joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001d5e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
lea r9d, [r8 + 3]
test r8d, r8d
cmovns r9d, r8d
and r9d, 0xfffffffc
jle 0x18001d63c
xor eax, eax
movaps xmm0, xmmword [0x1800f1cf0]
xor r10d, r10d
nop word cs:[rax + rax]
nop dword [rax + rax]
cdqe
movups xmm1, xmmword [rcx + rax]
movaps xmm2, xmm1
xorps xmm2, xmm0
blendps xmm2, xmm1, 5
movups xmmword [rdx + rax], xmm2
add r10d, 4
add eax, 0x10
cmp r10d, r9d
jl 0x18001d610
cmp r10d, r8d
jl 0x18001d644
add rsp, 0x18
ret
xor r10d, r10d
cmp r10d, r8d
jge 0x18001d637
movd xmm0, r10d
pshufd xmm0, xmm0, 0
por xmm0, xmmword [0x1800f1bd0]
movd xmm1, r8d
pshufd xmm1, xmm1, 0
pcmpgtd xmm1, xmm0
shl r10d, 2
movsxd r8, r10d
add rcx, r8
movmskps r11d, xmm1
mov eax, r11d
not eax
test al, 9
jne 0x18001d687
mov r9d, r11d
and r9d, 1
mov r10, rcx
jmp 0x18001d6bc
mov r9, r11
and r9, 1
jne 0x18001d723
test r11b, 2
jne 0x18001d736
test r11b, 4
jne 0x18001d74b
mov r10, rsp
test r11b, 8
je 0x18001d6bc
movd xmm0, dword [rcx + 0xc]
movd dword [rsp + 0xc], xmm0
movups xmm1, xmmword [r10]
movaps xmm0, xmmword [0x1800f1cf0]
xorps xmm0, xmm1
blendps xmm0, xmm1, 5
test r9, r9
je 0x18001d6db
movss dword [rdx + r8], xmm0
test r11b, 2
jne 0x18001d6f3
test r11b, 4
jne 0x18001d702
test r11b, 8
je 0x18001d637
jmp 0x18001d715
extractps dword [rdx + r8 + 4], xmm0, 1
test r11b, 4
je 0x18001d6e7
extractps dword [rdx + r8 + 8], xmm0, 2
test r11b, 8
je 0x18001d637
extractps dword [rdx + r8 + 0xc], xmm0, 3
add rsp, 0x18
ret
movd xmm0, dword [rcx]
movd dword [rsp], xmm0
test r11b, 2
je 0x18001d69e
movd xmm0, dword [rcx + 4]
movd dword [rsp + 4], xmm0
test r11b, 4
je 0x18001d6a8
movd xmm0, dword [rcx + 8]
movd dword [rsp + 8], xmm0
mov r10, rsp
test r11b, 8
jne 0x18001d6b1
jmp 0x18001d6bc
Function at 0x18001d770
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
lea r8d, [rdx + 3]
test edx, edx
cmovns r8d, edx
and r8d, 0xfffffffc
jle 0x18001d7bc
xor eax, eax
movaps xmm0, xmmword [0x1800f1cf0]
xor r9d, r9d
cdqe
movups xmm1, xmmword [rcx + rax]
movaps xmm2, xmm1
xorps xmm2, xmm0
blendps xmm2, xmm1, 5
movups xmmword [rcx + rax], xmm2
add r9d, 4
add eax, 0x10
cmp r9d, r8d
jl 0x18001d790
cmp r9d, edx
jl 0x18001d7c4
add rsp, 0x18
ret
xor r9d, r9d
cmp r9d, edx
jge 0x18001d7b7
movd xmm0, r9d
pshufd xmm0, xmm0, 0
por xmm0, xmmword [0x1800f1bd0]
movd xmm1, edx
pshufd xmm1, xmm1, 0
pcmpgtd xmm1, xmm0
shl r9d, 2
movsxd rax, r9d
add rcx, rax
movmskps eax, xmm1
mov edx, eax
not edx
test dl, 9
jne 0x18001d803
mov edx, eax
and edx, 1
mov r8, rcx
jmp 0x18001d82a
mov rdx, rax
and rdx, 1
jne 0x18001d87f
test al, 2
jne 0x18001d88c
test al, 4
jne 0x18001d89f
mov r8, rsp
test al, 8
je 0x18001d82a
movd xmm0, dword [rcx + 0xc]
movd dword [rsp + 0xc], xmm0
movups xmm1, xmmword [r8]
movaps xmm0, xmmword [0x1800f1cf0]
xorps xmm0, xmm1
blendps xmm0, xmm1, 5
test rdx, rdx
je 0x18001d847
movss dword [rcx], xmm0
test al, 2
jne 0x18001d859
test al, 4
jne 0x18001d864
test al, 8
je 0x18001d7b7
jmp 0x18001d873
extractps dword [rcx + 4], xmm0, 1
test al, 4
je 0x18001d84f
extractps dword [rcx + 8], xmm0, 2
test al, 8
je 0x18001d7b7
extractps dword [rcx + 0xc], xmm0, 3
add rsp, 0x18
ret
movd xmm0, dword [rcx]
movd dword [rsp], xmm0
test al, 2
je 0x18001d810
movd xmm0, dword [rcx + 4]
movd dword [rsp + 4], xmm0
test al, 4
je 0x18001d818
movd xmm0, dword [rcx + 8]
movd dword [rsp + 8], xmm0
mov r8, rsp
test al, 8
jne 0x18001d81f
jmp 0x18001d82a

Function at 0x18002e780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rax, [0x1800ef628]
mov dword [rcx + 0x14], 0x472c4400
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
mov qword [rcx + 0x3c], rax
mov qword [rcx + 0x44], rax
mov qword [rcx + 0x4c], rax
mov qword [rcx + 0x54], rax
mov qword [rcx + 0x5c], rax
mov qword [rcx + 0x64], rax
mov dword [rcx + 0x6c], eax
mov qword [rcx + 0x70], rax
mov qword [rcx + 0x80], rax
mov qword [rcx + 0x88], rax
mov qword [rcx + 0x98], rax
mov qword [rcx + 0xa0], rax
movzx eax, byte [rcx + 0xa8]
and al, 0xc9
mov dword [rcx + 0x18], 0x42c80000
or al, 9
mov dword [rcx + 0x1c], 0x42c80000
mov byte [rcx + 0xa8], al
mov rax, rcx
mov dword [rcx + 0x20], 0x3f333333
mov dword [rcx + 0x24], 0x44fa0000
mov qword [rcx + 0x28], 0x41200000
mov dword [rcx + 0x30], 0x3f800000
mov dword [rcx + 0x34], 0x3f800000
mov dword [rcx + 0x78], 0xffffffff
mov dword [rcx + 0x90], 0xffffffff
ret
Function at 0x180037010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [0x1801283de], 0
mov rdi, rdx
mov rbx, rcx
jne 0x18003704d
mov edx, dword [0x180128300]
lea rcx, str.ArrayComplexConjugate
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void___cdecl_FCsvProfilerTrace::OutputInlineStat_char_const____ptr64__int_]
mov byte [0x1801283de], 1
mov esi, dword [0x180128300]
lea r8, str.CSV_ArrayComplexConjugate
mov edx, esi
lea rcx, str.ArrayComplexConjugate
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void___cdecl_FCsvProfiler::BeginStat_char_const____ptr64__unsigned_int__char_const____ptr64_]
mov eax, dword [rbx + 8]
lea rbp, [0x1800eb948]
cmp dword [rdi + 8], eax
je 0x1800370a2
mov r9, qword [rsp + 0x38]
lea rdx, str.C:BuildAgent2work78a794e88763017dUE4EngineSourceRuntimeSignalProcessingPrivateFloatArrayMath.cpp
mov r8d, 0x56b
mov qword [rsp + 0x20], rbp
lea rcx, str.OutValues.Num____InValues.Num__
call qword [sym.imp.FactoryServer_Core.dll_public:_static_bool___cdecl_FDebug::CheckVerifyFailedImpl_char_const____ptr64__char_const____ptr64__int__void____ptr64__wchar_t_const____ptr64_]
test al, al
je 0x1800370a2
nop
int3
test byte [rbx + 8], 1
je 0x1800370d2
mov r9, qword [rsp + 0x38]
lea rdx, str.C:BuildAgent2work78a794e88763017dUE4EngineSourceRuntimeSignalProcessingPrivateFloatArrayMath.cpp
mov r8d, 0x56c
mov qword [rsp + 0x20], rbp
lea rcx, str._InValues.Num_____2___0
call qword [sym.imp.FactoryServer_Core.dll_public:_static_bool___cdecl_FDebug::CheckVerifyFailedImpl_char_const____ptr64__char_const____ptr64__int__void____ptr64__wchar_t_const____ptr64_]
test al, al
je 0x1800370d2
nop
int3
cmp byte [0x180128008], 0
movsxd r8, dword [rbx + 8]
mov rcx, qword [rbx]
mov r11, qword [rdi]
je 0x1800370f2
mov rdx, r11
call fcn.18001fbe0
jmp 0x1800371a2
movaps xmm1, xmmword [0x1800f1d10]
mov r10d, r8d
and r10d, 0xfffffffc
mov ebx, r8d
movsxd rdx, r10d
and ebx, 3
cmp rdx, 1
jl 0x180037146
mov r9, rcx
mov rax, r11
sub r9, r11
dec rdx
shr rdx, 2
inc rdx
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [r9 + rax]
lea rax, [rax + 0x10]
mulps xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
sub rdx, 1
jne 0x180037130
test ebx, ebx
je 0x1800371a2
movsxd rax, r10d
mov r9, r8
cmp rax, r8
jge 0x1800371a2
movss xmm1, dword [0x1800f1cf0]
lea r8, [r11 + 4]
sub r9, rax
lea r8, [r8 + rax*4]
dec r9
sub rcx, r11
shr r9, 1
inc r9
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx + r8 - 4]
mov dword [r8 - 4], eax
movss xmm0, dword [rcx + r8]
lea r8, [r8 + 8]
xorps xmm0, xmm1
movss dword [r8 - 8], xmm0
sub r9, 1
jne 0x180037180
mov edx, esi
lea rcx, str.ArrayComplexConjugate
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.FactoryServer_Core.dll_public:_static_void___cdecl_FCsvProfiler::EndStat_char_const____ptr64__unsigned_int_]
Function at 0x18003ebf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1801283e4], 0
mov rbx, rcx
jne 0x18003ec20
mov edx, dword [0x180128300]
lea rcx, str.ArrayUnderflowClamp
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void___cdecl_FCsvProfilerTrace::OutputInlineStat_char_const____ptr64__int_]
mov byte [0x1801283e4], 1
mov edi, dword [0x180128300]
lea r8, str.CSV_ArrayUnderflowClamp
mov edx, edi
lea rcx, str.ArrayUnderflowClamp
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void___cdecl_FCsvProfiler::BeginStat_char_const____ptr64__unsigned_int__char_const____ptr64_]
cmp byte [0x180128008], 0
movsxd rcx, dword [rbx + 8]
mov r9, qword [rbx]
mov edx, ecx
je 0x18003ec5b
mov rcx, r9
call fcn.180020f50
jmp 0x18003ed91
movaps xmm4, xmmword [0x1800f1be0]
and edx, 0xfffffffc
movaps xmm5, xmmword [0x1800f1d00]
mov r8d, ecx
and r8d, 3
movsxd r10, edx
cmp r10, 1
jl 0x18003ecb4
xor eax, eax
nop
movups xmm2, xmmword [r9 + rax*4]
movaps xmm3, xmm5
cmpltps xmm3, xmm2
movaps xmm0, xmm2
movaps xmm1, xmm2
xorps xmm1, xmmword [0x1800ec490]
cmpltps xmm0, xmm4
andps xmm3, xmm0
andps xmm3, xmm1
xorps xmm3, xmm2
movups xmmword [r9 + rax*4], xmm3
add rax, 4
cmp rax, r10
jl 0x18003ec80
test r8d, r8d
je 0x18003ed91
movsxd r8, edx
mov r10, rcx
cmp r8, rcx
jge 0x18003ed91
movss xmm2, dword [0x1800f1b70]
mov rax, rcx
movss xmm1, dword [0x1800f1a04]
sub rax, r8
cmp rax, 4
jl 0x18003ed70
sub rcx, r8
lea rax, [r9 + 8]
sub rcx, 4
lea rax, [rax + r8*4]
shr rcx, 2
inc rcx
lea r8, [r8 + rcx*4]
movss xmm0, dword [rax - 8]
comiss xmm0, xmm2
jbe 0x18003ed18
comiss xmm0, xmm1
jae 0x18003ed18
xorps xmm0, xmm0
movss dword [rax - 8], xmm0
movss xmm0, dword [rax - 4]
comiss xmm0, xmm2
jbe 0x18003ed2f
comiss xmm0, xmm1
jae 0x18003ed2f
xorps xmm0, xmm0
movss dword [rax - 4], xmm0
movss xmm0, dword [rax]
comiss xmm0, xmm2
jbe 0x18003ed45
comiss xmm0, xmm1
jae 0x18003ed45
xorps xmm0, xmm0
movss dword [rax], xmm0
movss xmm0, dword [rax + 4]
comiss xmm0, xmm2
jbe 0x18003ed5b
comiss xmm0, xmm1
jae 0x18003ed5b
xorps xmm0, xmm0
movss dword [rax + 4], xmm0
add rax, 0x10
sub rcx, 1
jne 0x18003ed06
cmp r8, r10
jge 0x18003ed91
nop
movss xmm0, dword [r9 + r8*4]
comiss xmm0, xmm2
jbe 0x18003ed83
comiss xmm0, xmm1
jae 0x18003ed83
xorps xmm0, xmm0
movss dword [r9 + r8*4], xmm0
inc r8
cmp r8, r10
jl 0x18003ed70
mov edx, edi
lea rcx, str.ArrayUnderflowClamp
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.FactoryServer_Core.dll_public:_static_void___cdecl_FCsvProfiler::EndStat_char_const____ptr64__unsigned_int_]
Function at 0x1800623a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x3c], 0
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1800623cb
call sym.FactoryServer_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::UpdateSettings_void____ptr64
mov ecx, dword [rbx + 0xc]
test ecx, ecx
je 0x180062412
sub ecx, 1
je 0x1800623f7
cmp ecx, 1
jne 0x180062412
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov r8, rsi
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, rbx
call sym.FactoryServer_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::ProcessHighShelf_float_const____ptr64__float____ptr64__float_const____ptr64__int____ptr64
jmp 0x18006242b
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov r8, rsi
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, rbx
call sym.FactoryServer_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::ProcessLowShelf_float_const____ptr64__float____ptr64__float_const____ptr64__int____ptr64
jmp 0x18006242b
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov r8, rsi
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, rbx
call sym.FactoryServer_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::ProcessBell_float_const____ptr64__float____ptr64__float_const____ptr64__int____ptr64
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp sym.FactoryServer_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::ClearFilterDenormals_void____ptr64
Function at 0x180092060
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
mov r9, rdx
mov edx, ecx
test r8d, r8d
jle 0x1800920d5
cmp r8d, 0x10
jb 0x1800920d5
movaps xmm2, xmmword [0x1800f61c0]
lea rax, [r9 + 0x20]
movsxd r10, r8d
and r10, 0xfffffffffffffff0
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add edx, 0x10
movaps xmm1, xmm2
add rcx, 0x10
mulps xmm1, xmm0
movups xmmword [rax - 0x60], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [rax - 0x50]
mulps xmm0, xmm2
movups xmmword [rax - 0x50], xmm0
movups xmm0, xmmword [rax - 0x40]
mulps xmm1, xmm0
movups xmmword [rax - 0x40], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [rax - 0x30]
mulps xmm1, xmm0
movups xmmword [rax - 0x30], xmm1
cmp rcx, r10
jl 0x180092090
movsxd rcx, edx
movsxd r8, r8d
cmp rcx, r8
jge 0x180092141
movaps xmm2, xmmword [0x1800f1cf0]
mov rax, r8
sub rax, rcx
cmp rax, 4
jl 0x18009212a
mov rdx, r8
lea rax, [r9 + 8]
sub rdx, rcx
lea rax, [rax + rcx*4]
sub rdx, 4
shr rdx, 2
inc rdx
lea rcx, [rcx + rdx*4]
movups xmm0, xmmword [rax - 8]
lea rax, [rax + 0x10]
xorps xmm0, xmm2
movups xmmword [rax - 0x18], xmm0
sub rdx, 1
jne 0x180092110
cmp rcx, r8
jge 0x180092141
movss xmm0, dword [r9 + rcx*4]
xorps xmm0, xmm2
movss dword [r9 + rcx*4], xmm0
inc rcx
cmp rcx, r8
jl 0x18009212a
ret

Function at 0x180093fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 8]
jmp sym.FactoryServer_SignalProcessing.dll_public:_bool___cdecl_Audio::FSpectrumAnalyzer::PerformAnalysisIfPossible_bool____ptr64
Function at 0x1800a32b0
Capabilities:
Encode data using xor

Disassembly:
movsxd rcx, dword [rsp + 0x28]
mov r10, r9
movss xmm3, dword [0x1800f1cf0]
movaps xmm0, xmm2
mov r9, rcx
xorps xmm0, xmm3
movaps xmm1, xmm2
and r9, 0xfffffffffffffffc
sub rdx, r10
unpcklps xmm1, xmm0
movlhps xmm1, xmm1
test r9, r9
jle 0x1800a3305
lea r8, [r9 - 1]
mov rax, r10
shr r8, 2
inc r8
nop dword [rax]
movups xmm0, xmmword [rdx + rax]
lea rax, [rax + 0x10]
mulps xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
sub r8, 1
jne 0x1800a32f0
cmp r9, rcx
jge 0x1800a3349
sub rcx, r9
lea rax, [r10 + 4]
dec rcx
lea rax, [rax + r9*4]
shr rcx, 1
inc rcx
nop
lea rax, [rax + 8]
movaps xmm0, xmm2
mulss xmm0, dword [rax + rdx - 0xc]
movaps xmm1, xmm2
movss dword [rax - 0xc], xmm0
mulss xmm1, dword [rax + rdx - 8]
xorps xmm1, xmm3
movss dword [rax - 8], xmm1
sub rcx, 1
jne 0x1800a3320
ret
Function at 0x1800ac290
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov eax, dword [rcx + 0x44]
mov ebp, edx
movaps xmmword [rsp + 0x50], xmm6
mov rbx, rcx
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x20], xmm9
mov edi, r8d
test eax, eax
je 0x1800ac40f
xor r15d, r15d
xor eax, eax
lock cmpxchg dword [rcx + 0x1c], r15d
mov ecx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x20], r15d
cmp eax, ecx
jl 0x1800ac2e6
sub eax, ecx
jmp 0x1800ac2eb
sub eax, ecx
add eax, dword [rbx + 0x18]
cmp eax, ebp
jge 0x1800ac40f
test r8d, r8d
je 0x1800ac44e
cmp dword [rbx + 0x18], ebp
jb 0x1800ac44e
mov rsi, qword [rbx + 0x48]
nop
test rsi, rsi
jne 0x1800ac332
xor ecx, ecx
call qword [sym.imp.FactoryServer_Core.dll_public:_static_class_FEvent____ptr64___cdecl_FGenericPlatformProcess::GetSynchEventFromPool_bool_]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [rbx + 0x48], rcx
mov rsi, rax
jne 0x1800ac32c
mov rsi, rcx
jmp 0x1800ac332
call qword [sym.imp.FactoryServer_Core.dll_public:_static_void___cdecl_FGenericPlatformProcess::ReturnSynchEventToPool_class_FEvent____ptr64_]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [sym.imp.FactoryServer_Core.dll_double_FGenericPlatformTime::SecondsPerCycle]
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x90]
movsd xmm7, qword [0x1800f5e60]
xorps xmm0, xmm0
mulsd xmm6, qword [rax]
mov eax, dword [rbx + 0x44]
cvtsi2sd xmm0, rdi
addsd xmm6, xmm7
mulsd xmm0, qword [0x1800f5de8]
addsd xmm6, xmm0
test eax, eax
je 0x1800ac40f
movsd xmm8, qword [0x1800f5e48]
xorps xmm9, xmm9
xor eax, eax
lock cmpxchg dword [rbx + 0x1c], r15d
mov ecx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x20], r15d
cmp eax, ecx
jl 0x1800ac3aa
sub eax, ecx
jmp 0x1800ac3af
sub eax, ecx
add eax, dword [rbx + 0x18]
cmp eax, ebp
jge 0x1800ac40f
mov rax, qword [rsi]
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call qword [rax + 0x20]
cmp edi, 0xffffffff
je 0x1800ac408
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [sym.imp.FactoryServer_Core.dll_double_FGenericPlatformTime::SecondsPerCycle]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0xa8]
movaps xmm1, xmm6
mulsd xmm0, qword [rax]
addsd xmm0, xmm7
subsd xmm1, xmm0
mulsd xmm1, xmm8
comisd xmm1, xmm9
jbe 0x1800ac43b
cvttsd2si rdi, xmm1
mov eax, dword [rbx + 0x44]
test eax, eax
jne 0x1800ac390
mov al, 1
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rbx + 0x44]
test eax, eax
je 0x1800ac40f
mov rcx, rbx
call sym.FactoryServer_SignalProcessing.dll_public:_int___cdecl_Audio::FPatchOutput::GetNumSamplesAvailable_void_const___ptr64
cmp eax, ebp
jge 0x1800ac40f
xor al, al
jmp 0x1800ac411
Function at 0x1800bc6b8
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov eax, r9d
movaps xmmword [rsp], xmm6
mov r10, rdx
xorps xmm6, xmm6
cdq
sub eax, edx
sar eax, 1
movsxd r9, eax
xor eax, eax
test r9, r9
jle 0x1800bc77a
movss xmm0, dword [r8 + rax*8]
movss xmm5, dword [rcx]
movss xmm4, dword [rcx + 4]
subss xmm0, xmm5
movss xmm2, dword [rcx + 8]
mulss xmm0, dword [0x1800f7888]
addss xmm5, xmm0
addss xmm0, dword [r8 + rax*8]
movss dword [rcx], xmm0
movss xmm3, dword [r8 + rax*8 + 4]
movaps xmm0, xmm3
subss xmm0, xmm4
addss xmm4, xmm5
mulss xmm0, dword [0x1800f786c]
addss xmm4, xmm0
addss xmm0, xmm3
xorps xmm3, xmmword [0x1800f1cf0]
movaps xmm1, xmm3
subss xmm1, xmm2
addss xmm2, xmm5
mulss xmm4, dword [0x1800f1aa8]
movss dword [rcx + 4], xmm0
mulss xmm1, dword [0x1800f786c]
addss xmm2, xmm1
addss xmm3, xmm1
mulss xmm2, xmm2
movss dword [rcx + 8], xmm3
movss dword [r10 + rax*4], xmm4
inc rax
addss xmm6, xmm2
cmp rax, r9
jl 0x1800bc6dc
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x1800e088c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
test byte [rsp + 0x88], 1
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r13, rcx
je 0x1800e08d4
mov r8d, 0x31
lea rdx, str..._.._.._third_party_opus_src_silk_NLSF_VQ.c
lea rcx, str.assertion_failed:___LPC_order__1____0
call fcn.1800b02e4
movsxd rbp, dword [rsp + 0x80]
test rbp, rbp
jle 0x1800e09c9
movsxd r9, dword [rsp + 0x88]
xor r11d, r11d
mov r10, r9
neg r10
add r10, r10
sub rbx, rdi
lea r14, [r9 - 2]
lea rax, [r9 + r9]
xor r12d, r12d
and dword [rsp + 0x88], r12d
test r14, r14
js 0x1800e09af
mov ebp, dword [rsp + 0x88]
lea r13, [r14 + rsi]
inc r14
mov r15, r9
shr r15, 1
lea rax, [rdi + r14*2]
mov r14, rax
movzx ecx, byte [r13 + 1]
movzx eax, word [rbx + r14]
shl cx, 7
sub ax, cx
sar ebp, 1
movzx ecx, byte [r13]
lea r13, [r13 - 2]
movsx r8d, ax
movsx eax, word [r14]
lea r14, [r14 - 4]
imul r8d, eax
shl cx, 7
mov eax, r8d
sar r8d, 1
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
add r12d, eax
movzx eax, word [rbx + r14 + 2]
sub ax, cx
movsx ebp, ax
movsx eax, word [r14 + 2]
imul ebp, eax
mov eax, ebp
sub eax, r8d
cdq
xor eax, edx
sub eax, edx
add r12d, eax
sub r15, 1
jne 0x1800e0933
movsxd rbp, dword [rsp + 0x80]
lea r14, [r9 - 2]
mov r13, qword [rsp + 0x60]
lea rax, [r9 + r9]
mov dword [r13 + r11*4], r12d
add rsi, r9
inc r11
add rdi, rax
add rbx, r10
cmp r11, rbp
jl 0x1800e0904
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800e1f1c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1800e1f94
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1800e1f94
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1800e1f94
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1800e1f88
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1800e1fa6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1800e1f76
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1800e1f96
Function at 0x14000a010
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x140016050]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0xc0000001
cmp qword [rsp + 0x30], 0
jne 0x14000a07a
mov eax, dword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x14000a07a
xor al, al
jmp 0x14000a259
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, qword [rsp + 0xc0]
call fcn.140009700
movzx eax, al
test eax, eax
je 0x14000a215
mov eax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
lea rax, [rcx + rax - 1]
mov rcx, rax
call fcn.140009700
movzx eax, al
test eax, eax
je 0x14000a215
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
cmp dword [0x14001fffc], 0
jne 0x14000a10a
cmp dword [0x14001ffbc], 0
je 0x14000a140
call fcn.1400021a0
cmp dword [0x14001fffc], 0
je 0x14000a11d
call fcn.14000fa80
cmp dword [0x14001ffbc], 0
je 0x14000a140
call fcn.140002740
btr rax, 0x10
mov rcx, rax
call fcn.140002840
mov dword [rsp + 0x24], 1
cmp dword [0x14001fffc], 0
jne 0x14000a15a
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x40], rax
jae 0x14000a179
mov eax, dword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
jmp 0x14000a1b6
lfence
mov r8d, dword [rsp + 0xc8]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000aa60
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xc8]
cmp dword [rsp + 0x38], eax
je 0x14000a1ae
mov dword [rsp + 0x20], 0xc0000001
jmp 0x14000a1b6
mov dword [rsp + 0x20], 0
cmp dword [0x14001fffc], 0
jne 0x14000a1c6
cmp dword [rsp + 0x24], 0
je 0x14000a215
mov qword [rsp + 0x50], 0
cmp dword [rsp + 0x24], 0
je 0x14000a1e8
call fcn.140002740
bts rax, 0x10
mov rcx, rax
call fcn.140002840
cmp dword [0x14001fffc], 0
je 0x14000a200
call fcn.14000fb40
mov qword [rsp + 0x50], rax
call fcn.14000fae0
call fcn.1400021b0
cmp qword [rsp + 0x50], 0
je 0x14000a215
mov dword [rsp + 0x20], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000a225
cmp qword [rsp + 0xb8], 0
jne 0x14000a23b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rsp + 0x20], 0
jl 0x14000a24c
mov dword [rsp + 0x28], 1
jmp 0x14000a254
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400126c0
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x1400018f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000193a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000193a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000193a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000193a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000193a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000193c
xor al, al
add rsp, 0x28
ret