joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53ee00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f053
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x68], rcx
mov rsi, qword [rax + 0x60]
test rsi, rsi
jle 0x53ef30
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x53f045
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x20]
cmp rbx, rsi
je 0x53eea2
mov rax, rsi
mov rcx, r8
call fcn.004637c0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x60]
add rsi, r8
mov qword [rax + 0x60], rsi
cmp rsi, 0x40
jne 0x53ef0c
mov qword [rsp], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0053f5a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x53f03c
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x53ef40
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x53efe0
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x53f034
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.0053f5a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x53f02f
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
je 0x53f01e
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x20]
cmp rbx, rdi
je 0x53f01a
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.004637c0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x60], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00462f00
mov rdx, r9
call fcn.00462ec0
mov rax, r8
nop
call fcn.00462f00
mov rax, rsi
mov ecx, 0x40
call fcn.00462f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0053ee00
Function at 0x56c920
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x56c938
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x56c938
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x56c940
xor eax, eax
ret
cmp rbx, 3
je 0x56c94c
cmp rbx, 4
jne 0x56c979
cmp al, 0x2c
ja 0x56c966
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x56c976
cmp al, 0x24
je 0x56c976
nop dword [rax]
cmp al, 0x26
jae 0x56c976
jmp 0x56c979
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x56c976
cmp al, 0x5b
je 0x56c976
cmp al, 0x5d
jne 0x56c979
xor eax, eax
ret
cmp al, 0x2f
ja 0x56c9b2
nop dword [rax]
cmp al, 0x26
ja 0x56c991
cmp al, 0x24
je 0x56c9d1
cmp al, 0x26
je 0x56c9d1
jmp 0x56ca4b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x56c9d1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x56ca48
cmp al, 0x2f
je 0x56c9d1
jmp 0x56ca4b
cmp al, 0x3d
ja 0x56c9c9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x56c9d1
nop
cmp al, 0x3d
je 0x56c9d1
jmp 0x56ca4b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x56ca40
cmp rbx, 2
jg 0x56ca07
cmp rbx, 1
je 0x56ca01
nop dword [rax]
cmp rbx, 2
jne 0x56ca4b
cmp al, 0x2f
je 0x56c9f2
cmp al, 0x3b
je 0x56c9f2
cmp al, 0x2c
jne 0x56c9f9
mov ecx, 1
jmp 0x56c9fe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x56ca2a
cmp al, 0x40
je 0x56ca19
cmp al, 0x2f
je 0x56ca19
cmp al, 0x3f
jne 0x56ca22
mov ecx, 1
nop
jmp 0x56ca27
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x56ca39
cmp rbx, 7
jne 0x56ca4b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x56ca48
cmp al, 0x7e
jne 0x56ca4b
xor eax, eax
ret
cmp rbx, 7
jne 0x56ca61
cmp al, 0x21
je 0x56ca5d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x56ca61
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x571800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x571a53
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rsi, qword [rax + 0x50]
test rsi, rsi
jle 0x571930
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x571a45
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x10]
cmp rbx, rsi
je 0x5718a2
mov rax, rsi
mov rcx, r8
call fcn.004637c0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x50]
add rsi, r8
mov qword [rax + 0x50], rsi
cmp rsi, 0x40
jne 0x57190c
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00571d40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x571a3c
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x571940
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x5719e0
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x571a34
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.00571d40
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x571a2f
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
je 0x571a1e
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x571a1a
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.004637c0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x50], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00462f00
mov rdx, r9
call fcn.00462ec0
mov rax, r8
nop
call fcn.00462f00
mov rax, rsi
mov ecx, 0x40
call fcn.00462f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00571800
Function at 0x583860
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5839b4
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.00582c80
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x583904
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x583955
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x583980
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x5838fe
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x5838fe
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x58396c
mov rax, rsi
mov ecx, 0x20
call fcn.00462e40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00460760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00583860
Function at 0x5cb880
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5cb955
movdqa xmm0, xmmword [0x00755180]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5cb8c1
movdqa xmm0, xmmword [0x00755190]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5cb9d7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5cb9ab
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x007549a0]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x007555f0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5d9540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5d96ef
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5d9567
inc rcx
cmp rbx, rcx
jle 0x5d96e1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5d9564
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0055fc80
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x008de110]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005d55e0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5d96d0
test rdx, rdx
je 0x5d96c1
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5d968b
xor eax, eax
lea rbx, [0x00754798]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006cfe15]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044d000
jmp 0x5d96b2
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x006cfd5e]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044cf20
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005d9540
Function at 0x1400039a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x140123c10]
lea rcx, [rbp - 0x60]
movdqa xmm1, xmmword [0x140123c00]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x30], 0x716d3c21
movdqa xmm0, xmmword [0x140123ae0]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x2c], 0x36352669
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x28], 0x1003b2f
call fcn.140006d70
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140123c10]
lea rcx, [rbp - 0x60]
movdqa xmm1, xmmword [0x140123b90]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x30], 0x3a23562e
movdqa xmm0, xmmword [0x140123a70]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x2c], 0x286b736b
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x28], 0x3d2d343b
mov word [rbp - 0x24], 0x100
call fcn.140006be0
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140123c10]
lea rcx, [rbp - 0x60]
movdqa xmm1, xmmword [0x140123be0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140123a80]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [str..DQ9ff_3__]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov byte [rbp - 0x20], 1
call fcn.140006a40
lea rcx, [rbp - 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140123b80]
lea rcx, [rbp - 0x60]
movdqa xmm1, xmmword [0x140123a90]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x40], Ordinal_50
movdqu xmmword [rbp - 0x50], xmm1
mov byte [rbp - 0x3e], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140123ad0]
lea rcx, [rbp - 0x60]
movdqa xmm1, xmmword [0x140123b40]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x36], 0x31263e
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x40], 0x20462f20
mov dword [rbp - 0x3c], 0x6c756e3e
mov word [rbp - 0x38], 0x3220
mov byte [rbp - 0x32], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140123bd0]
xor eax, eax
movdqa xmm1, xmmword [0x140123c40]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140123b20]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140123af0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140123b00]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x1a11024d
mov dword [rbp - 0xc], 0x1001703
nop dword [rax]
lea ecx, [rax - 0x2f]
xor byte [rbp + rax - 0x60], cl
lea ecx, [rax - 0x2e]
xor byte [rbp + rax - 0x5f], cl
add rax, 2
cmp rax, 0x56
jb 0x140003b60
lea rcx, [rbp - 0x60]
mov byte [rbp - 9], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x80
pop rbp
ret
Function at 0x140004940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
mov r8, rcx
je 0x1400049cb
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop dword [rax + rax]
lea edx, [r9 + rax]
lea ecx, [rdx - 0x2f]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx - 0x2e]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 0x2d]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 0x2c]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 0x2b]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 0x2a]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 0x29]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 0x28]
xor byte [rax - 9], cl
lea ecx, [rdx - 0x27]
xor byte [rax - 8], cl
lea ecx, [rdx - 0x26]
xor byte [rax - 7], cl
lea ecx, [rdx - 0x25]
xor byte [rax - 6], cl
lea ecx, [rdx - 0x24]
xor byte [rax - 5], cl
lea ecx, [rdx - 0x23]
xor byte [rax - 4], cl
sub dl, 0x22
xor byte [rax - 3], dl
lea rcx, [rax + r9]
cmp rcx, 0x46
jb 0x140004960
mov byte [r8 + 0x47], 0
mov rax, r8
ret

Function at 0x140005240
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140005268
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2f]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x140005250
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x1400289d0
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
xor ecx, ecx
jmp fcn.1400289e0

Function at 0x1400289e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140141940]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140141ee0]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x1fa5], 0
jne 0x140028a47
cmp byte [rbx + 0x1fa6], 0
jne 0x140028a47
mov r9d, dword [rbx + 0x2fe4]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140030fc0
test sil, 1
je 0x140028b76
jmp 0x140028adf
movss xmm1, dword [rbx + 0x1610]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400fd1ec]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400fd1e0]
addss xmm0, dword [rbx + 0x130]
addss xmm1, dword [rbx + 0x134]
or dword [rbx + 0x1b28], 1
mov qword [rbx + 0x1b40], rax
movss dword [rbx + 0x1b38], xmm0
mov dword [rbx + 0x1b2c], 1
movss dword [rbx + 0x1b3c], xmm1
movss xmm0, dword [rbx + 0x166c]
mov rax, qword [0x140141ee0]
mulss xmm0, dword [0x1400fd194]
or dword [rax + 0x1b28], 0x40
movss dword [rax + 0x1b88], xmm0
mov r9d, dword [rbx + 0x2fe4]
call fcn.140030fc0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140028b30
lea r11, [0x1400f7e40]
nop
cmp r9b, 0x23
jne 0x140028b13
cmp byte [r8], r9b
jne 0x140028b13
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140028b00
not ecx
call fcn.14002d5c0
test rax, rax
je 0x140028b76
cmp byte [rax + 0x7e], 0
je 0x140028b76
mov byte [rax + 0x85], 1
lea r8, str.Tooltip__02d
mov dword [rax + 0x9c], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2fe4]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x2fe4]
call fcn.140030fc0
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400252b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f1fc0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14002d640
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x14002d690
lea r11, [0x1400f7e40]
cmp r9b, 0x23
jne 0x14002d673
cmp byte [r8], r9b
jne 0x14002d673
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14002d660
not ecx
jmp fcn.14002d5c0
Function at 0x14002ea70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r8, qword [0x140141ee0]
mov rsi, rcx
mov rbp, rcx
shr rsi, 0x38
mov r14, rcx
shr rbp, 0x30
mov r15, rcx
shr r14, 0x28
mov rdi, qword [r8 + 0x1a88]
mov r12, rcx
mov r13, rcx
shr r15, 0x20
mov rax, rcx
shr r12, 0x18
shr rax, 8
mov rbx, rcx
shr r13, 0x10
cmp dword [rdi + 0xc0], 0
mov qword [rsp + 0x50], rax
jg 0x14002eafd
mov r8d, 0x55e
lea rdx, str.C:UserselilaDownloadsKeyAuth_IMGUI_LoginExample_masterKeyAuth_IMGUI_LoginExample_masterimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r8, qword [0x140141ee0]
movsxd rcx, dword [rdi + 0xc0]
lea r9, [0x1400f7e40]
mov rax, qword [rdi + 0xc8]
mov edx, dword [rax + rcx*4 - 4]
not edx
movzx eax, bl
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x50]
xor edx, dword [r9 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, r13b
xor edx, dword [r9 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, r12b
xor edx, dword [r9 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, r15b
xor edx, dword [r9 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, r14b
xor edx, dword [r9 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, bpl
xor edx, dword [r9 + rcx*4]
movzx ecx, dl
shr edx, 8
xor rcx, rax
xor edx, dword [r9 + rcx*4]
movzx ecx, dl
shr edx, 8
xor rcx, rsi
xor edx, dword [r9 + rcx*4]
not edx
cmp dword [r8 + 0x1ad0], edx
jne 0x14002ebae
mov dword [r8 + 0x1ad4], edx
mov eax, edx
cmp dword [r8 + 0x1b10], edx
jne 0x14002ebc1
mov byte [r8 + 0x1b14], 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14002ebe0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc0], 0
mov rbx, rcx
mov edi, edx
jg 0x14002ec16
mov r8d, 0x55e
lea rdx, str.C:UserselilaDownloadsKeyAuth_IMGUI_LoginExample_masterKeyAuth_IMGUI_LoginExample_masterimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xc8]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x1400f7e40]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140141ee0]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1ad0], edx
jne 0x14002ec90
mov dword [rax + 0x1ad4], edx
cmp dword [rax + 0x1b10], edx
jne 0x14002ec9f
mov byte [rax + 0x1b14], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret