx
nop dword [rax + rax]
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], 0
jne 0x140087411
mov rax, rcx
jmp 0x1400873e0
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x140087409
cmp rax, qword [rcx]
jne 0x140087409
mov rax, rcx
mov qword [rsp + 0x30], rcx
jmp 0x1400873f0
cmp byte [rax + 0x19], 0
cmove rax, rcx
mov qword [rsp + 0x30], rax
mov rcx, qword [rax + 0x20]
mov rdx, qword [r9]
cmp rcx, rdx
jb 0x140087440
ja 0x140087434
movzx ecx, word [r9 + 8]
cmp word [rax + 0x28], cx
setl cl
test cl, cl
jne 0x140087440
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov rax, rdi
jmp 0x14008746e
movzx eax, byte [rsp + 0x80]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r9
mov r9, r11
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140086d30
mov rcx, qword [rax]
mov qword [rdi], rcx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140088740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
mov r11, qword [rcx]
mov r10, qword [r11 + 8]
mov r8b, 1
nop dword [rax]
cmp byte [r10 + 0x19], 0
jne 0x14008881f
mov r11, r10
test bl, bl
je 0x1400887cf
mov r8, qword [r9]
mov rax, qword [r10 + 0x20]
cmp rax, r8
jne 0x140088793
xor r8b, r8b
jmp 0x1400887c9
mov rax, qword [rax + 0x10]
mov r8, qword [r8 + 0x10]
cmp rax, r8
jne 0x1400887a5
xor r8b, r8b
jmp 0x1400887c9
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400887c3
inc rax
test ecx, ecx
jne 0x1400887b0
test edx, edx
sets r8b
xor r8b, 1
jmp 0x140088809
mov r8, qword [r10 + 0x20]
mov rcx, qword [r9]
cmp rcx, r8
je 0x140088813
mov rcx, qword [rcx + 0x10]
mov r8, qword [r8 + 0x10]
cmp rcx, r8
je 0x140088813
sub r8, rcx
nop dword [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140088803
inc rcx
test eax, eax
jne 0x1400887f0
test edx, edx
sets r8b
test r8b, r8b
je 0x140088816
mov r10, qword [r10]
jmp 0x14008881a
xor r8b, r8b
mov r10, qword [r10 + 0x10]
jmp 0x140088770
movzx eax, byte [rsp + 0x70]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r9
mov r9, r11
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140088470
mov rcx, qword [rax]
mov qword [rsi], rcx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14008d170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov ecx, dword [0x14035bc30]
cmp ecx, 0xffffffff
jne 0x14008d198
xor esi, esi
jmp 0x14008d1a1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x14008d293
nop
mov rbx, qword [rsi + 0x18]
cmp qword [rsi + 0x30], 0
jne 0x14008d1c6
test rbx, rbx
je 0x14008d26c
jmp 0x14008d1d0
test rbx, rbx
je 0x14008d224
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008d207
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x14008d1d0
cmp qword [rsi + 0x30], 0
je 0x14008d1b0
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14008d24f
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x14008d24f
mov rax, qword [rcx]
call qword [rax + 8]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.14006e970
cmp qword [rsi + 0x30], 0
jne 0x14008d230
jmp 0x14008d1b0
lea rdx, [0x14008cb00]
lea rcx, [0x140377758]
call fcn.14008c8e0
mov ecx, dword [0x14035bc30]
cmp ecx, 0xffffffff
je 0x14008d293
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x14008d2c3
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14008d2c3
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14008d2e0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x14008d370]
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rsi, rax
test rax, rax
jne 0x14008d325
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov rax, qword [rdi]
lock inc dword [rax + 8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14008d348
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a9a50
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r15
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1400a9a85
or rax, 0xffffffffffffffff
add rsp, 0x78
pop r15
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x90], rbx
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.1400a8ee4
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
xor ebx, ebx
test eax, eax
jle 0x1400a9b89
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x70], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.1400a8ee4
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jl 0x1400a9b00
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14000df10
mov esi, eax
cmp dword [rsp + 0x40], ebx
jle 0x1400a9bc9
mov rdi, r14
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400a9bc9
call fcn.1400a8eec
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jl 0x1400a9bb0
mov rcx, r14
call fcn.1400a8eec
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
add rsp, 0x78
pop r15
pop rdi
ret
Function at 0x140d5e108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d5e28f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d5e139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d5e11f
add dl, dl
jne 0x140d5e146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d5e1a6
xor eax, eax
add dl, dl
jne 0x140d5e155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d5e25d
add dl, dl
jne 0x140d5e166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d5e173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d5e180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d5e18d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d5e19a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d5e12e
mov eax, 1
add dl, dl
jne 0x140d5e1b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d5e1c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d5e1ab
sub eax, ebx
mov ebx, 1
jne 0x140d5e1fc
mov ecx, 1
add dl, dl
jne 0x140d5e1de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d5e1eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d5e1d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d5e12e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d5e218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d5e225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d5e20d
cmp eax, 0x7d00
jae 0x140d5e24b
cmp eax, 0x500
jb 0x140d5e246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d5e12e
cmp eax, 0x7f
ja 0x140d5e24e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d5e12e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d5e282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d5e12e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140022e30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140022e3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140022e4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140022e35
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140022e65
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140022e52
sub eax, 3
jb 0x140022e7f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140022eb6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140022ea6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140022ea4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140022e93
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140022df2
jmp 0x140022e3d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xd600
mov dl, 7
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140022f02
cmp rsi, rcx
jae 0x140022f0a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140022ee9
cmp al, 0x8f
ja 0x140022ee9
cmp byte [rsi - 2], 0xf
je 0x140022eef
sub al, 0xe8
cmp al, 1
ja 0x140022ed3
cmp rsi, rcx
jae 0x140022f0a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140022ed9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140022f0a
lodsb al, byte [rsi]
jmp 0x140022ee9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x20000]
mov eax, dword [rdi]
or eax, eax
je 0x140022f67
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x27564]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140022f17
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140022f61
mov qword [rbx], rax
add rbx, 8
jmp 0x140022f37
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140022fa1
cmp al, 0xef
ja 0x140022f93
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140022f73
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140022f82
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140023020], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140023020
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140023010
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x140002df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x70
mov rbp, qword [0x14037cfc8]
mov rbx, rcx
movaps xmmword [rsp + 0x60], xmm6
mov r14, rbp
movaps xmmword [rsp + 0x50], xmm7
movaps xmm6, xmm1
movaps xmm7, xmm2
lea rax, [rbp + 8]
cmp rax, rcx
je 0x140002e47
mov r8d, 0x58a
lea rdx, str.C:UserskinseDesktopIMGUI_LOADER_FIVESENSE_imgui.cpp
lea rcx, str.g.IO__this___Can_only_add_events_to_current_context._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbp, qword [0x14037cfc8]
cmp byte [rbx + 0x37a1], 0
je 0x140002ff1
movss xmm1, dword [0x140054084]
xorps xmm2, xmm2
comiss xmm7, xmm1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
jbe 0x140002e94
comiss xmm7, xmm2
cvttss2si eax, xmm7
jae 0x140002e8d
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm7
jp 0x140002e8b
je 0x140002e8d
dec eax
movd xmm7, eax
cvtdq2ps xmm7, xmm7
comiss xmm6, xmm1
jbe 0x140002eb9
comiss xmm6, xmm2
cvttss2si eax, xmm6
jae 0x140002eb2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm6
jp 0x140002eb0
je 0x140002eb2
dec eax
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov esi, dword [rbp + 0x37c0]
sub esi, 1
movsxd rdi, esi
js 0x140002f0f
lea rbx, [rdi + rdi*2]
shl rbx, 3
nop
cmp esi, dword [rbp + 0x37c0]
jl 0x140002ef2
mov r8d, 0x702
lea rdx, str.C:UserskinseDesktopIMGUI_LOADER_FIVESENSE_imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbp + 0x37c8]
cmp dword [rbx + rax], 1
je 0x140002f99
dec esi
sub rbx, 0x18
sub rdi, 1
jns 0x140002ed0
movsd xmm0, qword [r14 + 0xdfc]
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
movss xmm0, dword [rax]
ucomiss xmm0, xmm6
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
movss xmm1, dword [rax + 4]
jp 0x140002f4e
jne 0x140002f4e
ucomiss xmm1, xmm7
jp 0x140002f4e
je 0x140002ff1
lea rbx, [r14 + 0x37c0]
movss dword [rsp + 0x38], xmm6
mov ecx, dword [rbx]
mov r8d, dword [rbx + 4]
movss dword [rsp + 0x3c], xmm7
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
cmp ecx, r8d
jne 0x140002fcf
inc ecx
test r8d, r8d
je 0x140002fbb
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140002fc0
movss xmm0, dword [rbx + rax + 8]
movss xmm1, dword [rbx + rax + 0xc]
lea rax, [rsp + 0x20]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x140002f23
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.14001eaa0
movsxd rax, dword [rbx]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 8]
movups xmmword [rax + rcx*8], xmm0
movsd qword [rax + rcx*8 + 0x10], xmm1
inc dword [rbx]
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
ret
Function at 0x1400033f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000344d
lea rbx, [0x14004ce90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003434
cmp r10, 2
jb 0x140003434
cmp byte [r9], r8b
jne 0x140003434
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003410
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000348f
lea rbx, [0x14004ce90]
cmp r8b, 0x23
jne 0x140003473
cmp byte [r9], r8b
jne 0x140003473
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003460
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003650
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000367f
mov r8d, 0x780
lea rdx, str.C:UserskinseDesktopIMGUI_LOADER_FIVESENSE_imgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000368b
mov qword [rdi], 0
lea rdx, [0x14004c6e8]
mov rcx, rbx
call fcn.1400034a0
mov rbx, rax
test rax, rax
jne 0x1400036ad
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003784
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003784
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003784
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003784
cmp rsi, 0xffffffffffffffff
je 0x140003784
mov rax, qword [0x14037cfc8]
test rax, rax
je 0x140003721
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003784
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003771
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14037cfc8]
test rax, rax
je 0x140003766
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000378d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14000377f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x14000378f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140006ee0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140006f18
mov r8d, 0x70b
lea rdx, str.C:UserskinseDesktopIMGUI_LOADER_FIVESENSE_imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x14004ce90]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3c]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3d]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3e]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3f]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x14037cfc8]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x140006fdb
mov r8, rdi
mov edx, 0xc
mov ecx, ebx
call fcn.14001d8b0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140006ff0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x140007027
mov r8d, 0x70b
lea rdx, str.C:UserskinseDesktopIMGUI_LOADER_FIVESENSE_imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x14004ce90]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x14037cfc8]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x1400070a6
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001d8b0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret