joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011c040
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
mov eax, Ordinal_211
call fcn.1400b21a0
sub rsp, rax
mov rax, qword [0x14021f0c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x40
test eax, eax
je 0x14011c0d2
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14011c0c5
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x14011c0b6
addsd xmm2, qword [0x1401dc490]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.1400bf6c0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, reloc.WLDAP32.dll_Ordinal_22
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14011c142
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14011c135
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x14011c126
addsd xmm2, qword [0x1401dc490]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.1400bf6c0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x14011c17d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14011c162
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x14011c17d
xorps xmm2, xmm2
lea rcx, [rsp + 0x40]
mov edx, 8
call fcn.1400bf6c0
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x14011c199
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 4
mov dword [rsp + 0x38], eax
call fcn.1400bf6c0
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movsd xmm2, qword [0x1401aa920]
lea rcx, [rsp + 0x48]
mov edx, Ordinal_60
call fcn.1400bf6c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsd xmm2, qword [0x1401aa920]
lea rcx, [rsp + 0x3c]
mov edx, 4
mov dword [rsp + 0x3c], eax
call fcn.1400bf6c0
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400b1b60
add rsp, 0xd0
pop rbx
ret
Function at 0x14012cf20
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x50]
mov eax, 0x150
call fcn.1400b21a0
sub rsp, rax
mov rax, qword [0x14021f0c0]
xor rax, rsp
mov qword [rbp + 0x40], rax
movups xmm2, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [rdx + 0x10]
lea rdx, [rbp - 0x10]
movd eax, xmm2
movups xmmword [rbp], xmm0
and al, 0xf8
psrldq xmm0, 8
movups xmmword [rbp - 0x10], xmm2
mov byte [rbp - 0x10], al
movq rax, xmm0
shr rax, 0x38
and al, 0x3f
or al, 0x40
mov byte [rbp + 0xf], al
call fcn.14012f6c0
mov ecx, dword [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x3c]
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rsp + 0x7c]
mov dword [rbp + 0x18], edx
mov edx, dword [rbp - 0x5c]
mov dword [rbp - 0x10], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x80]
mov dword [rbp + 0x1c], edx
mov edx, dword [rbp - 0x58]
mov dword [rbp - 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x7c]
mov dword [rbp + 0x20], edx
mov edx, dword [rbp - 0x54]
mov dword [rbp - 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x78]
mov dword [rbp + 0x24], edx
mov edx, dword [rbp - 0x50]
mov dword [rbp - 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x74]
mov dword [rbp + 0x28], edx
mov edx, dword [rbp - 0x4c]
mov dword [rbp], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x70]
mov dword [rbp + 0x2c], edx
mov edx, dword [rbp - 0x48]
mov dword [rbp + 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x6c]
mov dword [rbp + 0x30], edx
mov edx, dword [rbp - 0x44]
mov dword [rbp + 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x68]
mov dword [rbp + 0x34], edx
mov edx, dword [rbp - 0x40]
mov dword [rbp + 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov dword [rbp + 0x38], edx
lea rcx, [rsp + 0x20]
mov edx, dword [rbp - 0x64]
mov dword [rbp + 0x10], eax
lea eax, [rdx + r8]
sub r8d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r8d
mov dword [rbp + 0x14], eax
call fcn.14012d500
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.14012d780
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14012edb0
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400b1b60
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rbp
ret
Function at 0x1401363d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.1400b21a0
sub rsp, rax
mov rax, qword [0x14021f0c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor edi, edi
movsxd rsi, r8d
mov rbp, r9
mov r14, rdx
mov rbx, rcx
mov eax, edi
test r9, r9
je 0x140136436
cmp r9, qword [rcx]
je 0x14013642c
test rdx, rdx
je 0x140136619
test r8d, r8d
js 0x140136619
mov eax, 1
mov qword [rcx], r9
jmp 0x140136442
mov rbp, qword [rcx]
test rbp, rbp
je 0x140136619
test r14, r14
je 0x140136514
mov rcx, rbp
mov qword [rsp + 0xb0], r15
call fcn.1400e4fe0
mov r15d, eax
cmp eax, 0x80
jle 0x14013647e
mov r8d, Ordinal_41
lea rdx, str.cryptohmachmac.c
lea rcx, str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.1400c8780
cmp r15d, esi
mov r15, qword [rsp + 0xb0]
jge 0x1401364d0
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.1400ddb00
test eax, eax
je 0x1401364c9
mov rcx, qword [rbx + 8]
mov r8, rsi
mov rdx, r14
call fcn.1400ddd70
test eax, eax
je 0x1401364c9
mov rcx, qword [rbx + 8]
lea r14, [rbx + 0x20]
mov r8, r14
lea rdx, [rbx + 0x24]
call fcn.1400dda20
test eax, eax
jne 0x1401364ee
xor eax, eax
jmp 0x140136619
cmp esi, 0x80
ja 0x1401364c9
mov r8, rsi
lea rcx, [rbx + 0x24]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
lea r14, [rbx + 0x20]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x14013651c
mov eax, ecx
mov r8d, 0x80
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14013651c
test eax, eax
je 0x1401365ff
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, rdi
lea rsi, [rax + 0x24]
lea r14, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x140136540
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.1400ddb00
test eax, eax
je 0x1401364c9
mov rcx, rbp
call fcn.1400e4fe0
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1400ddd70
test eax, eax
je 0x1401364c9
nop
lea rcx, [rsp + 0x20]
add rcx, rdi
add rdi, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdi, 0x80
jl 0x1401365a0
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.1400ddb00
test eax, eax
je 0x1401364c9
mov rcx, rbp
call fcn.1400e4fe0
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1400ddd70
test eax, eax
je 0x1401364c9
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.1400dddd0
test eax, eax
je 0x1401364c9
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400b1b60
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14015c9e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x50
call fcn.1400b21a0
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rsi, rcx
mov rdi, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x30], rax
mov rbp, r8
mov rax, qword [rcx + 0x168]
mov r15, rdx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x14015cc1e
cmp rcx, r9
jb 0x14015cc1e
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r12
mov qword [rsi + 0x38], rcx
je 0x14015ca71
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov dword [rsi + 0x174], 0
mov ebx, dword [rsi + 0x170]
mov r12d, dword [rsi + 0xc]
mov dword [rsp + 0x80], ebx
bswap r12d
test ebx, ebx
je 0x14015cad4
nop dword [rax]
test r14, r14
je 0x14015cac2
movzx edx, byte [r15]
dec r14
mov ecx, ebx
inc r15
movzx eax, byte [rcx + rsi + 0x10]
xor al, dl
mov byte [rbp], al
inc rbp
xor byte [rcx + rsi + 0x40], dl
inc ebx
and ebx, 0xf
mov dword [rsp + 0x80], ebx
jne 0x14015ca90
jmp 0x14015caca
test ebx, ebx
jne 0x14015cbfd
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov qword [rsp + 0x40], r13
mov r13, qword [rsp + 0xa0]
cmp r14, 0xc00
jb 0x14015cb68
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
nop dword [rax + rax]
mov r9d, 0xc00
lea rdx, [rsi + 0x60]
mov r8, r15
lea rcx, [rsi + 0x40]
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8d, 0xc0
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, r15
call r13
add r12d, 0xc0
add rbp, 0xc00
mov eax, r12d
add r15, 0xc00
bswap eax
mov dword [rsi + 0xc], eax
sub rdi, 1
jne 0x14015cb10
mov ebx, dword [rsp + 0x80]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x14015cbb8
mov rdi, r13
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
shr rdi, 4
mov r9, r13
mov r8, r15
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8, rdi
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, r15
call qword [rsp + 0xa0]
add r12d, edi
add rbp, r13
mov eax, r12d
add r15, r13
bswap eax
mov dword [rsi + 0xc], eax
sub r14, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x14015cbfd
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r12d
bswap r12d
mov dword [rsi + 0xc], r12d
nop
mov edx, ebx
inc ebx
movzx ecx, byte [rdx + r15]
movzx eax, byte [rsi + rdx + 0x10]
xor byte [rdx + rsi + 0x40], cl
xor al, cl
mov byte [rdx + rbp], al
sub r14, 1
jne 0x14015cbe0
mov r12, qword [rsp + 0x48]
xor eax, eax
mov dword [rsi + 0x170], ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015cf00
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x50
call fcn.1400b21a0
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rsi, rcx
mov rdi, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x30], rax
mov r15, r8
mov rax, qword [rcx + 0x168]
mov rbp, rdx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x14015d15e
cmp rcx, r9
jb 0x14015d15e
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r12
mov qword [rsi + 0x38], rcx
je 0x14015cf91
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov dword [rsi + 0x174], 0
mov ebx, dword [rsi + 0x170]
mov r12d, dword [rsi + 0xc]
mov dword [rsp + 0x80], ebx
bswap r12d
test ebx, ebx
je 0x14015cff1
nop dword [rax]
test r14, r14
je 0x14015cfdf
mov ecx, ebx
dec r14
movzx eax, byte [rcx + rsi + 0x10]
xor al, byte [rbp]
inc rbp
mov byte [r15], al
inc r15
xor byte [rcx + rsi + 0x40], al
inc ebx
and ebx, 0xf
mov dword [rsp + 0x80], ebx
jne 0x14015cfb0
jmp 0x14015cfe7
test ebx, ebx
jne 0x14015d13d
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov r10, qword [rsp + 0xa0]
mov qword [rsp + 0x40], r13
cmp r14, 0xc00
jb 0x14015d0a6
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
mov qword [rsp + 0x98], r14
mov r14, qword [rsp + 0x30]
nop word [rax + rax]
mov r9, r14
mov qword [rsp + 0x20], rsi
mov r8d, 0xc0
mov rdx, r15
mov rcx, rbp
call r10
add r12d, 0xc0
lea rdx, [rsi + 0x60]
mov eax, r12d
lea rcx, [rsi + 0x40]
bswap eax
mov r9d, 0xc00
mov dword [rsi + 0xc], eax
mov r8, r15
call qword [rsp + gethostname]
mov r10, qword [rsp + 0xa0]
add r15, 0xc00
add rbp, 0xc00
sub rdi, 1
jne 0x14015d040
mov ebx, dword [rsp + 0x80]
mov r14, qword [rsp + 0x98]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x14015d0f2
mov r9, qword [rsp + 0x30]
mov rdi, r13
shr rdi, 4
mov rdx, r15
mov r8, rdi
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call r10
add r12d, edi
lea rdx, [rsi + 0x60]
mov eax, r12d
lea rcx, [rsi + 0x40]
bswap eax
mov r9, r13
mov dword [rsi + 0xc], eax
mov r8, r15
add rbp, r13
sub r14, r13
call qword [rsp + gethostname]
add r15, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x14015d13d
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r12d
bswap r12d
mov dword [rsi + 0xc], r12d
nop dword [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + rbp]
movzx eax, byte [rsi + rcx + 0x10]
xor edx, eax
mov byte [rcx + r15], dl
xor byte [rcx + rsi + 0x40], dl
sub r14, 1
jne 0x14015d120
mov r12, qword [rsp + 0x48]
xor eax, eax
mov dword [rsi + 0x170], ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015d360
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b21a0
sub rsp, rax
mov r13, qword [rcx + 0x160]
xor r14d, r14d
mov qword [rcx], r14
mov rsi, r8
mov qword [rcx + 8], r14
mov rdi, rdx
mov qword [rcx + 0x40], r14
mov rbx, rcx
mov qword [rcx + 0x48], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x170], r14
cmp r8, 0xc
jne 0x14015d3c7
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov byte [rcx + 0xf], 1
jmp 0x14015d539
mov qword [rsp + 0x58], rbp
mov rbp, rsi
mov qword [rsp + 0x50], rsi
cmp rsi, 0x10
jb 0x14015d473
mov qword [rsp + 0x60], r12
mov r12, rbx
shr rbp, 4
neg r12
imul rax, rbp, 0xfffffffffffffff0
mov qword [rsp + 0x68], r15
lea r15, [rcx + 0xf]
add rsi, rax
nop dword [rax]
lea r8, [r12 + rdi]
lea rax, [r8 + r15]
cmp rbx, rax
ja 0x14015d440
cmp r15, rdi
jb 0x14015d440
mov rax, rbx
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14015d420
jmp 0x14015d450
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
sub rbp, 1
jne 0x14015d400
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
test rsi, rsi
je 0x14015d51a
cmp rsi, 0x20
jb 0x14015d4e3
lea rcx, [rbx - 1]
lea rax, [rdi - 1]
add rcx, rsi
add rax, rsi
cmp rbx, rax
ja 0x14015d49a
cmp rcx, rdi
jae 0x14015d4e3
mov rdx, rsi
mov rcx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rbx
sub rcx, rbx
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r14, 0x20
movdqu xmm1, xmmword [rax + rcx]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r14, rdx
jb 0x14015d4b0
cmp r14, rsi
jae 0x14015d510
sub rdi, rbx
lea rcx, [r14 + rbx]
sub rsi, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x14015d500
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 8], rbp
mov rcx, rbx
call r13
mov edi, dword [rbx + 0xc]
mov rbp, qword [rsp + 0x58]
bswap edi
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x20
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401625f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, Ordinal_60
call fcn.1400b21a0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x140162619
lea rax, [0x140160bc0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14015bd70
lea rax, [0x14015fd20]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14015baa0
Function at 0x140198df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b21a0
sub rsp, rax
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov r10, rcx
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x140198e4e
mov rdx, qword [rdx + 8]
lea rax, [rsi + r8]
cmp rax, rdx
jbe 0x140198e39
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
jmp 0x140198e54
cmp rsi, qword [rdx + 8]
ja 0x140198e2c
mov rcx, qword [rbx + 0x20]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x38], rdi
movzx edi, byte [rcx + rax - 1]
mov rcx, qword [r10 + 0x2a0]
call fcn.1400e4a20
mov rcx, rax
call fcn.1400bed20
bt eax, 0x15
jae 0x140198ea0
or rax, 0xffffffffffffffff
sub rax, rdi
mov rdi, qword [rsp + 0x38]
add qword [rbx + 8], rax
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
lea rcx, [rdi + rsi]
mov qword [rsp + 0x30], rbp
mov rsi, qword [rbx + 8]
mov ebp, 0x100
mov r8, rsi
mov rax, rsi
sub r8, rcx
xor rax, rcx
xor r8, rcx
or r8, rax
xor r8, rsi
shr r8, 0x3f
dec r8
cmp rsi, rbp
cmovb rbp, rsi
xor r9d, r9d
test rbp, rbp
je 0x140198f2d
mov r10, rdi
lea r11, [rsi - 1]
shr r10, 0x3f
add r11, qword [rbx + 0x20]
nop dword [rax]
mov rax, r9
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r9
inc r9
shr rcx, 0x3f
xor cl, al
xor al, r10b
or cl, al
xor cl, r10b
dec cl
movzx edx, cl
movzx ecx, byte [r11 + 1]
xor rcx, rdi
and rdx, rcx
not rdx
and r8, rdx
cmp r9, rbp
jb 0x140198ef0
mov rbp, qword [rsp + 0x30]
not r8
movzx eax, r8b
lea rcx, [rax - 1]
not rax
shr rax, 0x3f
shr rcx, 0x3f
and rcx, rax
lea rax, [rdi + 1]
mov rdi, qword [rsp + 0x38]
neg rcx
and rax, rcx
sub rsi, rax
mov eax, ecx
and eax, 1
mov qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x40]
not ecx
or eax, ecx
add rsp, 0x20
pop rsi
ret
Function at 0x1400067a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400067fd
lea rbx, [0x140057a10]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400067e4
cmp r10, 2
jb 0x1400067e4
cmp byte [r9], r8b
jne 0x1400067e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400067c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000683f
lea rbx, [0x140057a10]
cmp r8b, 0x23
jne 0x140006823
cmp byte [r9], r8b
jne 0x140006823
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140006810
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140006a00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140006a2f
mov r8d, 0x645
lea rdx, str.C:UserskaiDocumentsoblivionoblivionimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140006a3b
mov qword [rdi], 0
lea rdx, [0x14005ff38]
mov rcx, rbx
call fcn.140006850
mov rbx, rax
test rax, rax
jne 0x140006a5d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140006b36
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006b36
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140006b36
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006b36
cmp rsi, 0xffffffffffffffff
je 0x140006b36
mov rax, qword [0x14012b510]
test rax, rax
je 0x140006ad3
inc dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140006b36
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140006b23
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14012b510]
test rax, rax
je 0x140006b18
dec dword [rax + 0x3b0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140006b3f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140006b31
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140006b41
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140009700
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rbx, rcx
mov edi, edx
jg 0x140009736
mov r8d, 0x6d4
lea rdx, str.C:UserskaiDocumentsoblivionoblivionimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140057a10]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x14012b510]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1d6c], edx
jne 0x1400097b0
mov dword [rax + 0x1d70], edx
cmp dword [rax + 0x1da8], edx
jne 0x1400097bf
mov byte [rax + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret