joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], al
mov dword [rsp + 0x20], 1
mov rdx, qword [rdx + 0x10]
call fcn.14000aee0
cmp qword [rdi + 0x18], 0x10
jb 0x1400b1fda
mov rdi, qword [rdi]
movzx ecx, byte [rdi]
test cl, cl
je 0x1400b210e
test ebp, ebp
jne 0x1400b2002
movzx eax, cl
xor eax, 0x20
sub eax, 0xa1
cmp eax, 0x3c
jae 0x1400b20c1
lea eax, [rbp + 1]
jmp 0x1400b204d
cmp ebp, 1
jne 0x1400b201e
lea eax, [rcx + 0x5f]
cmp al, 0x53
jbe 0x1400b2017
cmp cl, 0x8e
jne 0x1400b20c1
mov eax, 1
jmp 0x1400b204d
cmp ebp, 2
jne 0x1400b20c1
test cl, cl
jns 0x1400b20c1
mov eax, 0xffffffff
mov edx, 0x80
movsx r8d, cl
nop dword [rax]
inc eax
sar edx, 1
test edx, r8d
jne 0x1400b2040
test eax, eax
jle 0x1400b2091
mov esi, eax
nop
movzx r9d, byte [rdi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400b2080
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1400b2075
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400b2088
mov rcx, rbx
call fcn.14001c700
inc rdi
sub rsi, 1
jne 0x1400b2050
movzx r9d, byte [rdi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400b20f8
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1400b20b6
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400b2100
movsx ecx, byte [rdi]
call fcn.140274b40
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
cmp rdx, r8
jae 0x1400b20f4
lea rcx, [rdx + 1]
mov qword [rbx + 0x10], rcx
mov rcx, rbx
cmp r8, 0x10
jb 0x1400b20ea
mov rcx, qword [rbx]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x1400b2100
movzx r9d, al
mov rcx, rbx
call fcn.14001c700
inc rdi
movzx ecx, byte [rdi]
test cl, cl
jne 0x1400b1fe5
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b78a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rdx]
lea r8, [rdx + 0x48]
mov dword [rcx], eax
mov rbx, rcx
mov eax, dword [rdx + 4]
mov rdi, rdx
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x14], eax
movzx eax, byte [rdx + 0x18]
mov byte [rcx + 0x18], al
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x20]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x24]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x28]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x2c]
mov dword [rcx + 0x2c], eax
movzx eax, byte [rdx + 0x30]
mov byte [rcx + 0x30], al
mov eax, dword [rdx + 0x34]
mov dword [rcx + 0x34], eax
mov eax, dword [rdx + 0x38]
mov dword [rcx + 0x38], eax
mov eax, dword [rdx + 0x3c]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0x40]
mov dword [rcx + 0x40], eax
add rcx, 0x48
cmp rcx, r8
je 0x1400b7939
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x1400b7930
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
call fcn.14000b830
lea r8, [rdi + 0x68]
lea rcx, [rbx + 0x68]
cmp rcx, r8
je 0x1400b795c
cmp qword [r8 + 0x18], 0x10
mov rdx, r8
jb 0x1400b7953
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
call fcn.14000b830
mov eax, dword [rdi + 0x88]
mov dword [rbx + 0x88], eax
mov eax, dword [rdi + 0x8c]
mov dword [rbx + 0x8c], eax
mov eax, dword [rdi + 0x90]
mov dword [rbx + 0x90], eax
mov eax, dword [rdi + 0x94]
mov dword [rbx + 0x94], eax
mov eax, dword [rdi + 0x98]
mov dword [rbx + 0x98], eax
mov eax, dword [rdi + 0x9c]
mov dword [rbx + 0x9c], eax
mov eax, dword [rdi + 0xa0]
mov dword [rbx + 0xa0], eax
mov eax, dword [rdi + 0xa4]
mov dword [rbx + 0xa4], eax
mov eax, dword [rdi + 0xa8]
mov dword [rbx + 0xa8], eax
mov eax, dword [rdi + 0xac]
mov dword [rbx + 0xac], eax
mov eax, dword [rdi + 0xb0]
mov dword [rbx + 0xb0], eax
mov eax, dword [rdi + 0xb4]
mov dword [rbx + 0xb4], eax
mov eax, dword [rdi + 0xb8]
mov dword [rbx + 0xb8], eax
mov eax, dword [rdi + 0xbc]
mov dword [rbx + 0xbc], eax
mov eax, dword [rdi + 0xc0]
mov dword [rbx + 0xc0], eax
mov eax, dword [rdi + 0xc4]
mov dword [rbx + 0xc4], eax
movzx eax, byte [rdi + 0xc8]
mov byte [rbx + 0xc8], al
movzx eax, byte [rdi + 0xc9]
mov byte [rbx + 0xc9], al
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400df570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 8]
mov qword [rsp + 0x40], rbx
mov eax, dword [rdx + 8]
mov dword [rbx], eax
mov eax, dword [rdx + 0xc]
mov dword [rbx + 4], eax
mov eax, dword [rdx + 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdx + 0x14]
mov dword [rbx + 0xc], eax
mov eax, dword [rdx + 0x18]
mov dword [rbx + 0x10], eax
mov eax, dword [rdx + 0x1c]
mov dword [rbx + 0x14], eax
movzx eax, byte [rdx + 0x20]
mov byte [rbx + 0x18], al
mov eax, dword [rdx + 0x24]
mov dword [rbx + 0x1c], eax
mov eax, dword [rdx + 0x28]
mov dword [rbx + 0x20], eax
mov eax, dword [rdx + 0x2c]
mov dword [rbx + 0x24], eax
mov eax, dword [rdx + 0x30]
mov dword [rbx + 0x28], eax
mov eax, dword [rdx + 0x34]
mov dword [rbx + 0x2c], eax
movzx eax, byte [rdx + 0x38]
mov byte [rbx + 0x30], al
mov eax, dword [rdx + 0x3c]
mov dword [rbx + 0x34], eax
mov eax, dword [rdx + 0x40]
mov dword [rbx + 0x38], eax
mov eax, dword [rdx + 0x44]
mov dword [rbx + 0x3c], eax
mov eax, dword [rdx + 0x48]
mov dword [rbx + 0x40], eax
add rdx, 0x50
lea rcx, [rbx + 0x48]
call fcn.14000b200
nop
lea rdx, [rdi + 0x70]
lea rcx, [rbx + 0x68]
call fcn.14000b200
mov eax, dword [rdi + 0x90]
mov dword [rbx + 0x88], eax
mov eax, dword [rdi + 0x94]
mov dword [rbx + 0x8c], eax
mov eax, dword [rdi + 0x98]
mov dword [rbx + 0x90], eax
mov eax, dword [rdi + 0x9c]
mov dword [rbx + 0x94], eax
mov eax, dword [rdi + 0xa0]
mov dword [rbx + 0x98], eax
mov eax, dword [rdi + 0xa4]
mov dword [rbx + 0x9c], eax
mov eax, dword [rdi + 0xa8]
mov dword [rbx + 0xa0], eax
mov eax, dword [rdi + 0xac]
mov dword [rbx + 0xa4], eax
mov eax, dword [rdi + 0xb0]
mov dword [rbx + 0xa8], eax
mov eax, dword [rdi + 0xb4]
mov dword [rbx + 0xac], eax
mov eax, dword [rdi + 0xb8]
mov dword [rbx + 0xb0], eax
mov eax, dword [rdi + 0xbc]
mov dword [rbx + 0xb4], eax
mov eax, dword [rdi + 0xc0]
mov dword [rbx + 0xb8], eax
mov eax, dword [rdi + 0xc4]
mov dword [rbx + 0xbc], eax
mov eax, dword [rdi + 0xc8]
mov dword [rbx + 0xc0], eax
mov eax, dword [rdi + 0xcc]
mov dword [rbx + 0xc4], eax
movzx eax, byte [rdi + 0xd0]
mov byte [rbx + 0xc8], al
movzx eax, byte [rdi + 0xd1]
mov byte [rbx + 0xc9], al
lea rax, vtable.artemis::CFontProperty.0
mov qword [rsi], rax
mov eax, dword [rdi + 0xd8]
mov dword [rsi + 0xd8], eax
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400fdb30
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r11, qword [rcx]
mov rdi, rcx
mov ebx, dword [rcx + 0xc]
sub ebx, dword [rcx + 8]
mov rax, qword [r11 + 0x9c0]
cmp rax, 0x270
jne 0x1400fdb64
mov rcx, r11
call fcn.140115230
mov rax, qword [r11 + 0x9c0]
mov ecx, dword [r11 + rax*4]
inc rax
mov qword [r11 + 0x9c0], rax
mov eax, ecx
mov r8d, dword [rdi + 8]
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cmp ebx, 0xffffffff
jb 0x1400fdbaf
add eax, r8d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea ecx, [rbx + 1]
xor edx, edx
mov rbx, qword [rsp + 0x30]
div ecx
lea eax, [r8 + rdx]
add rsp, 0x20
pop rdi
ret

Function at 0x140103700
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [rdx]
mov dword [rcx], eax
mov qword [rcx + 0x9c0], 1
nop
mov r8, qword [rcx + 0x9c0]
mov edx, dword [rcx + r8*4 - 4]
shr edx, 0x1e
xor edx, dword [rcx + r8*4 - 4]
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rcx + r8*4], eax
inc qword [rcx + 0x9c0]
cmp qword [rcx + 0x9c0], 0x270
jb 0x140103710
mov edx, dword [rcx + 0x9bc]
xor edx, dword [rcx + 0x630]
mov r8d, dword [rcx]
jge 0x140103763
xor edx, 0x1908b0df
add edx, edx
or edx, 1
jmp 0x140103765
add edx, edx
mov eax, r8d
xor eax, edx
btr eax, 0x1f
xor eax, r8d
mov dword [rcx], eax
xor eax, eax
cmp dword [rcx + rax*4], 0
jne 0x14010378c
inc rax
cmp rax, 0x270
jb 0x140103775
mov dword [rcx], 0x80000000
ret

Function at 0x140107460
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using crc32b

Disassembly:
sub rsp, 8
xor r8d, r8d
mov r11, rcx
xor edx, edx
mov r9d, 0xffffffff
test r9b, 1
je 0x140107483
mov eax, 0x1f
sub eax, edx
bts r8d, eax
inc rdx
shr r9d, 1
cmp rdx, 0x20
jb 0x140107472
cmp byte [0x1404a34f0], 0
mov dword [rcx], r8d
jne 0x14010754e
mov qword [rsp], rbx
xor r10b, r10b
lea rbx, [0x1404a3500]
nop dword [rax]
xor eax, eax
mov r9b, 0x80
nop word [rax + rax]
mov edx, eax
movzx ecx, r9b
btc edx, 0x1f
movzx r8d, r9b
and cl, r10b
cmove edx, eax
lea ecx, [rdx + rdx]
mov eax, ecx
xor eax, 0x4c11db7
test edx, edx
cmovns eax, ecx
shr r9b, 1
cmp r8b, 2
jae 0x1401074c0
xor r8d, r8d
xor edx, edx
test al, 1
je 0x140107500
mov ecx, 0x1f
sub ecx, edx
bts r8d, ecx
inc rdx
shr eax, 1
cmp rdx, 0x20
jb 0x1401074f1
xor dl, dl
movzx r9d, r10b
xor ecx, ecx
test r9b, 1
je 0x140107526
mov eax, 7
movzx edx, dl
sub eax, ecx
bts edx, eax
inc rcx
shr r9b, 1
cmp rcx, 8
jb 0x140107513
movzx eax, dl
mov dword [rbx + rax*4], r8d
add r10b, 1
jne 0x1401074b0
mov rbx, qword [rsp]
mov byte [0x1404a34f0], 1
mov rax, r11
add rsp, 8
ret
Function at 0x140107560
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rcx
lea rax, [rdx + r8]
xor ecx, ecx
mov r10, r8
cmp rdx, rax
mov r9, rdx
cmova r10, rcx
test r10, r10
je 0x1401075bc
mov r8d, dword [r11]
mov qword [rsp], rbx
lea rbx, [0x1404a3500]
nop dword [rax]
movzx eax, byte [r11]
xor al, byte [r9]
inc r9
movzx ecx, al
mov eax, r8d
shr eax, 8
mov r8d, dword [rbx + rcx*4]
xor r8d, eax
mov rax, r9
sub rax, rdx
mov dword [r11], r8d
cmp rax, r10
jb 0x140107590
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x140108dd0
Capabilities:
Initialize winsock library

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x220
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x140479080]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov r15, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x40]
call fcn.140111670
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140007e30
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140108e4f
mov rax, qword [rcx]
call qword [rax + 0x28]
mov r14, rax
jmp 0x140108e52
mov r14, r12
lea rdi, [r14 + 8]
mov qword [rsp + 0x60], rdi
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x30], rcx
test rcx, rcx
je 0x140108e85
mov eax, 1
lock xadd dword [rcx + 8], eax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x48], rdx
movzx edx, word [r15]
lea r8, vtable.artemis::CServerSocket.0
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
test rcx, rcx
je 0x140108eb4
mov eax, 1
lock xadd dword [rcx + 8], eax
mov word [rdi + 0x18], dx
mov qword [rdi + 0x20], r12
mov ebp, 0xffffffff
mov dword [rdi + 0x28], ebp
mov qword [rdi + 0x2c], r12
lea rbx, [rdi + 0x38]
mov qword [rsp + 0x68], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
call fcn.1401a2550
mov qword [rbx], rax
mov eax, dword [0x1404a319c]
test eax, eax
jne 0x140108efe
lea ecx, [rbp + 3]
lea rdx, [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [0x1404a319c]
inc eax
mov dword [0x1404a319c], eax
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140108f3b
mov eax, ebp
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140108f3b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, ebp
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140108f3b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov byte [r14], 1
mov r8, rdi
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140007e30
mov qword [rsi], rdi
mov rbx, qword [rsp + 0x40]
mov qword [rsi + 8], rbx
test rbx, rbx
je 0x140108f6f
mov eax, 1
lock xadd dword [rbx + 8], eax
mov rbx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 1
test rbx, rbx
je 0x140108fa5
mov eax, ebp
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140108fa5
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_htonl]
lock xadd dword [rbx + 0xc], ebp
cmp ebp, 1
jne 0x140108fa5
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.WS2_32.dll_recv]
nop
mov rax, rsi
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.14023ed20
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14010ebd0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 4]
mov r11, rdx
sub ebx, dword [rcx]
mov rdi, rcx
mov rax, qword [rdx + 0x9c0]
cmp rax, 0x270
jne 0x14010ec03
mov rcx, rdx
call fcn.140115230
mov rax, qword [rcx + 0x9c0]
mov ecx, dword [r11 + rax*4]
inc rax
mov qword [r11 + 0x9c0], rax
mov eax, ecx
mov r8d, dword [rdi]
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cmp ebx, 0xffffffff
jb 0x14010ec4d
add eax, r8d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea ecx, [rbx + 1]
xor edx, edx
mov rbx, qword [rsp + 0x30]
div ecx
lea eax, [r8 + rdx]
add rsp, 0x20
pop rdi
ret
Function at 0x140115230
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x38
xor r8d, r8d
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1401152f0
movdqa xmm4, xmmword [0x140410960]
mov eax, 1
movdqa xmm5, xmmword [0x1404109b0]
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x10], xmm7
movdqa xmm7, xmmword [0x1404109d0]
movaps xmmword [rsp], xmm8
movdqa xmm8, xmmword [0x140410820]
movd xmm6, eax
nop dword [rax]
movdqu xmm2, xmmword [rcx + r8*4 + 4]
movdqu xmm0, xmmword [rcx + r8*4]
movdqa xmm3, xmm4
movdqa xmm1, xmm5
pand xmm1, xmm0
pand xmm3, xmm2
por xmm3, xmm1
movdqa xmm0, xmm8
pand xmm0, xmm2
psrld xmm3, xmm6
pmulld xmm0, xmm7
pxor xmm3, xmm0
movdqu xmm0, xmmword [rcx + r8*4 + 0x634]
pxor xmm3, xmm0
movdqu xmmword [rcx + r8*4], xmm3
add r8, 4
cmp r8, 0xdc
jb 0x140115280
movaps xmm8, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm6, xmmword [rsp + 0x20]
cmp r8, 0xde
jae 0x140115330
mov eax, dword [rcx + r8*4 + 4]
mov edx, eax
xor edx, dword [rcx + r8*4]
and eax, 1
and edx, 0x7ffffffe
imul eax, eax, 0x9908b0df
xor edx, dword [rcx + r8*4]
shr edx, 1
xor edx, eax
xor edx, dword [rcx + r8*4 + 0x634]
mov dword [rcx + r8*4], edx
inc r8
cmp r8, 0xde
jb 0x1401152f0
nop word [rax + rax]
mov r9d, dword [rcx + 0x37c]
mov eax, r9d
mov r10d, dword [rcx + 0x380]
and eax, 1
mov r8d, dword [rcx + 0x378]
xor r8d, r9d
imul edx, eax, 0x9908b0df
and r8d, 0x7ffffffe
mov eax, r10d
xor r8d, dword [rcx + 0x378]
and eax, 1
shr r8d, 1
xor r8d, edx
imul edx, eax, 0x9908b0df
xor r8d, dword [rcx + 0x9ac]
mov dword [rcx + 0x378], r8d
mov r8d, r10d
xor r8d, r9d
and r8d, 0x7ffffffe
xor r8d, r9d
mov r9d, dword [rcx + 0x384]
shr r8d, 1
mov eax, r9d
xor r8d, edx
and eax, 1
xor r8d, dword [rcx + 0x9b0]
mov dword [rcx + 0x37c], r8d
mov r8d, r9d
xor r8d, r10d
imul edx, eax, 0x9908b0df
and r8d, 0x7ffffffe
xor r8d, r10d
mov r10d, dword [rcx + 0x388]
shr r8d, 1
mov eax, r10d
and eax, 1
xor r8d, edx
imul edx, eax, 0x9908b0df
xor r8d, dword [rcx + 0x9b4]
mov eax, dword [rcx + 0x38c]
mov dword [rcx + 0x380], r8d
mov r8d, r10d
xor r8d, r9d
and r8d, 0x7ffffffe
xor r8d, r9d
shr r8d, 1
xor r8d, edx
mov edx, eax
xor r8d, dword [rcx + 0x9b8]
xor edx, r10d
and edx, 0x7ffffffe
mov dword [rcx + 0x384], r8d
xor edx, r10d
and eax, 1
imul eax, eax, 0x9908b0df
mov r8d, 0xe3
shr edx, 1
xor edx, eax
xor edx, dword [rcx + 0x9bc]
mov dword [rcx + 0x388], edx
nop word [rax + rax]
mov eax, dword [rcx + r8*4 + 4]
mov edx, eax
xor edx, dword [rcx + r8*4]
and eax, 1
and edx, 0x7ffffffe
imul eax, eax, 0x9908b0df
xor edx, dword [rcx + r8*4]
shr edx, 1
xor edx, eax
xor edx, dword [rcx + r8*4 - 0x38c]
mov dword [rcx + r8*4], edx
inc r8
cmp r8, 0x26f
jb 0x140115450
mov eax, dword [rcx]
mov edx, eax
xor edx, dword [rcx + 0x9bc]
and eax, 1
and edx, 0x7ffffffe
imul eax, eax, 0x9908b0df
xor edx, dword [rcx + 0x9bc]
shr edx, 1
mov qword [rcx + 0x9c0], 0
xor edx, eax
xor edx, dword [rcx + 0x630]
mov dword [rcx + 0x9bc], edx
add rsp, 0x38
ret
Function at 0x14012fc10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rbx, rdx
mov rsi, rcx
lea rdx, [rcx + 0x20]
mov rcx, rbx
call fcn.1401338d0
lea rdx, [rsi + 0x48]
mov rcx, rbx
call fcn.140133b50
cmp byte [rbx + 0x18], 0
jne 0x14012fc6e
xor r8d, r8d
lea edx, [r8 + 2]
mov rcx, rbx
call fcn.1401a01e0
test al, al
jne 0x14012fcea
lea rcx, [rsi + 0x70]
call fcn.140103790
mov r8, qword [rbx + 8]
mov rax, qword [r8 + 0x18]
test rax, rax
je 0x14012fcea
mov edx, dword [r8 + 0x2c]
lea r9d, [rdx + 4]
cmp dword [rax + 0x1c], r9d
jb 0x14012fcea
mov rcx, qword [rax + 8]
movsxd rax, dword [rax + 0x18]
add rax, rcx
mov eax, dword [rdx + rax]
mov dword [r8 + 0x2c], r9d
test eax, eax
je 0x14012fcea
mov edi, eax
xor r14d, r14d
nop dword [rax]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.1401349a0
lea rdx, [rsp + 0x28]
lea rcx, [rsi + 0x70]
call fcn.1401332f0
nop
lea rcx, [rsp + 0x28]
call fcn.140103970
sub rdi, 1
jne 0x14012fcb0
lea rdx, [rsi + 0xc0]
mov r8d, 3
mov rcx, rbx
call fcn.140133ce0
lea rdx, [rsi + 0xd8]
mov r8d, 4
mov rcx, rbx
call fcn.140133ce0
lea rdx, [rsi + 0xf0]
mov r8d, 5
mov rcx, rbx
call fcn.140133ce0
lea rdx, [rsi + 0x108]
mov r8d, 6
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp fcn.140133ce0
Function at 0x140133ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
push rsi
push r14
sub rsp, 0x68
cmp byte [rcx + 0x18], 0
mov eax, r8d
mov r14, rdx
mov rsi, rcx
jne 0x140133d0d
xor r8d, r8d
mov edx, eax
call fcn.1401a01e0
test al, al
jne 0x140133eb9
mov rax, qword [r14]
mov qword [r14 + 8], rax
mov r8, qword [rsi + 8]
mov rax, qword [r8 + 0x18]
test rax, rax
je 0x140133eb9
mov edx, dword [r8 + 0x2c]
lea r9d, [rdx + 4]
cmp dword [rax + 0x1c], r9d
jb 0x140133eb9
mov rcx, qword [rax + 8]
movsxd rax, dword [rax + 0x18]
add rax, rcx
mov eax, dword [rdx + rax]
mov dword [r8 + 0x2c], r9d
test eax, eax
je 0x140133eb9
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rbp
mov ebp, eax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r12
lea r12, vtable.boost::any::holder_class_artemis::CTextLayer::CTweenInfo____ptr64_.0
mov qword [rsp + 0x50], r15
xor r15d, r15d
nop dword [rax]
mov dword [rsp + 0x20], 6
mov byte [rsp + 0x24], r15b
mov qword [rsp + 0x28], 0x1f
mov qword [rsp + 0x30], r15
mov byte [rsp + 0x38], r15b
mov dword [rsp + 0x3c], r15d
mov byte [rsp + 0x40], r15b
cmp byte [rsi + 0x18], r15b
jne 0x140133dc5
mov r8b, 1
xor edx, edx
mov rcx, rsi
call fcn.1401a01e0
test al, al
jne 0x140133e5a
mov rbx, qword [0x1404a33a8]
cmp rbx, qword [0x1404a33b0]
je 0x140133e2e
nop word [rax + rax]
mov rdi, qword [rbx]
mov ecx, reloc.WS2_32.dll_recv
call fcn.14023ed4c
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x80], rax
lea r8, [rsp + 0x98]
mov rdx, rsi
mov qword [rax + 8], rcx
mov rcx, rdi
mov qword [rax], r12
mov qword [rsp + 0x98], rax
mov rax, qword [rdi]
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x140133e2e
add rbx, 0x10
cmp rbx, qword [0x1404a33b0]
jne 0x140133de0
cmp byte [rsi + 0x18], r15b
jne 0x140133e5a
mov eax, dword [rsi]
test eax, eax
je 0x140133e51
cmp eax, 1
jne 0x140133e5a
lea rcx, [rsi + 0x20]
call fcn.14000a9b0
mov rdx, qword [rsi + 8]
mov eax, dword [rax]
mov dword [rdx + 0x2c], eax
lea rcx, [rsi + 0x20]
call fcn.14000a8a0
mov rdx, qword [r14 + 8]
cmp qword [r14 + 0x10], rdx
je 0x140133e83
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov eax, dword [rsp + 0x40]
mov dword [rdx + 0x20], eax
add qword [r14 + 8], 0x24
jmp 0x140133e90
lea r8, [rsp + 0x20]
mov rcx, r14
call fcn.14010b960
sub rbp, 1
jne 0x140133d80
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
add rsp, 0x68
pop r14
pop rsi
ret