joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024d70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c58], 0
lea rbx, [rcx + 0x5c60]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140024e17
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140024dca
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140034280
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140033c00
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c58]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c68]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140284e00]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140024e1f
mov rcx, rbx
call fcn.140033c00
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14002db80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140284df8]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5bbc], ecx
test rbx, rbx
je 0x14002dbef
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.14002dc00
lea rdx, [0x1400ecfdc]
mov rcx, rbx
mov rdi, rax
call fcn.140022a50
mov rbx, rax
test rax, rax
je 0x14002dbea
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x140032450
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x140284df8]
cmp byte [rbx + 0x5bb9], 0
jne 0x1400325ca
cmp dword [rbx + 0x5be0], 0
je 0x14003248d
mov r8d, 0x30bf
lea rdx, str.C:UsersUnknownDesktopDreamdependenciesguiimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1400325c3
lea rdx, [0x1400ecfd8]
mov qword [rsp + 0x40], rdi
call fcn.140022a50
mov rdi, rax
test rax, rax
je 0x1400325be
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400325ab
xor edx, edx
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400325ab
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400325ab
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400325ab
cmp rsi, 0xffffffffffffffff
je 0x1400325ab
mov rax, qword [0x140284df8]
test rax, rax
je 0x140032535
inc dword [rax + 0x11c]
mov rdx, qword [0x140284e08]
mov rcx, rsi
call qword [0x140179020]
mov rbp, rax
test rax, rax
je 0x1400325ab
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x140032571
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140032587
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140032587
mov rdx, rsi
mov rcx, rbp
call fcn.140024780
mov rax, qword [0x140284df8]
test rax, rax
je 0x140032599
dec dword [rax + 0x11c]
mov rdx, qword [0x140284e08]
mov rcx, rbp
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400325b4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x5bb9], 1
movss xmm0, dword [rbx + 0x5bbc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14003261b
subss xmm0, dword [rbx + 0x40]
comiss xmm1, xmm0
movss dword [rbx + 0x5bbc], xmm0
jb 0x14003261b
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14003260a
call fcn.14002db80
mov dword [rbx + 0x5bbc], 0
add rsp, 0x20
pop rbx
ret
mov byte [rbx + 0x104], 1
mov dword [rbx + 0x5bbc], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140058ef0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140282300]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, 8
call fcn.1400da760
test rax, rax
je 0x140058f21
mov qword [rax], rdi
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14005bde0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140058f6e
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400dab60
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14007faf0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm6
mov rax, qword [0x140282300]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, r8
mov rsi, rdx
mov rdi, qword [rsp + 0x110]
xor ecx, ecx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
lea r15, [rsp + 0xe8]
movabs r12, 0xff00ff00ff00ff00
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r15
mov r14, qword [r15]
xor r14, r12
mov qword [rsp + 0x58], r14
mov qword [r15], rcx
xorps xmm6, xmm6
cvtss2sd xmm6, xmm3
movaps xmm1, xmm6
movq rdx, xmm6
lea rcx, [0x1400ed618]
call fcn.1400b98e0
movsxd rbx, eax
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140066200
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rcx, qword [rsp + 0x30]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
movq r9, xmm6
lea r8, [0x1400ed618]
call fcn.1400c02b0
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova r8, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x20
lea r9, [rsp + 0x70]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14007fc24
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007fc1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007fc1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400da79c
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
xor r14, r12
mov qword [r15], r14
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400dab60
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140081f20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
mov edx, 9
mov rcx, qword [0x140285690]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x14013dfa8]
movzx eax, word [0x14013dfd8]
xor r8d, r8d
cmp dword [0x1402822c8], 2
movups xmm1, xmmword [0x14013dfb8]
mov word [rsp + 0x60], ax
movzx eax, byte [0x14013dfda]
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x62], al
movups xmm0, xmmword [0x14013dfc8]
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
jl 0x1400820be
movdqa xmm0, xmmword [0x1400e6ff0]
lea rcx, [rsp + 0x34]
movdqa xmm4, xmmword [0x1400e6f80]
movdqa xmm3, xmmword [0x140140e70]
movdqa xmm5, xmmword [str.1111]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x1400e6fe0]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x30
jl 0x140081fd0
movaps xmm6, xmmword [rsp + 0x70]
cmp r8d, 0x33
jge 0x140082101
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x36
xor byte [r9 - 1], al
cmp r8d, 0x33
jl 0x1400820d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.140001f90
mov rcx, qword [0x140285690]
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
add rsp, 0x80
pop rbx
jmp fcn.140001f90
Function at 0x140082140
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
mov edx, 9
mov rcx, qword [0x140285690]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x14013df70]
mov eax, dword [0x14013dfa0]
xor r8d, r8d
cmp dword [0x1402822c8], 2
movups xmm1, xmmword [0x14013df80]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x14013dfa4]
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x64], al
movups xmm0, xmmword [0x14013df90]
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
jl 0x1400822de
movdqa xmm0, xmmword [0x1400e6ff0]
lea rcx, [rsp + 0x34]
movdqa xmm4, xmmword [0x1400e6f80]
movdqa xmm3, xmmword [0x140140e70]
movdqa xmm5, xmmword [str.1111]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x1400e6fe0]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x30
jl 0x1400821f0
movaps xmm6, xmmword [rsp + 0x70]
cmp r8d, 0x35
jge 0x140082321
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x36
xor byte [r9 - 1], al
cmp r8d, 0x35
jl 0x1400822f0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.140001f90
mov rcx, qword [0x140285690]
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
add rsp, 0x80
pop rbx
jmp fcn.140001f90
Function at 0x140082360
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
mov edx, 9
mov rcx, qword [0x140285690]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x14013dfe0]
mov eax, dword [0x14013e018]
xor r8d, r8d
cmp dword [0x1402822c8], 2
movups xmm1, xmmword [0x14013dff0]
mov dword [rsp + 0x68], eax
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x14013e000]
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x14013e010]
movsd qword [rsp + 0x60], xmm0
jl 0x1400824fe
movdqa xmm0, xmmword [0x1400e6ff0]
lea rcx, [rsp + 0x34]
movdqa xmm4, xmmword [0x1400e6f80]
movdqa xmm3, xmmword [0x140140e70]
movdqa xmm5, xmmword [str.1111]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x1400e6fe0]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x38
jl 0x140082410
movaps xmm6, xmmword [rsp + 0x70]
cmp r8d, 0x3c
jge 0x140082541
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x36
xor byte [r9 - 1], al
cmp r8d, 0x3c
jl 0x140082510
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.140001f90
mov rcx, qword [0x140285690]
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
add rsp, 0x80
pop rbx
jmp fcn.140001f90
Function at 0x140082580
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
mov rbx, rcx
mov edx, 3
mov rcx, qword [0x140285690]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x14013df38]
movzx eax, word [0x14013df68]
xor r8d, r8d
cmp dword [0x1402822c8], 2
movups xmm1, xmmword [0x14013df48]
mov word [rsp + 0x60], ax
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [0x14013df58]
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
jl 0x14008270e
movdqa xmm0, xmmword [0x1400e6ff0]
lea rcx, [rsp + 0x34]
movdqa xmm4, xmmword [0x1400e6f80]
movdqa xmm3, xmmword [0x140140e70]
movdqa xmm5, xmmword [str.1111]
movdqa xmmword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x20]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x1400e6fe0]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x30
jl 0x140082620
movaps xmm6, xmmword [rsp + 0x70]
cmp r8d, 0x32
jge 0x140082751
movsxd rax, r8d
lea r9, [rsp + 0x30]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x36
xor byte [r9 - 1], al
cmp r8d, 0x32
jl 0x140082720
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.140001f90
mov rcx, qword [0x140285690]
mov edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
add rsp, 0x80
pop rbx
jmp fcn.140001f90
Function at 0x140098e40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140282300]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rsi, [rsp + 0x88]
movabs rbp, 0xff00ff00ff00ff00
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsi]
xor rbx, rbp
mov qword [rsp + 0x40], rbx
mov qword [rsi], rdi
mov ecx, 8
call fcn.1400da760
test rax, rax
je 0x140098eb5
lea rcx, [0x14007c4a0]
mov qword [rax], rcx
jmp 0x140098eb8
mov rax, rdi
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14005bde0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140098fb5
cmp dword [rsp + 0x38], 0
je 0x140098faa
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140098faa
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov ecx, 1
call fcn.1400da760
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14005be10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140098fcf
cmp dword [rsp + 0x38], 0
je 0x140098fc4
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140098fc4
xor rbx, rbp
mov qword [rsi], rbx
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400dab60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14009b190
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x140285840]
mov eax, dword [0x14028579c]
mov dword [0x140285798], eax
test rcx, rcx
jne 0x14009b339
mov rax, qword gs:[0x60]
mov r11d, 0xf4d8b55
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
xor ebp, ebp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r14
mov r15, qword [rcx + 0x10]
mov rdi, r15
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x14009b23c
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x14009b234
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x14009b220
cmp edx, ebp
jne 0x14009b303
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r14, rcx
mov r10d, ecx
shr r14, 0x20
add r10, r9
cmp r10, r9
je 0x14009b303
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14009b303
mov esi, dword [r10 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rsi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14009b2b7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x14009b2a0
cmp edx, r11d
je 0x14009b2c3
test r8d, r8d
jne 0x14009b280
jmp 0x14009b303
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
cmp rcx, r10
jbe 0x14009b314
lea rax, [r14 + r10]
cmp rcx, rax
jae 0x14009b314
mov ebp, 0x811c9dc5
mov rdi, r15
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x44], ebp
mov r11, qword [rsp + 0x40]
shr r11, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r15
jne 0x14009b1f0
xor ecx, ecx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x140285840], rcx
call rcx
mov ecx, dword [0x140285798]
mov dword [0x14028579c], eax
test ecx, ecx
je 0x14009b39a
sub eax, ecx
cmp eax, 0x1770
jbe 0x14009b39a
mov eax, dword [str.bU:]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x14013b798]
xor byte [rsp + 0x41], 0x37
xor al, 0x3a
xor byte [rsp + 0x42], 0x38
xor byte [rsp + 0x43], 0x39
mov byte [rsp + 0x44], al
mov byte [rsp + 0x40], 0x54
call fcn.1400a1040
mov qword [0], 1
call fcn.14009b510
xor eax, eax
add rsp, 0x38
ret