joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ace0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x14000ad13
mov r8d, 0x712
lea rdx, str.D:hackbypassLucifer_ToolsLucifer_Toolsimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm2, dword [rbx + 0x110]
lea r9, [0x140143020]
movss xmm0, dword [rdi]
movsxd rcx, dword [rbx + 0xf0]
subss xmm0, xmm2
mov rax, qword [rbx + 0xf8]
movss xmm3, dword [rbx + 0x114]
movss xmm1, dword [rdi + 4]
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x20]
movss xmm0, dword [rdi + 8]
movzx ecx, r8b
subss xmm0, xmm2
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x14000f250
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x14017f690]
movzx esi, r9b
mov r12d, dword [rsp + 0x90]
mov r15d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x3ed0]
mov eax, dword [rbx + 0x14]
movss xmm3, dword [rbx + 0x250]
and eax, 4
movss xmm5, dword [rbx + 0x254]
or eax, 0x1000103
or r12d, eax
cmp qword [rbx + 0x1a8], 0
jne 0x14000f2ba
cmp qword [rdi + 0x4b30], 0
je 0x14000f2c2
movss xmm3, dword [rbx + 0x220]
cvttss2si eax, dword [r8]
subss xmm3, dword [rbx + 0x100]
subss xmm5, dword [rbx + 0x104]
xorps xmm4, xmm4
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm4
cvtdq2ps xmm0, xmm0
jp 0x14000f2fc
jne 0x14000f2fc
mov eax, 1
jmp 0x14000f2fe
xor eax, eax
ucomiss xmm0, xmm4
jp 0x14000f30d
jne 0x14000f30d
mov r14d, 2
jmp 0x14000f310
xor r14d, r14d
movss xmm2, dword [0x140161060]
or r14d, eax
comiss xmm4, xmm1
jb 0x14000f32c
addss xmm1, xmm3
comiss xmm1, xmm2
jae 0x14000f32c
movaps xmm1, xmm2
comiss xmm4, xmm0
jb 0x14000f33d
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x14000f33d
movaps xmm0, xmm2
or dword [rdi + 0x47a8], 2
xor edx, edx
movss dword [rdi + 0x47c8], xmm1
movss dword [rdi + 0x47cc], xmm0
mov dword [rdi + 0x47b0], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x14000f386
mov dword [rsp + 0x28], r15d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.140004090
jmp 0x14000f39c
lea r8, str._s__08X
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x70]
call fcn.140004090
movss xmm6, dword [rdi + 0x3800]
test sil, sil
jne 0x14000f3b3
mov dword [rdi + 0x3800], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.1400124b0
mov rsi, qword [rdi + 0x3ed0]
movzx ebp, al
movss dword [rdi + 0x3800], xmm6
cmp word [rsi + 0xc2], 1
mov dword [rsi + 0x80], r15d
mov byte [rsi + 0xd2], r14b
jne 0x14000f3f9
movsd xmm0, qword [rsi + 0x20]
movsd qword [rbx + 0x100], xmm0
mov r9d, r15d
lea rdx, [0x14013c509]
not r9d
lea r10, [0x140143020]
mov ebx, r9d
mov r8b, reloc.WLDAP32.dll_Ordinal_35
cmp r8b, 0x23
jne 0x14000f426
cmp byte [rdx], r8b
jne 0x14000f426
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14000f413
not ebx
cmp dword [rdi + 0x3f30], ebx
jne 0x14000f456
xor edx, edx
xor ecx, ecx
call fcn.14000afd0
cmp dword [rdi + 0x48c0], r15d
jne 0x14000f4a3
bt r12d, 0x17
jb 0x14000f4a3
cmp word [rsi + 0x15c], 0
jne 0x14000f479
cmp byte [rsi + 0x162], 0
je 0x14000f4a3
xor edx, edx
mov rcx, rsi
call fcn.140015480
xor edx, edx
mov rcx, rsi
call fcn.14001e8f0
mov rdx, rsi
mov ecx, ebx
call fcn.14000afd0
mov eax, dword [rdi + 0x48e4]
mov dword [rdi + 0x3f58], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001bd90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14017f690]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x14001bde2
cmp byte [rbx + 0x4a76], 0
jne 0x14001bde2
movsx r9d, word [rbx + 0x5b9a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140004010
test dil, 1
je 0x14001bf0f
jmp 0x14001be6b
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1401610b0]
xor eax, eax
mulss xmm1, dword [0x140161090]
addss xmm0, dword [rbx + 0xe08]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mulss xmm0, dword [0x140160f8c]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b9a]
call fcn.140004010
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001bec0
lea r11, [0x140143020]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x14001bea3
cmp byte [r8], r9b
jne 0x14001bea3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001be90
not ecx
call fcn.14000f970
test rax, rax
je 0x14001bf0f
cmp byte [rax + 0xb6], 0
je 0x14001bf0f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5b9a]
movsx r9d, word [rbx + 0x5b9a]
call fcn.140004010
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400124b0
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140023040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c80], 0
lea rbx, [rcx + 0x5c88]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400230e3
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x140023096
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140030db0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400053b0
mov eax, dword [rbx]
lea rcx, [0x14017f688]
mov r9, qword [rdi + 0x5c80]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x5c90]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400230eb
mov rcx, rbx
call fcn.1400053b0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400238c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x14017f690]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x140023924
lea r10, [0x140143020]
cmp r8b, 0x23
jne 0x140023907
cmp byte [rdx], r8b
jne 0x140023907
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x1400238f4
mov eax, dword [r14 + 0x5bf8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x140023985
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14002394a
cmp edi, eax
jl 0x140023964
mov r8d, 0x709
lea rdx, str.D:hackbypassLucifer_ToolsLucifer_Toolsimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5c00]
cmp dword [rax + rbp + 8], ebx
je 0x1400239a2
mov eax, dword [r14 + 0x5bf8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x140023941
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x1400239af
cmp edi, dword [r14 + 0x5bf8]
jl 0x1400239c9
mov r8d, 0x709
lea rdx, str.D:hackbypassLucifer_ToolsLucifer_Toolsimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5c00]
lea rax, [rax + rcx*8]
jmp 0x140023987
Function at 0x1400792c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, qword [0x14017f690]
mov rdi, rcx
movsxd rbp, edx
imul rbx, rbp, 0x70
add rbx, qword [rcx + 0x18]
cmp rbx, qword [rcx + 0x18]
jb 0x1400792f5
cmp rbx, qword [rcx + 0x20]
jb 0x14007930f
mov r8d, 0x261
lea rdx, str.D:hackbypassLucifer_ToolsLucifer_Toolsimgui_internal.h
lea rcx, str.p___Data__p___DataEnd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r9, qword [rdi + 0x180]
mov dword [rdi + 0x74], ebp
test dword [rbx], 0x10000
movss xmm1, dword [rbx + 0x34]
je 0x14007932e
addss xmm1, dword [rdi + 0x8c]
lea rbp, [r9 + 0x100]
movss dword [rbp], xmm1
movss xmm0, dword [rdi + 0xc0]
addss xmm0, dword [rdi + 0x7c]
movss dword [r9 + 0x118], xmm1
subss xmm1, dword [r9 + 0x20]
movss dword [r9 + 0x104], xmm0
subss xmm1, dword [r9 + 0x144]
movss dword [r9 + 0x148], xmm1
mov eax, dword [rdi + 0x88]
mov dword [r9 + 0x138], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x158], eax
movss dword [r9 + 0x21c], xmm0
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x218], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x220], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1bc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xbb], al
cmp byte [rbx + 0x68], 0
je 0x1400793cf
xor eax, eax
mov dword [rsi + 0x476c], eax
mov dword [rsi + 0x4774], eax
test dword [rdi + 4], 0x100000
je 0x1400793e3
mov r8d, 2
jmp 0x140079463
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x298]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x238], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x298]
mov rcx, qword [rdi + 0x198]
call fcn.14006c250
cmp byte [rsi + 0x5c78], 0
je 0x1400794a1
cmp byte [rbx + 0x68], 0
jne 0x1400794a1
xor r8d, r8d
lea rdx, [0x140158ed8]
mov rcx, rbp
call fcn.140023140
mov dword [rsi + 0x5ca8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14007c820
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14017f690]
mov ebx, ecx
mov rdi, qword [rax + 0x4b30]
cmp ecx, 0xffffffff
jne 0x14007c846
cmp dword [rdi + 0x74], ecx
cmovne ebx, dword [rdi + 0x74]
mov eax, dword [rdi + 0x6c]
cmp ebx, eax
jne 0x14007c854
mov ebx, 0xffffffff
jmp 0x14007c859
cmp ebx, 0xffffffff
jl 0x14007c85d
cmp ebx, eax
jl 0x14007c877
mov r8d, 0xbf7
lea rdx, str.D:hackbypassLucifer_ToolsLucifer_Toolsimgui_tables.cpp
lea rcx, str.column_n____1__column_n___table__ColumnsCount
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test byte [rdi + 4], 7
je 0x14007c8e9
mov r10d, dword [rdi]
lea r8, [0x140159989]
movzx eax, word [rdi + 0x78]
lea r11, [0x140143020]
not r10d
mov byte [rdi + 0x227], 1
mov ecx, r10d
mov word [rdi + 0x210], bx
mov word [rdi + 0x7a], ax
mov r9b, reloc.WLDAP32.dll_Ordinal_35
nop dword [rax]
cmp r9b, 0x23
jne 0x14007c8c3
cmp byte [r8], r9b
jne 0x14007c8c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14007c8b0
not ecx
xor edx, edx
call fcn.14001c1c0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14009c520
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov r10d, 0xffffffff
movaps xmmword [rsp + 0x30], xmm6
mov ecx, r10d
lea r8, [0x1401404f1]
movaps xmm6, xmm3
lea rbx, [0x140143020]
mov r11, rdx
mov r9b, reloc.WLDAP32.dll_Ordinal_35
nop
cmp r9b, 0x23
jne 0x14009c563
cmp byte [r8], r9b
jne 0x14009c563
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14009c550
not ecx
call fcn.14000f970
xor edi, edi
test rax, rax
je 0x14009c59a
cmp word [rax + 0xc2], di
jne 0x14009c66c
test r11, r11
jne 0x14009c5d2
mov rbx, qword [0x14017f690]
cmp dword [rbx + 0x48a0], edi
jg 0x14009c5c8
mov r8d, 0x709
lea rdx, str.D:hackbypassLucifer_ToolsLucifer_Toolsimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48a8]
mov r11, qword [rax]
movss xmm1, dword [r11 + 0xa8]
movss xmm0, dword [r11 + 0xc]
movaps xmm3, xmm1
addss xmm3, dword [r11 + 4]
movss xmm2, dword [r11 + 0xac]
subss xmm0, xmm1
addss xmm2, dword [r11 + 8]
mov rax, qword [0x14017f690]
xorps xmm1, xmm1
addss xmm0, dword [r11 + 0xb0]
or dword [rax + 0x47a8], 3
mov qword [rax + 0x47c0], rdi
mov dword [rax + 0x47ac], 1
maxss xmm1, xmm0
movaps xmm0, xmm3
unpcklps xmm0, xmm2
movsd qword [rax + 0x47b8], xmm0
mov dword [rax + 0x47b0], 1
addss xmm1, xmm3
subss xmm1, xmm3
movaps xmm0, xmm1
unpcklps xmm0, xmm6
movsd qword [rax + 0x47c8], xmm0
addss xmm6, dword [r11 + 0xac]
movss dword [r11 + 0xac], xmm6
mov rbx, qword [0x14017f690]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 3
movss xmm0, dword [rbx + 0x37e0]
lea rcx, [rbx + 0x4828]
movss dword [rsp + 0x24], xmm0
call fcn.140030720
mov dword [rbx + 0x37e0], edi
lea rdx, [rsp + 0x20]
mov rbx, qword [0x14017f690]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x37e8]
lea rcx, [rbx + 0x4828]
movss xmm0, dword [rbx + 0x37ec]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.140030720
xor edx, edx
mov qword [rbx + 0x37e8], rdi
mov r8d, 0x50f
lea rcx, str.MainMenuBar
call fcn.1400124b0
mov ecx, 2
movzx ebx, al
call fcn.140006f20
movaps xmm6, xmmword [rsp + 0x30]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14009f230
Capabilities:
Hash data with crc32

Disassembly:
test dword [rcx + 0x10], 0x100000
je 0x14009f2ad
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x14009f286
lea r11, [0x140143020]
cmp r9b, 0x23
jne 0x14009f269
cmp byte [r8], r9b
jne 0x14009f269
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14009f256
mov rcx, qword [0x14017f690]
not eax
cmp dword [rcx + 0x3f30], eax
jne 0x14009f29d
mov dword [rcx + 0x3f34], eax
cmp dword [rcx + 0x3f60], eax
jne 0x14009f2c0
mov byte [rcx + 0x3f64], 1
ret
mov rax, qword [0x14017f690]
mov rcx, qword [rax + 0x3ed0]
jmp fcn.14000aa70
ret
Function at 0x1400af100
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400af167
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400af122
mov ecx, dword [r10]
jmp 0x1400af276
cmp ecx, 0x270
jb 0x1400af276
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x1400af1a0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x1400af1f1
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x1400af820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [0x1401a5210]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x1400af92f
mov rax, qword [rdi]
test rax, rax
jne 0x1400af889
lea r8d, [rax + 0x4f]
lea rdx, str.D:hackbypassLucifer_ToolsLucifer_Toolsexamplesexample_win32_directx11DiscordRPC_srcconnection_win.cpp
lea rcx, str.self
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
jmp 0x1400af8df
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x1400af8df
test rsi, rsi
jne 0x1400af8b2
lea r8d, [rsi + 0x56]
lea rdx, str.D:hackbypassLucifer_ToolsLucifer_Toolsexamplesexample_win32_directx11DiscordRPC_srcconnection_win.cpp
lea rcx, [0x14015d750]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
jmp 0x1400af8df
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1400af8df
cmp dword [rsp + 0x40], ebx
je 0x1400af92f
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x1400af8fe
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x1400af8fe
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b7070
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x13e0
call fcn.1401281d0
sub rsp, rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
lea ecx, [rdi + 0x40]
call fcn.140127d04
mov rsi, rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], 0x3e
mov qword [rsp + 0x40], 0x3f
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14015f9d8]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14015f9e8]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x14015f9f8]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x14015fa00]
mov dword [rsi + 0x38], eax
movzx eax, word [0x14015fa04]
mov word [rsi + 0x3c], ax
mov byte [rsi + 0x3e], dil
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea edx, [rdi + 1]
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x54], eax
inc rdx
cmp rdx, 0x270
jb 0x1400b7120
mov dword [rsp + 0x50], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov edi, 9
nop dword [rax]
lea rcx, [rsp + 0x50]
call fcn.1400c5080
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x1400b719a
lea rcx, [rsp + 0x50]
call fcn.1400c5080
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x1400b7185
shr rax, 0x20
movsxd rcx, eax
movzx r9d, byte [rcx + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1400b71d2
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1400b71c7
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400b71da
mov rcx, rbx
call fcn.1400c4660
sub rdi, 1
jne 0x1400b7170
lea edx, [rdi + 0x40]
mov rcx, rsi
call fcn.14012791c
mov rax, rbx
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c1df0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400c1e18
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400c1e3e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400c1e40
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400c1e99
test ecx, ecx
jle 0x1400c1e79
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400c1e99
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400c1e99
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret