joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eedf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141ddb090]
and eax, dword [str.KzSb5_b]
imul eax, eax, 0x40e0904c
and eax, 0xf66ff438
add eax, 0x36ae607c
cmp eax, 0x9f3c4f8f
jb 0x1400eee00
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1400ef043
mov r8d, 0xf543f055
lea rax, [rcx + 1]
lea rdx, [rcx + rcx]
nop
mov r9d, dword [0x141ddb098]
mov r10d, dword [0x141ddb09c]
add r9d, r10d
add r9d, 0xe007dbfc
imul r9, r8
shr r9, 0x3d
cmp r9d, 0xb4a308c6
je 0x1400eee40
cmp rdx, rax
cmova rax, rdx
cmp rax, 9
mov edi, 8
cmovae rdi, rax
nop dword [rax]
mov eax, dword [0x141ddb0a0]
sub eax, dword [0x141ddb0a4]
imul eax, eax, 0xa4278946
xor eax, 0xbee65fc1
imul rax, rax, 0x1905e27
shr rax, 0x38
cmp eax, 0xcef85e74
je 0x1400eee80
test rdi, rdi
js 0x1400ef043
nop word cs:[rax + rax]
mov eax, dword [0x141ddb0a8]
xor edx, edx
div dword [0x141ddb0ac]
and eax, 0xfd6f3322
imul eax, eax, 0xbffd2273
and eax, 0xa2d37dae
cmp eax, 0xe3c288bf
je 0x1400eeec0
mov eax, 0x80d0167f
nop word [rax + rax]
mov edx, dword [0x141ddb0b0]
add edx, dword [0x141ddb0b4]
imul rdx, rax
shr rdx, 0x3d
cmp edx, 0xecf188f9
je 0x1400eeef0
test rcx, rcx
je 0x1400eef41
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rcx
nop
mov eax, dword [0x141ddb0b8]
xor edx, edx
div dword [0x141ddb0bc]
and eax, 0x80122001
cmp eax, 0x7310951d
ja 0x1400eef20
mov eax, 1
jmp 0x1400eef43
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov edx, 1
mov r8, rdi
call fcn.1400c1320
cmp qword [rsp + 0x40], 0
jne 0x1400ef020
mov eax, dword [0x141ddb0d0]
add eax, dword [0x141ddb0d4]
imul eax, eax, 0x266a6958
and eax, 0x51c72940
add eax, 0x7d0c20b1
cmp eax, 0x2f897059
nop dword [rax]
mov eax, dword [0x141ddb0d8]
and eax, dword [0x141ddb0dc]
imul eax, eax, 0x62e5400b
add eax, 0x5581a3fd
cmp eax, 0x281f67bf
jb 0x1400eef90
mov ecx, dword [str.wOr]
xor ecx, dword [0x141ddb0e4]
mov rax, qword [rsp + 0x48]
imul ecx, ecx, 0x789f5fac
add ecx, 0xe3de9e86
cmp ecx, 0x77bffa13
jae 0x1400eefe0
mov qword [rsi + 8], rax
mov qword [rsi], rdi
nop word [rax + rax]
mov ecx, dword [0x141ddb0e8]
or ecx, dword [0x141ddb0ec]
imul rcx, rcx, 0xcf35d95
shr rcx, 0x3a
imul ecx, ecx, 0xaadf5ca4
imul rcx, rcx, 0x411fe5df
shr rcx, 0x3e
mov qword [rsi + 8], rax
mov qword [rsi], rdi
cmp ecx, 0x9bcb80b2
ja 0x1400eefe0
add rsp, 0x58
pop rdi
pop rsi
ret
mov eax, dword [0x141ddb0c0]
or eax, dword [0x141ddb0c4]
imul eax, eax, 0x859dc741
add eax, 0x43071114
and eax, 0x12ff71f
cmp eax, 0xfbec5b50
ja 0x1400ef020
ud2

Function at 0x1400ef838
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ef882
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ef882
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ef882
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ef882
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ef882
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ef884
xor al, al
add rsp, 0x28
ret
Function at 0x1400f32e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
lea rcx, [rsp + 0x30]
call fcn.1400420e0
lea rcx, [rsp + 0x20]
call fcn.140042190
nop dword [rax]
mov eax, dword [0x141dc5748]
imul eax, dword [0x141dc574c]
xor eax, 0x40181004
and eax, 0xe81a9084
add eax, 0x2cf5221d
cmp eax, 0x6eb6f018
ja 0x1400f3300
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400f3330
mov esi, dword [rsp + 0x38]
mov eax, esi
and eax, 0xc000000
cmp eax, 0xc000000
jne 0x1400f33b3
call fcn.140042220
and eax, 6
nop
mov ecx, dword [0x141dc5760]
sub ecx, dword [0x141dc5764]
add ecx, 0xd552a327
imul rdx, rcx, 0x1410b2bf
shr rdx, 0x3c
cmp eax, 6
sete cl
cmp edx, 0x553d5d32
je 0x1400f3350
nop dword [rax + rax]
mov eax, dword [0x141dc5768]
xor eax, dword [0x141dc576c]
add eax, 0xa062d045
xor eax, 0xee6cbe58
imul rdx, rax, 0xc2893fb
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1b
cmp eax, 0x8cd60d0c
ja 0x1400f3380
jmp 0x1400f33b5
xor ecx, ecx
mov eax, dword [0x141dc5750]
add eax, dword [0x141dc5754]
xor eax, 0x83648d68
add eax, 0xc15bff7c
cmp eax, 0x995e8778
ja 0x1400f3415
mov eax, dword [0x141dc5758]
and eax, dword [0x141dc575c]
add eax, 0x520bbdfd
xor eax, 0x4f77eae1
imul eax, eax, 0xec2ff6b3
movzx edx, byte [rsp + 0x24]
shr dl, 5
mov r8d, esi
shr r8d, 0x1c
and r8d, 1
and r8b, cl
and r8b, dl
mov byte [section..data], r8b
cmp eax, 0x37677d2b
jne 0x1400f3431
movzx eax, byte [rsp + 0x24]
shr al, 5
mov edx, esi
shr edx, 0x1c
and edx, 1
and dl, cl
and dl, al
mov byte [section..data], dl
jmp 0x1400f33d2
add rsp, 0x40
pop rsi
ret
Function at 0x1400f5090
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov eax, dword [0x141dca188]
and eax, dword [0x141dca18c]
or eax, 0xbe85d7b7
xor eax, 0x98b852cf
imul eax, eax, 0x39df1637
cmp eax, 0x3f246c3e
je 0x1400f50fc
mov eax, dword [0x141dca190]
and eax, dword [0x141dca194]
or eax, 0xefb01458
mov ecx, 0xbb8de7e1
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x900f9a36
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rsi, rsp
cmp ecx, 0xb1f0d5ff
jbe 0x1400f510b
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
jmp 0x1400f50c0
mov eax, dword [0x141dca198]
xor eax, dword [0x141dca19c]
add eax, 0xcaba37fb
and eax, 0x40a0c4c7
cmp eax, 0x24bca7e1
ja 0x1400f515e
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r15, rsp
lea rax, [0x141ddb1a0]
mov qword [r15], rax
mov eax, dword [0x141ddb1a8]
xor ecx, ecx
test cl, cl
je 0x1400f518d
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rax, rsp
lea rcx, [0x141ddb1a0]
mov qword [rax], rcx
mov eax, dword [0x141ddb1a8]
jmp 0x1400f5128
xor ecx, ecx
nop
test cl, cl
jne 0x1400f5190
cmp eax, 3
je 0x1400f5260
mov eax, dword [0x141dca1a0]
and eax, dword [0x141dca1a4]
and eax, 0x32c19bc9
cmp eax, 0xfb1e6e55
je 0x1400f5286
lea rdi, [0x141ddb1a8]
lea rbx, [0x141db9008]
mov eax, dword [0x141dca1a8]
imul eax, dword [0x141dca1ac]
imul r12d, eax, 0x9c0bb152
imul rax, r12, 0xe70e8db
shr rax, 0x20
sub r12d, eax
shr r12d, 1
add r12d, eax
shr r12d, 0x1e
add r12d, 0xa26e69d
mov qword [r14], r15
mov qword [rsi], r14
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rsi
mov r9, rbx
call fcn.1400fb0a0
add rsp, 0x20
cmp r12d, 0x705a9ce2
ja 0x1400f51c7
nop word cs:[rax + rax]
mov eax, dword [0x141dca1b0]
and eax, dword [0x141dca1b4]
imul eax, eax, 0xb71e05a7
or eax, 0xa1541030
and eax, 0xb1df5073
cmp eax, 0xfab0bd24
ja 0x1400f5230
nop word cs:[rax + rax]
mov eax, dword [0x141dca1b8]
xor eax, dword [0x141dca1bc]
add eax, 0x91892bc
cmp eax, 0xb0e4c3e3
ja 0x1400f5260
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov qword [r14], r15
mov qword [rsi], r14
sub rsp, 0x20
lea rcx, [0x141ddb1a8]
lea r9, [0x141db9008]
xor edx, edx
mov r8, rsi
call fcn.1400fb0a0
add rsp, 0x20
jmp 0x1400f51b9
Function at 0x1400f52c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov eax, dword [0x141dcaa48]
and eax, dword [0x141dcaa4c]
mov ecx, 0x926aaaeb
imul rcx, rax
shr rcx, 0x3e
add ecx, 0x678e05f7
cmp ecx, 0x93dbb8ba
ja 0x1400f533f
mov ebx, dword [0x141dcaa50]
or ebx, dword [0x141dcaa54]
add ebx, 0xe0729ec7
and ebx, 0x648cc545
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov rcx, rdi
call fcn.1400420e0
add rsp, 0x20
cmp ebx, 0xd0934068
jne 0x1400f536b
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.1400420e0
add rsp, 0x20
jmp 0x1400f52ef
sub rsp, 0x20
mov rcx, rsi
call fcn.140042190
add rsp, 0x20
mov edi, dword [rdi + 8]
mov eax, edi
and eax, 0xc000000
xor ecx, ecx
nop word [rax + rax]
test cl, cl
jne 0x1400f5390
cmp eax, 0xc000000
jne 0x1400f53de
sub rsp, 0x20
call fcn.140042220
add rsp, 0x20
and eax, 6
nop dword [rax + rax]
mov ecx, dword [0x141dcaa68]
or ecx, dword [0x141dcaa6c]
add ecx, 0xff08d63e
and ecx, 0x32d7089
xor ecx, 0x366e5dc8
cmp ecx, 0x2a1c6b3f
jb 0x1400f53b0
cmp eax, 6
sete cl
jmp 0x1400f53e0
xor ecx, ecx
mov eax, dword [0x141dcaa58]
xor edx, edx
div dword [0x141dcaa5c]
add eax, 0x6bc7c778
mov edx, 0xbc1f34ed
imul rdx, rax
shr rdx, 0x3b
cmp edx, 0x68efe12c
je 0x1400f5452
mov edx, dword [0x141dcaa60]
add edx, dword [0x141dcaa64]
imul rax, rdx, 0x1cc5fa19
shr rax, 0x20
sub edx, eax
shr edx, 1
add edx, eax
shr edx, 0x1f
or edx, 0xbf899e28
movzx r8d, byte [rsi + 4]
shr r8b, 5
mov eax, edi
shr eax, 0x1c
and eax, 1
and al, cl
and al, r8b
mov byte [0x141dbf001], al
cmp edx, 0xd83f3014
jbe 0x1400f546d
movzx eax, byte [rsi + 4]
shr al, 5
mov edx, edi
shr edx, 0x1c
and edx, 1
and dl, cl
and dl, al
mov byte [0x141dbf001], dl
jmp 0x1400f5408
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400fc870
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov eax, dword [0x141dd4ec8]
or eax, dword [0x141dd4ecc]
mov edi, ecx
add eax, 0x3b596550
and eax, 0x5800540b
cmp eax, 0x56fc94c2
je 0x1400fc8c5
mov ebx, dword [0x141dd4ed0]
and ebx, dword [0x141dd4ed4]
add ebx, 0x480094fb
or ebx, 0x32f4f8d2
and ebx, 0x76f6f8f7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp ebx, 0x5204dccb
jae 0x1400fc8cd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1400fc899
mov rcx, rax
mov eax, dword [0x141dd4ed8]
xor edx, edx
div dword [0x141dd4edc]
add eax, 0x9ffcaba1
or eax, 0xd926afde
xor eax, 0x2454bd9c
cmp eax, 0xab1a3e20
jb 0x1400fc8d0
nop word cs:[rax + rax]
mov eax, dword [0x141dd4ee0]
imul eax, dword [0x141dd4ee4]
xor eax, 0x150e940
imul eax, eax, 0xce8a74ac
cmp eax, 0x1b7247eb
je 0x1400fc900
test rcx, rcx
je 0x1400fc938
mov qword [0x141ddb260], rcx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1400fc940
xor eax, eax
nop word [rax + rax]
mov ecx, dword [0x141dd4ee8]
or ecx, dword [0x141dd4eec]
imul rcx, rcx, 0x7f5f4375
shr rcx, 0x3e
or ecx, 0x307320e6
xor ecx, 0x60c2eed3
cmp ecx, 0xc243bea
jb 0x1400fc940
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400fe010
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, r9
mov rsi, rcx
mov r9, qword [rsp + 0xc0]
nop
mov eax, dword [0x141dd5348]
sub eax, dword [0x141dd534c]
add eax, 0xde6cf593
and eax, 0xd999b74d
imul r10, rax, 0x24c4341d
shr r10, 0x3b
mov rax, rdx
add rax, r8
setb cl
cmp r10d, 0xa1b53bfb
je 0x1400fe030
nop word cs:[rax + rax]
mov edx, dword [0x141dd5350]
imul edx, dword [0x141dd5354]
xor edx, 0xc4198a05
and edx, 0xe63fca3d
imul rdx, rdx, 0x643842f5
shr rdx, 0x3e
cmp edx, 0xfa6900db
ja 0x1400fe070
test cl, cl
jne 0x1400fe2b5
nop word cs:[rax + rax]
mov ecx, dword [0x141dd5358]
imul ecx, dword [0x141dd535c]
and ecx, 0x8206a626
add ecx, 0x2962db72
mov r8, qword [rsi]
lea r12, [r8 + r8]
cmp r12, rax
cmovbe r12, rax
cmp ecx, 0xb4064fbf
ja 0x1400fe0b0
xor eax, eax
cmp r9, 1
sete al
lea rax, [rax*4 + 4]
cmp rax, r12
cmova r12, rax
lea rax, [rdi + r9]
dec rax
mov rcx, rdi
neg rcx
and rcx, rax
movabs r10, 0x8000000000000000
mov eax, dword [0x141dd5360]
xor edx, edx
div dword [0x141dd5364]
sub r10, rdi
nop word cs:[rax + rax]
mov eax, dword [0x141dd5368]
xor edx, edx
div dword [0x141dd536c]
imul eax, eax, 0xbe4182dc
imul r11, rax, 0x17be3d1d
shr r11, 0x3c
xor r11d, 0xddf35b55
mov rax, rcx
mul r12
mov rbx, rax
seto al
cmp rbx, r10
seta dl
cmp r11d, 0x6ebe528c
jb 0x1400fe130
or al, dl
jne 0x1400fe2b5
test r8, r8
je 0x1400fe295
mov rax, qword [rsi + 8]
imul r8, r9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r8
mov r13, rdi
mov eax, dword [0x141dd5370]
imul eax, dword [0x141dd5374]
cmp eax, 0xb72322d0
jne 0x1400fe1c5
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov rdx, rdi
mov r8, rbx
call fcn.1400c1320
lea r14, [rsp + 0x40]
lea r15, [rsp + 0x28]
xor ebp, ebp
nop word cs:[rax + rax]
mov qword [rsp + 0x30], r13
mov rcx, r14
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.1400c1320
test bpl, bpl
jne 0x1400fe1e0
cmp qword [rsp + 0x40], 0
jne 0x1400fe2b5
nop word [rax + rax]
mov eax, dword [0x141dd5388]
imul eax, dword [0x141dd538c]
imul eax, eax, 0x7d739de0
add eax, 0x1176d57a
cmp eax, 0xc349f2ac
ja 0x1400fe210
mov rcx, qword [rsp + 0x48]
mov eax, dword [0x141dd5390]
xor edx, edx
div dword [0x141dd5394]
or eax, 0x348a0088
cmp eax, 0x6d4d24b6
jne 0x1400fe260
mov qword [rsi + 8], rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dd5398]
add eax, dword [0x141dd539c]
xor eax, 0xaaca72f3
add eax, 0xb1f140cb
mov qword [rsi + 8], rcx
cmp eax, 0x28df1e72
ja 0x1400fe260
mov qword [rsi], r12
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r13d, r13d
mov eax, dword [0x141dd5370]
imul eax, dword [0x141dd5374]
cmp eax, 0xb72322d0
je 0x1400fe1ab
jmp 0x1400fe1c5
mov eax, dword [0x141dd5378]
add eax, dword [0x141dd537c]
cmp eax, 0x2759aa05
jne 0x1400fe2ca
ud2
mov eax, 0x821175c1
nop
mov ecx, dword [0x141dd5380]
sub ecx, dword [0x141dd5384]
xor ecx, 0xe6ff8814
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x29a140cc
ud2
Function at 0x140100130
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea rax, [r8 + 0x110]
mov rcx, qword [r8 + 0x100]
mov rdx, qword [r9 + 0x50]
mov qword [rsp + 0x70], rdx
movups xmm0, xmmword [r9 + 0x40]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmm2, xmmword [r9 + 0x20]
movups xmm3, xmmword [r9 + 0x30]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], rcx
mov eax, dword [0x141dd6ba0]
imul eax, dword [0x141dd6ba4]
mov byte [rsp + 0xc8], 1
or eax, 0x14f43107
imul eax, eax, 0x8aa44d13
cmp eax, 0x3ae7e3bd
je 0x140100214
mov ebp, dword [0x141dd6ba8]
or ebp, dword [0x141dd6bac]
and ebp, 0xedeb4225
add ebp, 0x19271b34
mov qword [rsp + 0x78], 0
lea rdx, [0x1400ccf80]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.140082290
mov rax, qword [rsp + 0xb8]
cmp ebp, 0x6c9f87ea
jbe 0x14010023b
mov qword [rsp + 0x78], 0
lea rdx, [0x1400ccf80]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.140082290
mov rax, qword [rsp + 0xb8]
jmp 0x1401001cf
cmp rax, 3
je 0x1401002c0
mov eax, dword [0x141dd6bb0]
sub eax, dword [0x141dd6bb4]
and eax, 0x4f3a8ec5
imul eax, eax, 0x56519232
cmp eax, 0xc0e8c771
ja 0x140100275
lea rdx, [rsp + 0xb8]
mov rcx, rdi
call fcn.1400f64b0
xor eax, eax
test al, al
je 0x140100287
lea rdx, [rsp + 0xb8]
mov rcx, rdi
call fcn.1400f64b0
jmp 0x14010025f
mov eax, 0xdf64949f
nop dword [rax]
mov ecx, dword [0x141dd6bb8]
or ecx, dword [0x141dd6bbc]
and ecx, 0x9a1b1bda
imul rcx, rax
shr rcx, 0x3e
and ecx, 1
cmp ecx, 0xd7922d7b
je 0x140100290
nop word cs:[rax + rax]
mov eax, dword [0x141dd6bc0]
and eax, dword [0x141dd6bc4]
and eax, 0x81914090
or eax, 0x444a1125
imul eax, eax, 0xba677268
cmp eax, 0xebe4c4ca
ja 0x1401002c0
mov rax, qword [rsp + 0x78]
nop dword [rax + rax]
mov ecx, dword [0x141dd6bc8]
imul ecx, dword [0x141dd6bcc]
and ecx, 0x946b4094
imul ecx, ecx, 0x4723ee36
cmp ecx, 0xd910ef93
je 0x1401002f0
cmp rax, 1
jne 0x140100356
movaps xmm0, xmmword [rsp + 0x80]
mov eax, dword [0x141dd6bd8]
xor edx, edx
div dword [0x141dd6bdc]
lea rcx, [rsp + 0x90]
add eax, 0xad00766b
or eax, 0x24cf24cb
mov edx, 0xb5c846af
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0x19ea68fc
jne 0x140100388
jmp 0x1401003bc
test rax, rax
jne 0x140100360
ud2
mov eax, dword [0x141dd6bd0]
sub eax, dword [0x141dd6bd4]
or eax, 0x4bf4056a
imul eax, eax, 0x468fcdd2
xor eax, 0x322d1fb2
cmp eax, 0x445c5832
jb 0x140100360
call fcn.140073830
mov eax, dword [0x141dd6be0]
and eax, dword [0x141dd6be4]
add eax, 0x76fcec8e
xor eax, 0x452669a0
add eax, 0x92dcedc
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rcx]
movups xmm2, xmmword [rcx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm2
cmp eax, 0x461580ce
jae 0x1401003d0
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rcx]
movups xmm2, xmmword [rcx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi + 0x20], xmm2
jmp 0x140100388
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x1401003dc
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
xor eax, eax
test al, al
je 0x1401003ec
mov eax, dword [0x141ddb270]
mov eax, dword [0x141dd7d38]
add eax, dword [0x141dd7d3c]
xor eax, 0xf1adc7d8
add eax, 0xdf5cc253
xor eax, 0xe39a5324
mov ecx, dword [0x141ddb270]
cmp eax, 0x2e8a81a
jb 0x1401003ec
mov r8d, 0x67946d29
mov eax, dword [0x141dd7d40]
sub eax, dword [0x141dd7d44]
xor eax, 0x356c72b9
xor edx, edx
div r8d
cmp eax, 0x36ab907e
ja 0x14010041a
cmp ecx, 3
jne 0x140100447
xor eax, eax
test al, al
jne 0x14010043e
add rsp, 0x48
ret
lea rax, [0x141ddb274]
mov ecx, dword [0x141dd7d48]
imul ecx, dword [0x141dd7d4c]
mov qword [rsp + 0x30], rax
add ecx, 0x6d866936
or ecx, 0x367b1d2b
cmp ecx, 0x3ca3a73a
je 0x1401004a4
mov eax, dword [0x141dd7d50]
xor eax, dword [0x141dd7d54]
add eax, 0x9e8ce4ce
mov ecx, 0xb1478a19
xor edx, edx
div ecx
or eax, 0x27fee73a
lea rcx, [rsp + 0x2f]
mov qword [rsp + 0x38], rcx
cmp eax, 0x796b6787
jbe 0x1401004b0
lea rax, [rsp + 0x2f]
mov qword [rsp + 0x38], rax
jmp 0x140100474
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov qword [r8], rax
lea rcx, [0x141ddb270]
lea r9, [0x141db98b0]
mov dl, 1
call fcn.1400fb0a0
jmp 0x14010043c
Function at 0x140003ef0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003f4d
lea rbx, [0x14015c330]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003f34
cmp r10, 2
jb 0x140003f34
cmp byte [r9], r8b
jne 0x140003f34
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003f10
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003f8f
lea rbx, [0x14015c330]
cmp r8b, 0x23
jne 0x140003f73
cmp byte [r9], r8b
jne 0x140003f73
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003f60
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004150
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000417f
mov r8d, 0x7d7
lea rdx, str.C:Usersefe36DownloadsIMGUI_NESTA_V2IMGUI_NESTA_V2IMGUI_NESTA_V2Imgui_Design_V3Imgui_Design_V3imgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000418b
mov qword [rdi], 0
lea rdx, [0x14015bb48]
mov rcx, rbx
call fcn.140003fa0
mov rbx, rax
test rax, rax
jne 0x1400041ad
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140004286
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004286
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140004286
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004286
cmp rsi, 0xffffffffffffffff
je 0x140004286
mov rax, qword [0x1404990f0]
test rax, rax
je 0x140004223
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140004286
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140004273
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1404990f0]
test rax, rax
je 0x140004268
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000428f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140004281
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140004291
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007ee0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x140007f1c
mov r8d, 0x718
lea rdx, str.C:Usersefe36DownloadsIMGUI_NESTA_V2IMGUI_NESTA_V2IMGUI_NESTA_V2Imgui_Design_V3Imgui_Design_V3imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x14015c330]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x140007f97
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.1400203c0
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007fb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140007fe3
mov r8d, 0x718
lea rdx, str.C:Usersefe36DownloadsIMGUI_NESTA_V2IMGUI_NESTA_V2IMGUI_NESTA_V2Imgui_Design_V3Imgui_Design_V3imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x110]
lea r10, [0x14015c330]
movsxd rcx, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x114]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret