joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006910
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140006947
mov r8d, 0x6a9
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui.h
lea rcx, str.Size___0
call fcn.1400d24a8
movsxd r8, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140125810]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3c]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3d]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3e]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3f]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140244030]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1c5c], edx
jne 0x140006a09
mov dword [rax + 0x1c60], edx
cmp dword [rax + 0x1c98], edx
jne 0x140006a18
mov byte [rax + 0x1c9c], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret

Function at 0x140006a30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rbx, rcx
mov edi, edx
jg 0x140006a65
mov r8d, 0x6a9
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui.h
lea rcx, str.Size___0
call fcn.1400d24a8
movsxd r8, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140125810]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140244030]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1c5c], edx
jne 0x140006adf
mov dword [rax + 0x1c60], edx
cmp dword [rax + 0x1c98], edx
jne 0x140006aee
mov byte [rax + 0x1c9c], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x140006b00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140006b32
mov r8d, 0x6a9
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui.h
lea rcx, str.Size___0
call fcn.1400d24a8
movsxd rcx, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
movss xmm0, dword [rdi]
subss xmm0, dword [rbx + 0x10]
movss xmm1, dword [rdi + 4]
subss xmm1, dword [rbx + 0x14]
cvttss2si r8d, xmm0
movss xmm0, dword [rdi + 8]
subss xmm0, dword [rbx + 0x10]
cvttss2si r9d, xmm1
movss xmm1, dword [rdi + 0xc]
lea rdi, [0x140125810]
subss xmm1, dword [rbx + 0x14]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
cvttss2si r10d, xmm0
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
cvttss2si r11d, xmm1
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r10b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
xor ebx, dword [rdi + rdx*4]
shr eax, 0x10
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r11b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r11d
shr eax, 8
movzx edx, al
mov eax, r11d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x140244030]
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r11d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
not ebx
cmp dword [rax + 0x1c5c], ebx
jne 0x140006cd3
mov dword [rax + 0x1c60], ebx
cmp dword [rax + 0x1c98], ebx
jne 0x140006ce2
mov byte [rax + 0x1c9c], 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400122b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x140244030]
mov rsi, rcx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x1400122fa
mov r8d, 0x6a9
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui.h
lea rcx, str.Size___0
call fcn.1400d24a8
movsxd rdx, dword [rbx]
lea r8, [0x140125810]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x1400123d9
lea ecx, [rdx + 1]
test r8d, r8d
je 0x1400123c5
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400123ca
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.14001c440
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140012400
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x140244030]
mov esi, ecx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x140012448
mov r8d, 0x6a9
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui.h
lea rcx, str.Size___0
call fcn.1400d24a8
movsxd rdx, dword [rbx]
lea r8, [0x140125810]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x1400124db
lea ecx, [rdx + 1]
test r8d, r8d
je 0x1400124c7
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400124cc
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.14001c440
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400139f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x140244030]
mov edi, edx
cmp byte [rbx + 0x1f4d], 0
jne 0x140013a41
cmp byte [rbx + 0x1f4e], 0
jne 0x140013a41
mov r9d, dword [rbx + 0x3028]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002df0
test dil, 1
je 0x140013b66
jmp 0x140013ac9
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14013dca4]
xor eax, eax
mulss xmm1, dword [0x14013dc88]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1cc8], rax
mov dword [rbx + 0x1cb4], 1
movss dword [rbx + 0x1cc0], xmm0
movss dword [rbx + 0x1cc4], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x14013dbe0]
or dword [rbx + 0x1cb0], 0x41
movss dword [rbx + 0x1d10], xmm0
mov r9d, dword [rbx + 0x3028]
call fcn.140002df0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140013b20
lea r11, [0x140125810]
nop dword [rax]
cmp r9b, 0x23
jne 0x140013b03
cmp byte [r8], r9b
jne 0x140013b03
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140013af0
not ecx
call fcn.14000c270
test rax, rax
je 0x140013b66
cmp byte [rax + 0x8e], 0
je 0x140013b66
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3028]
mov edx, 0x10
mov r9d, dword [rbx + 0x3028]
call fcn.140002df0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000e840
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140038b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movsxd rsi, edx
mov rdi, rcx
imul rbx, rsi, 0x68
add rbx, qword [rcx + 0x18]
cmp rbx, qword [rcx + 0x18]
jb 0x140038b89
cmp rbx, qword [rcx + 0x20]
jb 0x140038ba2
mov r8d, 0x23b
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui_internal.h
lea rcx, [0x140125508]
call fcn.1400d24a8
mov r9, qword [rdi + 0x190]
mov dword [rdi + 0x7c], esi
test dword [rbx], 0x10000
movss xmm0, dword [rbx + 0x34]
je 0x140038bc1
addss xmm0, dword [rdi + 0x94]
lea rsi, [r9 + 0xd8]
movss dword [rsi], xmm0
movss xmm1, dword [rdi + 0xc8]
addss xmm1, dword [rdi + 0x84]
movss dword [r9 + 0xf0], xmm0
subss xmm0, dword [r9 + 0x10]
movss dword [r9 + 0xdc], xmm1
subss xmm0, dword [r9 + 0x118]
movss dword [r9 + 0x11c], xmm0
mov eax, dword [rdi + 0x90]
mov dword [r9 + 0x110], eax
movsx eax, byte [rbx + 0x62]
mov dword [r9 + 0x14c], eax
movss dword [r9 + 0x234], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x238], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1c4], eax
cmp byte [rbx + 0x5a], 0
jne 0x140038c5c
maxss xmm1, dword [rdi + 0x88]
movss dword [r9 + 0xdc], xmm1
movzx eax, byte [rbx + 0x60]
mov byte [r9 + 0x93], al
cmp byte [rbx + 0x60], 0
je 0x140038c76
xor eax, eax
mov qword [r9 + 0x124], rax
test dword [rdi + 4], 0x100000
je 0x140038c8a
mov r8d, 2
jmp 0x140038d0a
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2b0]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x250], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2b0]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [rbx + 0x57]
mov rdx, qword [r9 + 0x2b0]
mov rcx, qword [rdi + 0x1a8]
call fcn.14002be20
mov rdi, qword [0x140244030]
cmp byte [rdi + 0x30bc], 0
je 0x140038d4f
cmp byte [rbx + 0x60], 0
jne 0x140038d4f
xor r8d, r8d
lea rdx, [0x140135520]
mov rcx, rsi
call fcn.1400191d0
mov dword [rdi + 0x30f0], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14003abc0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140244030]
mov ebx, ecx
mov rdi, qword [rax + 0x1ff0]
cmp ecx, 0xffffffff
jne 0x14003abe6
cmp dword [rdi + 0x7c], ecx
cmovne ebx, dword [rdi + 0x7c]
mov eax, dword [rdi + 0x74]
cmp ebx, eax
jne 0x14003abf4
mov ebx, 0xffffffff
jmp 0x14003abf9
cmp ebx, 0xffffffff
jl 0x14003abfd
cmp ebx, eax
jl 0x14003ac16
mov r8d, 0xbc0
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui_tables.cpp
lea rcx, str.column_n____1__column_n___table__ColumnsCount
call fcn.1400d24a8
test byte [rdi + 4], 7
je 0x14003ac8a
mov r10d, dword [rdi]
lea r8, [0x140134c19]
movzx eax, word [rdi + 0x80]
lea r11, [0x140125810]
not r10d
mov byte [rdi + 0x1fe], 1
mov ecx, r10d
mov byte [rdi + 0x1f0], bl
mov word [rdi + 0x82], ax
mov r9b, 0x23
cmp r9b, 0x23
jne 0x14003ac64
cmp byte [r8], r9b
jne 0x14003ac64
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14003ac51
not ecx
xor edx, edx
call fcn.140013d80
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003f300
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test edx, edx
lea rax, str.SCROLLX
lea rdi, str.SCROLLY
mov rbx, rcx
cmove rdi, rax
cmp dword [rcx + 0xc8], 0
jg 0x14003f343
mov r8d, 0x6a9
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui.h
lea rcx, str.Size___0
call fcn.1400d24a8
movsxd rax, dword [rbx + 0xc8]
xor edx, edx
mov r8, qword [rbx + 0xd0]
mov rcx, rdi
mov r8d, dword [r8 + rax*4 - 4]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140002e70
Function at 0x140051b50
Capabilities:
Hash data with crc32

Disassembly:
test dword [rcx + 0x10], 0x100000
je 0x140051bcd
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140051ba6
lea r11, [0x140125810]
cmp r9b, 0x23
jne 0x140051b89
cmp byte [r8], r9b
jne 0x140051b89
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140051b76
mov rcx, qword [0x140244030]
not eax
cmp dword [rcx + 0x1c5c], eax
jne 0x140051bbd
mov dword [rcx + 0x1c60], eax
cmp dword [rcx + 0x1c98], eax
jne 0x140051be0
mov byte [rcx + 0x1c9c], 1
ret
mov rax, qword [0x140244030]
mov rcx, qword [rax + 0x1c10]
jmp fcn.140006890
ret

Function at 0x140058860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x90
movzx eax, byte [rcx]
mov ebp, edx
movaps xmmword [rsp + 0x80], xmm6
movaps xmm6, xmm2
mov rbx, rcx
test al, al
je 0x14005889b
cmp al, 0x25
jne 0x140058890
cmp byte [rbx + 1], al
jne 0x14005889b
inc rbx
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x140058884
cmp byte [rbx], 0x25
jne 0x140058a09
cmp byte [rbx + 1], 0x25
je 0x140058a09
mov qword [rsp + 0xa0], rsi
mov rcx, rbx
mov qword [rsp + 0xa8], rdi
lea rdi, [rsp + 0x20]
call fcn.140043eb0
mov rcx, rax
mov rsi, rax
sub rcx, rbx
inc rcx
cmp rcx, 0x20
jb 0x1400588f6
mov r8d, 0x89b
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui_widgets.cpp
lea rcx, str.__size_t_____fmt_end___fmt__1_____fmt_out_size
call fcn.1400d24a8
cmp rbx, rsi
jae 0x14005892d
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [rbx]
inc rbx
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140058923
bt rdx, rax
jb 0x140058928
mov byte [rdi], cl
inc rdi
cmp rbx, rsi
jb 0x140058910
xorps xmm3, xmm3
mov byte [rdi], 0
cvtss2sd xmm3, xmm6
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140002df0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
jne 0x140058978
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140058970
lea eax, [rbp - 8]
cmp eax, 1
jbe 0x1400589f8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x140058993
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1400589a9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1400589e6
movss xmm2, dword [0x14013dc8c]
cmp al, 0x39
ja 0x1400589e6
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400589c0
cmp r9b, 0x2d
jne 0x140058a04
xorps xmm1, xmmword [0x14013e590]
movaps xmm0, xmm1
jmp 0x140058a0c
call fcn.1400d2fcc
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140058a0c
movaps xmm0, xmm6
mov rbx, qword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbp
ret
Function at 0x140059050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x90
movzx eax, byte [rcx]
mov ebp, edx
movaps xmmword [rsp + 0x80], xmm6
movaps xmm6, xmm2
mov rbx, rcx
test al, al
je 0x14005908b
cmp al, 0x25
jne 0x140059080
cmp byte [rbx + 1], al
jne 0x14005908b
inc rbx
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x140059074
cmp byte [rbx], 0x25
jne 0x1400591eb
cmp byte [rbx + 1], 0x25
je 0x1400591eb
mov qword [rsp + 0xa0], rsi
mov rcx, rbx
mov qword [rsp + 0xa8], rdi
lea rdi, [rsp + 0x20]
call fcn.140043eb0
mov rcx, rax
mov rsi, rax
sub rcx, rbx
inc rcx
cmp rcx, 0x20
jb 0x1400590e6
mov r8d, 0x89b
lea rdx, str.E:Sources_LEANLOADERLOADERImGUIimgui_widgets.cpp
lea rcx, str.__size_t_____fmt_end___fmt__1_____fmt_out_size
call fcn.1400d24a8
cmp rbx, rsi
jae 0x14005911d
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [rbx]
inc rbx
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140059113
bt rdx, rax
jb 0x140059118
mov byte [rdi], cl
inc rdi
cmp rbx, rsi
jb 0x140059100
movaps xmm3, xmm6
mov byte [rdi], 0
movq r9, xmm6
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140002df0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
jne 0x140059160
inc rcx
cmp byte [rcx], 0x20
je 0x140059158
lea eax, [rbp - 8]
cmp eax, 1
jbe 0x1400591de
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14005917b
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x140059191
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1400591cc
movsd xmm2, qword [0x14013dc58]
cmp al, 0x39
ja 0x1400591cc
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x1400591a8
cmp r9b, 0x2d
jne 0x1400591e6
xorps xmm1, xmmword [0x14013e580]
movaps xmm0, xmm1
jmp 0x1400591ee
call fcn.1400d2fcc
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400591ee
movaps xmm0, xmm6
mov rbx, qword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbp
ret
Function at 0x14005d170
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x14005d193
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa
jb 0x14005d180
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x14005d1a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x14005d1c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x10
jb 0x14005d1b0
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x14005d230
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14005d253
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x46]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x14005d240
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14005d730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14005d761
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14005d7db
mov rdi, r14
mov rcx, rbx
call fcn.14005ec60
test rax, rax
jle 0x14005d7b3
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400f18a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14005d7cb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14005d7d3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14005d775
sub r14, rdi
jmp 0x14005d8bf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14005d7f2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14005d7f4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14005d826
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400f18a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14005d8bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14005d861
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14005d89d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400cc6dc
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14005d8bc
cmp rbp, rax
ja 0x14005d870
test rbp, rbp
je 0x14005d8bc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400cc6dc
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret