joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009d50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rsi, rcx
jg 0x140009d8d
mov r8d, 0x712
lea rdx, str.C:UsersFerDesktopexamplesimgui_1.89.6imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x1400b6eb0]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3c]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3d]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3e]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3f]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140009e4c
mov r8, rdi
mov edx, 0xc
mov ecx, ebx
call fcn.14002e990
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140009e60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x140009e9c
mov r8d, 0x712
lea rdx, str.C:UsersFerDesktopexamplesimgui_1.89.6imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x1400b6eb0]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140009f17
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14002e990
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140009f30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140009f63
mov r8d, 0x712
lea rdx, str.C:UsersFerDesktopexamplesimgui_1.89.6imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm2, dword [rbx + 0x110]
lea r9, [0x1400b6eb0]
movss xmm0, dword [rdi]
movsxd rcx, dword [rbx + 0xf0]
subss xmm0, xmm2
mov rax, qword [rbx + 0xf8]
movss xmm3, dword [rbx + 0x114]
movss xmm1, dword [rdi + 4]
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x20]
movss xmm0, dword [rdi + 8]
movzx ecx, r8b
subss xmm0, xmm2
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x14001af90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1400e0798]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x14001afe2
cmp byte [rbx + 0x4a76], 0
jne 0x14001afe2
movsx r9d, word [rbx + 0x5b9a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003260
test dil, 1
je 0x14001b10f
jmp 0x14001b06b
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400d1314]
xor eax, eax
mulss xmm1, dword [0x1400d12f4]
addss xmm0, dword [rbx + 0xe08]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mulss xmm0, dword [0x1400d120c]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b9a]
call fcn.140003260
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001b0c0
lea r11, [0x1400b6eb0]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x14001b0a3
cmp byte [r8], r9b
jne 0x14001b0a3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001b090
not ecx
call fcn.14000eb70
test rax, rax
je 0x14001b10f
cmp byte [rax + 0xb6], 0
je 0x14001b10f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b9a]
movsx r9d, word [rbx + 0x5b9a]
call fcn.140003260
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400116b0
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x140022230
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c80], 0
lea rbx, [rcx + 0x5c88]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400222d3
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x140022286
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.14002ffa0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004600
mov eax, dword [rbx]
lea rcx, [0x1400e0790]
mov r9, qword [rdi + 0x5c80]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x5c90]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400222db
mov rcx, rbx
call fcn.140004600
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140022ab0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1400e0798]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x140022b14
lea r10, [0x1400b6eb0]
cmp r8b, 0x23
jne 0x140022af7
cmp byte [rdx], r8b
jne 0x140022af7
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140022ae4
mov eax, dword [r14 + 0x5bf8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x140022b75
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x140022b3a
cmp edi, eax
jl 0x140022b54
mov r8d, 0x709
lea rdx, str.C:UsersFerDesktopexamplesimgui_1.89.6imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5c00]
cmp dword [rax + rbp + 8], ebx
je 0x140022b92
mov eax, dword [r14 + 0x5bf8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x140022b31
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x140022b9f
cmp edi, dword [r14 + 0x5bf8]
jl 0x140022bb9
mov r8d, 0x709
lea rdx, str.C:UsersFerDesktopexamplesimgui_1.89.6imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5c00]
lea rax, [rax + rcx*8]
jmp 0x140022b77
Function at 0x140078160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, qword [0x1400e0798]
mov rdi, rcx
movsxd rbp, edx
imul rbx, rbp, 0x70
add rbx, qword [rcx + 0x18]
cmp rbx, qword [rcx + 0x18]
jb 0x140078195
cmp rbx, qword [rcx + 0x20]
jb 0x1400781af
mov r8d, 0x261
lea rdx, str.C:UsersFerDesktopexamplesimgui_1.89.6imgui_internal.h
lea rcx, str.p___Data__p___DataEnd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r9, qword [rdi + 0x180]
mov dword [rdi + 0x74], ebp
test dword [rbx], 0x10000
movss xmm1, dword [rbx + 0x34]
je 0x1400781ce
addss xmm1, dword [rdi + 0x8c]
lea rbp, [r9 + 0x100]
movss dword [rbp], xmm1
movss xmm0, dword [rdi + 0xc0]
addss xmm0, dword [rdi + 0x7c]
movss dword [r9 + 0x118], xmm1
subss xmm1, dword [r9 + 0x20]
movss dword [r9 + 0x104], xmm0
subss xmm1, dword [r9 + 0x144]
movss dword [r9 + 0x148], xmm1
mov eax, dword [rdi + 0x88]
mov dword [r9 + 0x138], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x158], eax
movss dword [r9 + 0x21c], xmm0
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x218], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x220], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1bc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xbb], al
cmp byte [rbx + 0x68], 0
je 0x14007826f
xor eax, eax
mov dword [rsi + 0x476c], eax
mov dword [rsi + 0x4774], eax
test dword [rdi + 4], 0x100000
je 0x140078283
mov r8d, 2
jmp 0x140078303
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x298]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x238], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x298]
mov rcx, qword [rdi + 0x198]
call fcn.14006b440
cmp byte [rsi + 0x5c78], 0
je 0x140078341
cmp byte [rbx + 0x68], 0
jne 0x140078341
xor r8d, r8d
lea rdx, [0x1400cc938]
mov rcx, rbp
call fcn.140022330
mov dword [rsi + 0x5ca8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14007b6c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400e0798]
mov ebx, ecx
mov rdi, qword [rax + 0x4b30]
cmp ecx, 0xffffffff
jne 0x14007b6e6
cmp dword [rdi + 0x74], ecx
cmovne ebx, dword [rdi + 0x74]
mov eax, dword [rdi + 0x6c]
cmp ebx, eax
jne 0x14007b6f4
mov ebx, 0xffffffff
jmp 0x14007b6f9
cmp ebx, 0xffffffff
jl 0x14007b6fd
cmp ebx, eax
jl 0x14007b717
mov r8d, 0xbf7
lea rdx, str.C:UsersFerDesktopexamplesimgui_1.89.6imgui_tables.cpp
lea rcx, str.column_n____1__column_n___table__ColumnsCount
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test byte [rdi + 4], 7
je 0x14007b789
mov r10d, dword [rdi]
lea r8, [0x1400cd3e9]
movzx eax, word [rdi + 0x78]
lea r11, [0x1400b6eb0]
not r10d
mov byte [rdi + 0x227], 1
mov ecx, r10d
mov word [rdi + 0x210], bx
mov word [rdi + 0x7a], ax
mov r9b, 0x23
nop dword [rax]
cmp r9b, 0x23
jne 0x14007b763
cmp byte [r8], r9b
jne 0x14007b763
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14007b750
not ecx
xor edx, edx
call fcn.14001b3c0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14009b3c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov r10d, 0xffffffff
movaps xmmword [rsp + 0x30], xmm6
mov ecx, r10d
lea r8, [0x1400b4391]
movaps xmm6, xmm3
lea rbx, [0x1400b6eb0]
mov r11, rdx
mov r9b, 0x23
nop
cmp r9b, 0x23
jne 0x14009b403
cmp byte [r8], r9b
jne 0x14009b403
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14009b3f0
not ecx
call fcn.14000eb70
xor edi, edi
test rax, rax
je 0x14009b43a
cmp word [rax + 0xc2], di
jne 0x14009b50c
test r11, r11
jne 0x14009b472
mov rbx, qword [0x1400e0798]
cmp dword [rbx + 0x48a0], edi
jg 0x14009b468
mov r8d, 0x709
lea rdx, str.C:UsersFerDesktopexamplesimgui_1.89.6imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0x48a8]
mov r11, qword [rax]
movss xmm1, dword [r11 + 0xa8]
movss xmm0, dword [r11 + 0xc]
movaps xmm3, xmm1
addss xmm3, dword [r11 + 4]
movss xmm2, dword [r11 + 0xac]
subss xmm0, xmm1
addss xmm2, dword [r11 + 8]
mov rax, qword [0x1400e0798]
xorps xmm1, xmm1
addss xmm0, dword [r11 + 0xb0]
or dword [rax + 0x47a8], 3
mov qword [rax + 0x47c0], rdi
mov dword [rax + 0x47ac], 1
maxss xmm1, xmm0
movaps xmm0, xmm3
unpcklps xmm0, xmm2
movsd qword [rax + 0x47b8], xmm0
mov dword [rax + 0x47b0], 1
addss xmm1, xmm3
subss xmm1, xmm3
movaps xmm0, xmm1
unpcklps xmm0, xmm6
movsd qword [rax + 0x47c8], xmm0
addss xmm6, dword [r11 + 0xac]
movss dword [r11 + 0xac], xmm6
mov rbx, qword [0x1400e0798]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 3
movss xmm0, dword [rbx + 0x37e0]
lea rcx, [rbx + 0x4828]
movss dword [rsp + 0x24], xmm0
call fcn.14002f910
mov dword [rbx + 0x37e0], edi
lea rdx, [rsp + 0x20]
mov rbx, qword [0x1400e0798]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x37e8]
lea rcx, [rbx + 0x4828]
movss xmm0, dword [rbx + 0x37ec]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.14002f910
xor edx, edx
mov qword [rbx + 0x37e8], rdi
mov r8d, 0x50f
lea rcx, str.MainMenuBar
call fcn.1400116b0
mov ecx, 2
movzx ebx, al
call fcn.140006170
movaps xmm6, xmmword [rsp + 0x30]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14009e0d0
Capabilities:
Hash data with crc32

Disassembly:
test dword [rcx + 0x10], 0x100000
je 0x14009e14d
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x14009e126
lea r11, [0x1400b6eb0]
cmp r9b, 0x23
jne 0x14009e109
cmp byte [r8], r9b
jne 0x14009e109
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14009e0f6
mov rcx, qword [0x1400e0798]
not eax
cmp dword [rcx + 0x3f30], eax
jne 0x14009e13d
mov dword [rcx + 0x3f34], eax
cmp dword [rcx + 0x3f60], eax
jne 0x14009e160
mov byte [rcx + 0x3f64], 1
ret
mov rax, qword [0x1400e0798]
mov rcx, qword [rax + 0x3ed0]
jmp fcn.140009cc0
ret
Function at 0x1400acde8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ace32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ace32
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ace32
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ace32
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ace32
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ace34
xor al, al
add rsp, 0x28
ret
Function at 0x1401910ec
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14018b2d4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14018b2d4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14019123c
cmp rax, 0xffffffffffffffff
je 0x14019123c
xor edi, edi
test rbp, rbp
jle 0x1401911e7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14018158c
mov rbx, rax
test rax, rax
jne 0x140191174
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1401911dd
mov edx, 0x8000
mov ecx, r14d
call fcn.140179d3c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140184afc
cmp eax, 0xffffffff
je 0x1401911bd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140191184
mov edx, r15d
mov ecx, r14d
call fcn.140179d3c
jmp 0x1401911dd
cmp byte [rsi + 0x38], dil
je 0x1401911d4
cmp dword [rsi + 0x34], 5
jne 0x1401911d4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1401911dd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140181604
jmp 0x140191250
jns 0x140191250
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14018b2d4
cmp rax, 0xffffffffffffffff
jne 0x140191208
cmp byte [rsi + 0x30], dil
je 0x140191250
mov edi, dword [rsi + 0x2c]
jmp 0x140191250
mov ecx, r14d
call fcn.1401840c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140191250
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140191250
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140191249
mov eax, dword [rsi + 0x2c]
jmp 0x14019124e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14018b2d4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140191980
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401919a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401919a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400093d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140049020]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x70], 0x68
mov dword [rbp - 0x34], 1
xor esi, esi
mov word [rbp - 0x30], si
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
mov r8, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x140009449
mov r8, qword [rcx]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, dword [rcx + 0x10]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.14000af90
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov r9d, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400094a6
mov rbx, qword [rbx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdx
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140009520
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.140001200
jmp 0x140009546
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140009583
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000957e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400095a8
call fcn.140010de0
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140010dc0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140018cfc
int3
Function at 0x140017224
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1400170b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400170b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400170b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400170b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400170b7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400170b7
cmp dword [rcx + 0xf8], 0
je 0x1400170b7
mov ecx, ebx
call fcn.140017158
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140016f48
cmp dword [rbp + 0x20], 0
je 0x140017104
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001710c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140017050