joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4209f0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x004af588]
test rbx, rbx
je 0x420a20
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
mov rax, qword [0x004af588]
test rax, rax
je 0x420a44
cmp dword [rax], 0xffffffff
je 0x420a65
add rsp, 0x20
pop rbx
ret
lea r8, [0x0041fe80]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425bd0
mov rbx, rax
mov qword [0x004af588], rax
jmp 0x420a01
lea r8, [0x0041fe80]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425bd0
mov qword [0x004af588], rax
jmp 0x420a15
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]

Function at 0x420f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004af590]
test rcx, rcx
je 0x421040
call fcn.00420e70
mov rax, qword [0x004af588]
test rax, rax
je 0x421063
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x420f43
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00420840
test rax, rax
mov rbx, rax
je 0x4210ab
cmp qword [0x004b2050], 0
je 0x4210ab
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4210b2
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004af588]
test rax, rax
je 0x421087
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4210b2
mov rax, rbx
jmp 0x420f3a
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00425bd0
mov rcx, rax
mov qword [0x004af590], rax
jmp 0x420f18
lea r8, [0x0041fe80]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425bd0
mov qword [0x004af588], rax
jmp 0x420f2d
lea r8, [0x0041fe80]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425bd0
mov qword [0x004af588], rax
jmp 0x421028
xor eax, eax
jmp 0x420f3a
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00425bd0
Function at 0x4210c0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rcx, qword [0x004af590]
test rcx, rcx
je 0x421040
call fcn.00420e70
mov rax, qword [0x004af588]
test rax, rax
je 0x421063
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x420f43
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00420840
test rax, rax
mov rbx, rax
je 0x4210ab
cmp qword [0x004b2050], 0
je 0x4210ab
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rbx + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx + 0xb0], 0
mov qword [rbx + 0x28], 0
call rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rbx + 0x28]
mov r8, rbp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4210b2
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xb8], eax
movzx eax, byte [rbx + 0x40]
mov dword [rbx + 0xb4], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [0x004af588]
test rax, rax
je 0x421087
mov rdx, rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4210b2
mov rax, rbx
jmp 0x420f3a
lea rcx, str._pthread_tls_once_shmem
xor r8d, r8d
mov edx, 4
call fcn.00425bd0
mov rcx, rax
mov qword [0x004af590], rax
jmp 0x420f18
lea r8, [0x0041fe80]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425bd0
mov qword [0x004af588], rax
jmp 0x420f2d
lea r8, [0x0041fe80]
lea rcx, str._pthread_tls_shmem
mov edx, 4
call fcn.00425bd0
mov qword [0x004af588], rax
jmp 0x421028
xor eax, eax
jmp 0x420f3a
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
lea rcx, str._pthread_key_dest_shmem
xor r8d, r8d
mov edx, 8
jmp fcn.00425bd0
Function at 0x423e70
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x004af5d8]
mov esi, edx
test rcx, rcx
je 0x423e10
call fcn.00425f90
cmp dword [rbx], 0xbab1f00d
jne 0x423e37
mov eax, dword [rbx + 4]
test eax, eax
jle 0x423e37
mov eax, dword [rbx + 4]
test eax, eax
jle 0x423dc3
mov eax, dword [rbx + 4]
sub eax, 1
mov dword [rbx + 4], eax
mov rcx, qword [0x004af5d8]
test rcx, rcx
je 0x423de0
call fcn.00426040
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea r8, [0x00423b50]
lea rcx, str.mutex_global_shmem
mov edx, 8
call fcn.00425bd0
mov rcx, rax
mov qword [0x004af5d8], rax
call fcn.00426040
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.mutex_global_shmem
lea r8, [0x00423b50]
mov edx, 8
call fcn.00425bd0
mov rcx, rax
mov qword [0x004af5d8], rax
jmp 0x423d97
call qword [sym.imp.msvcrt.dll___iob_func]
lea r9, str.C:_crossdev_src_winpthreads_git20141130_src_mutex.c
lea rcx, [rax + 0x60]
lea r8, str._m___valid__LIFE_MUTEX____m___busy___0_
lea rdx, [0x00491f60]
mov dword [rsp + 0x20], 0x39
call sub.msvcrt.dll_fprintf
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
lea r8, [0x00423b50]
lea rcx, str.mutex_global_shmem
mov edx, 8
jmp fcn.00425bd0
Function at 0x425bd0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x80]
mov rdi, rcx
movsxd r12, edx
mov r13, r8
call sub.msvcrt.dll_strlen
mov r14, rax
lea ebx, [rax + 0xf]
lea eax, [rax + 0x51]
cdqe
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.004157f0
sub rsp, rax
movsxd r15, r14d
movabs rax, 0x656d68732d636367
lea rsi, [rsp + 0x20]
lea rcx, [rsp + 0x2f]
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov eax, 0x326d
mov dword [rsp + 0x28], 0x64742d6d
mov word [rsp + 0x2c], ax
movsxd rbx, ebx
mov byte [rsp + 0x2e], 0x2d
call sub.msvcrt.dll_memcpy
lea rax, [rsi + r15 + 0x10]
lea r15d, [r14 + 0x50]
movabs rdx, 0x6161616161616161
xor ecx, ecx
mov r8, rsi
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
mov qword [rax + 0x30], rdx
mov qword [rax + 0x38], rdx
movsxd rax, r15d
xor edx, edx
mov byte [rsp + rax + 0x20], 0
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov byte [rsp + rbx + 0x20], 0x2d
mov rdi, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x425cb9
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x425d52
mov rcx, r12
add r14d, 0x10
call sub.msvcrt.dll_malloc
mov r10d, 0x40
mov rbx, rax
bt rbx, r10
jae 0x425cf4
mov r11d, r15d
sub r11d, r10d
movsxd r11, r11d
mov byte [rsi + r11], 0x41
sub r10d, 1
jne 0x425ce0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x425d4f
mov rdx, rsi
movzx ecx, ax
mov r9d, r14d
mov r8d, r15d
call fcn.00425b50
cmp rax, rbx
mov rsi, rax
je 0x425d69
mov rcx, rbx
call fcn.0041fbd8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
lea rsp, [rbp - 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
int3
lea r9d, [r14 + 0x10]
mov rdx, rsi
movzx ecx, ax
mov r8d, r15d
call fcn.00425b50
mov rsi, rax
jmp 0x425d29
xor edx, edx
mov r8, r12
mov rcx, rbx
call sub.msvcrt.dll_memset
test r13, r13
je 0x425d29
mov rcx, rbx
call r13
jmp 0x425d29

Function at 0x427950
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x004775d0]
lea rcx, str.__terminate_handler_sh
mov edx, 8
jmp fcn.00415630

Function at 0x427970
Capabilities:
Check mutex on windows

Disassembly:
lea r8, [0x004775e0]
lea rcx, str.__unexpected_handler_sh
mov edx, 8
jmp fcn.00415630
Function at 0x457a30
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
mov rcx, rbp
call fcn.00457910
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x457a80
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x457a4a
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x4778c0
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.004015d9
mov rcx, qword [rsp + 0x30]
mov rsi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rsi
mov rcx, rbx
mov qword [0x004ae098], rax
call fcn.00455470
mov rcx, rbx
call fcn.004027cd
mov rcx, qword [rsp + 0x30]
call rsi
mov rcx, rbx
mov qword [0x004ae080], rax
call fcn.00455470
mov rcx, rbx
call fcn.00402d35
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x004ae080]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
mov rcx, rbx
mov qword [0x004ae078], rax
call fcn.00455470
mov rcx, rbx
call fcn.0040436e
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x004ae080]
call rsi
mov rcx, rbx
mov qword [0x004ae070], rax
call fcn.00455470
mov rcx, rbx
call fcn.004033cc
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x004ae080]
call rsi
mov rcx, rbx
mov qword [0x004ae068], rax
call fcn.00455470
mov rcx, rbx
call fcn.00403c27
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x004ae080]
call rsi
mov rcx, rbx
mov qword [0x004ae060], rax
call fcn.00455470
mov rcx, rbx
mov rdi, qword [0x004ae078]
call fcn.00404bc9
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x30]
call rdi
mov rcx, rbx
mov qword [0x004ae058], rax
call fcn.00455470
mov rcx, rbx
mov rdi, qword [0x004ae070]
call fcn.00405131
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x004ae058]
call rdi
mov rcx, rbx
mov qword [0x004ae050], rax
call fcn.00455470
lea r9, [0x004ae048]
lea r8, [0x004ae04c]
mov edx, 0x20000005
mov rcx, qword [0x004ae050]
mov dword [0x004ae048], 4
mov qword [rsp + 0x20], 0
call qword [0x004ae060]
mov ecx, dword [0x004ae04c]
call fcn.00476870
lea r9, [0x004ae038]
mov rdx, rax
mov r8d, dword [0x004ae04c]
mov rcx, qword [0x004ae050]
mov qword [0x004ae040], rax
call qword [0x004ae068]
mov rcx, rbx
call fcn.004021d1
mov rdx, qword [rsp + 0x30]
mov rcx, qword [0x004ae098]
call rsi
mov edx, dword [0x004ae04c]
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
call rax
mov rcx, rbx
mov qword [0x004ae030], rax
call fcn.00455470
mov ecx, dword [0x004ae04c]
mov rsi, qword [0x004ae040]
mov rdi, qword [0x004ae030]
rep movsb byte [rdi], byte [rsi]
nop
mov rbx, 0x4b
nop
jmp 0x407594
nop
nop
mov rax, 0x91
nop
jmp 0x4075a0
mov rbx, 0x24
jmp 0x4075a9
nop
mov rbx, 0x10a
nop
mov rax, qword [0x4ae030]
nop
push rax
nop
nop
ret
sub rsp, 0x28
call fcn.00414750
mov rax, qword [0x00492b40]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x00492b30]
mov r8, qword [rax]
mov rax, qword [0x00492b20]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x407370
Function at 0x1400125c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001261d
lea rbx, [0x140122d90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140012604
cmp r10, 2
jb 0x140012604
cmp byte [r9], r8b
jne 0x140012604
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400125e0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001265f
lea rbx, [0x140122d90]
cmp r8b, 0x23
jne 0x140012643
cmp byte [r9], r8b
jne 0x140012643
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140012630
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140012820
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14001284f
mov r8d, 0x7b2
lea rdx, str.C:Users_tDesktop_0_0order_90___loader_imgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14001285b
mov qword [rdi], 0
lea rdx, [0x1401225b8]
mov rcx, rbx
call fcn.140012670
mov rbx, rax
test rax, rax
jne 0x14001287d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140012954
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140012954
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140012954
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140012954
cmp rsi, 0xffffffffffffffff
je 0x140012954
mov rax, qword [0x140238960]
test rax, rax
je 0x1400128f1
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140012954
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140012941
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140238960]
test rax, rax
je 0x140012936
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14001295d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14001294f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x14001295f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016100
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x14001613c
mov r8d, 0x710
lea rdx, str.C:Users_tDesktop_0_0order_90___loader_imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x140122d90]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f38], ebx
jne 0x1400161b7
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14002d120
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400161d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140016203
mov r8d, 0x710
lea rdx, str.C:Users_tDesktop_0_0order_90___loader_imgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm2, dword [rbx + 0x110]
lea r9, [0x140122d90]
movss xmm0, dword [rdi]
movsxd rcx, dword [rbx + 0xf0]
subss xmm0, xmm2
mov rax, qword [rbx + 0xf8]
movss xmm3, dword [rbx + 0x114]
movss xmm1, dword [rdi + 4]
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x20]
movss xmm0, dword [rdi + 8]
movzx ecx, r8b
subss xmm0, xmm2
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x1400256b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x140238960]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x140025702
cmp byte [rbx + 0x4a76], 0
jne 0x140025702
movsx r9d, word [rbx + 0x5b82]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140012420
test dil, 1
je 0x14002582f
jmp 0x14002578b
movss xmm1, dword [rbx + 0x38bc]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14012da04]
xor eax, eax
mulss xmm1, dword [0x14012d9ec]
addss xmm0, dword [rbx + 0xe08]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47e0], rax
mov dword [rbx + 0x47cc], 1
movss dword [rbx + 0x47d8], xmm0
movss dword [rbx + 0x47dc], xmm1
movss xmm0, dword [rbx + 0x3924]
mulss xmm0, dword [0x14012d970]
or dword [rbx + 0x47c8], 0x41
movss dword [rbx + 0x4828], xmm0
movsx r9d, word [rbx + 0x5b82]
call fcn.140012420
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400257e0
lea r11, [0x140122d90]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400257c3
cmp byte [r8], r9b
jne 0x1400257c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400257b0
not ecx
call fcn.14001a860
test rax, rax
je 0x14002582f
cmp byte [rax + 0xb6], 0
je 0x14002582f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b82]
movsx r9d, word [rbx + 0x5b82]
call fcn.140012420
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14001d360
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14002b7d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c68], 0
lea rbx, [rcx + 0x5c70]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14002b877
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002b82a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002df60
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140012db0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c68]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c78]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140238958]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002b87f
mov rcx, rbx
call fcn.140012db0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14002bc30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x140238960]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14002bc94
lea r10, [0x140122d90]
cmp r8b, 0x23
jne 0x14002bc77
cmp byte [rdx], r8b
jne 0x14002bc77
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14002bc64
mov eax, dword [r14 + 0x5be0]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14002bcf5
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14002bcba
cmp edi, eax
jl 0x14002bcd4
mov r8d, 0x707
lea rdx, str.C:Users_tDesktop_0_0order_90___loader_imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5be8]
cmp dword [rax + rbp + 8], ebx
je 0x14002bd12
mov eax, dword [r14 + 0x5be0]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14002bcb1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14002bd1f
cmp edi, dword [r14 + 0x5be0]
jl 0x14002bd39
mov r8d, 0x707
lea rdx, str.C:Users_tDesktop_0_0order_90___loader_imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5be8]
lea rax, [rax + rcx*8]
jmp 0x14002bcf7