joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140129c80
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x318]
sub rsp, 0x410
mov rax, qword [0x1401d4618]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r14d, r14d
mov qword [rsp + 0x60], 7
mov rdi, rdx
mov qword [rsp + 0x58], r14
lea rdx, str.OSLTokenStore::ReadBaseReferral_called.
mov word [rsp + 0x48], r14w
lea rcx, [rsp + 0x48]
lea r8d, [r14 + 0x27]
call fcn.140008bbc
lea rdx, [rsp + 0x48]
lea ecx, [r14 + 3]
call sub.Mso20Win32Client.dll_Ordinal_478
xor r8d, r8d
lea rcx, [rsp + 0x48]
mov dl, 1
call fcn.14000867c
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], r14d
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], 4
lea rdx, str.SoftwareMicrosoftOfficeSoftwareProtectionPlatform
mov qword [rsp + 0x40], r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
mov dword [rsp + 0x30], edx
test edx, edx
jns 0x140129d65
lea r8, [rsp + 0x30]
lea rdx, str.OSLTokenStore::ReadBaseReferral_failed_to_open_registry:_hr0x_x
lea ecx, [r14 + 3]
call fcn.14002e1bc
mov ebx, dword [rsp + 0x30]
jmp 0x140129dc3
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.ReferralData
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
mov ecx, 3
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov dword [rsp + 0x30], ebx
test ebx, ebx
js 0x140129ded
lea r8, [rsp + 0x34]
lea rdx, str.OSLTokenStore::ReadBaseReferral_got_value_of:__x
call fcn.140127f00
mov ecx, dword [rsp + 0x34]
mov dword [rdi], ecx
mov eax, ebx
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140121d80
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea r8, [rsp + 0x30]
lea rdx, str.OSLTokenStore::ReadBaseReferral_failed_to_read_registry:_hr0x_x
call fcn.14002e1bc
mov r8d, dword [rsp + 0x30]
lea r9, str.Failed_to_read_value_out_of_registry
mov edx, 0x17
lea rcx, [rsp + 0x70]
call fcn.140023bb0
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14012a4f8
Capabilities:
Listen for remote procedure calls

Disassembly:
sub rsp, 0x3c8
mov rax, qword [0x1401d4618]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov r8d, edx
mov edx, dword [rcx + 0xc]
mov ecx, dword [rcx + 8]
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
test eax, eax
je 0x14012a52b
cmp eax, 0x6b1
jne 0x14012a543
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.140121d80
add rsp, 0x3c8
ret
lea r9, str.RpcServerListen_failed
mov r8d, eax
mov edx, 0xf
lea rcx, [rsp + 0x20]
call fcn.1400298a8
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
push rbx
sub rsp, 0x60
mov eax, dword [rsp + 0xd8]
mov rbx, rcx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call fcn.14012a23c
mov r8d, dword [rsp + 0xc0]
mov rcx, rbx
mov rdx, qword [rsp + 0xb8]
call fcn.14012a570
mov edx, dword [rsp + 0xc8]
mov rcx, rbx
add rsp, 0x60
pop rbx
jmp 0x14012a4f8

Function at 0x14012a5f4
Capabilities:
Listen for remote procedure calls

Disassembly:
sub rsp, 0x3c8
mov rax, qword [0x1401d4618]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov ecx, 1
mov edx, 0x4d2
mov r8d, ecx
call qword [sym.imp.RPCRT4.dll_RpcServerListen]
test eax, eax
je 0x14012a632
cmp eax, 0x6b1
je 0x14012a632
cmp eax, 0x6b3
jne 0x14012a64a
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.140121d80
add rsp, 0x3c8
ret
lea r9, str.RpcServerListen_failed
mov r8d, eax
mov edx, 0xf
lea rcx, [rsp + 0x20]
call fcn.1400298a8
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14012df74
Capabilities:
Initialize winhttp library

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x400
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1401d4618]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov r14, r9
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rax, vtable.RefCounted.0
mov qword [rcx], rax
xor r15d, r15d
mov dword [rcx + 8], r15d
lea rax, [0x1401d80d0]
mov qword [rcx], rax
mov word [rcx + 0x10], r15w
add rcx, 0x18
xor r8d, r8d
xor edx, edx
call fcn.14002a93c
nop
mov qword [rbx + 0x60], r15
lea rax, [rbx + 0x68]
lea edx, [r15 + 7]
mov qword [rax + 0x18], rdx
mov qword [rax + 0x10], r15
cmp rdx, 8
jb 0x14012e001
mov rax, qword [rax]
mov word [rax], r15w
lea rdi, [rbx + 0x88]
mov qword [rdi + 0x18], rdx
mov qword [rdi + 0x10], r15
cmp rdx, 8
jb 0x14012e01f
mov rax, qword [rdi]
jmp 0x14012e022
mov rax, rdi
mov word [rax], r15w
lea rcx, [rbx + 0xa8]
mov qword [rcx + 0x18], rdx
mov qword [rcx + 0x10], r15
cmp rdx, 8
jb 0x14012e040
mov rax, qword [rcx]
jmp 0x14012e043
mov rax, rcx
mov word [rax], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbp
call fcn.140008a84
nop
lea rcx, [rbx + 0xc8]
call fcn.140136fc4
nop
mov qword [rbx + 0x100], r15
mov qword [rbx + 0x108], r15
mov rax, qword [rsp + 0x458]
mov qword [rbx + 0x118], rax
mov rax, qword [rsp + 0x450]
mov qword [rbx + 0x120], rax
mov dword [rbx + 0x128], 0x57
mov qword [rbx + 0x110], r14
cmp qword [rsi + 0x18], 8
jb 0x14012e0ab
mov rsi, qword [rsi]
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx + 0x100], rax
test rax, rax
jne 0x14012e0fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.Failed_to_Open_Win_Http_session
mov edx, 0x79
lea rcx, [rsp + 0x60]
call fcn.1400165ec
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov r8, rbp
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14012e3a0
mov rsi, rax
cmp rdi, rax
je 0x14012e12f
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.14000867c
mov rdx, rsi
mov rcx, rdi
call fcn.14000841c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x40]
call fcn.14000867c
nop
mov rax, rbx
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.140121d80
mov rbx, qword [rsp + 0x448]
add rsp, 0x400
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14012ea54
Capabilities:
Prepare http request

Disassembly:
push rbx
sub rsp, 0x3f0
mov rax, qword [0x1401d4618]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
cmp qword [r8 + 0x10], 0
mov rax, r8
mov rbx, rdx
jne 0x14012ea7f
xor eax, eax
jmp 0x14012ea89
cmp qword [r8 + 0x18], 8
jb 0x14012ea89
mov rax, qword [r8]
lea r8, [rcx + 0x88]
cmp qword [r8 + 0x18], 8
jb 0x14012ea9a
mov r8, qword [r8]
and dword [rsp + 0x30], 0
xor r9d, r9d
and qword [rsp + 0x28], 0
mov rdx, rax
mov rcx, qword [rcx + 0x108]
and qword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
cmp qword [rbx], 0
jne 0x14012eb19
mov rcx, rbx
mov qword [rbx], rax
call fcn.14012fe48
test rax, rax
je 0x14012eb41
mov rcx, rbx
mov dword [rsp + 0x40], 1
call fcn.14012fe48
mov r9d, 4
lea r8, [rsp + 0x40]
mov rcx, rax
lea edx, [r9 + 0x49]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
je 0x14012eb72
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.140121d80
add rsp, 0x3f0
pop rbx
ret
lea r8, str.OHINTERNET_handle_already_set
mov edx, 0x26
lea rcx, [rsp + 0x50]
call fcn.14008878c
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_open_get_request_for_given_file
mov edx, 0x7c
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.140023cb8
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_set_the_auto_logon_option
mov edx, 0x8b
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.140013ef8
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14012f16c
Capabilities:
Read http header

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x358]
sub rsp, 0x430
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1401d4618]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov edi, r9d
mov r14, r8
mov rbx, rdx
mov dword [rsp + 0x38], r9d
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x34], r15d
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14012f257
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14012f257
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rbp + 0x380], r15b
je 0x14012f22e
mov dword [rsp + 0x30], eax
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.Header__d_not_available_in_the_request:_LastError:_0x_x
lea ecx, [r15 + 2]
call fcn.14012ddf8
lea edi, [r15 + 7]
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x10], r15
mov word [rbx], r15w
jmp 0x14012f35e
mov r8d, eax
lea r9, str.Failed_to_read_the_header_buf_size_from_request_headers
mov edx, 0x83
lea rcx, [rbp - 0x70]
call fcn.1400219c4
lea rdx, [0x1401e3810]
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov word [rsp + 0x30], r15w
mov edx, dword [rsp + 0x34]
shr rdx, 1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.14012fde4
nop
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x48]
mov r9, rsi
xor r8d, r8d
mov edx, edi
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14012f2da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r9, str.Failed_to_read_the_header_id_from_request_headers
mov edx, 0x83
lea rcx, [rbp - 0x70]
call fcn.1400241c0
lea rdx, [0x1401e3810]
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
mov edi, 7
mov qword [rbp - 0x80], rdi
mov qword [rsp + 0x78], r15
mov word [rsp + 0x68], r15w
cmp word [rsi], r15w
jne 0x14012f2f9
mov r8, r15
jmp 0x14012f307
or r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], r15w
jne 0x14012f2fd
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140008bbc
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x10], r15
cmp rdi, 8
jb 0x14012f327
mov rax, qword [rbx]
jmp 0x14012f32a
mov rax, rbx
mov word [rax], r15w
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.14000841c
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x68]
call fcn.14000867c
nop
mov rdx, qword [rsp + 0x58]
sub rdx, rsi
sar rdx, 1
mov rcx, rsi
call fcn.140006e88
mov rax, rbx
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.140121d80
mov rbx, qword [rsp + 0x460]
add rsp, 0x430
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14012f474
Capabilities:
Receive http response

Disassembly:
push rbx
sub rsp, 0x3d0
mov rax, qword [0x1401d4618]
xor rax, rsp
mov qword [rsp + 0x3c0], rax
mov ebx, r9d
mov r10, r8
mov rcx, rdx
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rdx, r10
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x14012f4cd
cmp dword [rsp + 0x20], ebx
jne 0x14012f4fe
mov al, 1
mov rcx, qword [rsp + 0x3c0]
xor rcx, rsp
call fcn.140121d80
add rsp, 0x3d0
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_read_available_request_data
mov edx, 0x80
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.1400096c4
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, str.Failed_to_read_all_of_available_data
mov edx, 0x81
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.140023bb0
lea rdx, [0x1401e3810]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1401303a4
Capabilities:
Check mutex on windows

Disassembly:
jmp 0x1401303a4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r8, str._MSIExecute
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rdi, rax
test rax, rax
jne 0x1401303d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1401303d9
xor bl, bl
jmp 0x1401303e9
mov bl, 1
test rdi, rdi
je 0x1401303e9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400032b0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xc
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x1400032c0
mov byte [rcx + 0x10], r10b
ret

Function at 0x1400032e0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xb
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x1400032f0
mov byte [rcx + 0xf], r10b
ret

Function at 0x140003340
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xa
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140003350
mov byte [rcx + 0xe], r10b
ret

Function at 0x140003370
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0xc
jb 0x140003380
mov byte [rcx + 0x10], 0
ret

Function at 0x140003490
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 9
jb 0x1400034a0
mov byte [rcx + 0xd], 0
ret

Function at 0x140003610
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0xa
jb 0x140003620
mov byte [rcx + 0xe], 0
ret

Function at 0x140003640
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 9
mov rdx, rax
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
mov r9d, dword [rcx]
xor r9b, r8b
mov byte [rdx - 1], r9b
sub r10, 1
jne 0x140003650
mov byte [rcx + 0xd], r10b
ret

Function at 0x1400036a0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9b, r8b
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0xb
jb 0x1400036b0
mov byte [rcx + 0xf], 0
ret

Function at 0x140003fa4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003fee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003fee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003fee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003fee
cmp dword [rcx + 0x84], 0xe
jbe 0x140003fee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003ff0
xor al, al
add rsp, 0x28
ret
Function at 0x140003b00
Capabilities:
Access peb ldr_data
Encode data using xor
Execute command
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x140062948]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140062948]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400037d0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140003bb7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140003bb7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x6bccc942
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003bb2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140003b90
cmp r8d, 0x42a1749c
je 0x140003bbc
test r9d, r9d
jne 0x140003b70
mov rax, qword [rax]
jmp 0x140003b40
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 0xd
mov rcx, qword [0x14015da80]
add rax, r10
call rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_______n_____n____________________________n
call fcn.1400043b0
mov rcx, rax
call fcn.140004580
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140003c87
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140003c87
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x643c4d0b
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140003c82
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140003c60
cmp r8d, 0x9a494137
je 0x140003c8c
test r9d, r9d
jne 0x140003c40
mov rax, qword [rax]
jmp 0x140003c10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 7
mov rcx, qword [0x14015da80]
add rax, r10
call rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__i___Join_Discord_for_Updates_n_n
call fcn.1400043b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.__i___Press_any_key_to_load_cheat_n_n
call fcn.1400043b0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14015e7c0]
call fcn.14000b120
call fcn.140053340
mov rbx, qword [rsp + 0x30]
mov eax, dword [rax + 0x70]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f550
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000f5ad
lea rbx, [0x140063f90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000f594
cmp r10, 2
jb 0x14000f594
cmp byte [r9], r8b
jne 0x14000f594
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000f570
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000f5ef
lea rbx, [0x140063f90]
cmp r8b, 0x23
jne 0x14000f5d3
cmp byte [r9], r8b
jne 0x14000f5d3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000f5c0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000f730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000f74a
mov qword [r8], 0
lea rdx, [0x140063b1c]
call fcn.14000f600
mov rbx, rax
test rax, rax
jne 0x14000f76a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000f841
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000f841
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000f841
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000f841
cmp rdi, 0xffffffffffffffff
je 0x14000f841
mov rax, qword [0x14015da40]
test rax, rax
je 0x14000f7de
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000f841
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000f82e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14015da40]
test rax, rax
je 0x14000f823
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000f84a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000f83c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000f84c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140012ea0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140063f90]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x14015da40]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x140012f36
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.1400268f0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140012f40
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf0]
lea r9, [0x140063f90]
movss xmm2, dword [rcx + 0x108]
movss xmm3, dword [rcx + 0x10c]
movsxd rcx, dword [rcx + 0xe8]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret