joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001196c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and qword [rcx], 0
mov rbx, rcx
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
and qword [rcx + 0x28], 0
and qword [rcx + 0x30], 0
and qword [rcx + 0x38], 0
lea rcx, str.crypt32.dll
call fcn.14000d9c4
mov rdi, rax
test rax, rax
je 0x140011a6b
lea rdx, str.CertCloseStore
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CertFindCertificateInStore
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CertFreeCertificateContext
mov rcx, rdi
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CertGetNameStringW
mov rcx, rdi
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptDecodeObject
mov rcx, rdi
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptMsgClose
mov rcx, rdi
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptMsgGetParam
mov rcx, rdi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptQueryObject
mov rcx, rdi
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptMsgClose
mov rcx, rdi
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140012de4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rdx + 0x10]
xor esi, esi
mov rbx, rcx
test r8, r8
jne 0x140012e75
lea r9, [rax + 8]
mov qword [rax + 8], rsi
xor edx, edx
lea rcx, [0x140040970]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140012e90
mov rdx, qword [rsp + 0x30]
lea rdi, [rbx + 0xc0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], si
jne 0x140012e2c
mov rcx, rdi
call fcn.140001d20
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r8d, 1
lea rdx, [0x14003e2b4]
mov rcx, rdi
call fcn.14000c074
mov r8d, 4
lea rdx, str.Zoom
mov rcx, rdi
call fcn.14000c074
jmp 0x140012e90
add rcx, 0xc0
cmp rcx, rdx
je 0x140012e90
cmp qword [rdx + 0x18], 8
jb 0x140012e8b
mov rdx, qword [rdx]
call fcn.140001d20
lea r8, [rbx + 0xc0]
add rbx, 0xe0
cmp rbx, r8
je 0x140012ebc
cmp qword [r8 + 0x18], 8
mov rdx, r8
jb 0x140012eb0
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, rbx
call fcn.140001d20
mov r8d, 6
lea rdx, str.data_
mov rcx, rbx
call fcn.14000c074
mov r8d, 0xb
lea rdx, str.Zoom.us.ini
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14000c074
Function at 0x140014258
Capabilities:
Read .ini file

Disassembly:
mov r11d, r9d
mov r10, r8
lea r9, [rcx + 8]
mov rax, rdx
cmp qword [r9 + 0x18], 8
jb 0x14001426f
mov r9, qword [r9]
cmp qword [r8 + 0x18], 8
jb 0x140014279
mov r10, qword [r8]
cmp qword [rdx + 0x18], 8
jb case.default.0x14001428c
mov rax, qword [rdx]
mov r8d, r11d
mov rdx, r10
mov rcx, rax
jmp qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
int3
std
cmc
mov esi, dword [rax - 0xb]
cmp eax, eax
jl 0x14009164f
mov edi, 0xf79952ea
invalid
adc al, 0x88
jo 0x140091e2d
mov al, 0x3e
test dword [rcx], 0xea25777f
sbb cl, byte [rsi]
hlt
xchg ebp, eax
invalid
invalid
mov bh, 0x3e
scasd eax, dword [rdi]
jne 0x140091e74
cmpsb byte [rsi], byte [rdi]
push 0x7dead587
mov esi, 0xbd7a5ff
jp 0x140091e39
invalid
sub byte [0x18eb204b7], cl
or eax, 0x4ea8e6a1
cmpsd dword [rsi], dword [rdi]
cmc
jb 0x140091dff
push rcx
jns 0x140091e69
invalid
nop
nop
iretd
or dword [rbx + 0x25852cf3], ecx
insb byte [rdi], dx
cmpsb byte [rsi], byte [rdi]
cmc
pop rbx
mov esi, ebx
sub al, 0x85
and eax, 0x5bf5a66c
xor dh, byte [rdx + 0x7d]
jge 0x140091de6
stosd dword [rdi], eax
sal edi, cl
invalid
or eax, 0xeb1594dc
pop rdx
invalid
invalid

Function at 0x140014294
Capabilities:
Read .ini file

Disassembly:
push rbx
add rcx, 8
mov r10, r9
mov r11, r8
mov rbx, rdx
cmp qword [rcx + 0x18], 8
jb case.default.0x1400142c9
mov rcx, qword [rcx]
mov eax, dword [rsp + 0x38]
mov r8, r10
mov r9, qword [rsp + 0x30]
mov rdx, r11
mov qword [rsp + 0x38], rcx
mov rcx, rbx
mov dword [rsp + 0x30], eax
pop rbx
jmp qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, 0x2cadaa69
mov byte [rbp - 0x26], dh
invalid
movabs al, byte [0xbaf9d00fb7d7e487]
jg 0x1400914ef
xlatb
push rcx
add eax, 0x627eb15d
add ecx, edx
or eax, 0xd927ded9
rcr byte [rdi - 0x19], 1
and cl, dh
mov dl, 0x7a
adc dword [rcx + 0x34], edx
jno 0x1400914fa
movsb byte [rdi], byte [rsi]
movabs dword [0x74a6bf70951fc1f1], eax
pmulhuw mm5, qword [rsi]
stosb byte [rdi], al
or al, 0xd
and dword [rax - 0x60], edx
movabs al, byte [0x743ce6bf16ea2757]
out dx, eax
jg 0x140091519
push rdi
invalid
invalid
cmp al, ch
sar dword [rbx - 0x16], 1
cmpsd dword [rsi], dword [rdi]
invalid
add bh, ah
add ah, cl
or edi, ebx
stc
invalid
idiv bh
cli
test dword [rbx - 0x21], esi
jo 0x1400915a1
mov ebp, 0xe11c9a3a
mov al, 0x12
pushfq
invalid
mov edi, 0xd174cf37
xor dword [rdx], eax
adc bl, byte [rax - 0x7f]
mov ebx, 0x4059ed1a
out dx, al
sbb dl, byte [rax]
jne 0x140091520
jnp 0x1400915b6
sal ch, cl
stosd dword [rdi], eax
jge 0x140091556
invalid
insb byte [rdi], dx
xor eax, 0x74ee5743
mov ebp, 0x1fdff7d
lodsd eax, dword [rsi]
insd dword [rdi], dx
fidivr dword [rdx]
or dword [rdx], ebp
invalid
invalid
and byte es:[rdx], ch
add al, 0xae
invalid
invalid
int 0x2c
imul esi, dword [rdi], 0xffffffc2
adc al, 0x5d
sahf
scasb al, byte [rdi]
invalid
Function at 0x140017770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140055180]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [rcx + 0x18], 0
mov r14, rdx
mov rsi, rcx
je 0x1400178ec
cmp byte [rcx + 0x8c], 0
mov ebp, dword [rdx + 0x10]
je 0x1400178cb
mov edx, dword [rcx + 0x98]
mov ecx, dword [rcx + 0x84]
lea eax, [rdx + rbp]
cmp eax, ecx
jle 0x1400178cb
mov ebx, dword [rsi + 0x88]
cmp ebx, 1
jne 0x14001782a
sub ecx, edx
movsxd rbx, ecx
mov rcx, rbx
call fcn.140019cc4
mov r8, rbx
mov edx, 0x20
mov rcx, rax
mov rdi, rax
call fcn.14001c440
mov r9, qword [rsi + 0x18]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.1400246b4
mov rcx, rdi
call fcn.140019790
mov rcx, qword [rsi + 0x18]
xor r8d, r8d
xor edx, edx
call fcn.1400256f4
and dword [rsi + 0x98], 0
jmp 0x1400178cb
jle 0x1400178cb
mov rcx, rsi
call fcn.140016e8c
mov rcx, rsi
call fcn.140017224
test al, al
je 0x1400178cb
cmp dword [rsi + 0x9c], ebx
jle 0x1400178cb
lea rdi, [rsi + 0xa8]
mov rax, qword [rdi]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400178cb
and qword [rsp + 0x20], 0
lea rdx, [rbx + 0x28]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x20]
and qword [rsp + 0x38], 0
call fcn.140002ee0
mov rdx, rbx
mov rcx, rdi
call fcn.140016dd8
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400178cb
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400178c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001790e
call fcn.140019790
cmp qword [r14 + 0x18], 0x10
jb 0x1400178d5
mov r14, qword [r14]
mov r9b, 1
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
call fcn.140017bf8
add dword [rsi + 0x98], ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140019770
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140023f10
int3

Function at 0x140017bf8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, rdx
movsxd r8, r8d
mov bl, r9b
mov rdi, rcx
mov r9, qword [rcx + 0x18]
mov edx, 1
mov rcx, rax
call fcn.1400246b4
test bl, bl
je 0x140017c2c
mov rcx, qword [rdi + 0x18]
call fcn.140025484
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140017cbc
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rdx, [rsp + 0x20]
mov rdi, rcx
call fcn.140017c90
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x140017d30
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140017d30
mov edx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140017d14
mov eax, dword [rbx + 0x10]
mov edi, 1
mov dword [0x140056f10], eax
mov edx, edi
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140017d35
mov rcx, rdi
call fcn.140017d8c
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edi, dword [rsp + 0x48]
jmp 0x140017d35
mov edi, 1
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140017d7f
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140017d7f
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax]
call qword [0x14003d5a8]
or ecx, 0xffffffff
lock xadd dword [rbx + 0xc], ecx
cmp ecx, 1
jne 0x140017d7f
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [0x14003d5a8]
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret

Function at 0x140017ebc
Capabilities:
Create thread
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x140017fa0]
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x10]
mov qword [r11 - 0x10], rax
mov dword [rsp + 0x20], 4
call fcn.140022e0c
mov rcx, rax
test rax, rax
je 0x140017f77
mov rax, qword [rdi]
mov rdx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rdi]
add rcx, 0x18
call fcn.140003268
mov rax, qword [rdi]
xor ecx, ecx
mov ebp, dword [rax + 0x10]
lea rax, [0x140056e40]
cmp dword [rax], 0
je 0x140017f44
inc ecx
lea rdx, [0x140056f50]
add rax, 0x44
cmp rax, rdx
jl 0x140017f2b
jmp 0x140017f68
movsxd rax, ecx
lea r14, [0x140056e00]
imul rbx, rax, 0x44
mov r8, rsi
mov edx, 0x40
lea rcx, [rbx + r14]
call fcn.140024b24
mov dword [rbx + r14 + 0x40], ebp
mov rcx, qword [rdi]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140002e10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002e6d
lea rbx, [0x1400c3a10]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002e54
cmp r10, 2
jb 0x140002e54
cmp byte [r9], r8b
jne 0x140002e54
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002e30
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002eaf
lea rbx, [0x1400c3a10]
cmp r8b, 0x23
jne 0x140002e93
cmp byte [r9], r8b
jne 0x140002e93
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002e80
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000309f
mov r8d, 0x72c
lea rdx, str.C:UsersAdministratorDocumentsMEMORIAPanelesREYXUSPANELBASICOunknwon_cheatsimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x1400030ab
mov qword [rdi], 0
lea rdx, [0x1400c32c8]
mov rcx, rbx
call fcn.140002ec0
mov rbx, rax
test rax, rax
jne 0x1400030cd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400031a4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400031a4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400031a4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400031a4
cmp rsi, 0xffffffffffffffff
je 0x1400031a4
mov rax, qword [0x1401b8330]
test rax, rax
je 0x140003141
inc dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1400031a4
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003191
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401b8330]
test rax, rax
je 0x140003186
dec dword [rax + 0xec]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400031ad
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14000319f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1400031af
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005b50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xd0], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x140005b87
mov r8d, 0x6fc
lea rdx, str.C:UsersAdministratorDocumentsMEMORIAPanelesREYXUSPANELBASICOunknwon_cheatsimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xd8]
lea rdx, [0x1400c3a10]
movsxd r8, dword [rbx + 0xd0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x1401b8330]
not ebx
cmp dword [rcx + 0x3ebc], ebx
jne 0x140005c06
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001ae80
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140014320
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1401b8330]
mov edi, ecx
cmp byte [rbx + 0x4235], 0
jne 0x140014372
cmp byte [rbx + 0x4236], 0
jne 0x140014372
movsx r9d, word [rbx + 0x531a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140002cd0
test dil, 1
je 0x140014498
jmp 0x1400143fb
movss xmm1, dword [rbx + 0x3890]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400cc204]
xor eax, eax
mulss xmm1, dword [0x1400cc1e0]
addss xmm0, dword [rbx + 0xdf4]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xdf8]
mov qword [rbx + 0x3fa0], rax
mov dword [rbx + 0x3f8c], 1
movss dword [rbx + 0x3f98], xmm0
movss dword [rbx + 0x3f9c], xmm1
movss xmm0, dword [rbx + 0x38ec]
mulss xmm0, dword [0x1400cc15c]
or dword [rbx + 0x3f88], 0x41
movss dword [rbx + 0x3fe8], xmm0
movsx r9d, word [rbx + 0x531a]
call fcn.140002cd0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140014450
lea r11, [0x1400c3a10]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140014433
cmp byte [r8], r9b
jne 0x140014433
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140014420
not ecx
call fcn.14000bfa0
test rax, rax
je 0x140014498
cmp byte [rax + 0x96], 0
je 0x140014498
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x531a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x531a]
call fcn.140002cd0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000e7d0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140019700
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53c8], 0
lea rbx, [rcx + 0x53d0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400197a3
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x140019756
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.14001bbb0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400037c0
mov eax, dword [rbx]
lea rcx, [0x1401b8328]
mov r9, qword [rdi + 0x53c8]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x53d8]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400197ab
mov rcx, rbx
call fcn.1400037c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140019e50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1401b8330]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x140019eb4
lea r10, [0x1400c3a10]
cmp r8b, 0x23
jne 0x140019e97
cmp byte [rdx], r8b
jne 0x140019e97
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140019e84
mov eax, dword [r14 + 0x5378]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x140019f15
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x140019eda
cmp edi, eax
jl 0x140019ef4
mov r8d, 0x6f3
lea rdx, str.C:UsersAdministratorDocumentsMEMORIAPanelesREYXUSPANELBASICOunknwon_cheatsimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5380]
cmp dword [rax + rbp + 8], ebx
je 0x140019f32
mov eax, dword [r14 + 0x5378]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x140019ed1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x140019f3f
cmp edi, dword [r14 + 0x5378]
jl 0x140019f59
mov r8d, 0x6f3
lea rdx, str.C:UsersAdministratorDocumentsMEMORIAPanelesREYXUSPANELBASICOunknwon_cheatsimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5380]
lea rax, [rax + rcx*8]
jmp 0x140019f17
Function at 0x14003bae0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.140012210
cmp byte [rax], 0
je 0x14003bb65
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003bb65
mov rbx, qword [0x1401b8330]
test rbx, rbx
jne 0x14003bb34
mov r8d, 0xebd
lea rdx, str.C:UsersAdministratorDocumentsMEMORIAPanelesREYXUSPANELBASICOunknwon_cheatsimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401b8330]
cmp byte [rbx + 0x37a1], 0
je 0x14003bb51
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.1400026f0
mov dword [rbx + 0x378], 0x210
mov dword [rbx + 0x938], 0xa0
mov ecx, 0x214
call fcn.140012210
cmp byte [rax], 0
je 0x14003bbe4
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003bbe4
mov rbx, qword [0x1401b8330]
test rbx, rbx
jne 0x14003bbb3
mov r8d, 0xebd
lea rdx, str.C:UsersAdministratorDocumentsMEMORIAPanelesREYXUSPANELBASICOunknwon_cheatsimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401b8330]
cmp byte [rbx + 0x37a1], 0
je 0x14003bbd0
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.1400026f0
mov dword [rbx + 0x37c], 0x214
mov dword [rbx + 0x948], 0xa1
mov ecx, 0x212
call fcn.140012210
cmp byte [rax], 0
je 0x14003bc63
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003bc63
mov rbx, qword [0x1401b8330]
test rbx, rbx
jne 0x14003bc32
mov r8d, 0xebd
lea rdx, str.C:UsersAdministratorDocumentsMEMORIAPanelesREYXUSPANELBASICOunknwon_cheatsimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401b8330]
cmp byte [rbx + 0x37a1], 0
je 0x14003bc4f
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.1400026f0
mov dword [rbx + 0x264], 0x212
mov dword [rbx + 0x940], 0x5b
mov ecx, 0x216
call fcn.140012210
cmp byte [rax], 0
je 0x14003bce2
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14003bce2
mov rbx, qword [0x1401b8330]
test rbx, rbx
jne 0x14003bcb1
mov r8d, 0xebd
lea rdx, str.C:UsersAdministratorDocumentsMEMORIAPanelesREYXUSPANELBASICOunknwon_cheatsimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1401b8330]
cmp byte [rbx + 0x37a1], 0
je 0x14003bcce
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.1400026f0
mov dword [rbx + 0x268], 0x216
mov dword [rbx + 0x950], 0x5c
add rsp, 0x20
pop rbx
ret