joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140562360
Capabilities:
Execute command
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1406dc5c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rdi, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x140678940]
lea rcx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x140678940]
lea rcx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rax
lea rdx, [0x140678950]
lea rcx, str.CONIN_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
mov qword [rsp + 0x20], 0
movdqa xmm0, xmmword [0x1406c10d0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov r8d, 1
lea rdx, [0x14067895c]
lea rcx, [rsp + 0x20]
call fcn.14054ed20
nop
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14056243b
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140557910
mov r8d, 1
lea rdx, [0x14067895c]
lea rcx, [rsp + 0x20]
call fcn.140557910
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
nop
lea rcx, [rsp + 0x20]
call fcn.14054ecc0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14063c0a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140562af0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1406dc5c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
movdqa xmm0, xmmword [0x1406c10d0]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov r8d, 6
lea rdx, str.start
lea rcx, [rsp + 0x28]
call fcn.14054ed20
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140562b4e
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x28]
call fcn.140557910
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rsp + 0x28]
call fcn.14054ecc0
nop
mov rcx, rbx
call fcn.14054ecc0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14063c0a0
add rsp, 0x50
pop rbx
ret
Function at 0x140565c10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
mov r8, rcx
je 0x140565c51
xor eax, eax
movabs r9, 0x92f5bff3befa57b
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + r8], dl
inc rax
cmp rax, 0x13
jb 0x140565c30
mov byte [r8 + 0x13], 0
mov rax, r8
ret

Function at 0x140565cc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
mov r8, rcx
je 0x140565d1a
mov r9, rcx
lea rax, [rcx + 1]
not r9
movabs r10, 0x872d5f4385792575
nop dword [rax]
lea ecx, [rax + r9]
mov rdx, r10
and cl, 7
shl cl, 3
shr rdx, cl
movzx ecx, al
xor byte [rax - 1], dl
sub cl, r8b
and cl, 7
mov rdx, r10
shl cl, 3
shr rdx, cl
xor byte [rax], dl
add rax, 2
lea rcx, [r9 + rax]
cmp rcx, 0x20
jb 0x140565ce0
mov byte [r8 + 0x20], 0
mov rax, r8
ret

Function at 0x140565d20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
mov r8, rcx
je 0x140565d61
xor eax, eax
movabs r9, 0xdb93c111f56b3399
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + r8], dl
inc rax
cmp rax, 0x17
jb 0x140565d40
mov byte [r8 + 0x17], 0
mov rax, r8
ret

Function at 0x140565d70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
mov r8, rcx
je 0x140565dca
mov r9, rcx
lea rax, [rcx + 1]
not r9
movabs r10, 0x57c9a51ba7cf4fe5
nop dword [rax]
lea ecx, [rax + r9]
mov rdx, r10
and cl, 7
shl cl, 3
shr rdx, cl
movzx ecx, al
xor byte [rax - 1], dl
sub cl, r8b
and cl, 7
mov rdx, r10
shl cl, 3
shr rdx, cl
xor byte [rax], dl
add rax, 2
lea rcx, [r9 + rax]
cmp rcx, 0x1a
jb 0x140565d90
mov byte [r8 + 0x1a], 0
mov rax, r8
ret

Function at 0x140565e00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
mov r8, rcx
je 0x140565e5a
mov r9, rcx
lea rax, [rcx + 1]
not r9
movabs r10, 0xfbad05af3bb1d545
nop dword [rax]
lea ecx, [rax + r9]
mov rdx, r10
and cl, 7
shl cl, 3
shr rdx, cl
movzx ecx, al
xor byte [rax - 1], dl
sub cl, r8b
and cl, 7
mov rdx, r10
shl cl, 3
shr rdx, cl
xor byte [rax], dl
add rax, 2
lea rcx, [r9 + rax]
cmp rcx, 0x24
jb 0x140565e20
mov byte [r8 + 0x24], 0
mov rax, r8
ret

Function at 0x140565e60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
mov r8, rcx
je 0x140565ea1
xor eax, eax
movabs r9, 0x13bfd92d2557e107
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + r8], dl
inc rax
cmp rax, 0x1d
jb 0x140565e80
mov byte [r8 + 0x1d], 0
mov rax, r8
ret
Function at 0x1405675f0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1406dc5c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
xor esi, esi
mov edx, dword [rcx + 0x118]
lea ecx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
mov rdi, rax
call fcn.14063d484
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1405676bc
nop word [rax + rax]
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x14056766d
mov r8, qword [rbx]
lea rax, [rsp + 0x50]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140567693
inc rax
test ecx, ecx
jne 0x140567680
test edx, edx
je 0x1405676ab
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140567660
jmp 0x1405676bc
mov rsi, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x40]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x20], rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14063c0a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14056a5b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14056a60d
lea rbx, [0x1406551e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14056a5f4
cmp r10, 2
jb 0x14056a5f4
cmp byte [r9], r8b
jne 0x14056a5f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14056a5d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14056a64f
lea rbx, [0x1406551e0]
cmp r8b, 0x23
jne 0x14056a633
cmp byte [r9], r8b
jne 0x14056a633
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14056a620
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14056b3b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp qword [0x1406dd860], 0
je 0x14056b414
call fcn.14056b440
mov r9, rax
cmp byte [rax + 0x59], 0
je 0x14056b42e
xor r8d, r8d
movabs r10, 0xfd37cbbd67bdc747
nop dword [rax]
movzx ecx, r8b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + r9], al
inc r8
cmp r8, 0x59
jb 0x14056b3e0
mov rax, qword [0x1406dd860]
add rax, 0x3908
mov byte [r9 + 0x59], 0
add rsp, 0x28
ret
mov r8d, 0xae2
lea rdx, str.D:BackupGamingAET_New_MenuImGui_Standalone_mainSourceImGui_StandaloneImGuiimgui.cpp
lea rcx, str.GImGui___0__________ay::obfuscated_data_sizeof__No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_______sizeof__No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext______0____ay::generate_key_int_2786U_____static_assert_sizeof_decltype_ay::generate_key_int_2786U______sizeof_ay::key_type____key_must_be_a_64_bit_unsigned_integer____static_assert__ay::generate_key_int_2786U_______1ull____56____key_must_span_all_8_bytes____constexpr_auto_n__sizeof__No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_______sizeof__No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext______0____constexpr_auto_obfuscator__ay::make_obfuscator_n__ay::generate_key_int_2786U_____No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext________thread_local_auto_obfuscated_data__ay::obfuscated_data_n__ay::generate_key_int_2786U____obfuscator___return_obfuscated_data____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1406dd860]
add rax, 0x3908
add rsp, 0x28
ret
Function at 0x14056d8b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rdx
mov qword [rsp + 0x28], rcx
mov ecx, dword [rcx + 0x108]
mov rax, rdx
shr rax, 0x10
mov rdi, rdx
mov qword [rsp + 0x38], rax
mov r14, rdx
mov rax, rdx
shr rdi, 0x38
mov r15, rdx
shr rax, 8
mov r12, rdx
shr r14, 0x30
mov r13, rdx
shr r15, 0x28
mov r8, rbx
shr r12, 0x20
mov r9, rbx
shr r13, 0x18
mov r10, rbx
shr rdx, 8
mov r11, rbx
shr r8, 0x10
mov rsi, rbx
shr r9, 0x18
mov rbp, rbx
shr r10, 0x20
shr r11, 0x28
shr rsi, 0x30
shr rbp, 0x38
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x20], bl
test ecx, ecx
jg 0x14056d987
mov r8d, 0x757
lea rdx, str.D:BackupGamingAET_New_MenuImGui_Standalone_mainSourceImGui_StandaloneImGuiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsp + 0x28]
mov r9, r13
mov rdx, qword [rsp + 0x30]
mov r10, r12
mov r8, qword [rsp + 0x38]
mov r11, r15
mov byte [rsp + 0x20], bl
mov rsi, r14
mov ecx, dword [rax + 0x108]
mov rbp, rdi
jmp 0x14056d98c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x110]
lea r14, [0x1406551e0]
movsxd rcx, ecx
mov edi, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp + 0x20]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
xor edi, dword [r14 + rcx*4]
mov eax, edi
shr edi, 8
xor rax, rdx
movzx ecx, al
xor edi, dword [r14 + rcx*4]
mov eax, edi
shr edi, 8
xor rax, r8
movzx ecx, al
xor edi, dword [r14 + rcx*4]
mov eax, edi
shr edi, 8
xor rax, r9
movzx ecx, al
xor edi, dword [r14 + rcx*4]
mov eax, edi
shr edi, 8
xor rax, r10
movzx ecx, al
xor edi, dword [r14 + rcx*4]
mov eax, edi
shr edi, 8
xor rax, r11
movzx ecx, al
xor edi, dword [r14 + rcx*4]
mov eax, edi
shr edi, 8
xor rax, rsi
movzx ecx, al
xor edi, dword [r14 + rcx*4]
movzx ecx, dil
xor rcx, rbp
shr edi, 8
xor edi, dword [r14 + rcx*4]
mov rcx, qword [0x1406dd860]
not edi
cmp dword [rcx + 0x401c], edi
jne 0x14056da3e
mov r8, rbx
mov edx, ntohs
mov ecx, edi
call fcn.1405967b0
mov rbx, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14056da60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x108]
mov r14, rcx
movsxd rbx, edx
mov edi, ebx
mov esi, ebx
mov ebp, ebx
shr edi, 0x18
mov edx, ebx
shr esi, 0x10
mov r8d, ebx
shr ebp, 8
mov r9d, ebx
shr edx, 8
shr r8d, 0x10
movzx r10d, bl
shr r9d, 0x18
test eax, eax
jg 0x14056dad9
mov r8d, 0x757
lea rdx, str.D:BackupGamingAET_New_MenuImGui_Standalone_mainSourceImGui_StandaloneImGuiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [r14 + 0x108]
movzx r10d, bl
movzx edx, bpl
movzx r8d, sil
movzx r9d, dil
movsxd rcx, eax
mov rax, qword [r14 + 0x110]
mov edi, dword [rax + rcx*4 - 4]
not edi
movzx eax, r10b
movzx ecx, dil
lea r10, [0x1406551e0]
xor rcx, rax
shr edi, 8
movzx eax, dl
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, r8b
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, r9b
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
xor edi, dword [r10 + rcx*4]
mov rcx, qword [0x1406dd860]
not edi
cmp dword [rcx + 0x401c], edi
jne 0x14056db57
mov r8, rbx
mov edx, 4
mov ecx, edi
call fcn.1405967b0
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14056db70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x108]
mov rdi, rdx
mov rbx, rcx
test eax, eax
jg 0x14056dbaa
mov r8d, 0x757
lea rdx, str.D:BackupGamingAET_New_MenuImGui_Standalone_mainSourceImGui_StandaloneImGuiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0x108]
movss xmm2, dword [rbx + 0x128]
lea r9, [0x1406551e0]
movss xmm0, dword [rdi]
movss xmm3, dword [rbx + 0x12c]
subss xmm0, xmm2
movss xmm1, dword [rdi + 4]
movsxd rcx, eax
subss xmm1, xmm3
mov rax, qword [rbx + 0x110]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rdi + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movzx eax, byte [rsp + 0x20]
not r8d
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x14056e350
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp qword [0x1406dd860], 0
je 0x14056e3b2
call fcn.14056e3e0
mov r9, rax
cmp byte [rax + 0x59], 0
je 0x14056e3cc
xor r8d, r8d
movabs r10, 0xc7b3072385f56925
nop dword [rax]
movzx ecx, r8b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + r9], al
inc r8
cmp r8, 0x59
jb 0x14056e380
mov rax, qword [0x1406dd860]
add rax, 8
mov byte [r9 + 0x59], 0
add rsp, 0x28
ret
mov r8d, 0xed1
lea rdx, str.D:BackupGamingAET_New_MenuImGui_Standalone_mainSourceImGui_StandaloneImGuiimgui.cpp
lea rcx, str.GImGui___0__________ay::obfuscated_data_sizeof__No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_______sizeof__No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext______0____ay::generate_key_int_3793U_____static_assert_sizeof_decltype_ay::generate_key_int_3793U______sizeof_ay::key_type____key_must_be_a_64_bit_unsigned_integer____static_assert__ay::generate_key_int_3793U_______1ull____56____key_must_span_all_8_bytes____constexpr_auto_n__sizeof__No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_______sizeof__No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext______0____constexpr_auto_obfuscator__ay::make_obfuscator_n__ay::generate_key_int_3793U_____No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext________thread_local_auto_obfuscated_data__ay::obfuscated_data_n__ay::generate_key_int_3793U____obfuscator___return_obfuscated_data____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1406dd860]
add rax, 8
add rsp, 0x28
ret
Function at 0x14056e510
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp qword [0x1406dd860], 0
je 0x14056e574
call fcn.14056e5a0
mov r9, rax
cmp byte [rax + 0x57], 0
je 0x14056e58e
xor r8d, r8d
movabs r10, 0xcbf35d03b951f527
nop dword [rax]
movzx ecx, r8b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + r9], al
inc r8
cmp r8, 0x57
jb 0x14056e540
mov rax, qword [0x1406dd860]
add rax, 0x3810
mov byte [r9 + 0x57], 0
add rsp, 0x28
ret
mov r8d, 0xed7
lea rdx, str.D:BackupGamingAET_New_MenuImGui_Standalone_mainSourceImGui_StandaloneImGuiimgui.cpp
lea rcx, str.GImGui___0__________ay::obfuscated_data_sizeof__No_current_context._Did_you_call_ImGui::CreateContext___or_ImGui::SetCurrentContext______sizeof__No_current_context._Did_you_call_ImGui::CreateContext___or_ImGui::SetCurrentContext_____0____ay::generate_key_int_3799U_____static_assert_sizeof_decltype_ay::generate_key_int_3799U______sizeof_ay::key_type____key_must_be_a_64_bit_unsigned_integer____static_assert__ay::generate_key_int_3799U_______1ull____56____key_must_span_all_8_bytes____constexpr_auto_n__sizeof__No_current_context._Did_you_call_ImGui::CreateContext___or_ImGui::SetCurrentContext______sizeof__No_current_context._Did_you_call_ImGui::CreateContext___or_ImGui::SetCurrentContext_____0____constexpr_auto_obfuscator__ay::make_obfuscator_n__ay::generate_key_int_3799U_____No_current_context._Did_you_call_ImGui::CreateContext___or_ImGui::SetCurrentContext_______thread_local_auto_obfuscated_data__ay::obfuscated_data_n__ay::generate_key_int_3799U____obfuscator___return_obfuscated_data____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [0x1406dd860]
add rax, 0x3810
add rsp, 0x28
ret
Function at 0x140574ba0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140574bf0
lea r11, [0x1406551e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140574bd3
cmp byte [r8], r9b
jne 0x140574bd3
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140574bc0
mov rcx, qword [0x1406dd860]
not edx
add rcx, 0x3fc0
jmp fcn.14056af90
Function at 0x140581250
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1406dc5c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1406dd860]
mov edi, ecx
cmp byte [rbx + 0x43fd], 0
jne 0x1405812b1
cmp byte [rbx + 0x43fe], 0
jne 0x1405812b1
movsx r9d, word [rbx + 0x54de]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14056a4a0
test dil, 1
je 0x1405813e7
jmp 0x140581341
movss xmm1, dword [rbx + 0x39c0]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1406c0ee4]
xor eax, eax
mulss xmm1, dword [0x1406c0ec4]
addss xmm0, dword [rbx + 0xd9c]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xda0]
mov qword [rbx + 0x410c], rax
mov dword [rbx + 0x40f4], 1
movss dword [rbx + 0x4104], xmm0
mov byte [rbx + 0x412c], 1
movss dword [rbx + 0x4108], xmm1
movss xmm0, dword [rbx + 0x3a1c]
mulss xmm0, dword [0x1406c0cf0]
or dword [rbx + 0x40f0], 0x41
movss dword [rbx + 0x4150], xmm0
movsx r9d, word [rbx + 0x54de]
call fcn.14056a4a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140581391
lea r11, [0x1406551e0]
cmp r9b, 0x23
jne 0x140581374
cmp byte [r8], r9b
jne 0x140581374
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140581361
mov rcx, qword [0x1406dd860]
not edx
add rcx, 0x3fc0
call fcn.14056af90
test rax, rax
je 0x1405813e7
cmp byte [rax + 0xcb], 0
je 0x1405813e7
mov byte [rax + 0xd2], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xec], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x54de]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x54de]
call fcn.14056a4a0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.140577c90
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14063c0a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140588140
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x140588196
lea r11, [0x1406551e0]
cmp r9b, 0x23
jne 0x140588179
cmp byte [r8], r9b
jne 0x140588179
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140588166
not ecx
call fcn.140588050
test rax, rax
jne 0x1405881af
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140587f60
add rsp, 0x20
pop rbx
ret

Function at 0x1405881c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1406dd860]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x140588224
lea r10, [0x1406551e0]
cmp r8b, 0x23
jne 0x140588207
cmp byte [rdx], r8b
jne 0x140588207
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x1405881f4
mov eax, dword [r14 + 0x5580]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x140588285
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14058824a
cmp edi, eax
jl 0x140588264
mov r8d, 0x74e
lea rdx, str.D:BackupGamingAET_New_MenuImGui_Standalone_mainSourceImGui_StandaloneImGuiimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rdx, qword [r14 + 0x5588]
cmp dword [rdx + rbp + 8], ebx
je 0x1405882a2
mov eax, dword [r14 + 0x5580]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x140588241
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x1405882af
cmp edi, dword [r14 + 0x5580]
jl 0x1405882d0
mov r8d, 0x74e
lea rdx, str.D:BackupGamingAET_New_MenuImGui_Standalone_mainSourceImGui_StandaloneImGuiimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rdx, qword [r14 + 0x5588]
movsxd rax, edi
lea rcx, [rax + rax*8]
lea rax, [rdx + rcx*8]
jmp 0x140588287