joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44e738
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44e5fc
test r8b, r8b
jne 0x44e5fc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44e60f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44e6f8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44e6e6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44e6dc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44e663
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44e6a6
mov eax, 1
cmp rax, rbx
ja 0x44e695
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00460500
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44e6d4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44e69d
mov r8d, eax
mov eax, r10d
jmp 0x44e668
mov rcx, rbx
call fcn.00460440
xor eax, eax
mov rcx, rax
call fcn.00460440
mov eax, r8d
mov rcx, rbx
call fcn.00460500
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44e72e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44e6f1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44e615
mov eax, edx
mov rcx, rbx
call fcn.00460440
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00460440
nop
int3
Function at 0x455f20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455fd9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00456020]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045dca0
xorps xmm15, xmm15
mov r14, qword [0x00611008]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045dde0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455f20
Function at 0x45fe80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402eef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409780
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045dde0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402ec0
cmp byte [0x00610e11], 0
je 0x45fe95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45cee0
jmp 0x402ec0

Function at 0x45fea0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00611100]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00610e11], 0
je 0x45fed5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00611440]
aesenc xmm0, xmmword [0x00611450]
aesenc xmm0, xmmword [0x00611460]
movq rax, xmm0
ret
jmp 0x409980

Function at 0x45fee0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00611100]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00610e11], 0
je 0x45ff16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00611440]
aesenc xmm0, xmmword [0x00611450]
aesenc xmm0, xmmword [0x00611460]
movq rax, xmm0
ret
jmp 0x4099e0

Function at 0x461900
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x006113c0]
mov qword [rsp + 8], rdx
lea r8d, [0x00610e2c]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045fdc0
add rsp, 0x30
ret

Function at 0x461e40
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x461e6c
call fcn.0045fdc0
shl rcx, 3
add rcx, 0x1480
mov qword [0x00611008], rcx
ret
Function at 0x486b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486dbc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.00483040
xorps xmm15, xmm15
mov r14, qword [0x00611008]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x486cca
nop
cmp rdx, 0x40
ja 0x486dae
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x486c39
mov rax, rdx
mov rcx, rsi
nop
call fcn.00460dc0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x486ca1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004871e0
xorps xmm15, xmm15
mov r14, qword [0x00611008]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x486da3
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x486cd7
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x486d57
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.004871e0
xorps xmm15, xmm15
mov r14, qword [0x00611008]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x486d92
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x486d8e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00460dc0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00460500
mov rax, rdx
mov ecx, 0x40
call fcn.00460500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045dde0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00486b80
Function at 0x4cab60
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
nop
mov rax, qword [rax + 0x18]
nop
mov rax, qword [rax + 0x20]
nop
xor r10, r10
cmp r10, qword [rsp + 8]
nop
je 0x4cab89
nop
mov rax, qword [rax]
nop
inc r10
jmp 0x4cab77
mov rcx, qword [rax + 0x30]
nop
mov qword [rsp + 0x18], rcx
nop
mov rcx, qword [rax + 0x20]
nop
mov qword [rsp + 0x10], rcx
nop
mov rcx, rax
nop
add rcx, 0x38
nop
mov qword [rsp + 0x20], rcx
ret
Function at 0x140001af0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x1400ce198]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x1400ce19c]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x1400ce180]
mov word [rsp + 0x6c], ax
mov eax, Ordinal_50
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x1400ce190]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x140001bf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140001ba8
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x140001c17
inc ax
mov word [rsp + 0x6a], ax
jmp 0x140001bc3
cmp eax, 0xe7
jne 0x140001c17
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x140001c17
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x140001b88
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400c90c0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x140001bf9

Function at 0x140001c20
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140001cd0
test rcx, rcx
je 0x140001cd0
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140001cd0
xor ebp, ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x30], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140001cbb
mov eax, dword [rsp + 0x30]
cmp rax, rdi
jb 0x140001cd0
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x34]
mov r8d, edi
mov dword [rsp + 0x34], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140001cb1
jmp 0x140001cd2
mov rcx, rbx
call fcn.140001aa0
jmp 0x140001cd0
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c90c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001cf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
test r8, r8
jne 0x140001d22
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0x40
pop rbx
ret
test rcx, rcx
je 0x140001d57
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x140001d57
test rdx, rdx
je 0x140001d57
xor eax, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140001d57
cmp dword [rsp + 0x30], ebx
je 0x140001d0d
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0x40
pop rbx
ret
Function at 0x140002240
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400022f3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x1400023b9
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x38], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400023a7
mov ecx, dword [rsp + 0x38]
cmp ecx, 1
jb 0x1400023a7
shr ecx, 1
je 0x140002365
lea rax, [rsp + 0xc0]
cmp word [rax], 0x2f
jne 0x14000235b
mov word [rax], 0x5c
add rax, 2
sub rcx, 1
jne 0x140002350
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.1400020d0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.140001d70
jmp 0x1400023c1
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.1400023f0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.1400c90c0
add rsp, 0xae0
pop rbx
ret
Function at 0x1400025f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov edx, dword [rcx]
mov r9d, pe_nt_image_headers64
mov r10, rcx
xorps xmm1, xmm1
cmp edx, r9d
jne 0x14000265a
lea r8, [rcx + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x140002615
mov edx, dword [r10]
jmp 0x140002765
cmp edx, 0x270
jb 0x140002765
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [rcx + 0x9c8]
mov qword [rsp], rdi
mov r9, qword [rbx]
mov edi, 0x9c
nop dword [rax + rax]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x140002690
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
nop
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x1400026e0
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
xor edx, edx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], edx
mov eax, edx
xorps xmm0, xmm0
mov rcx, qword [r10 + rax*8 + 8]
lea eax, [rdx + 1]
mov dword [r10], eax
movabs rdx, 0x38eb3ffff6d3
mov rax, rcx
shr rax, 0x1d
and rax, qword [r10 + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x1400027c0
cvtsi2sd xmm0, rdx
jmp 0x1400027d5
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
subsd xmm0, xmm1
addsd xmm0, xmm1
mulsd xmm0, qword [0x1400ce458]
add rsp, 8
ret
Function at 0x140003d90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rbx, rdx
mov rbp, rcx
lea rdx, [0x14010afe4]
mov ecx, 0xb0
mov rdi, r9
mov r14d, r8d
call fcn.1400c9374
mov rsi, rax
test rax, rax
je 0x140003f89
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0xaf
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsi + 8]
mov byte [rsi], 1
mov edx, 2
call sub.MSVCP140.dll__Mtx_init_in_situ
lea rcx, [rsi + 0x58]
call sub.MSVCP140.dll__Cnd_init_in_situ
mov qword [0x14014b6a8], rsi
xorps xmm0, xmm0
movups xmmword [rsi + 0xa0], xmm0
test r14d, r14d
je 0x140003e30
test rdi, rdi
je 0x140003e26
cmp byte [rdi], 0
je 0x140003e26
mov rdx, rdi
mov rcx, rbp
call fcn.140002240
jmp 0x140003e30
xor edx, edx
mov rcx, rbp
call fcn.1400021a0
call sub.KERNEL32.dll_GetCurrentProcessId
lea rcx, [0x14012a220]
mov dword [0x14014b6a4], eax
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x140003fb9
cmp dword [0x14012a26c], 0x7fffffff
je 0x140003fc4
test rbx, rbx
je 0x140003e7f
movups xmm0, xmmword [rbx]
movups xmmword [0x14014b338], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14014b348], xmm1
movups xmm0, xmmword [rbx + 0x20]
jmp 0x140003e9f
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [0x14014b338], xmm0
movups xmmword [0x14014b348], xmm0
movups xmmword [0x14014b358], xmm0
lea rcx, [0x14012a220]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [0x14014b368], xmm0
movups xmmword [0x14014b378], xmm0
movups xmmword [0x14014b388], xmm0
call sub.MSVCP140.dll__Mtx_unlock
cmp qword [0x14014b330], 0
jne 0x140003f92
mov rcx, rbp
call fcn.140005560
mov qword [0x14014b330], rax
lea rcx, [0x140002440]
mov qword [rax + 0x10], rcx
lea rcx, [0x140002450]
mov rax, qword [0x14014b330]
mov qword [rax + 0x18], rcx
mov eax, 1
mov rdi, qword [0x14014b6a8]
mov ecx, 8
xchg byte [rdi], al
call fcn.1400c90e0
xor ebx, ebx
test rax, rax
je 0x140003f3d
mov qword [rax], rdi
jmp 0x140003f40
mov rax, rbx
lea rcx, [rsp + 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1400024a0]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140003faa
cmp dword [rdi + 0xa8], ebx
jne 0x140003f82
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + 0xa0], xmm1
jmp 0x140003f92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor ebx, ebx
mov qword [0x14014b6a8], rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, 6
mov dword [rsp + 0x38], ebx
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [0x14012a26c], 0x7ffffffe
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14000fc80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140129b78]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14015fb28]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x20d5], 0
jne 0x14000fce7
cmp byte [rbx + 0x20d6], 0
jne 0x14000fce7
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14001cd80
test sil, 1
je 0x14000fe1c
jmp 0x14000fd86
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400cff60]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400cff58]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
or dword [rbx + 0x1dc0], 1
mov qword [rbx + 0x1ddc], rax
movss dword [rbx + 0x1dd4], xmm0
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd8], xmm1
mov byte [rbx + 0x1dfc], 1
movss xmm0, dword [rbx + 0x1748]
mov rax, qword [0x14015fb28]
mulss xmm0, dword [0x1400cfeec]
or dword [rax + 0x1dc0], 0x40
movss dword [rax + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.14001cd80
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14000fdd6
lea r11, [0x1400cf2e0]
cmp r9b, 0x23
jne 0x14000fdb9
cmp byte [r8], r9b
jne 0x14000fdb9
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14000fda6
not ecx
call fcn.14001b630
test rax, rax
je 0x14000fe1c
cmp byte [rax + 0xdf], 0
je 0x14000fe1c
mov byte [rax + 0xe6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0x100], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.14001cd80
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.14000bf10
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c90c0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret