joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051028
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x20], 0x101c3f73
mov byte [rbp - 0x16], al
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x1c], 0x1351f12
mov r8b, 0x73
mov word [rbp - 0x18], 0x1616
xor byte [rbp + rax - 0x1f], r8b
inc rax
cmp rax, 9
jae 0x140051070
mov r8b, byte [rbp - 0x20]
jmp 0x14005105c
mov byte [rbp - 0x16], 0
mov cl, 0x43
mov dword [rbp - 0x10], 0x31260843
xor eax, eax
mov dword [rbp - 0xc], 0x702f262d
mov dword [rbp - 8], 0x2f276d71
mov word [rbp - 4], 0x2f
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 0xc
jae 0x1400510a5
mov cl, byte [rbp - 0x10]
jmp 0x140051093
lea rdx, [rbp - 0xf]
mov byte [rbp - 3], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x1400510dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x10], 0x2c390649
mov byte [rbp - 2], al
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0xc], 0x20250a27
mov r8b, 0x49
mov dword [rbp - 8], 0x28262b39
mov word [rbp - 4], 0x2d3b
xor byte [rbp + rax - 0xf], r8b
inc rax
cmp rax, 0xd
jae 0x14005112b
mov r8b, byte [rbp - 0x10]
jmp 0x140051117
mov byte [rbp - 2], 0
mov cl, 0x1d
mov dword [rbp - 0x20], 0x786e481d
xor eax, eax
mov dword [rbp - 0x1c], 0x332f2e6f
mov dword [rbp - 0x18], 0x717179
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xa
jae 0x14005115a
mov cl, byte [rbp - 0x20]
jmp 0x140051148
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x15], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x140051190
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [str.0_B_SUCC]
mov rdi, r8
movdqu xmmword [rbp - 0x10], xmm0
mov rsi, rdx
mov rbx, rcx
xor r9d, r9d
mov al, byte [rbp - 0x10]
xor byte [rbp + r9 - 0xf], al
inc r9
cmp r9, 0xe
jb 0x1400511c0
mov byte [rbp - 1], 0
mov cl, 0xc
mov dword [rbp - 0x20], 0x7e69470c
xor eax, eax
mov dword [rbp - 0x1c], 0x3f606962
mov dword [rbp - 0x18], 0x6068223e
mov word [rbp - 0x14], 0x60
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x140051206
mov cl, byte [rbp - 0x20]
jmp 0x1400511f4
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x140051244
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x10], 0x5b466434
mov byte [rbp - 2], al
mov rdi, r8
mov rsi, rdx
mov dword [rbp - 0xc], 0x47475157
mov rbx, rcx
mov dword [rbp - 8], 0x517a0607
mov r9b, 0x34
mov word [rbp - 4], 0x404c
xor byte [rbp + rax - 0xf], r9b
inc rax
cmp rax, 0xd
jae 0x14005129b
mov r9b, byte [rbp - 0x10]
jmp 0x140051287
mov byte [rbp - 2], 0
mov cl, 0x7e
mov dword [rbp - 0x20], 0xc1b357e
xor eax, eax
mov dword [rbp - 0x1c], 0x4d121b10
mov dword [rbp - 0x18], 0x121a504c
mov word [rbp - 0x14], 0x12
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x1400512d0
mov cl, byte [rbp - 0x20]
jmp 0x1400512be
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret

Function at 0x1400513f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
movdqa xmm0, xmmword [0x140061b70]
mov rdi, r9
movdqu xmmword [rbp - 0x20], xmm0
mov rsi, r8
mov word [rbp - 0x10], 0x28
mov r14, rdx
mov rbx, rcx
xor r10d, r10d
mov al, byte [rbp - 0x20]
xor byte [rbp + r10 - 0x1f], al
inc r10
cmp r10, 0x10
jb 0x14005142d
mov byte [rbp - 0xf], 0
mov cl, 0x47
mov dword [rbp - 0x30], 0x31230647
xor eax, eax
mov dword [rbp - 0x2c], 0x742e3726
mov dword [rbp - 0x28], 0x2b236975
mov word [rbp - 0x24], 0x2b
xor byte [rbp + rax - 0x2f], cl
inc rax
cmp rax, 0xc
jae 0x140051473
mov cl, byte [rbp - 0x30]
jmp 0x140051461
lea rdx, [rbp - 0x2f]
mov byte [rbp - 0x23], 0
mov rcx, rbx
call fcn.140051798
lea r8, [rbp - 0x1f]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov rcx, qword [rbp + 0x40]
mov r8, rdi
mov r9, qword [rbp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, r14
call rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140051630
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x140061b00]
mov r14, rdx
xor edx, edx
mov edi, r9d
mov r10d, edx
mov rsi, r8
mov rbx, rcx
movdqu xmmword [rbp - 0x10], xmm0
mov al, byte [rbp - 0x10]
xor byte [rbp + r10 - 0xf], al
inc r10
cmp r10, 0xe
jb 0x140051669
mov byte [rbp - 1], dl
mov cl, 0x32
mov dword [rbp - 0x20], 0x40577932
mov rax, rdx
mov dword [rbp - 0x1c], 0x15e575c
mov dword [rbp - 0x18], 0x5e561c00
mov word [rbp - 0x14], 0x5e
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x1400516af
mov cl, byte [rbp - 0x20]
jmp 0x14005169d
mov byte [rbp - 0x13], dl
mov rcx, rbx
lea rdx, [rbp - 0x1f]
call fcn.140051798
lea r8, [rbp - 0xf]
mov rdx, rax
mov rcx, rbx
call fcn.1400516f8
mov r9, qword [rbp + 0x30]
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call rax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400516f8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [str.mOzXEIkNNXOYY]
mov rbx, r8
movdqu xmmword [rbp - 0x10], xmm0
mov rdi, rdx
xor ecx, ecx
mov al, byte [rbp - 0x10]
xor byte [rbp + rcx - 0xf], al
inc rcx
cmp rcx, 0xe
jb 0x14005171f
mov byte [rbp - 1], 0
mov cl, 0x1c
mov dword [rbp - 0x20], 0x6e79571c
xor eax, eax
mov dword [rbp - 0x1c], 0x2f707972
mov dword [rbp - 0x18], 0x7078322e
mov word [rbp - 0x14], 0x70
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x140051764
mov cl, byte [rbp - 0x20]
jmp 0x140051752
lea rcx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp - 0xf]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rbx
mov rcx, rdi
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret

Function at 0x140051798
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rdx
mov dword [rbp - 0x10], 0x545a7935
mov rdi, rcx
mov dword [rbp - 0xc], 0x575c7951
mov r8b, 0x35
mov dword [rbp - 8], 0x4c475447
mov word [rbp - 4], 0x74
xor eax, eax
xor byte [rbp + rax - 0xf], r8b
inc rax
cmp rax, 0xc
jae 0x1400517e4
mov r8b, byte [rbp - 0x10]
jmp 0x1400517d0
mov byte [rbp - 3], 0
mov cl, 0x61
mov dword [rbp - 0x20], 0x13042a61
xor eax, eax
mov dword [rbp - 0x1c], 0x520d040f
mov dword [rbp - 0x18], 0xd054f53
mov word [rbp - 0x14], 0xd
xor byte [rbp + rax - 0x1f], cl
inc rax
cmp rax, 0xc
jae 0x140051819
mov cl, byte [rbp - 0x20]
jmp 0x140051807
lea rcx, [rbp - 0x1f]
mov byte [rbp - 0x13], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea r8, [rbp - 0xf]
mov rcx, rdi
mov rdx, rax
call fcn.1400516f8
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x140051ab8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140051af2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140051af7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140051b40
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140061c90]
cmp byte [rcx + rax], 0
je 0x140051b40
dec r8
sub rdx, 1
jne 0x140051b26
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14005311c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140053166
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140053166
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140053166
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140053166
cmp dword [rcx + 0x84], 0xe
jbe 0x140053166
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140053168
xor al, al
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rcx
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov r8d, dword [rax + 0x20]
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
pop rsi
add rax, rdx
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140002070
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.1400f2f60
sub rsp, rax
mov rax, qword [0x140235cc0]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call fcn.1400f4cc0
mov dword [rsp + 0x24], eax
mov r9d, 1
mov r10d, 0x270
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, r10
jb 0x1400020c3
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], r10d
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140002192
lea r8, [rsp + 0x28]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140002120
mov r10d, dword [rsp + 0x20]
mov ecx, dword [rsp + r10*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov edx, ecx
shr edx, 0x12
xor edx, ecx
jmp 0x1400021c9
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x1400021b0
lea rcx, [rsp + 0x20]
call fcn.140007430
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x1400021c9
cmp r9d, ebx
jne 0x140002195
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400f22a0
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140007430
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140007491
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140007450
mov ecx, dword [r10]
jmp 0x14000757a
cmp ecx, 0x4e0
jb 0x14000757a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400074b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140007500
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14000f170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x14000f1a4
cmp ecx, r10d
jge 0x14000f192
mov rcx, rbx
call fcn.14000e970
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14000f1de
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x14000f1c0
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x14000f206
mov rax, qword gs:[0x58]
mov edx, Ordinal_41
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14000f235
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14000f21f
xor dl, dl
jmp 0x14000f228
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14000f216
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14000f1e2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14000f29f
mov rax, qword gs:[0x58]
mov edx, Ordinal_41
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14000f2b9
mov rcx, rbx
call fcn.14000eac0
test eax, eax
je 0x14000f292
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1400f6550
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14001b3f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001b44d
lea rbx, [0x140209f80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14001b434
cmp r10, 2
jb 0x14001b434
cmp byte [r9], r8b
jne 0x14001b434
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14001b410
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001b48f
lea rbx, [0x140209f80]
cmp r8b, 0x23
jne 0x14001b473
cmp byte [r9], r8b
jne 0x14001b473
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14001b460
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14001ddb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movsxd rdi, edx
mov r14, rcx
mov ebx, edi
mov esi, edi
mov ebp, edi
shr ebx, 0x18
mov edx, edi
shr esi, 0x10
mov r8d, edi
shr ebp, 8
mov r9d, edi
shr edx, 8
shr r8d, 0x10
movzx r10d, dil
shr r9d, 0x18
cmp dword [rcx + 0xc8], 0
jg 0x14001de20
mov r8d, 0x70d
lea rdx, str.E:CodecppOcean2Ocean2guiimguiimgui.h
lea rcx, str.Size___0
call fcn.1401013fc
movzx r10d, dil
movzx edx, bpl
movzx r8d, sil
movzx r9d, bl
movsxd rcx, dword [r14 + 0xc8]
mov rax, qword [r14 + 0xd0]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r10b
movzx ecx, bl
lea r10, [0x140209f80]
xor rcx, rax
shr ebx, 8
movzx eax, dl
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov rax, qword [0x140238828]
xor ebx, dword [r10 + rcx*4]
not ebx
cmp dword [rax + 0x3e74], ebx
jne 0x14001de95
mov dword [rax + 0x3e78], ebx
cmp dword [rax + 0x3ec0], ebx
jne 0x14001dea4
mov byte [rax + 0x3ec4], 1
cmp dword [rax + 0x3e5c], ebx
jne 0x14001debb
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.140031af0
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14002ad30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140235cc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140238828]
mov edi, ecx
cmp byte [rbx + 0x41cd], 0
jne 0x14002ad91
cmp byte [rbx + 0x41ce], 0
jne 0x14002ad91
movsx r9d, word [rbx + 0x52ae]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14001b370
test dil, 1
je 0x14002aeb8
jmp 0x14002ae1a
movss xmm1, dword [rbx + 0x3830]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140214c14]
xor eax, eax
mulss xmm1, dword [0x140214c04]
addss xmm0, dword [rbx + 0xd0c]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xd10]
mov qword [rbx + 0x3f48], rax
mov dword [rbx + 0x3f34], 1
movss dword [rbx + 0x3f40], xmm0
movss dword [rbx + 0x3f44], xmm1
movss xmm0, dword [rbx + 0x388c]
mulss xmm0, dword [0x140214b64]
or dword [rbx + 0x3f30], 0x41
movss dword [rbx + 0x3f90], xmm0
movsx r9d, word [rbx + 0x52ae]
call fcn.14001b370
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14002ae70
lea r11, [0x140209f80]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x14002ae53
cmp byte [r8], r9b
jne 0x14002ae53
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14002ae40
not ecx
call fcn.140023180
test rax, rax
je 0x14002aeb8
cmp byte [rax + 0x8e], 0
je 0x14002aeb8
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x52ae]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x52ae]
call fcn.14001b370
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400259a0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f22a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140030680
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140238828]
cmp byte [rbx + 0x52f9], 0
jne 0x1400307c2
cmp dword [rbx + 0x5320], 0
je 0x1400306ca
mov r8d, 0x2cfe
lea rdx, str.E:CodecppOcean2Ocean2guiimguiimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call fcn.1401013fc
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400307bb
lea rdx, [0x1401440ac]
call fcn.14001b4a0
mov rdi, rax
test rax, rax
je 0x1400307bb
mov rcx, rax
call fcn.1400fee50
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400307b3
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.1400ff334
test eax, eax
jne 0x1400307b3
mov rcx, rdi
call fcn.1400fee50
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400307b3
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call fcn.1400ff334
test eax, eax
jne 0x1400307b3
cmp rsi, 0xffffffffffffffff
je 0x1400307b3
mov rax, qword [0x140238828]
test rax, rax
je 0x140030755
inc dword [rax + 0xec]
mov rcx, rsi
call fcn.140101508
mov rbp, rax
test rax, rax
je 0x1400307b3
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call fcn.140100bb0
mov rcx, rdi
cmp rax, rsi
je 0x140030787
call fcn.1400ff034
jmp 0x140030797
call fcn.1400ff034
mov rdx, rsi
mov rcx, rbp
call fcn.140030960
mov rax, qword [0x140238828]
test rax, rax
je 0x1400307a9
dec dword [rax + 0xec]
mov rcx, rbp
call fcn.14010093c
jmp 0x1400307bb
mov rcx, rdi
call fcn.1400ff034
mov byte [rbx + 0x52f9], 1
movss xmm0, dword [rbx + 0x52fc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14003084f
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x52fc], xmm0
jb 0x14003084f
mov rdi, qword [rbx + 0x20]
xor ebp, ebp
test rdi, rdi
je 0x140030842
mov rax, qword [0x140238828]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x52fc], ebp
call fcn.140030e50
lea rdx, [0x140211e58]
mov rcx, rdi
mov rsi, rax
call fcn.14001b4a0
mov rdi, rax
test rax, rax
je 0x140030849
mov r8, qword [rsp + 0x30]
lea edx, [rbp + 1]
mov r9, rax
mov rcx, rsi
call fcn.1401024f0
mov rcx, rdi
call fcn.1400ff034
jmp 0x140030849
mov byte [rbx + 0xd4], 1
mov dword [rbx + 0x52fc], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret