joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004da20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400af118]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [section..data]
lea rcx, [rsp + 0x48]
call fcn.14004d4e0
nop
mov r8, rbx
lea rdx, [0x14008fc24]
lea rcx, [rsp + 0x68]
call fcn.14004d390
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14004da82
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14004dd40
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x14004dad5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dbee
call fcn.1400659f8
mov rbx, rsi
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004db82
cmp qword [rdi + 0x18], 8
jb 0x14004db1d
mov rdi, qword [rdi]
mov dword [rsp + 0x30], 0xb
mov dword [rsp + 0x34], 8
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004db71
cmp dword [rsp + 0x30], 0xb
jne 0x14004db71
cmp dword [rsp + 0x34], 8
cmove rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004db82
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14004dbc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dbbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dbe8
call fcn.1400659f8
mov rax, rbx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140065b10
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14006c06c
nop
call fcn.14006c06c
nop
int3
Function at 0x140052f80
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x188
mov rax, qword [0x1400af118]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov dword [rsp + 0x30], r9d
mov r13, r8
mov r12, rdx
mov r15, rcx
call qword [0x14008f6d0]
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
call fcn.14004d720
mov rcx, rax
test rax, rax
je 0x1400531c1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140053520
lea rsi, [rbp - 1]
test al, al
jne 0x140053021
test rbx, rbx
jne 0x140053003
xor eax, eax
jmp 0x140053010
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140053006
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14005a2d0
nop
mov rbx, qword [rsp + 0x38]
lea r14, [rbx - 0x18]
cmp dword [r14 + 8], 0
jge 0x140053035
mov eax, esi
jmp 0x140053053
lea rdx, str.__no_sandbox
mov rcx, rbx
call fcn.1400680e4
test rax, rax
jne 0x14005304d
mov eax, esi
jmp 0x140053053
sub rax, rbx
sar rax, 1
shr eax, 0x1f
xor edi, edi
test al, al
je 0x14005311f
cmp byte [0x1400b0dd8], dil
je 0x140053072
movzx eax, byte [0x1400b0dd9]
jmp 0x1400530af
xor edx, edx
lea rcx, [0x1400af038]
call fcn.140054790
movzx ebx, al
mov edx, 1
lea rcx, [0x1400af058]
call fcn.140054790
test bl, bl
je 0x1400530a0
test al, al
je 0x1400530a0
mov al, 1
jmp 0x1400530a2
xor al, al
mov byte [0x1400b0dd9], al
mov byte [0x1400b0dd8], 1
test al, al
je 0x14005311f
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x54]
call fcn.140067c70
mov dword [rsp + 0x50], 0x114
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x54], 6
ja 0x1400530ed
jne 0x14005311f
cmp dword [rsp + 0x58], 1
setae al
test al, al
je 0x14005311f
mov ecx, 8
call fcn.140065764
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14005311d
mov qword [rax], 0
call section..text
mov qword [rdi], rax
test rdi, rdi
je 0x14005311f
mov rbp, rax
jmp 0x14005311f
xor edi, edi
call qword [0x14008f758]
lea rcx, str.MainFrame.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140053181
lea rdx, str.DTAppMainEntrance
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140053181
mov qword [rsp + 0x20], rbp
mov r9d, dword [rsp + 0x30]
mov r8, r13
mov rdx, r12
mov rcx, r15
call rax
mov ebx, eax
test rdi, rdi
je 0x140053183
mov rcx, qword [rdi]
call fcn.140001045
mov qword [rdi], 0
mov rcx, rdi
call fcn.1400657a0
jmp 0x140053183
xor ebx, ebx
lock xadd dword [r14 + 0x10], esi
sub esi, 1
jg 0x14005319b
mov rcx, qword [r14]
mov r8, qword [rcx]
mov rdx, r14
call qword [r8 + 8]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140065b10
add rsp, 0x188
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.1400534d0
int3
Function at 0x140053c60
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov rdi, rcx
mov dword [rsp + 0x20], 0
call fcn.14004d720
mov rcx, rax
test rax, rax
je 0x140053e6e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
call fcn.14004d720
mov rcx, rax
test rax, rax
je 0x140053e79
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.14004d720
mov rcx, rax
test rax, rax
je 0x140053e63
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.140053e90
mov r8d, 4
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.14005a170
nop
lea rbp, [0x140090390]
mov rdx, rbp
mov rcx, qword [rax]
call fcn.14006fa80
test eax, eax
sete sil
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053d40
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test sil, sil
je 0x140053d73
mov rdx, rbp
lea rcx, [0x1400903a0]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rbp + rax*2], 0
jne 0x140053d60
mov rdx, rbp
jmp 0x140053e10
mov r8d, 2
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x68]
call fcn.14005a170
nop
lea rbp, [0x1400903a8]
mov rdx, rbp
mov rcx, qword [rax]
call fcn.14006fa80
test eax, eax
sete sil
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053dbf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [0x1400903a0]
test sil, sil
je 0x140053df0
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rbp + rax*2], 0
jne 0x140053de0
mov rdx, rbp
jmp 0x140053e10
lea rsi, str.release
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rax, rbx
inc rax
cmp word [rsi + rax*2], 0
jne 0x140053e03
mov rdx, rsi
mov r8d, eax
mov rcx, rdi
call fcn.14005a2d0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140053e3b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140053e57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, rdi
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.1400534d0
nop
mov ecx, 0x80004005
call fcn.1400534d0
nop
mov ecx, 0x80004005
call fcn.1400534d0
int3
Function at 0x140054790
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
cmp qword [0x1400af030], 8
lea rax, [rsp + 0x38]
mov ebx, edx
mov qword [rsp + 0x20], rax
mov rdi, rcx
lea rdx, [0x1400af018]
cmovae rdx, qword [0x1400af018]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140054868
cmp qword [rdi + 0x18], 8
jb 0x1400547ee
mov rdi, qword [rdi]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x68], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov dword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140054845
mov eax, dword [rsp + 0x60]
add eax, 0xfffffffd
cmp eax, 1
ja 0x140054845
cmp dword [rsp + 0x68], 4
cmove ebx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test ebx, ebx
setne bl
test rcx, rcx
je 0x14005485a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x40
pop rdi
ret
Function at 0x14005a410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005a485
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14005a485
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14005a475
nop
cmp rbx, rcx
jae 0x14005a485
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14005a460
cmp rbx, rcx
jae 0x14005a485
cmp word [rbx], 0
je 0x14005a485
mov rax, rbx
jmp 0x14005a487
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005a620
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400af118]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14005a6f4
cmp byte [rcx + 0x72], 0
je 0x14005a6f4
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14005a6f0
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14005a6b6
sub eax, 1
je 0x14005a6ba
cmp eax, 2
jne 0x14005a6f0
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140065b10
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14005a6e7
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140072cd4
cmp rdi, rax
jne 0x14005a6f0
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14005a69e
xor al, al
jmp 0x14005a69e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140065b10
add rsp, 0x60
pop rbx
ret
Function at 0x140061440
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400af118]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140061471
xor eax, eax
jmp 0x1400615bf
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400614ae
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x1400614ae
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x1400615bf
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x1400615b4
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400614f5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14006151e
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140071654
cmp ax, di
je 0x1400615b4
movzx edi, si
jmp 0x1400615b4
lea r8, [rsp + 0x48]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x140061574
sub eax, 1
je 0x140061574
cmp eax, 2
jne 0x1400615b4
movzx ecx, word [rsp + 0x40]
jmp 0x140061501
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x1400615a1
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.140072cd4
cmp rbp, rax
jne 0x1400615b4
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
movzx eax, si
jne 0x1400615b7
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140065b10
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400746f0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14007451c
Function at 0x14007f94c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14007f672
call fcn.14006f564
mov dword [rax], 0x16
call fcn.14006c04c
jmp 0x14007f7bd
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14007f7bd
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14007f7bd
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14007f6a1
lock or dword [rcx + 0x14], 0x10
jmp 0x14007f7bd
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14007f6b5
call fcn.14007fd10
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x14007f6c5
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x14007f6c8
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400766b8
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400811e0
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14007f7ab
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14007f759
mov rcx, rbx
call fcn.1400766b8
cmp eax, 0xffffffff
je 0x14007f744
mov rcx, rbx
call fcn.1400766b8
cmp eax, 0xfffffffe
je 0x14007f744
mov rcx, rbx
call fcn.1400766b8
movsxd rdi, eax
lea r14, [0x1400b3e60]
mov rcx, rbx
sar rdi, 6
call fcn.1400766b8
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14007f74b
lea rdx, [0x1400af4d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14007f759
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14007f77d
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14007f77d
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14007f77d
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x14007f79b
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x14007f7a6
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x14007f7c2
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14007f63c
Function at 0x140003090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x70
mov rbp, qword [0x14011eab0]
mov rbx, rcx
movaps xmmword [rsp + 0x60], xmm6
mov r14, rbp
movaps xmmword [rsp + 0x50], xmm7
movaps xmm6, xmm1
movaps xmm7, xmm2
lea rax, [rbp + 8]
cmp rax, rcx
je 0x1400030e7
mov r8d, 0x598
lea rdx, str.C:UserskornwDesktopHEROHONDAimgui.cpp
lea rcx, str.g.IO__this___Can_only_add_events_to_current_context._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbp, qword [0x14011eab0]
cmp byte [rbx + 0x37a1], 0
je 0x140003291
movss xmm1, dword [0x1400cc198]
xorps xmm2, xmm2
comiss xmm7, xmm1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
jbe 0x140003134
comiss xmm7, xmm2
cvttss2si eax, xmm7
jae 0x14000312d
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm7
jp 0x14000312b
je 0x14000312d
dec eax
movd xmm7, eax
cvtdq2ps xmm7, xmm7
comiss xmm6, xmm1
jbe 0x140003159
comiss xmm6, xmm2
cvttss2si eax, xmm6
jae 0x140003152
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm6
jp 0x140003150
je 0x140003152
dec eax
movd xmm6, eax
cvtdq2ps xmm6, xmm6
mov esi, dword [rbp + 0x37c0]
sub esi, 1
movsxd rdi, esi
js 0x1400031af
lea rbx, [rdi + rdi*2]
shl rbx, 3
nop
cmp esi, dword [rbp + 0x37c0]
jl 0x140003192
mov r8d, 0x6fd
lea rdx, str.C:UserskornwDesktopHEROHONDAimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbp + 0x37c8]
cmp dword [rbx + rax], 1
je 0x140003239
dec esi
sub rbx, 0x18
sub rdi, 1
jns 0x140003170
movsd xmm0, qword [r14 + 0xdfc]
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
movss xmm0, dword [rax]
ucomiss xmm0, xmm6
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
movss xmm1, dword [rax + 4]
jp 0x1400031ee
jne 0x1400031ee
ucomiss xmm1, xmm7
jp 0x1400031ee
je 0x140003291
lea rbx, [r14 + 0x37c0]
movss dword [rsp + 0x38], xmm6
mov ecx, dword [rbx]
mov r8d, dword [rbx + 4]
movss dword [rsp + 0x3c], xmm7
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
cmp ecx, r8d
jne 0x14000326f
inc ecx
test r8d, r8d
je 0x14000325b
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140003260
movss xmm0, dword [rbx + rax + 8]
movss xmm1, dword [rbx + rax + 0xc]
lea rax, [rsp + 0x20]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x1400031c3
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.14001de00
movsxd rax, dword [rbx]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 8]
movups xmmword [rax + rcx*8], xmm0
movsd qword [rax + rcx*8 + 0x10], xmm1
inc dword [rbx]
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
ret
Function at 0x1400035d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000362d
lea rbx, [0x1400c4630]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003614
cmp r10, 2
jb 0x140003614
cmp byte [r9], r8b
jne 0x140003614
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400035f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000366f
lea rbx, [0x1400c4630]
cmp r8b, 0x23
jne 0x140003653
cmp byte [r9], r8b
jne 0x140003653
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003640
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003830
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000385f
mov r8d, 0x78d
lea rdx, str.C:UserskornwDesktopHEROHONDAimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000386b
mov qword [rdi], 0
lea rdx, [0x1400c3e78]
mov rcx, rbx
call fcn.140003680
mov rbx, rax
test rax, rax
jne 0x14000388d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003964
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003964
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003964
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003964
cmp rsi, 0xffffffffffffffff
je 0x140003964
mov rax, qword [0x14011eab0]
test rax, rax
je 0x140003901
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003964
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003951
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14011eab0]
test rax, rax
je 0x140003946
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000396d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14000395f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x14000396f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007040
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x140007077
mov r8d, 0x706
lea rdx, str.C:UserskornwDesktopHEROHONDAimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x1400c4630]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x14011eab0]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x1400070f6
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001cbc0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret