joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006e5d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14006e77f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140019390
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14006e744
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14006e6bd
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14006e733
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14006e6fa
mov r10, qword [rdx]
cmp r10, rax
je 0x14006e6f4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14006e733
cmp r9, rdx
je 0x14006e70f
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14006e759
cmp r9, rdx
jne 0x14006e700
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14006e670
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14006e733
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14006e790
Capabilities:
Hash data using fnv

Disassembly:
push r14
sub rsp, 0x30
mov rax, qword [rcx + 0x50]
mov r14, rcx
cmp qword [rcx + 8], rax
jbe 0x14006e956
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rdi, qword [rcx]
mov rsi, qword [rdi]
test rax, rax
je 0x14006e7ca
mov rsi, qword [rsi]
sub rax, 1
jne 0x14006e7c1
mov rbx, rsi
cmp rsi, rdi
je 0x14006e947
mov qword [rsp + 0x48], rbp
movabs rbp, 0x100000001b3
mov qword [rsp + 0x28], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x20], r15
xor r15d, r15d
nop dword [rax]
mov edx, dword [rbx + 0x10]
mov eax, edx
shr eax, 8
movzx r8d, al
movzx eax, dl
xor rax, r12
imul rax, rbp
xor r8, rax
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
imul r8, rbp
shr rax, 0x18
xor r8, rcx
mov rcx, qword [r14 + 0x40]
imul r8, rbp
xor r8, rax
mov rax, qword [r14 + 0x28]
imul r8, rbp
and rcx, r8
shl rcx, 4
add rax, rcx
mov rcx, qword [rax + 8]
cmp rcx, qword [r14 + 0x18]
je 0x14006e870
mov rax, qword [rax]
cmp edx, dword [rcx + 0x10]
je 0x14006e873
nop dword [rax]
cmp rcx, rax
je 0x14006e870
mov rcx, qword [rcx + 8]
cmp edx, dword [rcx + 0x10]
jne 0x14006e860
jmp 0x14006e873
mov rcx, r15
test rcx, rcx
je 0x14006e8df
mov rdx, qword [r14 + 0x28]
mov rax, qword [r14 + 0x40]
and rax, r8
add rax, rax
lea r9, [rdx + rax*8]
lea r8, [rdx + rax*8]
mov rax, qword [rdx + rax*8]
cmp qword [r9 + 8], rcx
jne 0x14006e8b4
cmp rax, rcx
jne 0x14006e8aa
mov rax, qword [r14 + 0x18]
mov qword [r8], rax
mov qword [r9 + 8], rax
jmp 0x14006e8bf
mov rax, qword [rcx + 8]
mov qword [r9 + 8], rax
jmp 0x14006e8bf
cmp rax, rcx
jne 0x14006e8bf
mov rax, qword [rcx]
mov qword [r8], rax
mov rdx, qword [rcx]
dec qword [r14 + 0x20]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1400fcffc
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14006e800
mov rax, qword [rsi + 8]
mov r12, qword [rsp + 0x28]
mov qword [rax], rdi
mov qword [rdi + 8], rax
nop dword [rax + rax]
mov rbx, qword [rsi + 0x18]
mov rbp, qword [rsi]
test rbx, rbx
je 0x14006e921
mov rcx, rbx
call fcn.140070980
mov edx, Ordinal_23
mov rcx, rbx
call fcn.1400fcffc
mov edx, 0x20
mov rcx, rsi
call fcn.1400fcffc
inc r15
mov rsi, rbp
cmp rbp, rdi
jne 0x14006e900
sub qword [r14 + 8], r15
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14006fdf0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ebx, dl
movzx edi, cl
mov r8d, dword [0x1401acfc8]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1401acce0], eax
jg 0x14006fed3
movzx ecx, di
shl cx, 4
and bl, 0xf
movzx eax, bl
or cx, ax
movzx edx, cx
movzx ecx, dl
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
mov eax, edx
shr rax, 8
xor rcx, rax
imul rcx, r8
and rcx, qword [0x1401acc60]
shl rcx, 4
add rcx, qword [0x1401acc48]
mov rax, qword [rcx + 8]
mov r8, qword [0x1401acc38]
cmp rax, r8
je 0x14006fea2
mov rcx, qword [rcx]
cmp dx, word [rax + 0x10]
je 0x14006fea4
cmp rax, rcx
je 0x14006fea2
mov rax, qword [rax + 8]
cmp dx, word [rax + 0x10]
jne 0x14006fe91
jmp 0x14006fea4
xor eax, eax
mov rcx, r8
test rax, rax
cmovne rcx, rax
cmp rcx, r8
lea rax, [0x1401a6450]
je 0x14006febe
lea rax, [rcx + 0x18]
cmp qword [rax + 0x18], 0xf
jbe 0x14006fec8
mov rax, qword [rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1401acce0]
call fcn.1400fd6c8
cmp dword [0x1401acce0], 0xffffffff
jne 0x14006fe28
vpxor xmm0, xmm0, xmm0
vmovups xmmword [0x1401a6450], xmm0
mov qword [reloc.portaudio.dll_Ordinal_9], 9
mov qword [reloc.portaudio.dll_Ordinal_15], 0xf
vmovsd xmm0, qword [str.Undefined]
vmovsd qword [0x1401a6450], xmm0
movzx eax, byte [0x140157ef0]
mov byte [0x1401a6458], al
mov byte [0x1401a6459], 0
lea rcx, [0x14014d9b0]
call fcn.1400fd22c
nop
lea rcx, [0x1401acce0]
call fcn.1400fd65c
jmp 0x14006fe28

Function at 0x14006ff90
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cl
mov edx, dword [0x1401acfc8]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
mov eax, dword [rcx + rax]
cmp dword [0x1401acce4], eax
jg 0x140070044
mov rcx, rbx
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
and rcx, qword [0x1401acca0]
shl rcx, 4
add rcx, qword [0x1401acc88]
mov rax, qword [rcx + 8]
mov rdx, qword [0x1401acc78]
cmp rax, rdx
je 0x140070018
mov rcx, qword [rcx]
cmp bl, byte [rax + 0x10]
je 0x14007001a
cmp rax, rcx
je 0x140070018
mov rax, qword [rax + 8]
cmp bl, byte [rax + 0x10]
jne 0x140070008
jmp 0x14007001a
xor eax, eax
mov rcx, rdx
test rax, rax
cmovne rcx, rax
cmp rcx, rdx
lea rax, [0x1401a6470]
je 0x140070034
lea rax, [rcx + 0x18]
cmp qword [rax + 0x18], 0xf
jbe 0x14007003e
mov rax, qword [rax]
add rsp, 0x20
pop rbx
ret
lea rcx, [0x1401acce4]
call fcn.1400fd6c8
cmp dword [0x1401acce4], 0xffffffff
jne 0x14006ffc0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [0x1401a6470], xmm0
mov qword [reloc.portaudio.dll_Ordinal_9], 9
mov qword [reloc.portaudio.dll_Ordinal_15], 0xf
vmovsd xmm0, qword [str.Undefined]
vmovsd qword [0x1401a6470], xmm0
movzx eax, byte [0x140157ef0]
mov byte [0x1401a6478], al
mov byte [0x1401a6479], 0
lea rcx, [0x14014da20]
call fcn.1400fd22c
nop
lea rcx, [0x1401acce4]
call fcn.1400fd65c
jmp 0x14006ffc0
Function at 0x140070470
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140070610
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140019390
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400705d5
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
movzx edx, byte [rax + 0x11]
xor r9, rbp
mov r11, qword [rsi + 0x30]
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x14007054a
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400705c4
mov rdx, qword [r11 + 8]
movzx r9d, word [rax + 0x10]
cmp r9w, word [rdx + 0x10]
jne 0x140070589
mov r10, qword [rdx]
cmp r10, rax
je 0x140070583
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400705c4
cmp r8, rdx
je 0x1400705a0
nop
mov rdx, qword [rdx + 8]
cmp r9w, word [rdx + 0x10]
je 0x1400705ea
cmp r8, rdx
jne 0x140070590
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140070510
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400705c4
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140078100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x140078134
cmp ecx, r10d
jge 0x140078122
mov rcx, rbx
call fcn.140073d10
mov eax, dword [rbx + 0x18]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x18], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14007816e
mov ecx, dword [rbx + 0x18]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x18], ecx
movzx r9d, cl
test eax, eax
jg 0x140078150
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x14007819d
mov edx, dword [0x1401acfc8]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1400781cf
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x1400781b9
xor dl, dl
jmp 0x1400781c2
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1400781b0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x140078172
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140078244
mov edx, dword [0x1401acfc8]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x14007825e
mov rcx, rbx
call fcn.14007a530
test eax, eax
je 0x140078237
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140081c10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, qword [0x1401acd00]
xor r14d, r14d
mov ebp, ecx
mov r15d, r14d
mov rbx, qword [rsi + 0x4140]
test cl, 0x10
jne 0x140081d88
mov edi, dword [rsi + 0x4ae8]
test edi, edi
je 0x140081c87
cmp dword [rsi + 0x41a4], edi
jne 0x140081d81
mov eax, dword [rsi + 0x41cc]
cmp eax, 0xffffffff
cmove eax, r14d
movsxd r14, eax
cmp byte [r14 + rsi + 0xe50], r15b
je 0x140081d81
cmp byte [rbx + 0xf8], r15b
jmp 0x140081d49
cmp byte [rsi + 0xe50], r14b
je 0x140081d81
cmp byte [rbx + 0xf8], r14b
jne 0x140081d81
test byte [rsi + 0x4af0], 1
jne 0x140081cc4
cmp dword [rsi + 0x41a4], r14d
je 0x140081d81
cmp qword [rsi + 0x41c0], rbx
jne 0x140081d81
test bpl, 8
je 0x140081d81
lea rdx, [rsi + 0x4af4]
mov rcx, rbx
call fcn.140090430
mov edi, eax
mov dword [rsi + 0x4ae8], eax
mov rax, qword [0x1401acd00]
cmp dword [rax + 0x41a4], edi
jne 0x140081cfa
mov dword [rax + 0x41a8], edi
cmp dword [rax + 0x41d0], edi
jne 0x140081d09
mov byte [rax + 0x41d4], 1
mov r8d, dword [rsi + 0x4aec]
lea rcx, [rsi + 0x4af4]
mov edx, edi
call fcn.140093c20
movzx r15d, al
test al, al
je 0x140081d43
cmp byte [rsi + 0x3870], r14b
je 0x140081d43
mov rdx, rbx
mov ecx, edi
call fcn.14009ec60
xor edx, edx
mov rcx, rbx
call fcn.14008fbf0
cmp dword [rsi + 0x41a4], edi
jne 0x140081d81
mov byte [rsi + 0x41b1], r15b
movsxd rcx, dword [rbx + 0x130]
mov rax, qword [rbx + 0x138]
vmovss xmm1, dword [0x140153c04]
mov r15d, dword [rax + rcx*4 - 4]
mov ecx, r14d
call fcn.140093410
movzx ebx, al
call fcn.14009edc0
test bl, bl
jne 0x140081dd5
xor al, al
jmp 0x140081e92
mov r9d, 0xffffffff
lea rdx, [0x14015ab01]
mov edi, r9d
lea r10, [0x140158df0]
mov r8b, 0x23
cmp r8b, 0x23
jne 0x140081db5
cmp byte [rdx], r8b
jne 0x140081db5
cmp byte [rdx + 1], r8b
cmove edi, r9d
movzx ecx, dil
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr edi, 8
inc rdx
xor edi, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140081da2
not edi
cmp byte [rsi + 0x4f18], 0
jne 0x140081e13
call fcn.140083690
mov dword [rsi + 0x4f34], edi
mov dword [rsi + 0x4f38], r15d
mov byte [rsi + 0x4f18], 1
mov dword [rsi + 0x4f1c], ebp
mov dword [rsi + 0x4f24], r14d
cmp edi, dword [rsi + 0x41a4]
jne 0x140081e13
mov byte [rsi + 0x41b2], 1
mov eax, dword [rsi + 0x4098]
mov dword [rsi + 0x4f20], eax
mov byte [rsi + 0x4f19], 1
test bpl, 1
jne 0x140081e83
cmp dword [rsi + 0x4f98], 0
je 0x140081e7a
test dword [rsi + 0x4f8c], 0x1000
je 0x140081e7a
mov rbx, qword [0x1401acd00]
lea rcx, str.Tooltip_Hidden
xor edx, edx
mov r8d, 0x2030347
call fcn.14007e040
mov rax, qword [rbx + 0x4140]
mov byte [rax + 0xf8], 1
mov byte [rax + 0xfa], 1
mov byte [rax + 0x118], 1
jmp 0x140081e83
xor edx, edx
xor ecx, ecx
call fcn.140082170
test bpl, 0x12
jne 0x140081e90
and dword [rsi + 0x4af0], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140082170
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401a6c00]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401acd00]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4f19], 0
jne 0x1400821d8
cmp byte [rbx + 0x4f1a], 0
jne 0x1400821d8
movsx r9d, word [rbx + 0x6070]
lea r8, str.Tooltip__02d
mov edx, Ordinal_17
lea rcx, [rsp + 0x20]
call fcn.1400917a0
test sil, 2
je 0x140082314
jmp 0x140082275
vmovss xmm1, dword [rbx + 0x3ad0]
vmulss xmm0, xmm1, dword [0x140150974]
vaddss xmm2, xmm0, dword [rbx + 0xe48]
vmulss xmm1, xmm1, dword [0x140152db0]
vaddss xmm0, xmm1, dword [rbx + 0xe4c]
or dword [rbx + 0x4b38], 1
lea r8, str.Tooltip__02d
vmovss dword [rbx + 0x4b50], xmm0
vmovss dword [rbx + 0x4b4c], xmm2
mov dword [rbx + 0x4b3c], 1
lea rcx, [rsp + 0x20]
mov byte [rbx + 0x4b78], 1
xor eax, eax
mov qword [rbx + 0x4b54], rax
mov edx, Ordinal_17
vmovss xmm0, dword [rbx + 0x3b2c]
mov rax, qword [0x1401acd00]
vmulss xmm1, xmm0, dword [0x1401509f8]
or dword [rax + 0x4b38], 0x40
vmovss dword [rax + 0x4ba0], xmm1
movsx r9d, word [rbx + 0x6070]
call fcn.1400917a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400822c5
lea r11, [0x140158df0]
cmp r9b, 0x23
jne 0x1400822a8
cmp byte [r8], r9b
jne 0x1400822a8
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140082295
not ecx
call fcn.14008f8d0
test rax, rax
je 0x140082314
cmp byte [rax + 0xf3], 0
je 0x140082314
mov byte [rax + 0xf8], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xfa], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0x118], 1
mov edx, Ordinal_17
inc word [rbx + 0x6070]
movsx r9d, word [rbx + 0x6070]
call fcn.1400917a0
or edi, 0x20b0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.14007e040
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400fd350
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14008c310
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [0x1401acd00]
mov rbp, rdx
vmovss xmm4, dword [rcx + 0x48]
mov rsi, rcx
mov eax, 1
cmp dword [rdi + 0x3a20], 0
jne 0x14008c362
vmovss xmm1, dword [rdi + 0x3a38]
vmovss xmm0, dword [rdi + 0x3e78]
vaddss xmm2, xmm0, dword [rcx + 0x4c]
vaddss xmm1, xmm1, xmm1
vaddss xmm3, xmm2, xmm1
vxorps xmm1, xmm1, xmm1
jmp 0x14008c38c
vmovss xmm1, dword [rdi + 0x3e78]
vaddss xmm2, xmm1, dword [rcx + 0x4c]
vmovss xmm0, dword [rdi + 0x3a38]
vaddss xmm4, xmm4, dword [rcx + 0x50]
vmovss xmm1, dword [0x1401509fc]
vaddss xmm3, xmm0, xmm0
vaddss xmm3, xmm3, xmm2
or dword [rdi + 0x4b38], 1
vmovss dword [rdi + 0x4b4c], xmm4
vmovss dword [rdi + 0x4b50], xmm3
vmovss dword [rdi + 0x4b54], xmm1
vxorps xmm0, xmm0, xmm0
vmovss dword [rdi + 0x4b58], xmm0
mov dword [rdi + 0x4b3c], eax
mov byte [rdi + 0x4b78], 1
mov rcx, qword [0x1401acd00]
mov eax, dword [rcx + 0x4c50]
cmp dword [rcx + 0x4c40], eax
jg 0x14008c3f3
mov dword [rcx + 0x4b38], 0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rcx + 0x4140]
lea rdx, [0x14015b099]
mov qword [rsp + 0x30], rbx
lea r11, [0x140158df0]
mov r8b, 0x23
movsxd rcx, dword [r10 + 0x130]
mov rax, qword [r10 + 0x138]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
nop dword [rax]
cmp r8b, 0x23
jne 0x14008c443
cmp byte [rdx], r8b
jne 0x14008c443
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r11 + rcx*4]
test r8b, r8b
jne 0x14008c430
mov rax, qword [r10]
not ebx
cmp dword [rax + 0x418c], ebx
jne 0x14008c482
xor r9d, r9d
lea r8, str.WindowMenu
mov ecx, ebx
lea edx, [r9 + 0xb]
call fcn.140084200
mov edx, 0x141
mov ecx, ebx
call fcn.1400820a0
mov rbx, qword [rsp + 0x30]
test al, al
je 0x14008c4b2
or byte [rsi + 0xcc], 2
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rdi + 0x6160]
call fcn.14008ebb0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14008c5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x14008c62d
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x14008c632
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x14008c65d
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14008c65d
mov rax, qword [rax + 0x3b0]
test rax, rax
je 0x14008c65d
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jmp 0x14008c662
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x14008c67c
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x14008c681
mov byte [rsp + 0x30], 0xff
vcvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0x3fc20
mov dword [rsp + 0x34], eax
vcvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
vcvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
vcvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
vcvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
vcvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
mov byte [rsp + 0x31], sil
cmp ecx, r8d
jne 0x14008c706
inc ecx
test r8d, r8d
je 0x14008c6ee
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14008c6f3
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
vzeroupper
call fcn.1400a7170
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
vmovups ymm0, ymmword [rsp + 0x20]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
vmovups ymmword [rcx + rdx*4], ymm0
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x14008c740
lea r8d, [rsi + 1]
mov rcx, rbp
vzeroupper
call fcn.14008c5e0
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x14008c750
inc esi
jmp 0x14008c610
vzeroupper
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret