joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a4020
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov r8, rcx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x140186d50]
mov rsi, qword [rax + 0x4078]
mov rax, qword [rsi + 0x110]
movsxd rcx, dword [rsi + 0x108]
mov edi, dword [rax + rcx*4 - 4]
movzx eax, byte [r8]
test al, al
je 0x1400a40ba
not edi
lea rcx, [r8 + 2]
lea rdx, [0x140109410]
mov r9d, edi
jmp 0x1400a409a
movzx r10d, r10b
movzx r11d, r9b
shr r9d, 8
xor r11d, r10d
xor r9d, dword [rdx + r11*4]
inc rcx
test al, al
je 0x1400a40b4
mov r10d, eax
movzx eax, byte [rcx - 1]
cmp r10b, 0x23
jne 0x1400a4080
cmp al, 0x23
jne 0x1400a4080
cmp byte [rcx], 0x23
cmove r9d, edi
jmp 0x1400a4080
not r9d
mov edi, r9d
mov rax, qword [rsi]
add rsi, 0x108
cmp dword [rax + 0x40cc], edi
jne 0x1400a40db
mov ecx, edi
mov edx, recv
xor r9d, r9d
call fcn.1400a3d50
mov dword [rsp + 0x2c], edi
lea rdx, [rsp + 0x2c]
mov rcx, rsi
call fcn.140087e50
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f0d70
nop
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x1400a7690
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [0x140186d50]
cmp byte [rbx + 0x4dc5], 0
jne 0x1400a76c3
mov edi, ecx
cmp byte [rbx + 0x4dc6], 0
je 0x1400a7720
movss xmm0, dword [rbx + 0x39e0]
unpcklps xmm0, xmm0
mulps xmm0, xmmword [0x1401152c0]
movsd xmm1, qword [rbx + 0x110]
addps xmm1, xmm0
movlps qword [rbx + 0x4aa0], xmm1
mov qword [rbx + 0x4aa8], 0
mov dword [rbx + 0x4a94], 1
movss xmm0, dword [rbx + 0x3a3c]
or byte [rbx + 0x4a90], 0x41
mulss xmm0, dword [0x140115418]
movss dword [rbx + 0x4af0], xmm0
mov edi, 2
movsx r9d, word [rbx + 0x5fe8]
cmp byte [0x1401879ff], 0
jne 0x1400a7763
movabs rax, 0x69746c6f6f542323
mov qword [0x1401879f0], rax
mov dword [0x1401879f8], 0x30255f70
mov word [0x1401879fc], 0x6432
mov byte [0x1401879fe], 0
mov byte [0x1401879ff], 1
lea r8, [0x1401879f0]
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_recv
call fcn.140086a70
test dil, 2
je 0x1400a78e7
movzx ecx, byte [rsp + 0x20]
test cl, cl
je 0x1400a77e9
mov edx, 0xffffffff
lea r8, [rsp + 0x22]
lea r9, [0x140109410]
mov eax, 0xffffffff
jmp 0x1400a77c9
movzx r10d, r10b
movzx r11d, al
shr eax, 8
xor r11d, r10d
xor eax, dword [r9 + r11*4]
inc r8
test cl, cl
je 0x1400a77e5
mov r10d, ecx
movzx ecx, byte [r8 - 1]
cmp r10b, 0x23
jne 0x1400a77b0
cmp cl, 0x23
jne 0x1400a77b0
cmp byte [r8], 0x23
cmove eax, edx
jmp 0x1400a77b0
not eax
jmp 0x1400a77eb
xor eax, eax
mov rcx, qword [0x140186d50]
movsxd r9, dword [rcx + 0x4058]
test r9, r9
je 0x1400a78e7
mov rcx, qword [rcx + 0x4060]
mov rdx, r9
shl rdx, 4
add rdx, rcx
mov r8, r9
jmp 0x1400a7828
mov r9, r8
test r8, r8
je 0x1400a7847
shr r8, 1
mov r10, r8
shl r10, 4
cmp dword [rcx + r10], eax
jae 0x1400a7820
not r8
add r8, r9
add rcx, r10
add rcx, 0x10
jmp 0x1400a7820
cmp rcx, rdx
je 0x1400a78e7
cmp dword [rcx], eax
jne 0x1400a78e7
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400a78e7
cmp byte [rax + 0xca], 0
je 0x1400a78e7
mov byte [rax + 0xcf], 1
mov byte [rax + 0xd2], 1
mov byte [rax + 0xec], 1
mov eax, dword [rbx + 0x5fe8]
inc eax
mov word [rbx + 0x5fe8], ax
movsx r9d, ax
cmp byte [0x1401879ff], 0
jne 0x1400a78d1
movabs rax, 0x69746c6f6f542323
mov qword [0x1401879f0], rax
mov dword [0x1401879f8], 0x30255f70
mov word [0x1401879fc], 0x6432
mov byte [0x1401879fe], 0
mov byte [0x1401879ff], 1
lea r8, [0x1401879f0]
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_recv
call fcn.140086a70
or esi, 0x2030347
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.140099e80
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f0d70
mov al, 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400a7b50
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [0x140186d50]
test rcx, rcx
je 0x140099ab0
mov r8d, 0xffffffff
test byte [rcx + 0x17], 1
je 0x140099aa0
nop dword [rax + rax]
mov rcx, qword [rcx + 0x380]
test byte [rcx + 0x17], 1
jne 0x140099a90
xor r8d, r8d
movsx ecx, word [rcx + 0xe0]
add ecx, r8d
test ecx, ecx
jns 0x140099abc
jmp 0x140099b00
mov ecx, dword [rax + 0x4028]
dec ecx
test ecx, ecx
js 0x140099b00
mov rax, qword [rax + 0x4030]
mov r8d, ecx
inc r8
jmp 0x140099ad5
dec r8
jle 0x140099b00
mov rcx, qword [rax + r8*8 - 8]
cmp rcx, rdx
je 0x140099ad0
cmp byte [rcx + 0xcb], 0
je 0x140099ad0
mov r10d, dword [rcx + 0x14]
not r10d
test r10d, 0x10200
je 0x140099ad0
mov edx, r9d
jmp fcn.140091d30
xor ecx, ecx
mov edx, r9d
jmp fcn.140091d30
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, edx
mov esi, ecx
mov r15, qword [0x140186d50]
test byte [r15 + 0x6184], 4
je 0x1400a7c05
movzx r8d, bl
cmp byte [0x140187a99], 0
jne 0x1400a7bf7
xor ecx, ecx
movabs r9, 0xe38e38e38e38e38f
lea r10, [0x140109b30]
lea r11, [0x140187a68]
nop dword [rax + rax]
mov rax, rcx
mul r9
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rdx, [rdx + rdx*8]
mov rax, r10
sub rax, rdx
movzx edx, byte [rax + rcx + 0x2141]
xor dl, byte [rcx + r10 + 0x2153]
mov byte [rcx + r11], dl
cmp rcx, 0x30
je 0x1400a7bf0
add rax, 0x2141
movzx eax, byte [rax + rcx + 1]
xor al, byte [rcx + r10 + 0x2154]
mov byte [rcx + r11 + 1], al
add rcx, 2
jmp 0x1400a7ba0
mov byte [0x140187a99], 1
lea rcx, [0x140187a68]
mov edx, esi
call fcn.140086520
lea rcx, [r15 + 0x4b68]
mov rax, qword [r15 + 0x4b70]
movsxd rdx, esi
imul rdx, rdx, 0x38
mov rdi, qword [rax + rdx + 8]
mov r14, qword [rax + rdx + 0x10]
mov edx, esi
call fcn.140099cb0
test bl, bl
je 0x1400a7c70
test rdi, rdi
je 0x1400a7c70
test byte [rdi + 0x17], 0x10
je 0x1400a7c41
mov r14, qword [rdi + 0x380]
test r14, r14
je 0x1400a7c50
cmp byte [r14 + 0xcb], 0
je 0x1400a7c7d
xor edx, edx
cmp dword [r15 + 0x4bb8], 0
sete dl
mov rcx, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140091d30
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rdi
xor edx, edx
mov r9d, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140099a70
Function at 0x1400a7ca0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, qword [0x140186d50]
mov r8d, dword [rdi + 0x4b78]
test r8d, r8d
jle 0x1400a7e21
cmp r8d, dword [rdi + 0x4b68]
jg 0x1400a7e21
dec r8d
mov rax, qword [rdi + 0x4b70]
mov rcx, qword [rdi + 0x4b80]
mov edx, r8d
imul rdx, rdx, 0x38
mov ecx, dword [rcx + rdx]
cmp ecx, dword [rax + rdx]
jne 0x1400a7e21
mov ecx, r8d
nop word cs:[rax + rax]
test ecx, ecx
jle 0x1400a7d35
mov esi, ecx
mov ecx, ecx
imul rcx, rcx, 0x38
mov rcx, qword [rax + rcx + 8]
test rcx, rcx
je 0x1400a7d37
test byte [rcx + 0x17], 0x10
je 0x1400a7d37
lea ecx, [rsi - 1]
imul rdx, rcx, 0x38
mov rdx, qword [rax + rdx + 8]
test rdx, rdx
je 0x1400a7d37
test byte [rdx + 0x15], 4
je 0x1400a7d00
jmp 0x1400a7d37
xor esi, esi
test byte [rdi + 0x6184], 4
je 0x1400a7e05
cmp byte [0x140187abe], 0
jne 0x1400a7df3
mov ecx, 1
xor r9d, r9d
movabs r10, 0xf0f0f0f0f0f0f0f1
lea r11, [0x140109b30]
lea rbx, [0x140187a9a]
nop word cs:[rax + rax]
mov rax, rcx
mul r10
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
lea r14, [r11 + r9]
mov r15, r14
sub r15, rdx
mov rax, r9
mul r10
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
sub r14, rdx
movzx eax, byte [r14 + 0x2199]
xor al, byte [r9 + r11 + 0x21aa]
mov byte [r9 + rbx], al
movzx eax, byte [r15 + 0x219a]
xor al, byte [r9 + r11 + 0x21ab]
mov byte [r9 + rbx + 1], al
add r9, 2
add rcx, 2
cmp r9, 0x24
jne 0x1400a7d80
mov byte [0x140187abe], 1
lea rcx, [0x140187a9a]
mov edx, r8d
mov r8d, esi
call fcn.140086520
mov ecx, esi
mov dl, 1
call fcn.1400a7b50
mov rax, qword [rdi + 0x4ba8]
test rax, rax
je 0x1400a7e21
mov byte [rax + 0x179], 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a8280
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov edi, ecx
mov rbx, qword [0x140186d50]
cmp qword [rbx + 0x4ba8], rdx
je 0x1400a83e8
test byte [rbx + 0x6184], 2
mov rax, rbx
je 0x1400a83ae
test rsi, rsi
je 0x1400a82bf
mov r8, qword [rsi + 8]
jmp 0x1400a82f0
lea r8, [0x140187514]
cmp byte [0x14018751b], 0
jne 0x1400a82f0
mov dword [0x140187514], 0x4c554e3c
mov word [0x140187518], 0x3e4c
mov byte [0x14018751a], 0
mov byte [0x14018751b], 1
cmp byte [0x140187b1a], 0
jne 0x1400a8398
mov ecx, 1
xor r9d, r9d
movabs r10, 0x642c8590b21642c9
lea r11, [0x140109b30]
lea r14, [0x140187afe]
nop dword [rax]
mov rax, rcx
mul r10
mov r15, rcx
sub r15, rdx
shr r15, 1
add r15, rdx
shr r15, 4
mov rax, r9
mul r10
imul rax, r15, 0xffffffffffffffe9
mov r15, r9
sub r15, rdx
shr r15, 1
add r15, rdx
shr r15, 4
imul rdx, r15, 0xffffffffffffffe9
lea r15, [r11 + r9]
movzx edx, byte [rdx + r15 + 0x22d7]
xor dl, byte [r9 + r11 + 0x22ee]
mov byte [r9 + r14], dl
movzx eax, byte [rax + r15 + 0x22d8]
xor al, byte [r9 + r11 + 0x22ef]
mov byte [r9 + r14 + 1], al
add r9, 2
add rcx, 2
cmp r9, 0x1c
jne 0x1400a8320
mov byte [0x140187b1a], 1
lea rcx, [0x140187afe]
mov rdx, r8
call fcn.140086520
mov rax, qword [0x140186d50]
mov qword [rbx + 0x4ba8], rsi
mov qword [rbx + 0x4bf8], 0xffffffffffffffff
mov word [rbx + 0x4c40], 0
mov byte [rbx + 0x4c05], 0
mov cl, 1
cmp byte [rax + 0x4c41], 0
jne 0x1400a83e2
movzx ecx, byte [rax + 0x4c05]
mov byte [rax + 0x4c04], cl
movsxd r14, dword [rsi + 0x170]
mov dword [rbx + 0x4bb0], edi
mov dword [rbx + 0x4bb8], r14d
mov ecx, dword [rbx + 0x49fc]
call fcn.1400a3530
mov dword [rsi + r14*4 + 0x3c0], edi
cmp dword [rbx + 0x4a40], edi
jne 0x1400a8439
shl r14, 4
movsd xmm0, qword [rsi + 0x128]
movlhps xmm0, xmm0
movups xmm1, xmmword [rbx + 0x4a5c]
subps xmm1, xmm0
movups xmmword [rsi + r14 + 0x3c8], xmm1
mov eax, dword [rbx + 0x4110]
and eax, 0xfffffffe
cmp eax, 2
jne 0x1400a8450
mov byte [rbx + 0x4c03], 1
jmp 0x1400a8457
mov byte [rbx + 0x4c02], 1
mov rax, qword [0x140186d50]
mov rcx, qword [rax + 0x4ba8]
mov rcx, qword [rcx + 0x3a8]
movsxd rax, dword [rax + 0x4bb8]
mov dword [rcx + rax*8 + 0x3e8], 0x7f7fffff
mov rax, qword [0x140186d50]
mov rcx, qword [rax + 0x4ba8]
mov rcx, qword [rcx + 0x3a8]
movsxd rax, dword [rax + 0x4bb8]
mov dword [rcx + rax*8 + 0x3ec], 0x7f7fffff
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a8da0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov rax, qword [0x140183d00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, qword [0x140186d50]
cmp byte [r14 + 0x6140], 0
je 0x1400a8e58
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rsp + 0x20], rdi
lea rbx, [r14 + 0x6150]
cmp qword [r14 + 0x6148], 0
je 0x1400a8e4a
xor ebp, ebp
mov rcx, rbx
xor edx, edx
call fcn.1400878c0
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140087ac0
mov r9, qword [r14 + 0x6148]
mov eax, dword [r14 + 0x6150]
sub eax, 1
cmovb eax, ebp
movsxd r8, eax
mov rax, qword [r14 + 0x6158]
test rax, rax
lea rcx, [0x140186d58]
cmovne rcx, rax
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400a8e58
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140087ac0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400f0d70
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400a96b0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rbx, qword [0x140186d50]
cmp byte [rbx + 0x80], 0
jne 0x1400a96fd
cmp byte [0x140187dc4], 0
jne 0x1400a96e7
mov dword [0x140187dc0], 0x232323
mov byte [0x140187dc4], 1
lea rdx, [0x140187dc0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_strstr
test rax, rax
cmovne rsi, rax
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
lea rcx, [rbx + 0x60c0]
movsxd r14, dword [rbx + 0x60c0]
and eax, 0xfffffffc
lea edx, [rax + r14]
add edx, 0x18
mov ebp, eax
add ebp, 0x18
call fcn.1400878c0
mov rax, qword [rbx + 0x60c8]
mov dword [rax + r14], ebp
mov rax, qword [rbx + 0x60c8]
lea rcx, [rax + r14]
lea rbx, [rax + r14]
add rbx, 4
xorps xmm0, xmm0
movups xmmword [rax + r14 + 4], xmm0
test rdi, rdi
je 0x1400a97c6
lea rax, [rdi - 1]
lea rdx, [rsi + 2]
mov r8d, 0xffffffff
lea r9, [0x140109410]
mov r11d, 0xffffffff
jmp 0x1400a97a6
movzx ebp, r10b
mov r10d, r11d
shr r10d, 8
movzx r11d, r11b
xor r11d, ebp
xor r10d, dword [r9 + r11*4]
inc rdx
mov r11d, r10d
add rax, 0xffffffffffffffff
jae 0x1400a9830
movzx r10d, byte [rdx - 2]
cmp rax, 2
jb 0x1400a9780
cmp r10b, 0x23
jne 0x1400a9780
cmp byte [rdx - 1], 0x23
jne 0x1400a9780
cmp byte [rdx], 0x23
cmove r11d, r8d
jmp 0x1400a9780
movzx eax, byte [rsi]
test al, al
je 0x1400a982a
lea rdx, [rsi + 2]
mov r8d, 0xffffffff
lea r9, [0x140109410]
mov r11d, 0xffffffff
jmp 0x1400a9810
movzx ebp, r10b
mov r10d, r11d
shr r10d, 8
movzx r11d, r11b
xor r11d, ebp
xor r10d, dword [r9 + r11*4]
inc rdx
mov r11d, r10d
test al, al
je 0x1400a9830
mov r10d, eax
movzx eax, byte [rdx - 1]
cmp r10b, 0x23
jne 0x1400a97f0
cmp al, 0x23
jne 0x1400a97f0
cmp byte [rdx], 0x23
cmove r11d, r8d
jmp 0x1400a97f0
mov r10d, 0xffffffff
not r10d
mov dword [rcx + 4], r10d
add rcx, 0x14
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400ab6e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [0x140186d50]
test rcx, rcx
je 0x1400ab716
andps xmm1, xmmword [0x140114fb0]
movss xmm0, dword [0x140115180]
mulss xmm1, xmm0
addss xmm1, dword [rdi + 0x40b8]
minss xmm1, xmm0
jmp 0x1400ab719
xorps xmm1, xmm1
movss dword [rdi + 0x40b8], xmm1
cmp qword [rdi + 0x40a0], rsi
je 0x1400ab82f
test byte [rdi + 0x6184], 0x40
je 0x1400ab800
test rsi, rsi
je 0x1400ab746
mov r8, qword [rsi + 8]
jmp 0x1400ab76e
lea r8, [0x1401886f0]
cmp byte [0x1401886f5], 0
jne 0x1400ab76e
mov dword [0x1401886f0], 0x4c4c554e
mov byte [0x1401886f4], 0
mov byte [0x1401886f5], 1
cmp byte [0x14018a9ea], 0
jne 0x1400ab7f1
xor ecx, ecx
movabs r9, 0xcccccccccccccccd
lea r10, [0x140109b30]
lea r11, [0x14018a9ca]
nop word cs:[rax + rax]
mov rax, rcx
mul r9
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
lea rdx, [r10 + rcx]
sub rdx, rax
movzx eax, byte [rdx + 0xa653]
movzx edx, byte [rdx + 0xa654]
xor al, byte [rcx + r10 + 0xa667]
xor dl, byte [rcx + r10 + 0xa668]
mov byte [rcx + r11], al
mov byte [rcx + r11 + 1], dl
add rcx, 2
cmp rcx, 0x20
jne 0x1400ab7a0
mov byte [0x14018a9ea], 1
lea rcx, [0x14018a9ca]
mov rdx, r8
call fcn.140086520
mov qword [rdi + 0x40a0], rsi
mov rax, qword [rdi + 0x110]
mov qword [rdi + 0x40a8], rax
test rsi, rsi
jne 0x1400ab82f
mov dword [rdi + 0x40b0], 0xffffffff
mov qword [rdi + 0x40c4], 0
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400abd40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov esi, ecx
mov rbx, qword [0x140186d50]
test ecx, ecx
jne 0x1400abe2a
mov rax, qword [rbx + 0x4ba8]
mov rcx, qword [rax + 0x3b8]
test rcx, rcx
je 0x1400abd79
cmp byte [rcx + 0xcb], 0
jne 0x1400abd7c
mov rcx, rax
mov qword [rbx + 0x4ba8], rcx
mov qword [rbx + 0x4bf8], 0xffffffffffffffff
test byte [rbx + 0x6184], 2
je 0x1400abe2a
mov r8, qword [rcx + 8]
mov r9, qword [rax + 8]
cmp byte [0x14018ab3a], 0
jne 0x1400abe1b
xor ecx, ecx
movabs r10, 0x8888888888888889
lea r11, [0x140109b30]
lea rdi, [0x14018ab00]
nop word cs:[rax + rax]
mov rax, rcx
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
lea rdx, [r11 + rcx]
movzx ebp, byte [rax + rdx + 0xa976]
movzx eax, byte [rax + rdx + 0xa977]
xor bpl, byte [rcx + r11 + 0xa994]
xor al, byte [rcx + r11 + 0xa995]
mov byte [rcx + rdi], bpl
mov byte [rcx + rdi + 1], al
add rcx, 2
cmp rcx, 0x3a
jne 0x1400abdd0
mov byte [0x14018ab3a], 1
lea rcx, [0x14018ab00]
mov rdx, r9
call fcn.140086520
mov rdi, qword [rbx + 0x4ba8]
movsxd r14, esi
mov ebp, dword [rdi + r14*4 + 0x3c0]
test ebp, ebp
je 0x1400abefa
mov rbx, r14
shl rbx, 4
mov r15, qword [0x140186d50]
mov dword [r15 + 0x4bb0], ebp
mov dword [r15 + 0x4bb8], esi
mov dword [r15 + 0x4bb4], 0
lea rcx, [r15 + 0x4bd0]
xor edx, edx
call fcn.14009fd80
mov rax, qword [r15 + 0x4ba8]
mov dword [rax + r14*4 + 0x3c0], ebp
mov rax, qword [r15 + 0x4ba8]
movups xmm0, xmmword [rdi + rbx + 0x3c8]
movups xmmword [rax + rbx + 0x3c8], xmm0
mov rax, qword [0x140186d50]
mov rcx, qword [rax + 0x4ba8]
mov rcx, qword [rcx + 0x3a8]
movsxd rax, dword [rax + 0x4bb8]
mov dword [rcx + rax*8 + 0x3e8], 0x7f7fffff
mov rax, qword [0x140186d50]
mov rcx, qword [rax + 0x4ba8]
mov rcx, qword [rcx + 0x3a8]
movsxd rax, dword [rax + 0x4bb8]
mov dword [rcx + rax*8 + 0x3ec], 0x7f7fffff
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [rbx + 0x4bb8], esi
mov rcx, rdi
mov dl, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400a1300
Function at 0x1400b45a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
movaps xmm6, xmm2
mov rbx, rdx
mov rdi, rcx
mov r15, qword [rsp + 0x90]
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 4
cdqe
imul rax, rax, 0x66666667
mov rcx, rax
shr rcx, 0x3f
shr rax, 0x21
add eax, ecx
shl eax, 2
movsxd rcx, eax
call fcn.140086700
mov r14, rax
movzx ecx, byte [rbx]
test cl, cl
je 0x1400b46a9
add rbx, 5
mov rax, r14
nop word cs:[rax + rax]
movsx edx, cl
xor ecx, ecx
cmp dl, 0x5c
setge cl
xor ecx, 0xffffffdd
add ecx, edx
movsx r8d, byte [rbx - 4]
xor edx, edx
cmp r8d, 0x5c
setge dl
xor edx, 0xffffffdd
add edx, r8d
movsx r9d, byte [rbx - 3]
xor r8d, r8d
cmp r9d, 0x5c
setge r8b
xor r8d, 0xffffffdd
add r8d, r9d
movsx r9d, byte [rbx - 2]
xor r10d, r10d
cmp r9d, 0x5c
setge r10b
xor r10d, 0xffffffdd
add r10d, r9d
movsx r9d, byte [rbx - 1]
xor r11d, r11d
cmp r9d, 0x5c
setge r11b
xor r11d, 0xffffffdd
add r11d, r9d
imul r9d, r11d, 0x55
add r9d, r10d
imul r9d, r9d, 0x55
add r9d, r8d
imul r8d, r9d, 0x55
add r8d, edx
imul edx, r8d, 0x55
add edx, ecx
mov dword [rax], edx
add rax, 4
movzx ecx, byte [rbx]
add rbx, 5
test cl, cl
jne 0x1400b4610
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, r14
movaps xmm3, xmm6
call fcn.1400b4820
mov rsi, rax
mov rcx, r14
call fcn.140086990
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400be310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
movaps xmm6, xmm2
mov rsi, rdx
movzx eax, word [rsp + 0x88]
movsxd rdx, dword [rcx + 0x18]
cmp rax, rdx
jae 0x1400be348
mov rdx, qword [rcx + 0x20]
movzx eax, word [rdx + rax*2]
cmp rax, 0xffff
jne 0x1400be356
mov rbx, qword [rcx + 0x38]
test rbx, rbx
jne 0x1400be36b
jmp 0x1400be4bf
lea rbx, [rax + rax*4]
shl rbx, 3
add rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x1400be4bf
mov eax, dword [rbx]
test al, 2
je 0x1400be4bf
mov edx, dword [rsp + 0x80]
mov edi, edx
or edi, 0xffffff
test al, 1
cmove edi, edx
xorps xmm0, xmm0
ucomiss xmm6, xmm0
jae 0x1400be39b
movss xmm6, dword [0x140107640]
jmp 0x1400be3a0
divss xmm6, dword [rcx + 0x14]
movsd xmm0, qword [r9]
cvttps2dq xmm0, xmm0
cvtdq2ps xmm7, xmm0
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.1400b04f0
mov eax, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
mov r8d, dword [rbx + 0x1c]
mov ecx, dword [rbx + 0x18]
shufps xmm6, xmm6, 0
movsd xmm1, qword [rbx + 8]
movsd xmm0, qword [rbx + 0x10]
mulps xmm1, xmm6
addps xmm1, xmm7
mov r9d, dword [rsi + 0x34]
mov r10, qword [rsi + 0x48]
lea r11d, [r9 + 1]
lea ebx, [r9 + 2]
mov word [r10], r9w
mov r10, qword [rsi + 0x48]
mov word [r10 + 2], r11w
mov r10, qword [rsi + 0x48]
mov word [r10 + 4], bx
mov r10, qword [rsi + 0x48]
mov word [r10 + 6], r9w
add r9d, 3
movaps xmm2, xmm1
shufps xmm2, xmm1, 0x55
mulps xmm0, xmm6
addps xmm0, xmm7
mov r10, qword [rsi + 0x48]
mov word [r10 + 8], bx
mov r10, qword [rsi + 0x48]
mov word [r10 + 0xa], r9w
mov r9, qword [rsi + 0x40]
movlps qword [r9], xmm1
mov r9, qword [rsi + 0x40]
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], r8d
mov r9, qword [rsi + 0x40]
mov dword [r9 + 0x10], edi
mov r9, qword [rsi + 0x40]
movss dword [r9 + 0x14], xmm0
movss dword [r9 + 0x18], xmm2
mov r9, qword [rsi + 0x40]
mov dword [r9 + 0x1c], edx
mov dword [r9 + 0x20], r8d
mov r8, qword [rsi + 0x40]
mov dword [r8 + 0x24], edi
mov r8, qword [rsi + 0x40]
movlps qword [r8 + 0x28], xmm0
mov r8, qword [rsi + 0x40]
mov dword [r8 + 0x30], edx
mov dword [r8 + 0x34], eax
mov rdx, qword [rsi + 0x40]
mov dword [rdx + 0x38], edi
mov rdx, qword [rsi + 0x40]
movss dword [rdx + 0x3c], xmm1
shufps xmm0, xmm0, 0x55
movss dword [rdx + 0x40], xmm0
mov rdx, qword [rsi + 0x40]
mov dword [rdx + 0x44], ecx
mov dword [rdx + 0x48], eax
mov rax, qword [rsi + 0x40]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x40], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x48], 0xc
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400d16f0
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx + 0x360]
mov edx, 1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0x20001
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400d1732
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400f2110
add rsp, 0x38
ret

Function at 0x1400d1740
Capabilities:
Register raw input devices

Disassembly:
sub rsp, 0x38
mov edx, 1
mov dword [rsp + 0x20], 0x20001
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x28], 0
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400d1782
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400f2110
add rsp, 0x38
ret

Function at 0x1400d1790
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [0x140198e48], rcx
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400d17e9
mov rcx, qword [rbx + 0x360]
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [rsp + 0x40]
movd xmm1, dword [rsp + 0x44]
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
movsd qword [0x140198e38], xmm0
movsd qword [0x140198e40], xmm1
mov eax, dword [rbx + 0x8c]
cmp eax, 0x34001
je 0x1400d1806
cmp eax, 0x34004
je 0x1400d1806
mov rcx, qword [0x140198e68]
jmp 0x1400d1825
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x1400d1815
mov rcx, qword [rcx + 8]
jmp 0x1400d1825
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, rbx
call fcn.1400ccf00
mov rcx, rbx
call fcn.1400d1670
cmp dword [rbx + 0x208], 0
je 0x1400d1882
mov rax, qword [rbx + 0x360]
lea rcx, [rsp + 0x20]
mov edx, 1
mov qword [rsp + 0x20], 0x20001
mov qword [rsp + 0x28], rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1400d1882
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400f2110
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret