joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140148970
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14013b1c4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14013b1c4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140148ac0
cmp rax, 0xffffffffffffffff
je 0x140148ac0
xor edi, edi
test rbp, rbp
jle 0x140148a6b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1401382ec
mov rbx, rax
test rax, rax
jne 0x1401489f8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140148a61
mov edx, 0x8000
mov ecx, r14d
call fcn.1401351ac
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14013abfc
cmp eax, 0xffffffff
je 0x140148a41
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140148a08
mov edx, r15d
mov ecx, r14d
call fcn.1401351ac
jmp 0x140148a61
cmp byte [rsi + 0x38], dil
je 0x140148a58
cmp dword [rsi + 0x34], 5
jne 0x140148a58
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140148a61
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1401382b0
jmp 0x140148ad4
jns 0x140148ad4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14013b1c4
cmp rax, 0xffffffffffffffff
jne 0x140148a8c
cmp byte [rsi + 0x30], dil
je 0x140148ad4
mov edi, dword [rsi + 0x2c]
jmp 0x140148ad4
mov ecx, r14d
call fcn.140141e80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140148ad4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140148ad4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140148acd
mov eax, dword [rsi + 0x2c]
jmp 0x140148ad2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14013b1c4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x10040163e
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x80]
mov qword [rbp], rcx
lea rax, [rbp - 0x25]
mov rcx, rax
call fcn.1004551c0
lea rdx, [rbp - 0x25]
lea rax, [rbp - 0x40]
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call fcn.1004782e0
lea rax, [rbp - 0x25]
mov rcx, rax
call fcn.1004551f0
mov dword [rbp - 0x44], 0
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.10041d290
mov ebx, eax
lea rax, [rbp - 0x40]
mov edx, 0
mov rcx, rax
call fcn.1004783a0
mov rcx, rax
mov rax, qword [rbp]
mov rax, qword [rax]
lea rdx, [rbp - 0x44]
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, ebx
mov rdx, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov dword [rbp - 0x24], eax
cmp dword [rbp - 0x24], 0
je 0x1004016e2
mov eax, dword [rbp - 0x44]
test eax, eax
jne 0x100401740
cmp dword [rbp - 0x24], 0
jne 0x1004016fd
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0x6d
jne 0x1004016fd
mov eax, 1
jmp 0x100401702
mov eax, 0
test al, al
je 0x100401719
mov eax, dword [rbp - 0x44]
mov edx, eax
lea rcx, str.OutputHandler:_pipe_closed:_numRead_u
call fcn.1004059cb
jmp 0x100401777
mov ebx, dword [rbp - 0x44]
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov eax, dword [rbp - 0x24]
mov r9d, ebx
mov r8d, edx
mov edx, eax
lea rcx, str.OutputHandler:_read_failed:_ret_d_lastError0x_x_numRead_u
call fcn.1004059cb
jmp 0x100401777
mov eax, dword [rbp - 0x44]
mov ebx, eax
lea rax, [rbp - 0x40]
mov edx, 0
mov rcx, rax
call fcn.1004783a0
mov rdx, rax
mov rax, qword [rbp]
mov eax, dword [rax + 8]
mov r8, rbx
mov ecx, eax
call fcn.1004017e0
xor eax, 1
test al, al
jne 0x100401776
jmp 0x100401680
nop
mov rax, qword [rbp]
mov dword [rax + 0x24], 1
mov rax, qword [rbp]
mov rax, qword [rax + 0x18]
mov rcx, rax
call fcn.100401ace
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.100478350
jmp 0x1004017d5
add rsp, 0x68
pop rbx
pop rbp
ret

Function at 0x10040194a
Capabilities:
Get socket status

Disassembly:
push rbp
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x10], rcx
mov dword [rbp - 8], edx
mov qword [rbp], r8
mov rdx, qword [rbp]
mov eax, dword [rbp - 8]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, eax
call sub.msys_2.0.dll_select
mov dword [rbp - 0x44], eax
cmp dword [rbp - 0x44], 0
jns 0x1004019f9
call sub.msys_2.0.dll___errno
mov eax, dword [rax]
cmp eax, 4
sete al
test al, al
je 0x1004019cd
mov rax, qword [rbp]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0
cmp qword [rbp - 0x38], 7
ja 0x1004019f8
mov rax, qword [rbp - 0x40]
lea rdx, [rax + 1]
mov qword [rbp - 0x40], rdx
mov byte [rax], 0
add qword [rbp - 0x38], 1
jmp 0x1004019b0
call sub.msys_2.0.dll___errno
mov ebx, dword [rax]
call sub.msys_2.0.dll___getreent
mov rax, qword [rax + 0x18]
mov r9d, ebx
mov r8, qword [rbp - 0x10]
lea rdx, str.Internal_error:__s_select_failed:_error__d
mov rcx, rax
call sub.msys_2.0.dll_fprintf
call sub.msys_2.0.dll_abort
nop
add rsp, 0x58
pop rbx
pop rbp
ret
Function at 0x100401ec8
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0
cmp dword [rbp - 4], 2
jg 0x100401f51
mov rdx, qword [rbp + 0x10]
mov eax, dword [rbp - 4]
cdqe
movzx eax, byte [rdx + rax + 4]
xor eax, 1
test al, al
jne 0x100401f4a
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
add rax, rax
add rax, rdx
shl rax, 2
mov rdx, qword [rbp + 0x10]
add rax, rdx
lea rdx, [rax + 8]
mov eax, dword [rbp - 4]
mov r8, rdx
mov edx, 1
mov ecx, eax
call sub.msys_2.0.dll_tcsetattr
shr eax, 0x1f
test al, al
je 0x100401f4b
lea rcx, str.error_restoring_terminal_mode
call sub.msys_2.0.dll_perror
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
add dword [rbp - 4], 1
jmp 0x100401edb
nop
add rsp, 0x30
pop rbp
ret
Function at 0x100402b3e
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.100474770
lea rax, [0x10049255b]
mov qword [rbp - 0x50], rax
lea rax, str.WINPTY_SHOW_CONSOLE
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 0
mov dword [rbp + 0x3c], 0
mov eax, dword [rbp + 0x3c]
cdqe
mov rax, qword [rbp + rax*8 - 0x50]
test rax, rax
je 0x100402c21
mov eax, dword [rbp + 0x3c]
cdqe
mov rax, qword [rbp + rax*8 - 0x50]
mov rcx, rax
call sub.msys_2.0.dll_getenv
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x100402c18
mov rax, qword [rbp + 0x30]
movzx eax, byte [rax]
test al, al
je 0x100402c18
lea rax, [rbp + 0xf]
mov rcx, rax
call fcn.1004551c0
mov eax, dword [rbp + 0x3c]
cdqe
mov rdx, qword [rbp + rax*8 - 0x50]
lea rcx, [rbp + 0xf]
mov rax, rbp
mov r8, rcx
mov rcx, rax
call fcn.10045e9d0
mov rdx, rbp
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1004747b0
mov rcx, rax
mov rax, qword [rbp + 0x30]
mov rdx, rax
call fcn.10045eff0
mov rax, rbp
mov rcx, rax
call fcn.10045ef70
lea rax, [rbp + 0xf]
mov rcx, rax
call fcn.1004551f0
add dword [rbp + 0x3c], 1
jmp 0x100402b80
mov ecx, 0x20
call sub.msys_2.0.dll_cygwin_internal
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.100474750
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.100474730
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x10]
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.1004196f0
test al, al
je 0x100402cf2
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.100419720
mov rcx, rax
call fcn.100414fa0
mov rcx, rax
call fcn.100402999
mov qword [rbp + 0x28], rax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.100419720
add rax, 8
mov rcx, rax
call fcn.100414fa0
mov rcx, rax
call fcn.100402999
mov qword [rbp + 0x20], rax
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call rax
cmp qword [rbp + 0x28], 0
je 0x100402cce
mov rax, qword [rbp + 0x28]
mov rcx, rax
call sub.msys_2.0.dll___wrap__ZdaPv
cmp qword [rbp + 0x20], 0
je 0x100402ce1
mov rax, qword [rbp + 0x20]
mov rcx, rax
call sub.msys_2.0.dll___wrap__ZdaPv
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.100470bd0
jmp 0x100402c3b
mov edx, 0
lea rcx, str.TERM
mov rax, qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.100474790
jmp 0x100402d51
add rsp, 0xc8
pop rbx
pop rbp
ret
Function at 0x100402d5b
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov rdx, qword [rbp + 0x10]
lea rcx, str.Usage:__s__options_______program__args__n
call sub.msys_2.0.dll_printf
mov ecx, 0xa
call sub.msys_2.0.dll_putchar
lea rcx, str.Options:
call sub.msys_2.0.dll_puts
lea rcx, str.___h____help__Show_this_help_message
call sub.msys_2.0.dll_puts
lea rcx, str.____mouse_____Enable_terminal_mouse_input
call sub.msys_2.0.dll_puts
lea rcx, str.____showkey___Dump_STDIN_escape_sequences
call sub.msys_2.0.dll_puts
lea rcx, str.____version___Show_the_winpty_version_number
call sub.msys_2.0.dll_puts
mov eax, dword [rbp + 0x18]
mov ecx, eax
call sub.msys_2.0.dll_exit
nop
Function at 0x1004053b8
Capabilities:
Read pipe
Write pipe

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp - 8], 0xffffffffffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x110000
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 0
mov edx, 0xc0000000
lea rcx, str..pipeDebugServer
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0xffffffffffffffff
jne 0x100405441
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xe7
jne 0x100405441
mov edx, 0xffffffff
lea rcx, str..pipeDebugServer
mov rax, qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call rax
test eax, eax
je 0x100405441
mov eax, 1
jmp 0x100405446
mov eax, 0
test al, al
je 0x10040544c
jmp 0x1004053cc
cmp qword [rbp - 8], 0xffffffffffffffff
je 0x1004054d2
mov dword [rbp - 0xc], 2
lea rdx, [rbp - 0xc]
mov rax, qword [rbp - 8]
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
call rax
mov dword [rbp - 0x24], 0
mov rcx, qword [rbp + 0x10]
call sub.msys_2.0.dll_strlen
mov r8d, eax
lea rcx, [rbp - 0x20]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x30], 0
lea rdx, [rbp - 0x24]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x10
mov r9, rcx
mov rdx, qword [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x70
pop rbp
ret

Function at 0x10040553f
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
mov rax, qword [0x1004b9010]
test rax, rax
sete al
test al, al
je 0x100405685
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.100405370
mov dword [rbp + 0xdc], 0x100
lea rax, [rbp - 0x60]
mov r8d, 0x100
mov rdx, rax
lea rcx, str.WINPTY_DEBUG
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
mov dword [rbp + 0xd8], eax
cmp dword [rbp + 0xd8], 0
je 0x1004055b6
cmp dword [rbp + 0xd8], 0xff
jbe 0x1004055ba
mov byte [rbp - 0x60], 0
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msys_2.0.dll_strlen
add rax, 1
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sub.msys_2.0.dll___wrap__Znam
mov qword [rbp + 0xc8], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
add rdx, rax
mov rcx, qword [rbp + 0xc8]
lea rax, [rbp - 0x60]
mov r8, rcx
mov rcx, rax
call fcn.100488660
lea rax, [0x1004b9010]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xa8], 0
mov rcx, qword [rbp + 0xb0]
mov rax, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xb8]
lock cmpxchg qword [rdx], rcx
mov qword [rbp + 0xc0], rax
cmp qword [rbp + 0xc0], 0
je 0x100405676
cmp qword [rbp + 0xc8], 0
je 0x100405676
mov rax, qword [rbp + 0xc8]
mov rcx, rax
call sub.msys_2.0.dll___wrap__ZdaPv
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.100405394
mov rax, qword [0x1004b9010]
jmp 0x1004056ab
add rsp, 0x168
pop rbx
pop rbp
ret
Function at 0x100410e40
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, ecx
mov byte [rbp + 0x10], al
mov byte [rbp - 0x30], 0x40
mov byte [rbp - 0x2f], 0x41
mov byte [rbp - 0x2e], 0x42
mov byte [rbp - 0x2d], 0x43
mov byte [rbp - 0x2c], 0x44
mov byte [rbp - 0x2b], 0x45
mov byte [rbp - 0x2a], 0x46
mov byte [rbp - 0x29], 0x47
mov byte [rbp - 0x28], 0x48
mov byte [rbp - 0x27], 0x49
mov byte [rbp - 0x26], 0x4a
mov byte [rbp - 0x25], 0x4b
mov byte [rbp - 0x24], 0x4c
mov byte [rbp - 0x23], 0x4d
mov byte [rbp - 0x22], 0x4e
mov byte [rbp - 0x21], 0x4f
mov byte [rbp - 0x20], 0x50
mov byte [rbp - 0x1f], 0x51
mov byte [rbp - 0x1e], 0x52
mov byte [rbp - 0x1d], 0x53
mov byte [rbp - 0x1c], 0x54
mov byte [rbp - 0x1b], 0x55
mov byte [rbp - 0x1a], 0x56
mov byte [rbp - 0x19], 0x57
mov byte [rbp - 0x18], 0x58
mov byte [rbp - 0x17], 0x59
mov byte [rbp - 0x16], 0x5a
mov byte [rbp - 0x15], 0x5b
mov byte [rbp - 0x14], 0x5c
mov byte [rbp - 0x13], 0x5d
mov byte [rbp - 0x12], 0x5e
mov byte [rbp - 0x11], 0x5f
movzx eax, byte [rbp + 0x10]
mov byte [rbp - 1], al
movzx eax, byte [rbp - 1]
cmp eax, 0x1f
jg 0x100410eea
movzx eax, byte [rbp - 1]
cdqe
movzx eax, byte [rbp + rax - 0x30]
jmp 0x100410efc
cmp byte [rbp - 1], 0x7f
jne 0x100410ef7
mov eax, 0x3f
jmp 0x100410efc
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x14084e174
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0x140915980
push rdi
xchg dil, dil
movsx rdi, r11w
mov dil, r11b
push r9
movzx di, al
mov dil, r10b
push rcx
push r14
movsxd rdi, r10d
push r15
cmovno di, r10w
push rdx
push rax
movzx ax, bl
rdtsc
push r10
push r8
lahf
cmovge rax, rbx
push r11
movsx ax, bh
push rsi
rdtsc
pushfq
bts r10d, eax
btc eax, esi
push r13
push rbp
push r12
movsxd rax, r10d
cwde
push rbx
rcl dil, cl
movsxd rax, r15d
movabs rdx, 0
push rdx
setbe bh
mov rbx, qword [rsp + 0x90]
movsx bp, r10b
lahf
rol ebx, 2
cmp r15w, 0x7cb6
btc ax, 0x3f
sub ebx, 0x35f52eed
movzx rbp, bp
xor ebx, 0xb413fb3
neg ebx
cwde
dec ebx
lea rbx, [rbx + rdx]
not bp
rol si, cl
bsf eax, r11d
movabs rdi, 0x100000000
shr bpl, cl
shrd rax, r11, 0x1b
add rbx, rdi
shld r11, rbp, 0x87
neg r10b
sal si, 8
mov rsi, rsp
sub rsp, 0x180
movzx r10d, ax
rcr r11w, cl
and rsp, 0xfffffffffffffff0
shld r10, r11, 0x49
movzx ebp, di
mov rbp, rbx
cmp r13b, bl
movabs r11, 0
sub rbp, r11
xadd r10d, eax
lea r10, [0x14084e26d]
bsr eax, r11d
mov eax, dword [rbx]
add rbx, 4
cmp r11b, 0xef
test r12b, 0x3a
xor eax, ebp
stc
cmc
ror eax, 1
jmp 0x1408eabac
ror eax, 1
jmp 0x1408c6405
sub eax, 0x5a15584b
stc
push rbp
xor dword [rsp], eax
pop rbp
test rbx, r14
movsxd rax, eax
cmc
test rbp, rsp
add r10, rax
jmp r10
dec eax
jmp 0x140842dbd
dec eax
jmp 0x1408ace4d
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test al, 0xdb
hlt
mov ebx, 0xf4ff68bd
dec byte [r11 + 0x620d3477]
cmp al, 0xfc
push rbx
adc rax, 0x23e4a990
leave
jo 0x140023235
fdivp st(2)
mov ebp, dword [rsi - 0x25]
jmp 0x1400232cb
and eax, 0x1537f30a
or byte [rsi + 0x5e], 0xf3
cmpsb byte [rsi], byte [rdi]
invalid
Function at 0x140008a10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140155678]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140155be8]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x20d5], 0
jne 0x140008a77
cmp byte [rbx + 0x20d6], 0
jne 0x140008a77
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140019260
test sil, 1
je 0x140008bac
jmp 0x140008b16
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400c6acc]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400c6ac4]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
or dword [rbx + 0x1dc0], 1
mov qword [rbx + 0x1ddc], rax
movss dword [rbx + 0x1dd4], xmm0
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd8], xmm1
mov byte [rbx + 0x1dfc], 1
movss xmm0, dword [rbx + 0x1748]
mov rax, qword [0x140155be8]
mulss xmm0, dword [0x1400c6a5c]
or dword [rax + 0x1dc0], 0x40
movss dword [rax + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140019260
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140008b66
lea r11, [0x1400bfd70]
cmp r9b, 0x23
jne 0x140008b49
cmp byte [r8], r9b
jne 0x140008b49
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140008b36
not ecx
call fcn.1400175e0
test rax, rax
je 0x140008bac
cmp byte [rax + 0xcf], 0
je 0x140008bac
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.140019260
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140004840
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400bba80
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000ba60
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14000bc9e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140155678]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400bfd70]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14000bc66
mov rcx, rbp
call fcn.14000b680
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14000bb31
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14000bb21
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14000bb19
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14000bb1c
mov rdx, rcx
test rdx, rdx
jne 0x14000baf0
cmp r8, r10
je 0x14000bb31
cmp dword [r8], r9d
jne 0x14000bb31
mov rcx, qword [r8 + 8]
jmp 0x14000bb33
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14000bbc7
cmp qword [rcx + 0x18], 0
jne 0x14000bbbc
mov qword [rcx + 0x18], rbx
jmp 0x14000bbc7
cmp qword [rcx + 0x20], 0
jne 0x14000bbc7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov rcx, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000bbfc
nop
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14000bbf0
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_sendto
call fcn.140019260
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14000bc58
cmp r9b, 0x23
jne 0x14000bc3b
cmp byte [r8], r9b
jne 0x14000bc3b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14000bc28
not ecx
call fcn.1400175e0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14000bab0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400bba80
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x1400171b0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x140017206
lea r11, [0x1400bfd70]
cmp r9b, 0x23
jne 0x1400171e9
cmp byte [r8], r9b
jne 0x1400171e9
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400171d6
not ecx
call fcn.1400177f0
test rax, rax
jne 0x14001721f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14000ae10
add rsp, 0x20
pop rbx
ret

Function at 0x140017660
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x1400176b0
lea r11, [0x1400bfd70]
cmp r9b, 0x23
jne 0x140017693
cmp byte [r8], r9b
jne 0x140017693
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017680
not ecx
jmp fcn.1400175e0

Function at 0x140017f20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rbx, rcx
mov edi, edx
jg 0x140017f56
mov r8d, 0x6d1
lea rdx, str.D:MainBackupzchairs_loaderimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x1400bfd70]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140155be8]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1d6c], edx
jne 0x140017fd0
mov dword [rax + 0x1d70], edx
cmp dword [rax + 0x1da8], edx
jne 0x140017fdf
mov byte [rax + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret