joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014a040
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x130]
lea r9, [0x1402d76e0]
movss xmm2, dword [rcx + 0x148]
movss xmm3, dword [rcx + 0x14c]
movsxd rcx, dword [rcx + 0x128]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x14014e490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x140358d08]
movzx esi, r9b
mov r12d, dword [rsp + 0x90]
mov r15d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x4018]
mov eax, dword [rbx + 0x14]
and eax, 4
or eax, 0x1200103
or r12d, eax
cmp qword [rbx + 0x1e0], 0
jne 0x14014e4ef
cmp qword [rdi + 0x4d10], 0
mov eax, 0x2b8
je 0x14014e4f4
mov eax, 0x288
movss xmm4, dword [rax + rbx]
xorps xmm3, xmm3
movss xmm5, dword [rax + rbx + 4]
cvttss2si eax, dword [r8]
subss xmm4, dword [rbx + 0x138]
subss xmm5, dword [rbx + 0x13c]
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
jp 0x14014e539
jne 0x14014e539
mov eax, 1
jmp 0x14014e53b
xor eax, eax
ucomiss xmm0, xmm3
jp 0x14014e54a
jne 0x14014e54a
mov r14d, 2
jmp 0x14014e54d
xor r14d, r14d
movss xmm2, dword [0x1402f3110]
or r14d, eax
comiss xmm3, xmm1
jb 0x14014e569
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x14014e569
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x14014e57a
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x14014e57a
movaps xmm0, xmm2
or dword [rdi + 0x48f8], 2
xor edx, edx
movss dword [rdi + 0x491c], xmm1
movss dword [rdi + 0x4920], xmm0
mov dword [rdi + 0x4900], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x14014e5c3
mov dword [rsp + 0x28], r15d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.140146470
jmp 0x14014e5d9
lea r8, str._s__08X
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x70]
call fcn.140146470
movss xmm6, dword [rdi + 0x3908]
test sil, sil
jne 0x14014e5f0
mov dword [rdi + 0x3908], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.140151870
mov rsi, qword [rdi + 0x4018]
movzx ebp, al
movss dword [rdi + 0x3908], xmm6
cmp word [rsi + 0xf8], 1
mov dword [rsi + 0xb4], r15d
mov byte [rsi + 0x10a], r14b
jne 0x14014e636
movsd xmm0, qword [rsi + 0x50]
movsd qword [rbx + 0x138], xmm0
mov r9d, r15d
lea rdx, [0x1402ee161]
not r9d
lea r10, [0x1402d76e0]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x14014e663
cmp byte [rdx], r8b
jne 0x14014e663
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14014e650
not ebx
cmp dword [rdi + 0x4078], ebx
jne 0x14014e693
xor edx, edx
xor ecx, ecx
call fcn.14014a200
cmp dword [rdi + 0x4aa8], r15d
jne 0x14014e6e0
bt r12d, 0x17
jb 0x14014e6e0
cmp word [rsi + 0x194], 0
jne 0x14014e6b6
cmp byte [rsi + 0x19a], 0
je 0x14014e6e0
xor edx, edx
mov rcx, rsi
call fcn.1401547b0
xor edx, edx
mov rcx, rsi
call fcn.14015b740
mov rdx, rsi
mov ecx, ebx
call fcn.14014a200
mov eax, dword [rdi + 0x4acc]
mov dword [rdi + 0x40a0], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14014ea30
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x14014ea80
lea r11, [0x1402d76e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14014ea63
cmp byte [r8], r9b
jne 0x14014ea63
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x14014ea50
mov rcx, qword [0x140358d08]
not edx
add rcx, 0x3ff8
jmp fcn.140146bd0
Function at 0x140159100
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140332240]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140358d08]
mov edi, ecx
cmp byte [rbx + 0x4c59], 0
jne 0x140159161
cmp byte [rbx + 0x4c5a], 0
jne 0x140159161
movsx r9d, word [rbx + 0x5d8a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1401463f0
test dil, 2
je 0x14015929e
jmp 0x1401591f1
movss xmm1, dword [rbx + 0x39ac]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5d8a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1402f317c]
mulss xmm1, dword [0x1402f3160]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x4914], rax
mov dword [rbx + 0x48fc], 1
movss dword [rbx + 0x490c], xmm0
mov byte [rbx + 0x4934], 1
movss dword [rbx + 0x4910], xmm1
movss xmm0, dword [rbx + 0x3a08]
mulss xmm0, dword [0x1402f2ff8]
or dword [rbx + 0x48f8], 0x41
movss dword [rbx + 0x4958], xmm0
call fcn.1401463f0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140159241
lea r11, [0x1402d76e0]
cmp r9b, 0x23
jne 0x140159224
cmp byte [r8], r9b
jne 0x140159224
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140159211
mov rcx, qword [0x140358d08]
not edx
add rcx, 0x3ff8
call fcn.140146bd0
test rax, rax
je 0x14015929e
cmp byte [rax + 0xeb], 0
je 0x14015929e
mov byte [rax + 0xf0], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0x110], 1
mov edx, 0x10
inc word [rbx + 0x5d8a]
movsx r9d, word [rbx + 0x5d8a]
call fcn.1401463f0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.140151870
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14026cac0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14015f4d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ed0], 0
lea rbx, [rcx + 0x5ed8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14015f577
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14015f52a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14016cd60
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140146f10
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ed0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5ee0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1403580a5]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14015f57f
mov rcx, rbx
call fcn.140146f10
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14015f8d0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140358d08]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14015f933
mov qword [rsp], rbx
lea rbx, [0x1402d76e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14015f913
cmp byte [r8], r9b
jne 0x14015f913
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14015f900
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5e30]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14015f967
mov r10, qword [r10 + 0x5e38]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14015f96e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14015f954
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140162fa0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x1401631ac
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140332240]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x18]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1402d76e0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x18]
test edx, edx
je 0x140163174
mov rcx, rbp
call fcn.1401626f0
mov edx, dword [rdi - 0x14]
mov rbx, rax
test edx, edx
je 0x14016301e
lea rcx, [rbp + 0x5dd8]
call fcn.140146bd0
mov r11, rax
jmp 0x140163021
xor r11d, r11d
mov qword [rbx + 0x18], r11
movsx eax, word [rdi]
movd xmm1, eax
movsx eax, word [rdi + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 4]
movd xmm1, eax
movsx eax, word [rdi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 8]
movd xmm1, eax
movsx eax, word [rdi + 0xa]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xc8]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xc8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test r11, r11
je 0x1401630b5
cmp qword [r11 + 0x20], 0
jne 0x1401630aa
mov qword [r11 + 0x20], rbx
jmp 0x1401630b5
cmp qword [r11 + 0x28], 0
jne 0x1401630b5
mov qword [r11 + 0x28], rbx
mov eax, dword [rdi - 0xc]
mov r9, rbx
mov dword [rbx + 0xbc], eax
movsx eax, byte [rdi - 8]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 4]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x1401630fc
nop dword [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1401630f0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.1401463f0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov edx, r14d
test r9b, r9b
je 0x140163158
cmp r9b, 0x23
jne 0x14016313b
cmp byte [r8], r9b
jne 0x14016313b
cmp byte [r8 + 1], r9b
cmove edx, r14d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r15 + rcx*4]
test r9b, r9b
jne 0x140163128
mov rcx, qword [0x140358d08]
not edx
add rcx, 0x3ff8
call fcn.140146bd0
mov qword [rbx + 0x88], rax
add rdi, 0x24
sub rsi, 1
jne 0x140162ff0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14026cac0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14016b190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x14016b1dd
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x14016b1e2
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x14016b20d
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14016b20d
mov rax, qword [rax + 0x3d8]
test rax, rax
je 0x14016b20d
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jmp 0x14016b212
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x14016b22c
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x14016b231
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], sil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x14016b2b3
inc ecx
test r8d, r8d
je 0x14016b29e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14016b2a3
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.14016cb50
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x14016b2f2
lea r8d, [rsi + 1]
mov rcx, rbp
call fcn.14016b190
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x14016b302
inc esi
jmp 0x14016b1c0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1401a52b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r11, qword [0x140358d08]
movaps xmmword [rsp + 0x30], xmm6
mov rdi, r11
mov rax, qword [r11 + 0x4a28]
mov rbx, qword [rax]
test rbx, rbx
je 0x1401a52e7
mov eax, dword [r11 + 0x3f70]
mov dword [rbx + 0x6c], eax
cmp qword [r11 + 0x4a38], rbx
je 0x1401a5332
test rbx, rbx
je 0x1401a5320
mov eax, dword [rbx + 0x28]
mov dword [r11 + 0x4a30], eax
mov rax, qword [r11 + 0x3880]
mov qword [r11 + 0x4a38], rbx
test rax, rax
je 0x1401a5332
mov rcx, rbx
call rax
mov r11, qword [0x140358d08]
jmp 0x1401a5332
mov dword [r11 + 0x4a30], 0x3f800000
mov qword [r11 + 0x4a38], rbx
movss xmm1, dword [rdi + 0x39a4]
lea r8, [0x1402eec39]
subss xmm1, dword [rdi + 0x3918]
movss xmm0, dword [rdi + 0x39a0]
lea rsi, [0x1402d76e0]
movss dword [rdi + 0x4980], xmm0
xorps xmm6, xmm6
mov r10d, 0xffffffff
mov r9b, 0x23
mov edx, r10d
maxss xmm1, xmm6
movss dword [rdi + 0x4984], xmm1
movss xmm5, dword [r11 + 0x3918]
addss xmm5, xmm5
addss xmm5, dword [r11 + 0x3d50]
cmp r9b, 0x23
jne 0x1401a53a4
cmp byte [r8], r9b
jne 0x1401a53a4
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [rsi + rcx*4]
test r9b, r9b
jne 0x1401a5391
not edx
lea rcx, [r11 + 0x3ff8]
call fcn.140146bd0
mov rcx, rax
test rbx, rbx
jne 0x1401a53e0
mov rax, qword [r11 + 0x4a28]
mov rbx, qword [rax]
xor esi, esi
test rcx, rcx
je 0x1401a53f4
cmp word [rcx + 0xf8], si
jne 0x1401a5492
movss xmm1, dword [rbx + 0x130]
movaps xmm3, xmm6
movss xmm0, dword [rbx + 0x10]
movaps xmm4, xmm1
addss xmm4, dword [rbx + 8]
movss xmm2, dword [rbx + 0x134]
subss xmm0, xmm1
addss xmm2, dword [rbx + 0xc]
addss xmm0, dword [rbx + 0x138]
or dword [r11 + 0x48f8], 3
movss dword [r11 + 0x490c], xmm4
movss dword [r11 + 0x4910], xmm2
movss dword [r11 + 0x4920], xmm5
maxss xmm3, xmm0
mov qword [r11 + 0x4914], rsi
mov dword [r11 + 0x48fc], 1
mov byte [r11 + 0x4934], 1
mov dword [r11 + 0x4900], 1
addss xmm3, xmm4
subss xmm3, xmm4
movss dword [r11 + 0x491c], xmm3
addss xmm5, dword [rbx + 0x134]
movss dword [rbx + 0x134], xmm5
mov eax, dword [rbx]
movaps xmm1, xmm6
or dword [r11 + 0x48f8], 0x100
mov ecx, 3
mov dword [r11 + 0x495c], eax
call fcn.140147110
mov rbx, qword [0x140358d08]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x38f0]
lea rcx, [rbx + 0x4998]
movss xmm0, dword [rbx + 0x38f4]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.14016c970
xor edx, edx
mov qword [rbx + 0x38f0], rsi
mov r8d, 0x20050f
lea rcx, str.MainMenuBar
call fcn.140151870
mov ecx, 2
movzx ebx, al
call fcn.140147220
mov qword [rdi + 0x4980], rsi
test bl, bl
je 0x1401a5529
call fcn.1401a4da0
jmp 0x1401a552e
call fcn.1401543f0
mov rsi, qword [rsp + 0x58]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x1401ac730
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov r10, rcx
mov eax, r11d
test r9b, r9b
je 0x1401ac78b
mov qword [rsp], rbx
lea rbx, [0x1402d76e0]
cmp r9b, 0x23
jne 0x1401ac76b
cmp byte [r8], r9b
jne 0x1401ac76b
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1401ac758
mov rbx, qword [rsp]
movsxd rdx, dword [r10 + 0x90]
not eax
mov r9, qword [r10 + 0x98]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x1401ac7e1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x1401ac7d9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x1401ac7dc
mov rdx, r8
test rdx, rdx
jne 0x1401ac7b0
cmp r9, r10
je 0x1401ac7f4
cmp dword [r9], eax
jne 0x1401ac7f4
mov eax, dword [r9 + 8]
add rsp, 8
ret
mov eax, 0xffffffff
add rsp, 8
ret

Function at 0x1401c85b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, qword [r8 + 8]
mov r15, rdx
mov r14, qword [r8]
xor edx, edx
mov esi, 0xcbf29ce4
test rbp, rbp
je 0x1401c85f7
nop
movsx rax, byte [r14 + rdx]
inc rdx
xor rax, rsi
imul rsi, rax, 0x1000193
cmp rdx, rbp
jb 0x1401c85e0
mov rdi, qword [rcx + 8]
movabs rax, 0x2aaaaaaaaaaaaaab
mov rbx, qword [rcx]
mov rcx, rdi
sub rcx, rbx
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1401c8660
nop dword [rax]
nop dword [rax + rax]
mov rcx, rdx
shr rcx, 1
lea rax, [rcx + rcx*2]
cmp qword [rbx + rax*8 + 0x10], rsi
lea r8, [rbx + rax*8]
jae 0x1401c8658
mov rax, 0xffffffffffffffff
lea rbx, [r8 + 0x18]
sub rax, rcx
add rdx, rax
jmp 0x1401c865b
mov rdx, rcx
test rdx, rdx
jg 0x1401c8630
cmp rbx, rdi
je 0x1401c868c
cmp qword [rbx + 0x10], rsi
jne 0x1401c868c
mov r8, qword [rbx + 8]
cmp r8, rbp
jne 0x1401c8683
mov rcx, qword [rbx]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401c86ab
add rbx, 0x18
cmp rbx, rdi
jne 0x1401c8665
mov qword [r15], rdi
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov qword [r15], rbx
jmp 0x1401c868f
Function at 0x1401c89c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12, qword [r8 + 0x18]
mov r15, rdx
mov rbp, qword [r8 + 0x10]
mov r14, r8
mov rbx, rcx
mov rdx, r8
cmp r12, 0xf
jbe 0x1401c89f3
mov rdx, qword [r8]
xor ecx, ecx
mov edi, 0xcbf29ce4
test rbp, rbp
je 0x1401c8a17
nop
movsx rax, byte [rdx + rcx]
inc rcx
xor rax, rdi
imul rdi, rax, 0x1000193
cmp rcx, rbp
jb 0x1401c8a00
mov rsi, qword [rbx + 8]
movabs rax, 0x6666666666666667
mov rbx, qword [rbx]
mov rcx, rsi
sub rcx, rbx
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
test rdx, rdx
jle 0x1401c8a80
nop dword [rax]
nop dword [rax + rax]
mov rcx, rdx
shr rcx, 1
lea rax, [rcx + rcx*4]
cmp qword [rbx + rax*8 + 0x20], rdi
lea r8, [rbx + rax*8]
jae 0x1401c8a78
mov rax, 0xffffffffffffffff
lea rbx, [r8 + 0x28]
sub rax, rcx
add rdx, rax
jmp 0x1401c8a7b
mov rdx, rcx
test rdx, rdx
jg 0x1401c8a50
cmp rbx, rsi
je 0x1401c8abf
cmp qword [rbx + 0x20], rdi
jne 0x1401c8abf
mov rdx, r14
cmp r12, 0xf
jbe 0x1401c8a97
mov rdx, qword [r14]
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x1401c8aa8
mov rcx, qword [rbx]
cmp r8, rbp
jne 0x1401c8ab6
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401c8adc
add rbx, 0x28
cmp rbx, rsi
jne 0x1401c8a85
mov qword [r15], rsi
mov rbx, qword [rsp + 0x50]
mov rax, r15
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov qword [r15], rbx
jmp 0x1401c8ac2
Function at 0x1401d0ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r15, rcx
call fcn.1401c5dc0
mov r13, rax
mov rbp, qword [rbx + 8]
mov r14, qword [rbx]
mov esi, 0xcbf29ce4
xor ecx, ecx
test rbp, rbp
je 0x1401d0b17
nop dword [rax]
movsx rax, byte [r14 + rcx]
xor rax, rsi
imul rsi, rax, 0x1000193
inc rcx
cmp rcx, rbp
jb 0x1401d0b00
mov rdi, qword [r13 + 0x18]
mov r12, qword [r13 + 0x10]
mov rcx, rdi
sub rcx, r12
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rbx, r12
test rdx, rdx
jle 0x1401d0b7f
nop dword [rax + rax]
mov rcx, rdx
shr rcx, 1
lea rax, [rcx + rcx*4]
lea r8, [rbx + rax*8]
cmp qword [r8 + 0x20], rsi
jae 0x1401d0b77
lea rbx, [r8 + 0x28]
mov rax, 0xffffffffffffffff
sub rax, rcx
add rdx, rax
jmp 0x1401d0b7a
mov rdx, rcx
test rdx, rdx
jg 0x1401d0b50
cmp rbx, rdi
je 0x1401d0bb5
cmp qword [rbx + 0x20], rsi
jne 0x1401d0bb5
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1401d0b97
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rbp
jne 0x1401d0bac
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401d0bdd
add rbx, 0x28
cmp rbx, rdi
jne 0x1401d0b84
call fcn.1401c51d0
mov qword [r15], rax
mov rax, r15
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
sub rbx, r12
movabs rax, 0x6666666666666667
imul rbx
sar rdx, 4
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
mov rcx, qword [r13 + 0x28]
lea rcx, [rcx + rdx*8]
cmp rcx, qword [r13 + 0x30]
je 0x1401d0bb5
mov rdx, qword [rcx]
mov qword [r15], rdx
jmp 0x1401d0bbd
Function at 0x1401d8be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rcx
test rcx, rcx
jne 0x1401d8c03
lea eax, [rcx + 0x23]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x88]
test rcx, rcx
je 0x1401d8c1e
mov rax, qword [rcx + 0x10]
call qword [rax + 0x18]
xor edx, edx
cmp eax, dword [rbx + 0x10]
cmovb edx, eax
mov r8d, edi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401d8c40