joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010bc0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, dword [rdx + 0xc]
xor ebx, ebx
sub ebp, r8d
je 0x140010c14
mov ebx, 0xffffffff
jl 0x140010c14
mov rsi, r9
mov rdi, rcx
add r8d, dword [rdx + 8]
mov rcx, qword [rcx]
mov edx, r8d
xor r8d, r8d
call fcn.14001be78
test eax, eax
jne 0x140010c14
mov eax, dword [rsp + 0x70]
cmp ebp, eax
cmovg ebp, eax
mov r9, qword [rdi]
movsxd r8, ebp
mov edx, 1
mov rcx, rsi
call fcn.140020f94
mov rbx, rax
mov eax, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140010c20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14003a820]
xor eax, eax
movdqa xmm1, xmmword [0x14003a830]
movdqa xmm2, xmmword [0x14003a840]
lea rcx, [0x140048780]
movdqa xmm3, xmmword [0x14003a850]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm4, xmm0
psrld xmm4, 1
movdqa xmm5, xmm0
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrld xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubd xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrld xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubd xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrld xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
movdqa xmmword [rax + rcx], xmm5
paddd xmm0, xmm3
add rax, 0x10
cmp rax, 0x400
jne 0x140010c60
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret

Function at 0x140010d60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14003a860]
xor eax, eax
movdqa xmm1, xmmword [0x14003a870]
movdqa xmm2, xmmword [0x14003a880]
lea rcx, [0x140048b80]
movdqa xmm3, xmmword [0x14003a890]
nop word cs:[rax + rax]
nop dword [rax]
movdqa xmm4, xmm0
psrlq xmm4, 1
movdqa xmm5, xmm0
pand xmm5, xmm1
pxor xmm6, xmm6
psubq xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrlq xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubq xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrlq xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubq xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrlq xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubq xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrlq xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubq xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
psrlq xmm5, 1
pand xmm6, xmm1
pxor xmm4, xmm4
psubq xmm4, xmm6
pand xmm4, xmm2
pxor xmm4, xmm5
psrlq xmm4, 1
pand xmm5, xmm1
pxor xmm6, xmm6
psubq xmm6, xmm5
pand xmm6, xmm2
pxor xmm6, xmm4
psrlq xmm6, 1
pand xmm4, xmm1
pxor xmm5, xmm5
psubq xmm5, xmm4
pand xmm5, xmm2
pxor xmm5, xmm6
movdqa xmmword [rax + rcx], xmm5
paddq xmm0, xmm3
add rax, 0x10
cmp rax, 0x800
jne 0x140010da0
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x1400116f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov r10, rcx
mov rax, qword [r8]
cmp dword [rcx], 4
jne 0x140011710
sub r9, rax
cmp r9, 5
jae 0x140011717
xor esi, esi
jmp 0x1400118af
add rdx, rax
mov r12d, dword [r10 + 0x10]
add r9, 0xfffffffffffffffc
mov rax, 0xffffffffffffffff
xor esi, esi
lea r15, [0x14003a8b0]
mov r14d, 0x17
jmp 0x140011753
mov rcx, rsi
mov rsi, rcx
add rsi, 1
cmp rsi, r9
jae 0x140011892
mov cl, byte [rdx + rsi]
and cl, 0xfe
cmp cl, 0xe8
jne 0x140011740
mov rcx, rsi
sub rcx, rax
cmp rcx, 3
jbe 0x140011770
xor r12d, r12d
jmp 0x1400117b0
add cl, 0xff
shl r12d, cl
mov eax, r12d
and eax, 7
mov r12d, 0
test eax, eax
je 0x1400117b0
bt r14d, eax
jae 0x14001187f
movzx ecx, byte [rax + r15]
mov rdi, rsi
sub rdi, rcx
mov cl, byte [rdi + rdx + 4]
add cl, 1
cmp cl, 1
jbe 0x14001187f
mov r12d, eax
nop
movzx ebx, byte [rdx + rsi + 4]
lea eax, [rbx + 1]
cmp al, 1
jbe 0x1400117c9
lea r12d, [r12 + r12]
add r12d, 1
jmp 0x140011887
movzx eax, byte [rdx + rsi + 1]
movzx ecx, byte [rdx + rsi + 2]
shl ecx, 8
movzx ebp, byte [rdx + rsi + 3]
shl ebp, 0x10
shl ebx, 0x18
or ebx, eax
or ebx, ecx
or ebx, ebp
mov eax, dword [r10 + 0xc]
add eax, esi
mov r13d, 0xfffffffb
sub r13d, eax
add ebx, r13d
test r12d, r12d
je 0x140011855
mov eax, r12d
movzx r11d, byte [rax + r15]
shl r11d, 3
mov eax, 0x18
sub eax, r11d
mov ebp, ebx
mov ecx, eax
shr ebp, cl
add bpl, 1
cmp bpl, 1
ja 0x140011855
neg r11b
mov ebp, 0xffffffff
mov ecx, r11d
shl ebp, cl
not ebp
nop word cs:[rax + rax]
nop dword [rax + rax]
xor ebx, ebp
add ebx, r13d
mov edi, ebx
mov ecx, eax
shr edi, cl
add dil, 1
cmp dil, 2
jb 0x140011840
lea rcx, [rsi + 4]
mov eax, ebx
and eax, 0x1000000
mov ebp, eax
neg ebp
or ebp, eax
mov byte [rdx + rsi + 1], bl
mov byte [rdx + rsi + 2], bh
shr ebx, 0x10
mov byte [rdx + rsi + 3], bl
shr ebp, 0x18
mov byte [rdx + rsi + 4], bpl
jmp 0x14001188a
lea r12d, [rax + rax]
add r12d, 1
mov rcx, rsi
mov rax, rsi
jmp 0x140011743
mov rdx, rsi
sub rdx, rax
lea ecx, [rdx - 1]
shl r12d, cl
xor eax, eax
cmp rdx, 3
cmovbe eax, r12d
mov dword [r10 + 0x10], eax
mov rax, qword [r8]
add rax, rsi
mov qword [r8], rax
add dword [r10 + 0xc], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14001f774
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14001f794
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001bab4
or eax, 0xffffffff
jmp 0x14001f796
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001f7cc
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14001f7ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001bab4
or eax, 0xffffffff
jmp 0x14001f7ee
xor eax, eax
add rsp, 0x28
ret
Function at 0x140420800
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push rbp
push rax
push rcx
push rdx
lea rcx, section.UPX1
mov rdx, rcx
mov rsi, 0x10
mov al, byte [rdx]
xor al, 0x3c
mov byte [rdx], al
inc rdx
mov al, byte [rdx]
xor al, 0xe8
mov byte [rdx], al
inc rdx
dec rsi
jne 0x140420818
mov rsi, rcx
lea rdx, [rcx - 0x37d000]
mov rdi, rdx
pop rdx
pop rcx
pop rax
lea rax, [rdi + 0x401874]
push qword [rax]
mov dword [rax], 0x6e74baa6
push rax
push rdi
xor ebx, ebx
xor ecx, ecx
or rbp, 0xffffffffffffffff
call fcn.1404208ad
add ebx, ebx
je 0x140420863
repz ret
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
repz ret
Function at 0x1400021ac
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r9
xor r10d, r10d
xor edi, edi
mov r14, r8
mov r15, rdx
mov rbp, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add rbx, rax
test esi, esi
je 0x14000222c
cmp dword [rbx], 0x45474150
je 0x140002206
cmp dword [rbx], 0x7865742e
jne 0x140002222
cmp byte [rbx + 4], 0x74
jne 0x140002222
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8, r15
call fcn.140002138
mov r10, rax
test rax, rax
jne 0x14000222c
inc edi
add rbx, 0x28
cmp edi, esi
jb 0x1400021f0
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140002248
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebp, ebp
lea r9, [rax + 0x18]
and dword [rax + 0x18], ebp
mov rsi, rdx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbp + 0xb]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400022c4
mov edx, dword [rsp + 0x180]
xor ecx, ecx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1400022c4
mov r8d, dword [rsp + 0x180]
xor r9d, r9d
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jns 0x1400022de
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xor edi, edi
cmp dword [rbx], edi
jbe 0x1400023a0
mov eax, edi
lea rcx, [rsp + 0x20]
imul rax, rax, 0x128
mov edx, 2
add rax, 8
add rax, rbx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140002302
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call fcn.1400023f0
mov rcx, rax
mov rdx, r14
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140002390
inc edi
cmp edi, dword [rbx]
jb 0x1400022e8
jmp 0x1400023a0
mov rbp, qword [rsp + 0x30]
test rsi, rsi
je 0x1400023a0
mov ecx, dword [rsp + 0x38]
mov dword [rsi], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbp
jmp 0x1400022c6
Function at 0x1400023b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x1400023be
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4b9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x1400023eb
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x1400023d6
mov eax, ecx
ret

Function at 0x1400024a8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov esi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rdi
call fcn.1400023b4
xor ebx, eax
test esi, esi
je 0x1400024ee
mov ecx, esi
imul ebx, ebx, 0x41c64e6d
add ebx, 0x3039
mov eax, ebx
shr eax, 0x10
xor byte [rdi], al
inc rdi
sub rcx, 1
jne 0x1400024d2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400032e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000333d
lea rbx, [0x1400e33e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003324
cmp r10, 2
jb 0x140003324
cmp byte [r9], r8b
jne 0x140003324
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003300
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000337f
lea rbx, [0x1400e33e0]
cmp r8b, 0x23
jne 0x140003363
cmp byte [r9], r8b
jne 0x140003363
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003350
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000356f
mov r8d, 0x7d7
lea rdx, str.C:Users_tauro_source_reposMultiProjectLoaderx64ReleasemenusLoader2imgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000357b
mov qword [rdi], 0
lea rdx, [0x1400e2be8]
mov rcx, rbx
call fcn.140003390
mov rbx, rax
test rax, rax
jne 0x14000359d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003676
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003676
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003676
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003676
cmp rsi, 0xffffffffffffffff
je 0x140003676
mov rax, qword [0x14042ed08]
test rax, rax
je 0x140003613
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003676
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003663
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14042ed08]
test rax, rax
je 0x140003658
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000367f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140003671
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140003681
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400072b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x1400072ec
mov r8d, 0x717
lea rdx, str.C:Users_tauro_source_reposMultiProjectLoaderx64ReleasemenusLoader2imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x1400e33e0]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x140007367
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001fa90
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007380
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x1400073b3
mov r8d, 0x717
lea rdx, str.C:Users_tauro_source_reposMultiProjectLoaderx64ReleasemenusLoader2imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x110]
lea r10, [0x1400e33e0]
movsxd rcx, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x114]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret
Function at 0x140017980
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14042ed08]
mov edi, ecx
cmp byte [rbx + 0x4a9d], 0
jne 0x1400179d2
cmp byte [rbx + 0x4a9e], 0
jne 0x1400179d2
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003140
test dil, 1
je 0x140017aff
jmp 0x140017a5d
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400ec09c]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x1400ec07c]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47e8], rax
mov dword [rbx + 0x47d4], 1
movss dword [rbx + 0x47e0], xmm0
movss dword [rbx + 0x47e4], xmm1
movss xmm0, dword [rbx + 0x3904]
mulss xmm0, dword [0x1400ebfb8]
or dword [rbx + 0x47d0], 0x41
movss dword [rbx + 0x4830], xmm0
movsx r9d, word [rbx + 0x5bc2]
call fcn.140003140
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140017ab0
lea r11, [0x1400e33e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140017a93
cmp byte [r8], r9b
jne 0x140017a93
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017a80
not ecx
call fcn.14000c0a0
test rax, rax
je 0x140017aff
cmp byte [rax + 0xb6], 0
je 0x140017aff
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bc2]
movsx r9d, word [rbx + 0x5bc2]
call fcn.140003140
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000ed10
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14001e120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca8], 0
lea rbx, [rcx + 0x5cb0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001e1c7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001e17a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400208d0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003d40
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14042ed00]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001e1cf
mov rcx, rbx
call fcn.140003d40
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001e580
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x14042ed08]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001e5e4
lea r10, [0x1400e33e0]
cmp r8b, 0x23
jne 0x14001e5c7
cmp byte [rdx], r8b
jne 0x14001e5c7
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001e5b4
mov eax, dword [r14 + 0x5c20]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001e645
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001e60a
cmp edi, eax
jl 0x14001e624
mov r8d, 0x70e
lea rdx, str.C:Users_tauro_source_reposMultiProjectLoaderx64ReleasemenusLoader2imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5c28]
cmp dword [rax + rbp + 8], ebx
je 0x14001e662
mov eax, dword [r14 + 0x5c20]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001e601
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001e66f
cmp edi, dword [r14 + 0x5c20]
jl 0x14001e689
mov r8d, 0x70e
lea rdx, str.C:Users_tauro_source_reposMultiProjectLoaderx64ReleasemenusLoader2imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5c28]
lea rax, [rax + rcx*8]
jmp 0x14001e647
Function at 0x140036760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x30
mov r8, qword [0x14042ed08]
mov r9, rdx
movaps xmmword [rsp + 0x20], xmm6
mov rbx, rcx
mov rax, qword [r8 + 0x3ef8]
cmp qword [rax + 0x1a8], 0
movss xmm0, dword [rax + 0x20]
movss xmm6, dword [rax + 0x250]
subss xmm6, xmm0
jne 0x1400367a4
cmp qword [r8 + 0x4b58], 0
je 0x1400367b0
movss xmm6, dword [rax + 0x220]
subss xmm6, xmm0
movss xmm5, dword [rax + 0x100]
lea rdx, [0x14042e630]
movss xmm4, dword [rax + 0x104]
movaps xmm1, xmm0
movss xmm0, dword [rax + 0x84]
subss xmm5, xmm1
movss xmm3, dword [rax + 0x24]
mov rcx, r9
movss xmm2, dword [rax + 0x88]
subss xmm4, xmm3
subss xmm6, dword [0x1400ec190]
mov byte [rax + 0xb8], 1
mov rax, qword [r8 + 0x3ef8]
addss xmm5, xmm0
mov r8d, 0x301a0
addss xmm4, xmm2
movss xmm0, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
addss xmm5, xmm6
subss xmm0, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
xorps xmm6, xmm6
mov byte [rax + 0x141], 1
addss xmm4, xmm6
addss xmm5, xmm0
addss xmm1, xmm4
movss dword [rax + 0x100], xmm5
movss dword [rax + 0x104], xmm1
call fcn.140042f20
mov rcx, qword [0x14042ed08]
lea rdx, [0x14042ed84]
mov rax, qword [rcx + 0x3ef8]
movss xmm1, dword [rax + 0x20]
movss xmm0, dword [rax + 0x84]
movss xmm5, dword [rax + 0x100]
movss xmm4, dword [rax + 0x104]
subss xmm5, xmm1
movss xmm3, dword [rax + 0x24]
movss xmm2, dword [rax + 0x88]
subss xmm4, xmm3
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ef8]
mov rcx, rbx
addss xmm5, xmm0
addss xmm4, xmm2
movss xmm0, dword [rax + 0x20]
movss xmm1, dword [rax + 0x24]
subss xmm0, dword [rax + 0x84]
subss xmm1, dword [rax + 0x88]
subss xmm4, dword [0x1400ec0cc]
subss xmm5, xmm6
mov byte [rax + 0x141], 1
addss xmm1, xmm4
addss xmm5, xmm0
movss dword [rax + 0x104], xmm1
movss dword [rax + 0x100], xmm5
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
jmp fcn.140035c90