joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4440c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444322
push rbp
mov rbp, rsp
sub rsp, 0x30
jmp 0x4440da
inc dword [0x009a3818]
mov ecx, dword [rax + 0x18c]
cmp dword [rax + 0x188], ecx
je 0x44412c
dec ecx
mov dword [rax + 0x18c], ecx
movzx ecx, cl
mov rcx, qword [rax + rcx*8 + 0x190]
mov rdx, qword [0x009a3808]
nop
nop
mov qword [rcx + 0xa8], rdx
mov rdx, rcx
nop
mov qword [0x009a3808], rcx
cmp qword [0x009a3810], 0
nop
jne 0x4440d4
nop
mov qword [0x009a3810], rdx
jmp 0x4440d4
mov rcx, qword [rax + 0x990]
test rcx, rcx
je 0x444177
mov rdx, qword [0x009a3808]
nop
nop
nop
mov qword [rcx + 0xa8], rdx
mov rdx, rcx
nop
mov qword [0x009a3808], rcx
cmp qword [0x009a3810], 0
jne 0x444166
nop
mov qword [0x009a3810], rdx
inc dword [0x009a3818]
mov qword [rax + 0x990], 0
mov qword [rsp + 0x40], rax
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
lea rbx, [rax + 0x2288]
test byte [rcx], al
add rcx, 0x2288
mov rax, rcx
call fcn.004554a0
cmp dword [0x009e6f84], 0
je 0x4441c6
mov rax, qword [rsp + 0x40]
call fcn.00430100
mov rax, qword [rsp + 0x40]
lea rcx, [rax + 0x1248]
mov rax, rcx
call fcn.00424d40
mov rax, qword [rsp + 0x40]
lea rcx, [rax + 0x9c0]
mov ebx, 0x400
mov rax, rcx
call fcn.00469180
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x9b0], 0
mov qword [rax + 0x9b8], 0x80
lea rcx, [rax + 0x9c0]
cmp dword [0x009e7410], 0
je 0x444228
call fcn.004729e0
mov qword [r11], rcx
mov rdx, qword [rax + 0x9a8]
mov qword [r11 + 8], rdx
mov rdx, qword [rax + 0x11c8]
mov qword [r11 + 0x10], rdx
mov qword [rax + 0x9a8], rcx
mov qword [rax + 0x11c8], 0
lea rcx, [rax + 0x78]
mov ebx, 0x100
mov rax, rcx
call fcn.00469180
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x68], 0
mov qword [rcx + 0x70], 0x20
lea rdx, [rcx + 0x78]
cmp dword [0x009e7410], 0
je 0x44427d
call fcn.004729c0
mov qword [r11], rdx
mov rax, qword [rcx + 0x60]
mov qword [r11 + 8], rax
mov qword [rcx + 0x60], rdx
lea rax, [0x004443a0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
lea rax, [rsp + 0x20]
mov qword [rsp], rax
nop dword [rax + rax]
call fcn.00470960
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x38]
lea rdx, [0x00444340]
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x10]
mov qword [rsp], rcx
call fcn.00470960
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x38], 0
nop
call fcn.00443c00
mov rax, qword [rsp + 0x40]
mov qword [rax + 0x1220], 0
mov dword [rax + 4], 4
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00470a80
mov rax, qword [rsp + 8]
jmp fcn.004440c0
Function at 0x446c40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x446dfc
push rbp
mov rbp, rsp
sub rsp, 0x10
mov edx, dword [rax + 0x188]
mov esi, dword [rax + 0x18c]
mov rdi, qword [rax + 0x990]
mov r8d, dword [rax + 0x18c]
cmp r8d, esi
jne 0x446c52
cmp esi, edx
jne 0x446dea
nop dword [rax]
test rdi, rdi
jne 0x446dea
test rbx, rbx
jne 0x446cb4
mov qword [rsp + 0x20], rax
nop
call fcn.004746a0
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + 0x22a8]
test edx, edx
jne 0x446d11
mov ecx, dword [rax]
mov edx, ecx
sar edx, 0x1f
shr edx, 0x1b
add edx, ecx
mov esi, edx
and edx, 0xffffffe0
sub ecx, edx
test ecx, ecx
jl 0x446de5
mov rdx, qword [0x009a05c8]
sar esi, 5
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and r8d, edi
cmp rdx, rsi
jbe 0x446dd9
mov rdx, qword [0x009a05c0]
lea rdx, [rdx + rsi*4]
not r8d
lock and dword [rdx], r8d
mov ecx, dword [rax]
mov edx, ecx
sar edx, 0x1f
shr edx, 0x1b
add edx, ecx
mov esi, edx
and edx, 0xffffffe0
sub ecx, edx
test ecx, ecx
jl 0x446dd4
mov rdx, qword [0x009a05a8]
sar esi, 5
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and r8d, edi
cmp rdx, rsi
jbe 0x446dc9
mov rcx, qword [0x009a05a0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], r8d
mov rcx, qword [0x009a37f0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x009a37f0], rax
nop
mov edx, 1
lea rsi, [0x009a37f8]
lock xadd dword [rsi], edx
nop
mov rdx, qword [rcx + 0x1230]
shr rdx, 0x3d
test dl, dl
jne 0x446db8
movabs rdx, 0x1fffffffffffffff
and rdx, rbx
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1230], rdx
mov rax, rbx
add rsp, 0x10
pop rbp
ret
lea rax, [0x006e9152]
mov ebx, 0x28
call fcn.0046a840
mov rax, rsi
mov rcx, rdx
call fcn.00472d60
call fcn.00434e60
mov rax, rsi
mov rcx, rdx
nop
call fcn.00472d60
call fcn.00434e60
lea rax, [0x006e7007]
mov ebx, 0x23
call fcn.0046a840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00470a80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00446c40
Function at 0x460160
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x460203
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.0045caa0
nop
test bl, bl
je 0x4601fd
mov qword [rsp + 0x18], rax
lea rcx, [0x00460240]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00470960
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00470a80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00460160
Function at 0x46aba0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x30], r14
mov rax, qword [r14 + 0x30]
inc dword [rax + 0xd8]
mov byte [r14 + 0xbf], 1
mov qword [r14 + 0x10], 0xfffffffffffffade
mov rax, qword [r14 + 0x30]
mov rcx, qword [rax + 0xa0]
mov ecx, dword [rcx + 0x14]
mov dword [rax + 0x2b4], ecx
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
inc dword [rax + 0x14]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x18], rax
call fcn.00449a60
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rax, qword [rsp + 0x80]
call fcn.00441ca0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x38]
mov qword [rax + 0x70], rcx
mov rdx, qword [rax + 0x40]
mov qword [rax + 0x78], rdx
mov rdx, qword [rax + 0x68]
mov qword [rax + 0x80], rdx
cmp qword [rax], rcx
ja 0x46ac46
nop word [rax + rax]
cmp qword [rax + 8], rcx
jae 0x46ac94
mov rdx, qword [rax + 0x38]
lea rbx, [0x00442620]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x50]
mov qword [rsp], rcx
call fcn.00470960
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x30]
mov ebx, 2
mov ecx, 3
nop
call fcn.0043b7a0
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rdx + 0x70]
cmp qword [rdx], rsi
ja 0x46acb9
cmp qword [rdx + 8], rsi
jae 0x46acfc
lea rax, [0x00442520]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x38]
mov qword [rsp], rax
nop dword [rax]
call fcn.00470960
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rdx + 0x80]
test rax, rax
je 0x46ad0d
cmp qword [rdx], rax
ja 0x46ad13
cmp qword [rdx + 8], rax
jae 0x46ad4e
lea rax, [0x00442420]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x38]
mov qword [rsp], rax
call fcn.00470960
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x0070bdc0]
mov qword [rsp], rax
call fcn.00470960
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
nop dword [rax]
call fcn.00449a60
mov rbx, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x80]
call fcn.00441ca0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x78
pop rbp
ret
Function at 0x46da20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x46db97
movzx edx, byte [rax]
test edx, edx
jne 0x46da54
nop dword [rax]
test r8b, r8b
jne 0x46da54
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x46da67
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x46db57
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x46db45
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x46db37
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x46dabd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x46db00
mov eax, 1
cmp rax, rbx
ja 0x46daeb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00472e20
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x46db2f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x46daf3
mov rcx, r11
mov eax, r12d
jmp 0x46dac2
mov rcx, rbx
call fcn.00472d60
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00472d60
mov eax, r8d
mov rcx, rbx
call fcn.00472e20
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46db8d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x46db50
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46da6d
mov eax, edx
mov rcx, rbx
call fcn.00472d60
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00472d60
nop
int3

Function at 0x46f360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f40f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045a160]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00470960
xorps xmm15, xmm15
mov r14, qword [0x009e71d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00470a80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0046f360
Function at 0x1400087bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008808
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140008800
cmp dword [rcx + 0x3c], edx
jl 0x140008800
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140008800
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140008808
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14124e0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14124e237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14124e0e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14124e0c7
add dl, dl
jne 0x14124e0ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14124e14e
xor eax, eax
add dl, dl
jne 0x14124e0fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14124e205
add dl, dl
jne 0x14124e10e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14124e11b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14124e128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14124e135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14124e142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14124e0d6
mov eax, 1
add dl, dl
jne 0x14124e15e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14124e16b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14124e153
sub eax, ebx
mov ebx, 1
jne 0x14124e1a4
mov ecx, 1
add dl, dl
jne 0x14124e186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14124e193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14124e17b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14124e0d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14124e1c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14124e1cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14124e1b5
cmp eax, 0x7d00
jae 0x14124e1f3
cmp eax, 0x500
jb 0x14124e1ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14124e0d6
cmp eax, 0x7f
ja 0x14124e1f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14124e0d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14124e22a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14124e0d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002660
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400026aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400026aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400026aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400026aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400026aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400026ac
xor al, al
add rsp, 0x28
ret
Function at 0x140004480
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400044dd
lea rbx, [0x140160050]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400044c4
cmp r10, 2
jb 0x1400044c4
cmp byte [r9], r8b
jne 0x1400044c4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400044a0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000451f
lea rbx, [0x140160050]
cmp r8b, 0x23
jne 0x140004503
cmp byte [r9], r8b
jne 0x140004503
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400044f0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400046e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000470f
mov r8d, 0x7d7
lea rdx, str.C:UserscrackDesktopImgui_Personalizadoimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000471b
mov qword [rdi], 0
lea rdx, [0x14015f868]
mov rcx, rbx
call fcn.140004530
mov rbx, rax
test rax, rax
jne 0x14000473d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140004816
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004816
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140004816
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004816
cmp rsi, 0xffffffffffffffff
je 0x140004816
mov rax, qword [0x1403442f0]
test rax, rax
je 0x1400047b3
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140004816
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140004803
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1403442f0]
test rax, rax
je 0x1400047f8
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000481f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140004811
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140004821
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140008560
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x14000859c
mov r8d, 0x720
lea rdx, str.C:UserscrackDesktopImgui_Personalizadoimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x140160050]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f50], ebx
jne 0x140008617
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.140020cd0
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140008630
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140008663
mov r8d, 0x720
lea rdx, str.C:UserscrackDesktopImgui_Personalizadoimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x110]
lea r10, [0x140160050]
movsxd rcx, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x114]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret
Function at 0x140018e00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbx, qword [0x1403442f0]
mov edi, ecx
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0xb8], rbx
cmp byte [rbx + 0x4aad], 0
jne 0x140018e53
cmp byte [rbx + 0x4aae], 0
jne 0x140018e53
movss xmm2, dword [rbx + 0xe08]
mov ecx, 1
movss xmm1, dword [rbx + 0xe0c]
jmp 0x140018e85
movss xmm1, dword [rbx + 0x389c]
mov ecx, 1
movaps xmm2, xmm1
mov edi, ecx
mulss xmm2, dword [0x14016c748]
mulss xmm1, dword [0x14016c730]
addss xmm2, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov eax, dword [rbx + 0x47e0]
xorps xmm0, xmm0
or eax, 1
mov qword [rsp + 0xb0], rbx
mov dword [rbx + 0x47e0], eax
mov r9d, 0x47fc
mov r11d, 0x47f4
mov r10d, 0x47f8
mov r8d, 0x47e4
mov rbp, rbx
mov edx, 0x4840
or eax, 0x40
mov esi, 0x47f0
mov r13, rbx
mov r12, rbx
mov r15, rbx
mov r14, rbx
movss dword [rsi + rbx], xmm2
movss dword [r11 + rbx], xmm1
movss dword [r10 + rbx], xmm0
movss dword [r9 + rbx], xmm0
mov dword [r8 + rbx], ecx
lea r8, str.Tooltip__02d
mov rbx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x20]
mov dword [rbx + 0x47e0], eax
movss dword [rdx + rbp], xmm0
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5bde]
call fcn.1400042e0
test dil, 1
je 0x140018fc8
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140018f80
lea r11, [0x140160050]
nop dword [rax]
cmp r9b, 0x23
jne 0x140018f63
cmp byte [r8], r9b
jne 0x140018f63
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140018f50
not ecx
call fcn.14000d450
test rax, rax
je 0x140018fc8
cmp byte [rax + 0xb6], 0
je 0x140018fc8
mov byte [rax + 0xbd], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5bde]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5bde]
call fcn.1400042e0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400100b0
mov rbx, qword [0x1403442f0]
test rbx, rbx
jne 0x140019007
mov r8d, 0xba4
lea rdx, str.C:UserscrackDesktopImgui_Personalizadoimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1403442f0]
movdqa xmm1, xmmword [0x14016cc10]
lea rcx, [rbx + 0x4850]
movdqa xmm6, xmmword [0x14016cbf0]
lea rdx, [rsp + 0x30]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0
movups xmmword [rbx + 0x38f8], xmm0
movups xmmword [rbx + 0x3908], xmm1
movups xmm0, xmmword [rbx + 0x38b8]
movups xmmword [rsp + 0x34], xmm0
call fcn.1400215d0
movups xmmword [rbx + 0x38b8], xmm6
mov rbx, qword [rsp + 0xa0]
mov al, 1
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret