joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140066e60
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xb0
mov r12, rcx
lea rcx, [rbp - 0x61]
mov edi, r9d
mov rbx, r8
mov r15b, dl
call fcn.140003200
xor eax, eax
lea rcx, [rbp - 0x41]
xor edx, edx
lea r13d, [rax + 1]
lea r8d, [rax + 0x70]
mov r14d, eax
mov dword [rbp + 0x77], r13d
mov esi, eax
call fcn.140014ac0
cmp edi, 2
jb 0x140066ee7
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.14005f6d0
xor ecx, ecx
cmp word [rax], cx
je 0x140066ee7
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.14005f6d0
mov rcx, rax
call fcn.140013110
mov r14, rax
cmp edi, 3
jb 0x140066f04
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14005f6d0
mov rcx, rax
call fcn.140013110
mov rsi, rax
cmp edi, 4
jb 0x140066f4c
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call fcn.14005f6d0
xor ecx, ecx
cmp word [rax], cx
je 0x140066f4c
mov rax, qword [rbx + 8]
lea edx, [rcx + 0x29]
mov r13, qword [rax + 0x18]
mov rcx, r13
call fcn.140058300
test al, al
jne 0x140066f48
mov rcx, r13
call fcn.14000f8e0
lea rcx, [rbp - 0x61]
mov rdx, rax
call fcn.1400105f0
mov r13d, dword [rbp + 0x77]
cmp edi, 5
jb 0x140066f62
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x20]
call fcn.14000eed0
movzx r13d, ax
mov edi, WSACleanup
lea rcx, [rbp - 0x41]
xor edx, edx
mov r8d, edi
call fcn.140014ac0
mov rax, qword [rbp - 0x61]
mov dword [rbp - 0x41], edi
mov qword [rbp - 0x31], rax
mov rax, qword [rbx + 8]
mov dword [rbp - 0x3d], 0x40
xor edi, edi
mov qword [rbp - 0x39], rdi
mov rcx, qword [rax]
call fcn.14005f6d0
lea rcx, [rbp - 0x41]
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x19], rsi
mov dword [rbp - 0x11], r13d
mov qword [rbp - 0x29], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
test r14, r14
je 0x140066fc2
mov rcx, r14
call fcn.14001460c
test rsi, rsi
je 0x140066fcf
mov rcx, rsi
call fcn.14001460c
test ebx, ebx
jne 0x140066ffe
mov rax, qword [r12]
lea esi, [rbx + 1]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
mov edx, esi
add rcx, r12
call fcn.1400032e0
mov rbx, qword [rbp + 0x7f]
mov rcx, rbx
call fcn.140009a80
mov dword [rbx + 8], esi
mov dword [rbx], edi
jmp 0x140067036
test r15b, r15b
je 0x140067011
mov rax, qword [rbp + 0x27]
mov qword [r12 + 0x7a8], rax
jmp 0x140067036
mov rbx, qword [rbp + 0x7f]
mov rcx, rbx
call fcn.140009a80
mov rcx, qword [rbp + 0x27]
mov esi, 1
mov dword [rbx + 8], esi
mov dword [rbx], esi
test rcx, rcx
je 0x140067036
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x61]
call fcn.140002bd0
lea r11, [rsp + 0xb0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400671e0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x1f78]
mov eax, 0x2060
call fcn.1400243b0
sub rsp, rax
mov r12, rcx
lea rcx, [rsp + 0x20]
call fcn.140003200
lea rcx, [rsp + 0x40]
call fcn.140003200
mov rcx, r12
call fcn.14005f6d0
xor r13d, r13d
movzx edx, word [rax]
mov rsi, rax
mov dil, r13b
mov ebx, r13d
test dx, dx
je 0x140067369
lea r14d, [r13 + 0x25]
inc rbx
cmp dx, r14w
jne 0x14006731b
cmp word [rsi + rbx*2], r14w
jne 0x140067273
lea rcx, [rsp + 0x20]
mov edx, r14d
mov dil, 1
call fcn.14000d330
inc rbx
jmp 0x140067325
lea rdx, [0x140097d60]
lea rcx, [rsp + 0x40]
call fcn.140002730
jmp 0x14006729d
test r11w, r11w
je 0x1400672a8
lea rcx, [rsp + 0x40]
movzx edx, r11w
call fcn.14000d330
inc rbx
movzx r11d, word [rsi + rbx*2]
cmp r11w, r14w
jne 0x140067286
cmp word [rsi + rbx*2], r13w
je 0x140067334
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0xfff
inc rbx
mov word [rsp + 0x60], r13w
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
test eax, eax
je 0x1400672ea
lea rdx, [rsp + 0x60]
call fcn.140001400
mov dil, 1
jmp 0x140067325
lea rdx, [0x14009fbdc]
mov dil, 1
call fcn.140001400
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000cb10
lea rdx, [0x14009fbdc]
lea rcx, [rsp + 0x20]
call fcn.140001400
jmp 0x140067325
lea rcx, [rsp + 0x20]
call fcn.14000d330
movzx edx, word [rsi + rbx*2]
test dx, dx
jne 0x140067247
jmp 0x140067357
lea rdx, [0x14009fbdc]
lea rcx, [rsp + 0x20]
mov dil, 1
call fcn.140001400
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000cb10
test dil, dil
je 0x140067369
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.140010ef0
lea rcx, [rsp + 0x40]
call fcn.140002bd0
lea rcx, [rsp + 0x20]
call fcn.140002bd0
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x14006b370
Capabilities:
Parse url

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rsi, rdx
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x60]
lea rcx, [rbp - 0x31]
call fcn.140014ac0
mov r12d, 1
mov rcx, rbx
mov dword [rbp - 9], r12d
mov dword [rbp - 0x19], r12d
mov dword [rbp - 0x29], r12d
mov dword [rbp + 0x27], r12d
mov dword [rbp + 0x17], r12d
mov dword [rbp + 7], r12d
mov dword [rbp - 0x39], 0xf0
call fcn.140014a44
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x14006b4d8
mov r9d, dword [rbp - 0x29]
mov rdx, qword [rbp - 0x31]
xor r8d, r8d
mov rcx, rsi
call fcn.14000e9b0
mov r9d, dword [rbp - 0x19]
mov rdx, qword [rbp - 0x21]
lea rcx, [rsi + 0x20]
xor r8d, r8d
call fcn.14000e9b0
mov r9d, dword [rbp - 9]
mov rdx, qword [rbp - 0x11]
lea rcx, [rsi + 0x40]
xor r8d, r8d
call fcn.14000e9b0
mov r9d, dword [rbp + 7]
mov rdx, qword [rbp - 1]
lea rcx, [rsi + 0x60]
xor r8d, r8d
call fcn.14000e9b0
mov r9d, dword [rbp + 0x17]
mov rdx, qword [rbp + 0xf]
lea rcx, [rsi + 0x80]
xor r8d, r8d
call fcn.14000e9b0
mov r9d, dword [rbp + 0x27]
mov rdx, qword [rbp + 0x1f]
lea rcx, [rsi + 0xa0]
xor r8d, r8d
call fcn.14000e9b0
lea r8, [rsi + 0xa0]
lea rdx, [rbp + 0x37]
lea rcx, [rsi + 0x80]
call fcn.140057dc0
lea rcx, [rsi + 0xc0]
mov rdx, rax
call fcn.1400105f0
lea rcx, [rbp + 0x37]
call fcn.140002bd0
mov ecx, dword [rbp - 0x25]
movzx r11d, word [rbp - 0x15]
mov dword [rsi + 0xe4], ecx
dec ecx
mov word [rsi + 0xe8], r11w
je 0x14006b4ce
dec ecx
je 0x14006b4c2
mov dword [rsi + 0xe0], 3
jmp 0x14006b4d5
mov dword [rsi + 0xe0], 2
jmp 0x14006b4d5
mov dword [rsi + 0xe0], r12d
mov al, r12b
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14006b600
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp byte [rcx + 0x188], bl
je 0x14006b640
test dl, dl
je 0x14006b640
add rcx, 0x190
call fcn.140038ec0
lea rcx, [0x14006b5f0]
mov r8, rdi
xor edx, edx
call fcn.140017c24
cmp dword [rdi + 0x20], ebx
sete al
jmp 0x14006b645
call fcn.14006b500
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140072420
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x220
mov rbx, rcx
mov rcx, qword [rcx + 0x88]
mov edx, 0x3e9
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edi, edi
test rax, rax
je 0x1400724b5
lea rdx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test byte [rbx + 0x10], 1
je 0x140072474
cmp word [rsp + 0x20], di
jne 0x140072474
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1400724b5
movsd xmm0, qword [rbx + 0x18]
comisd xmm0, xmmword [0x1400a0908]
jbe 0x140072495
mov rcx, qword [rbx + 0x88]
mov edx, 0x40a
call qword [sym.imp.USER32.dll_KillTimer]
lea rcx, [rbx + 0x48]
lea rdx, [rsp + 0x20]
call fcn.140002730
mov rcx, qword [rbx + 0x88]
mov edx, 1
call qword [sym.imp.USER32.dll_EndDialog]
mov rbx, qword [rsp + 0x230]
add rsp, 0x220
pop rdi
ret

Function at 0x140073030
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, rdx
mov r13, rcx
lea rdx, [0x140097d60]
mov rcx, rbp
call fcn.140002730
mov rcx, r13
call fcn.14003e0f0
xor esi, esi
test al, al
je 0x140073072
xor al, al
jmp 0x1400730fd
mov rcx, qword [r13]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, 0xffffffffffffffff
mov rdi, rax
mov eax, 0x7fff
test rdi, rdi
cmove rdi, rax
mov eax, 2
lea rbx, [rdi + 1]
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140014c1c
mov rcx, qword [r13]
mov r8, rbx
mov r9, rax
mov edx, reloc.WSOCK32.dll_listen
mov r12, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov word [r12 + rdi*2], si
mov rcx, rbp
test rax, rax
jne 0x1400730e7
lea rdx, [0x140097d60]
call fcn.140002730
jmp 0x1400730f2
mov rdx, r12
call fcn.140002730
mov sil, 1
mov rcx, r12
call fcn.14001460c
mov al, sil
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140073e50
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, rcx
mov rcx, qword [rcx]
mov r13, rdx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
mov edx, 0xb0
call qword [sym.imp.USER32.dll_SendMessageW]
mov r11d, dword [rsp + 0x60]
cmp dword [rsp + 0x68], r11d
jae 0x140073f1b
mov rcx, qword [r12]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
mov rdi, rax
test eax, eax
je 0x140073f1b
cmp eax, dword [rsp + 0x68]
jb 0x140073f1b
cmp eax, dword [rsp + 0x60]
jb 0x140073f1b
lea ebx, [rax + 1]
lea rcx, [rsi - 1]
lea eax, [rsi + 2]
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140014c1c
mov rcx, qword [r12]
lea edx, [rsi + 0xd]
mov r9, rax
mov r8d, ebx
mov rbp, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140073f0e
cmp dword [rsp + 0x60], edi
je 0x140073efa
mov ecx, dword [rsp + 0x60]
mov word [rbp + rcx*2], si
mov eax, dword [rsp + 0x68]
mov rcx, r13
lea rdx, [rbp + rax*2]
call fcn.140002730
mov sil, 1
mov rcx, rbp
call fcn.14001460c
mov al, sil
jmp 0x140073f1d
xor al, al
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140076b60
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov r13d, 2
mov word [rdx], r13w
lea rdx, [rax - 0x38]
mov rcx, r8
mov esi, r9d
mov r12, r8
call fcn.14006a000
mov rcx, qword [rax]
call qword [sym.imp.WSOCK32.dll_inet_addr]
lea rcx, [rsp + 0x20]
mov ebp, eax
call fcn.140001510
cmp ebp, 0xffffffff
jne 0x140076bcd
lea rdx, str.255.255.255.255
mov rcx, r12
call fcn.140057d40
test al, al
je 0x140076bcd
lea edx, [r13 - 1]
jmp 0x140076bee
lea eax, [rsi - 1]
mov dword [rdi + 4], ebp
cmp eax, 0xfffe
ja 0x140076beb
movzx ecx, si
call qword [sym.imp.WSOCK32.dll_htons]
mov word [rdi + 2], ax
mov al, 1
jmp 0x140076c02
mov edx, r13d
mov rax, qword [rbx]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
add rcx, rbx
call fcn.1400032e0
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret

Function at 0x140079eb0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
mov r12b, byte [0x1400b28e7]
mov rbp, rdx
mov rdi, rcx
call fcn.1400168e0
mov edx, 0x8000
mov ecx, eax
call fcn.1400167e4
mov rcx, rbp
mov esi, eax
call fcn.14004d6c0
test al, al
je 0x140079f20
mov rcx, rbp
call fcn.14004c780
mov rcx, rbp
movsxd rbx, eax
call fcn.1400799f0
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.140016a94
mov rbx, rax
jmp 0x140079f76
lea rcx, [rsp + 0x20]
call fcn.14000f9e0
mov rcx, rbp
call fcn.14000f8e0
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.1400711c0
mov r8, qword [rsp + 0x20]
lea rdx, [0x14009b3b4]
mov rcx, rdi
call fcn.140016b24
movsxd rbx, eax
test r12b, r12b
je 0x140079f6c
mov rcx, rbp
call fcn.14005f6d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x20]
call fcn.140001510
mov rcx, rdi
call fcn.140016e08
mov rcx, rdi
call fcn.1400168e0
mov edx, 0x4000
mov ecx, eax
cmp esi, 0xffffffff
je 0x140079f94
mov edx, esi
call fcn.1400167e4
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x14007a570
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rcx
xor ecx, ecx
mov r12, r9
lea ebx, [rcx + 1]
mov r13, r8
mov edi, ecx
mov ebp, ecx
cmp qword [r15 + 8], rcx
jne 0x14007a5a8
xor al, al
jmp 0x14007a757
mov rax, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov byte [r9], cl
mov byte [r8], cl
mov dword [rdx], ecx
mov rsi, rax
mov byte [rax], cl
mov byte [r14], cl
movsxd rdx, edi
mov rcx, r15
call fcn.14003e1b0
cmp word [rax], 0x2b
je 0x14007a5f1
cmp word [rax], 0x5e
je 0x14007a5eb
cmp word [rax], 0x21
je 0x14007a5eb
cmp word [rax], 0x23
jne 0x14007a61a
cmp word [rax], 0x2b
jne 0x14007a5f7
mov byte [r13], bl
jmp 0x14007a616
cmp word [rax], 0x5e
jne 0x14007a603
mov byte [r12], bl
jmp 0x14007a616
cmp word [rax], 0x21
jne 0x14007a60e
mov byte [r14], bl
jmp 0x14007a616
cmp word [rax], 0x23
jne 0x14007a616
mov byte [rsi], bl
add edi, ebx
jmp 0x14007a5c8
movsxd rdx, edi
add edi, ebx
mov rcx, r15
mov dword [rsp + 0x80], edi
call fcn.14003e1b0
mov rsi, qword [rsp + 0x88]
movzx ecx, word [rax]
cmp cx, 0x7b
jne 0x14007a71e
lea rcx, [rsp + 0x20]
mov edx, 0x40
call fcn.140001440
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x20]
mov ecx, 0x7d
mov rdx, r15
call fcn.1400716e0
test al, al
je 0x14007a704
lea rdi, [0x1400adbd0]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rdi]
call fcn.140014fd0
test eax, eax
je 0x14007a69e
lea rax, reloc.WSOCK32.dll_accept
add rdi, 8
add ebp, ebx
cmp rdi, rax
jl 0x14007a67b
cmp ebp, 0x62
jne 0x14007a6f0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.14000ee90
movzx ecx, word [rax]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
jne 0x14007a6d1
lea rcx, [rsp + 0x20]
call fcn.140002bd0
jmp 0x14007a5a1
bt ecx, 9
jae 0x14007a6db
mov byte [r12], bl
bt ecx, 0xa
jae 0x14007a6e4
mov byte [r14], bl
bt ecx, 8
jae 0x14007a712
mov byte [r13], bl
jmp 0x14007a712
lea rcx, [0x140000000]
movsxd rax, ebp
cmp byte [rax + rcx + 0xadee0], 0
je 0x14007a708
xor bl, bl
jmp 0x14007a712
movzx eax, byte [rax + rcx + 0xadf50]
mov dword [rsi], eax
lea rcx, [rsp + 0x20]
call fcn.140002bd0
jmp 0x14007a74f
call qword [sym.imp.USER32.dll_VkKeyScanW]
movsx ecx, ax
mov dword [rsi], ecx
cmp ecx, 0xffffffff
je 0x14007a5a1
bt ecx, 9
jae 0x14007a73c
mov byte [r12], bl
bt ecx, 0xa
jae 0x14007a745
mov byte [r14], bl
bt ecx, 8
jae 0x14007a74f
mov byte [r13], bl
and dword [rsi], 0xff
mov al, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140027680
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400276f2
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400276b0
mov ecx, dword [r10]
jmp 0x1400277f3
cmp ecx, 0x270
jb 0x1400277f3
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x140027720
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x140027770
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x140036ab0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140036b11
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140036ad0
mov ecx, dword [r10]
jmp 0x140036bfa
cmp ecx, 0x4e0
jb 0x140036bfa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140036b30
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140036b80
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14006c780
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14006c7dd
lea rbx, [0x140140f70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14006c7c4
cmp r10, 2
jb 0x14006c7c4
cmp byte [r9], r8b
jne 0x14006c7c4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14006c7a0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14006c81f
lea rbx, [0x140140f70]
cmp r8b, 0x23
jne 0x14006c803
cmp byte [r9], r8b
jne 0x14006c803
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14006c7f0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14006f0c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rbx, rcx
mov edi, edx
jg 0x14006f0f6
mov r8d, 0x6d2
lea rdx, str.E:CodeKionClientRecode_1.20.0imguiimgui.h
lea rcx, str.Size___0
call qword [0x14012fe68]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140140f70]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1401c03a0]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1d6c], edx
jne 0x14006f170
mov dword [rax + 0x1d70], edx
cmp dword [rax + 0x1da8], edx
jne 0x14006f17f
mov byte [rax + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x14006f190
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rdi, rdx
mov rbx, rcx
jg 0x14006f1c3
mov r8d, 0x6d2
lea rdx, str.E:CodeKionClientRecode_1.20.0imguiimgui.h
lea rcx, str.Size___0
call qword [0x14012fe68]
movsxd rcx, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
movss xmm0, dword [rdi]
subss xmm0, dword [rbx + 0x50]
movss xmm1, dword [rdi + 4]
subss xmm1, dword [rbx + 0x54]
cvttss2si r8d, xmm0
movss xmm0, dword [rdi + 8]
subss xmm0, dword [rbx + 0x50]
cvttss2si r9d, xmm1
movss xmm1, dword [rdi + 0xc]
lea rdi, [0x140140f70]
subss xmm1, dword [rbx + 0x54]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
cvttss2si r10d, xmm0
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
cvttss2si r11d, xmm1
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r10b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
xor ebx, dword [rdi + rdx*4]
shr eax, 0x10
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r11b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r11d
shr eax, 8
movzx edx, al
mov eax, r11d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x1401c03a0]
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r11d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
not ebx
cmp dword [rax + 0x1d6c], ebx
jne 0x14006f364
mov dword [rax + 0x1d70], ebx
cmp dword [rax + 0x1da8], ebx
jne 0x14006f373
mov byte [rax + 0x1dac], 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret