joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d830
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
xor edx, edx
mov dword [rsp + 0x20], pe_nt_image_headers64
mov rdi, rcx
xor sil, sil
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14006d88e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_take_process_snapshot.
call fcn.140067700
mov rcx, rax
lea rdx, [0x1400a0b90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14006d910
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14006d8e0
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14006d8c3
inc rax
test ecx, ecx
jne 0x14006d8b0
test edx, edx
je 0x14006d8db
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14006d8a0
jmp 0x14006d903
mov sil, 1
jmp 0x14006d903
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_retrieve_information_about_the_first_process.
call fcn.140067700
mov rcx, rax
lea rdx, [0x1400a0b90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400701b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rbx, rdx
jbe 0x1400701c3
mov rdx, qword [rdx]
mov r8, qword [rbx + 0x10]
xor eax, eax
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1400701f5
movabs r10, 0x100000001b3
movzx ecx, byte [rax + rdx]
inc rax
xor r9, rcx
imul r9, r10
cmp rax, r8
jb 0x1400701e2
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e40]
call fcn.1400a9050
mov rdx, qword [rax + 8]
mov rax, qword [0x140156e48]
test rdx, rdx
cmovne rax, rdx
cmp rax, qword [0x140156e48]
je 0x140070245
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e40]
call fcn.1400a2aa0
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140070b00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, r8
mov rbp, rdx
mov rbx, qword [r8]
mov rdi, qword [r8 + 8]
cmp rbx, rdi
je 0x140070c08
movabs r12, 0xcbf29ce484222325
xor r15d, r15d
movabs r14, 0x100000001b3
nop dword [rax + rax]
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x40]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
mov r9, r12
mov rax, r15
mov r8, qword [rsp + 0x50]
test r8, r8
je 0x140070b95
movzx ecx, byte [rax + rdx]
xor r9, rcx
imul r9, r14
inc rax
cmp rax, r8
jb 0x140070b82
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e00]
call fcn.1400a9050
mov rax, qword [rax + 8]
test rax, rax
je 0x140070bf1
cmp rax, qword [0x140156e08]
je 0x140070bf1
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140070bf1
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::ChannelControl::stop_void____ptr64]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [0x140156e00]
call fcn.1400a3040
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rax + 8], r15
lea rcx, [rsp + 0x40]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rdi
jne 0x140070b50
mov rcx, rsi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
jmp fcn.14009f3f0
Function at 0x140070c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
movzx r13d, r9b
mov r12, rdx
mov r15, qword [rbp + 0x7f]
mov r14, qword [r15]
mov rbx, qword [r15 + 8]
mov qword [rbp + 0x5f], rbx
movabs rsi, 0x7ffffffffffffff
cmp r14, rbx
je 0x140070ded
movabs rdi, 0x100000001b3
movabs r13, 0xcbf29ce484222325
mov r9, r14
mov r8, r12
lea rdx, [rbp - 9]
call fcn.1400700e0
nop
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rdx, qword [rbp - 9]
mov r9, r13
xor ecx, ecx
mov r8, qword [rbp + 7]
test r8, r8
je 0x140070ce3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rdi
inc rcx
cmp rcx, r8
jb 0x140070cd0
lea r8, [rbp - 9]
lea rdx, [rbp - 0x49]
lea rcx, [0x140156e00]
call fcn.1400a9050
mov rcx, qword [rax + 8]
mov r13, qword [0x140156e08]
test rcx, rcx
cmovne r13, rcx
cmp r13, qword [0x140156e08]
je 0x140070dd2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], 0
mov rdx, qword [r15 + 8]
sub rdx, qword [r15]
sar rdx, 5
test rdx, rdx
je 0x140070da8
cmp rdx, rsi
ja 0x140070eac
lea rcx, [rbp - 0x39]
call fcn.1400a67d0
lea rax, [rbp - 0x39]
mov qword [rbp - 0x51], rax
mov rsi, qword [r15 + 8]
mov rbx, qword [r15]
mov rdi, qword [rbp - 0x39]
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], rdi
lea rax, [rbp - 0x39]
mov qword [rbp - 0x11], rax
cmp rbx, rsi
je 0x140070d8c
mov rdx, rbx
mov rcx, rdi
call fcn.14009ec80
add rdi, 0x20
mov qword [rbp - 0x19], rdi
add rbx, 0x20
cmp rbx, rsi
jne 0x140070d70
mov qword [rbp - 0x31], rdi
mov rbx, qword [rbp + 0x5f]
movabs rdi, 0x100000001b3
movabs rsi, 0x7ffffffffffffff
lea r8, [rbp - 0x39]
mov rdx, r12
call fcn.140070b00
mov rcx, qword [r13 + 0x30]
mov rcx, qword [rcx]
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::Sound::release_void____ptr64]
lea rdx, [rbp - 9]
lea rcx, [0x140156e00]
call fcn.14009d5d0
nop
lea rcx, [rbp - 9]
call fcn.1400672b0
add r14, 0x20
cmp r14, rbx
jne 0x140070c8e
movzx r13d, byte [rbp + 0x77]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], 0
mov rdx, qword [r15 + 8]
sub rdx, qword [r15]
sar rdx, 5
test rdx, rdx
je 0x140070e70
cmp rdx, rsi
ja 0x140070eb2
lea rcx, [rbp - 0x39]
call fcn.1400a67d0
lea rax, [rbp - 0x39]
mov qword [rbp + 0x5f], rax
mov rsi, qword [r15 + 8]
mov rdi, qword [r15]
mov rbx, qword [rbp - 0x39]
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], rbx
lea rax, [rbp - 0x39]
mov qword [rbp - 0x11], rax
cmp rdi, rsi
je 0x140070e6c
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14009ec80
add rbx, 0x20
mov qword [rbp - 0x19], rbx
add rdi, 0x20
cmp rdi, rsi
jne 0x140070e50
mov qword [rbp - 0x31], rbx
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
movzx r9d, r13b
mov r8, qword [rbp + 0x6f]
mov rdx, r12
call fcn.140070250
nop
mov rcx, r15
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14009f3f0
call fcn.1400a05c0
nop
call fcn.1400a05c0
int3
Function at 0x140070ec0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x80
mov rdi, r9
mov r14, r8
mov rbp, rdx
mov rbx, qword [r8]
mov rsi, qword [r8 + 8]
cmp rbx, rsi
je 0x140071000
movabs r13, 0xcbf29ce484222325
movabs r15, 0x100000001b3
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x60]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
mov r9, r13
xor ecx, ecx
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x140070f54
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r15
inc rcx
cmp rcx, r8
jb 0x140070f41
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [0x140156e00]
call fcn.1400a9050
mov rax, qword [rax + 8]
test rax, rax
je 0x140070fe9
cmp rax, qword [0x140156e08]
je 0x140070fe9
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140070fe9
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, rdx
sar rax, 2
cmp rax, 8
jne 0x140070fe9
movss xmm0, dword [rdx + 0x1c]
movss dword [rsp + 0x40], xmm0
movss xmm2, dword [rdx + 0x18]
movss dword [rsp + 0x38], xmm2
movss xmm0, dword [rdx + 0x14]
movss dword [rsp + 0x30], xmm0
movss xmm2, dword [rdx + 0x10]
movss dword [rsp + 0x28], xmm2
movss xmm0, dword [rdx + 0xc]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [rdx + 8]
movss xmm2, dword [rdx + 4]
movss xmm1, dword [rdx]
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::ChannelControl::setMixLevelsOutput_float__float__float__float__float__float__float__float____ptr64]
nop
lea rcx, [rsp + 0x60]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rsi
jne 0x140070f10
mov rcx, r14
call fcn.14009f3f0
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x140071059
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x14007103d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140071075
mov rcx, r8
call fcn.14010a808
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov qword [rdi + 0x10], 0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140071080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rsi, r8
mov r14, rdx
mov rbx, qword [r8]
mov rbp, qword [r8 + 8]
cmp rbx, rbp
je 0x1400711a5
movabs r12, 0xcbf29ce484222325
movabs r15, 0x100000001b3
nop word [rax + rax]
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x30]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
mov r9, r12
xor ecx, ecx
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x140071114
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r15
inc rcx
cmp rcx, r8
jb 0x140071101
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e00]
call fcn.1400a9050
mov rcx, qword [rax + 8]
mov rdi, qword [0x140156e08]
test rcx, rcx
cmovne rdi, rcx
cmp rdi, qword [0x140156e08]
je 0x14007118e
mov rcx, qword [rdi + 0x30]
cmp qword [rcx + 8], 0
je 0x14007118e
mov r8d, 1
lea rdx, [rsp + 0xa0]
mov rcx, qword [rcx]
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::Sound::getLength_unsigned_int____ptr64__unsigned_int____ptr64]
mov rcx, qword [rdi + 0x30]
mov r8d, 1
lea rdx, [rsp + 0xb8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::Channel::getPosition_unsigned_int____ptr64__unsigned_int____ptr64]
mov ecx, dword [rsp + 0xa0]
test ecx, ecx
jne 0x1400711c4
lea rcx, [rsp + 0x30]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rbp
jne 0x1400710d0
mov rcx, rsi
call fcn.14009f3f0
xorps xmm0, xmm0
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, dword [rsp + 0xb8]
xorps xmm6, xmm6
cvtsi2ss xmm6, rax
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
divss xmm6, xmm1
lea rcx, [rsp + 0x30]
call fcn.1400672b0
nop
mov rcx, rsi
call fcn.14009f3f0
movaps xmm0, xmm6
jmp 0x1400711b0
Function at 0x140071200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, r8
mov rbp, rdx
xor dil, dil
mov byte [rax + 8], dil
mov rbx, qword [r8]
mov rsi, qword [r8 + 8]
cmp rbx, rsi
je 0x1400712f7
movabs rdi, 0x100000001b3
movabs r15, 0xcbf29ce484222325
nop dword [rax + rax]
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x30]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
mov r9, r15
xor eax, eax
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x140071294
movzx ecx, byte [rax + rdx]
xor r9, rcx
imul r9, rdi
inc rax
cmp rax, r8
jb 0x140071281
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e00]
call fcn.1400a9050
mov rax, qword [rax + 8]
test rax, rax
je 0x1400712d8
cmp rax, qword [0x140156e08]
je 0x1400712d8
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400712d8
lea rdx, [rsp + 0x80]
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::ChannelControl::isPlaying_bool____ptr64____ptr64]
nop
lea rcx, [rsp + 0x30]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rsi
jne 0x140071250
movzx edi, byte [rsp + 0x80]
mov rcx, r14
call fcn.14009f3f0
movzx eax, dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140075850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rdi, rcx
lea rdx, [rcx + 0x1a8]
lea rcx, [rsp + 0x30]
call fcn.14009dc00
mov r14, rax
mov qword [rsp + 0xa0], rax
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
cmp rbx, rsi
je 0x14007595b
movabs rbp, 0x100000001b3
movabs r15, 0xcbf29ce484222325
nop word [rax + rax]
mov r9, rbx
lea r8, [rdi + 0x28]
lea rdx, [rsp + 0x48]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rdx, qword [rsp + 0x48]
mov r9, r15
xor ecx, ecx
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x140075905
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rbp
inc rcx
cmp rcx, r8
jb 0x1400758f2
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e00]
call fcn.1400a9050
mov rax, qword [rax + 8]
test rax, rax
je 0x140075944
cmp rax, qword [0x140156e08]
je 0x140075944
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140075944
movaps xmm1, xmm6
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::ChannelControl::setPitch_float____ptr64]
nop
lea rcx, [rsp + 0x48]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rsi
jne 0x1400758c0
mov rcx, r14
call fcn.14009f3f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140077770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmm6, xmm1
mov rdi, rcx
lea rdx, [rcx + 0x1a8]
lea rcx, [rsp + 0x30]
call fcn.14009dc00
mov r14, rax
mov qword [rsp + 0xa0], rax
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
cmp rbx, rsi
je 0x140077889
movabs rbp, 0x100000001b3
movabs r15, 0xcbf29ce484222325
nop word [rax + rax]
mov r9, rbx
lea r8, [rdi + 0x28]
lea rdx, [rsp + 0x48]
call fcn.1400700e0
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rdx, qword [rsp + 0x48]
mov r9, r15
xor ecx, ecx
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x140077825
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rbp
inc rcx
cmp rcx, r8
jb 0x140077812
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
lea rcx, [0x140156e00]
call fcn.1400a9050
mov rax, qword [rax + 8]
test rax, rax
je 0x140077872
cmp rax, qword [0x140156e08]
je 0x140077872
mov rax, qword [rax + 0x30]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140077872
cvttss2si rax, xmm6
imul edx, eax, 0x3e8
mov r8d, 1
call qword [sym.imp.fmod.dll_public:_enum_FMOD_RESULT___cdecl_FMOD::Channel::setPosition_unsigned_int__unsigned_int____ptr64]
nop
lea rcx, [rsp + 0x48]
call fcn.1400672b0
add rbx, 0x20
cmp rbx, rsi
jne 0x1400777e0
mov rcx, r14
call fcn.14009f3f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14007f600
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13d0
call fcn.14010b010
sub rsp, rax
movaps xmmword [rsp + 0x13c0], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x13b0], xmm7
movaps xmm7, xmm0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, 0x270
jb 0x14007f640
movsd xmm3, qword [0x140133b10]
xorps xmm1, xmm1
mov edx, 0x270
xorps xmm4, xmm4
cvtss2sd xmm1, xmm6
mov dword [rsp + 0x20], edx
mov r10d, 2
movsd xmm6, qword [0x140133c70]
xorps xmm5, xmm5
cvtss2sd xmm4, xmm7
xorps xmm2, xmm2
cmp edx, 0x270
jne 0x14007f6f2
lea r8, [rsp + 0x28]
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14007f6b0
mov edx, dword [rsp + 0x20]
jmp 0x14007f7eb
cmp edx, 0x4e0
jb 0x14007f7eb
xor r8d, r8d
lea r9, [rsp + 0x9e4]
lea r11, [rsp + 0x1018]
lea rbx, [rsp + 0x24]
nop word [rax + rax]
mov edx, dword [r9 + r8*4]
xor edx, dword [rsp + r8*4 + 0x9e8]
btr edx, 0x1f
xor edx, dword [r9 + r8*4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + r8*4]
xor ecx, edx
mov dword [rbx + r8*4], ecx
inc r8
cmp r8, 0xe3
jb 0x14007f720
mov r8d, 0xe3
lea r9, [rsp + 0x9e8]
lea r11, [rsp + 0x24]
nop dword [rax]
mov eax, dword [rsp + r8*4 + 0x9e4]
mov edx, eax
xor edx, dword [r9 + r8*4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rsp + r8*4 - 0x368]
xor ecx, edx
mov dword [r11 + r8*4], ecx
inc r8
cmp r8, 0x26f
jb 0x14007f770
mov edx, dword [rsp + 0x13a0]
mov eax, dword [rsp + 0x24]
and edx, 0x80000000
btr eax, 0x1f
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [rsp + 0x654]
xor edx, edx
mov dword [rsp + 0x9e0], ecx
mov dword [rsp + 0x20], edx
mov eax, edx
xorps xmm0, xmm0
inc edx
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rsp + 0x13a4]
xor ecx, eax
mov dword [rsp + 0x20], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
subsd xmm0, xmm5
mulsd xmm0, xmm3
mulsd xmm3, xmm6
addsd xmm2, xmm0
sub r10, 1
jne 0x14007f692
movaps xmm6, xmmword [rsp + 0x13c0]
subsd xmm1, xmm4
movaps xmm7, xmmword [rsp + 0x13b0]
xorps xmm0, xmm0
divsd xmm2, xmm3
mulsd xmm1, xmm2
addsd xmm1, xmm4
cvtsd2ss xmm0, xmm1
add rsp, 0x13d0
pop rbx
ret
Function at 0x14008c890
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub rsp, 0x28
cmp dword [0x1401562e0], 0
jne 0x1400017f0
xor edx, edx
mov ecx, 0x10001
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x140003b90
sub rsp, 0x28
mov rcx, qword [0x1401578c8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140003bbd
lea rdx, str.Win32:_Failed_to_open_clipboard
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
add rsp, 0x28
ret
mov ecx, recv
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
jne 0x140003bf8
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, str.Win32:_Failed_to_convert_clipboard_to_string
mov ecx, 0x10009
call fcn.140004d20
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
ret
mov rcx, qword [0x1401578d8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rax
call fcn.140009c70
mov rcx, rbx
mov qword [0x1401578d8], rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, qword [0x1401578d8]
test rax, rax
jne 0x140003c4b
lea rdx, str.Win32:_Failed_to_convert_wide_string_to_UTF_8
mov ecx, 0x10008
call fcn.140004d20
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rcx, qword [0x140156be0]
jmp 0x1400017d0
Function at 0x14009d5d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rsi, rcx
mov r9, rdx
jbe 0x14009d5ef
mov r9, qword [rdx]
mov r10, qword [rdx + 0x10]
xor r8d, r8d
movabs rdi, 0xcbf29ce484222325
test r10, r10
je 0x14009d624
movabs rcx, 0x100000001b3
nop
movzx eax, byte [r8 + r9]
inc r8
xor rdi, rax
imul rdi, rcx
cmp r8, r10
jb 0x14009d610
mov r8, rdx
mov r9, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400a9050
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x14009d6c4
mov rdx, qword [rsi + 0x30]
and rdx, rdi
shl rdx, 4
add rdx, qword [rsi + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x14009d678
cmp rax, rbx
jne 0x14009d66e
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14009d683
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14009d683
cmp rax, rbx
jne 0x14009d683
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rsi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call fcn.1400672b0
mov edx, 0x38
mov rcx, rbx
call fcn.14010a808
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret