joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140120bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140120c8c
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rsi
call fcn.14000c0a0
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x140265d40]
call fcn.1400054e0
mov rcx, qword [rsp + 0x80]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 8], rcx
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x10], ecx
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x14], ecx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
call fcn.140116140
xorps xmm15, xmm15
mov r14, qword [0x14041a548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x38]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.140063e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.140120bc0

Function at 0x140128620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401286b2
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
lea rax, [0x140264a80]
lea rcx, [0x140269aa0]
lea rdi, [0x1402488e8]
call fcn.1400054e0
mov rdx, qword [rsp + 0x38]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 8], rdx
mov edx, dword [rsp + 0x60]
or edx, 6
mov dword [rsp + 0x10], edx
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x18], rdx
call fcn.1401164a0
xorps xmm15, xmm15
mov r14, qword [0x14041a548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
call fcn.140063e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.140128620
Function at 0x14012a280
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14012a326
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 0x10]
test rdi, rdi
jbe 0x14012a31a
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x58], rcx
call fcn.14000c0a0
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x140265e00]
call fcn.1400054e0
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov ecx, dword [rsp + 0x2c]
mov dword [rsp + 8], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x18], ecx
call fcn.140115fe0
xorps xmm15, xmm15
mov r14, qword [0x14041a548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
mov rcx, rax
nop
call fcn.140066500
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.140063e80
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop dword [rax]
jmp fcn.14012a280

Function at 0x14012a380
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14012a45e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rdx, qword [rcx]
cmp qword [rcx + 8], 0
jbe 0x14012a453
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
call fcn.14000c0a0
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x140265e00]
call fcn.1400054e0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14000c1c0
mov rbx, qword [rsp + 0x38]
lea rcx, [0x140269640]
mov rdi, rax
lea rax, [0x14026bb60]
call fcn.1400054e0
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov ecx, dword [rsp + 0x2c]
mov dword [rsp + 8], ecx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x18], ecx
call fcn.140115e80
xorps xmm15, xmm15
mov r14, qword [0x14041a548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
mov rcx, rax
call fcn.140066500
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140063e80
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14012a380
Function at 0x14012a800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14012a8a6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 0x10]
test rdi, rdi
jbe 0x14012a89a
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x58], rcx
call fcn.14000c0a0
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x140265e00]
call fcn.1400054e0
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov ecx, dword [rsp + 0x2c]
mov dword [rsp + 8], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x18], ecx
call fcn.140115fe0
xorps xmm15, xmm15
mov r14, qword [0x14041a548]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
mov rcx, rax
nop
call fcn.140066500
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.140063e80
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop dword [rax]
jmp fcn.14012a800

Function at 0x140159480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13d, dword [rcx + 0x80]
movsxd rdx, edx
mov rsi, rcx
mov rcx, qword [rcx + 0x78]
mov rbp, rdx
imul rdx, rdx, 0x38
call fcn.140153980
test rax, rax
mov rdi, rax
je 0x140159590
movsxd rbx, r13d
mov r8d, ebp
xor edx, edx
imul rbx, rbx, 0x38
sub r8d, r13d
xor r12d, r12d
movsxd r8, r8d
imul r8, r8, 0x38
add rbx, rax
mov rcx, rbx
call sub.msvcrt.dll_memset
cmp r13d, ebp
mov qword [rsi + 0x78], rdi
jl 0x140159547
jmp 0x1401595b0
mov rdi, rax
mov ecx, 0x40
mov rax, r12
rep stosq qword [rdi], rax
mov dword [rdx], r14d
mov qword [rbx + 0x10], rdx
mov rax, qword [rsi + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x140159533
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add r13d, 1
add rbx, 0x38
cmp r13d, ebp
mov dword [rsi + 0x80], r13d
je 0x1401595b0
mov rax, qword [rsi + 0x50]
mov r14d, dword [rsi + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r14d
je 0x1401595a8
mov rax, qword [rsi + 0x60]
test rax, rax
jle 0x1401595a8
mov qword [rbx], rax
mov eax, dword [rsi + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call fcn.140153820
test rax, rax
mov rdx, rax
jne 0x1401594f0
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [rsi + 0xb8]
jmp 0x140159562
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140160b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebx, dword [rcx + 0x28]
test ebx, ebx
mov rdi, rdx
mov r12, r8
jle 0x140160bb2
mov rsi, qword [rcx + 0x20]
lea rbp, [0x1403b5880]
xor r13d, r13d
nop dword [rax + rax]
mov r10d, r13d
xor r10d, 1
cmp r13d, 2
cmovge r10d, r13d
movsxd rax, r10d
shl rax, 5
add rax, rsi
test r12, r12
mov r9, qword [rax + 0x18]
je 0x140160b91
mov r8, qword [rax]
xor ecx, ecx
jmp 0x140160b7f
movzx edx, byte [rbp + rdx]
cmp byte [rbp + rax], dl
jne 0x140160bc8
add rcx, 1
movzx eax, byte [r8 + rcx]
movzx edx, byte [r12 + rcx]
cmp eax, edx
jne 0x140160b70
test eax, eax
jne 0x140160b7b
lea rcx, [r9 + 0x20]
xor r8d, r8d
mov rdx, rdi
call fcn.140159b30
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140160bb4
add r13d, 1
cmp r13d, ebx
jne 0x140160b40
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test r10d, r10d
jne 0x140160ba9
lea rcx, str.main
mov r8, r12
jmp 0x140160bf3
movzx edx, byte [rbp + rdx]
cmp byte [rbp + rax], dl
jne 0x140160ba9
add rcx, 1
add r8, 1
movzx eax, byte [rcx]
movzx edx, byte [r8]
cmp eax, edx
jne 0x140160be0
test eax, eax
jne 0x140160beb
jmp 0x140160b91
Function at 0x140169db0
Capabilities:
Create thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor r12d, r12d
movzx r13d, byte [rcx + 0x5b]
mov rsi, r13
sub r13d, 1
mov rbp, rcx
mov byte [rcx + 0x58], 1
test r13d, r13d
jg 0x140169df0
jmp 0x140169e39
cmp qword [rbx + 0x60], 0
je 0x140169e40
add r12d, 1
cmp r12d, r13d
je 0x140169e40
movzx eax, byte [rbp + 0x5a]
lea eax, [r12 + rax + 1]
cdq
idiv r13d
movsxd rdx, edx
lea rbx, [rdx + rdx*2]
lea rcx, [rdx + rdx*2 + 3]
shl rbx, 5
add rbx, rbp
shl rcx, 5
mov eax, dword [rbx + 0x68]
lea rdi, [rbp + rcx]
test eax, eax
je 0x140169de0
mov rcx, rdi
call fcn.140152680
test eax, eax
je 0x140169de0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor edi, edi
nop dword [rax + rax]
cmp r13d, r12d
je 0x140169ec0
lea rdx, [rbp + 0x60]
mov rax, rdi
mov rcx, qword [rdi + 0x28]
sub rax, rdx
movabs rdx, 0xaaaaaaaaaaaaaaab
sar rax, 5
imul rax, rdx
test rcx, rcx
mov byte [rbp + 0x5a], al
mov rax, qword [rbp + 0x38]
mov qword [rdi + 0x20], rax
mov rax, qword [rbp + 0x40]
mov qword [rdi + 0x28], rax
mov rax, qword [rbp + 0x48]
mov qword [rdi + 0x30], rax
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
je 0x140169ee0
mov qword [rbp + 0x40], rcx
call qword [0x14025a918]
mov dword [rbp + 0x54], eax
lea rdx, [0x140169d90]
mov r8, rdi
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1401546b0
lea rcx, [rsi + rsi*2]
lea rdx, [rbp + 0x38]
shl rcx, 5
add rcx, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140169b10
cmp qword [rbp + 0x40], 0
je 0x140169ea2
movsxd rcx, dword [rbp + 0x54]
call fcn.140153820
test rax, rax
mov qword [rbp + 0x40], rax
jne 0x140169ea2
mov eax, 7
jmp 0x140169e2c
Function at 0x1401714e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xc0
mov rsi, r8
movzx r8d, byte [r8 + 8]
mov rax, rcx
mov rdi, r9
cmp byte [rcx + 0x16], r8b
jne 0x140171530
mov r10d, dword [rcx + 0x10]
mov r8, qword [rdx + 8]
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x20], r8
mov r9d, dword [rdx + 0x10]
mov edx, r10d
mov r8, qword [rax + 8]
call qword [rsi + 0x18]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x60], 0
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x98], rcx
mov rcx, qword [rax]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x50], rcx
movzx ecx, word [rax + 0x14]
test ch, 0x20
jne 0x140171582
and ch, 0x8f
or ch, 0x40
mov word [rsp + 0x54], cx
mov rax, qword [rdx]
mov qword [rsp + 0x80], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x88], rax
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x90], rax
movzx eax, word [rdx + 0x14]
test ah, 0x20
jne 0x1401715bc
and ah, 0x8f
or ah, 0x40
mov word [rsp + 0x94], ax
xor ebx, ebx
and ecx, 1
jne 0x1401715d9
lea rcx, [rsp + 0x40]
movzx edx, r8b
call fcn.140170cb0
movzx r8d, byte [rsi + 8]
mov rbx, rax
movzx eax, word [rsp + 0x94]
mov edx, eax
not edx
test dx, 0x202
je 0x140171678
test al, 1
jne 0x140171668
lea rcx, [rsp + 0x80]
movzx edx, r8b
call fcn.140170cb0
test rbx, rbx
je 0x140171668
test rax, rax
je 0x140171668
mov rcx, qword [rsi + 0x10]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x90]
mov edx, dword [rsp + 0x50]
call qword [rsi + 0x18]
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x140171698
mov edx, dword [rsp + 0xa0]
test edx, edx
je 0x14017151d
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], eax
call fcn.140158a00
mov eax, dword [rsp + 0x3c]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
ret
test rdi, rdi
je 0x140171670
mov byte [rdi], 7
xor eax, eax
jmp 0x14017162a
cmp byte [rsp + 0x96], r8b
jne 0x1401715f0
mov rax, qword [rsp + 0x88]
jmp 0x140171605
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x3c], eax
call fcn.140158a00
mov eax, dword [rsp + 0x3c]
jmp 0x140171632
Function at 0x1401716b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
movzx r9d, word [rcx + 0x14]
movzx r10d, word [rdx + 0x14]
mov eax, r9d
or eax, r10d
test al, 1
jne 0x140171720
test al, 0x2c
je 0x1401716f8
mov eax, r9d
and eax, r10d
test al, 0x24
jne 0x140171738
test al, 8
je 0x140171750
movsd xmm1, qword [rcx]
movsd xmm0, qword [rdx]
comisd xmm0, xmm1
ja 0x140171762
xor eax, eax
comisd xmm1, xmm0
seta al
jmp 0x14017172e
test al, 2
je 0x140171711
and r9d, 2
je 0x140171770
and r10d, 2
je 0x140171762
test r8, r8
jne 0x1401717a8
add rsp, 0x28
jmp fcn.14014f040
and r10d, 1
and r9d, 1
mov eax, r10d
sub eax, r9d
add rsp, 0x28
ret
mov rax, qword [rdx]
cmp qword [rcx], rax
jl 0x140171762
setg al
movzx eax, al
add rsp, 0x28
ret
test r9b, 0x24
je 0x140171780
test r10b, 8
jne 0x1401717b8
and r10d, 0x24
jne 0x140171738
mov eax, 0xffffffff
jmp 0x14017172e
mov eax, 1
jmp 0x14017172e
and r9d, 8
mov eax, 1
je 0x14017172e
and r10d, 0x24
je 0x140171762
mov rax, qword [rdx]
movsd xmm1, qword [rcx]
mov rcx, rax
call fcn.1401508d0
neg eax
jmp 0x14017172e
xor r9d, r9d
add rsp, 0x28
jmp fcn.1401714e0
mov rcx, qword [rcx]
movsd xmm1, qword [rdx]
add rsp, 0x28
jmp fcn.1401508d0
Function at 0x1401c2870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
jne 0x1401c28a8
movzx eax, byte [rcx + 0x10]
test al, al
je 0x1401c28a8
cmp al, 1
je 0x1401c28b0
test r8, r8
mov r9, qword [rcx]
mov rcx, qword [rcx + 8]
je 0x1401c289e
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x50]
mov eax, dword [rax + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
jne 0x1401c28d0
xor eax, eax
ret
jmp fcn.1401c1ef0
test edx, edx
jne 0x1401c28a8
test r8, r8
je 0x1401c28a2
mov rax, qword [rcx + 8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x50]
mov eax, dword [rax + 0x28]
bswap eax
mov dword [r8], eax
jmp 0x1401c28a2
mov rcx, qword [rcx]
mov edx, dword [r9 + 0x2e0]
cmp edx, dword [rcx + 0x80]
jle 0x1401c28a2
cmp byte [rcx + 0xa], 0
je 0x1401c28a2
jmp fcn.140159480
Function at 0x1401db2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
movzx eax, byte [rdx]
cmp al, 0xb0
mov rsi, rdx
mov rbx, rcx
mov edx, eax
jne 0x1401db316
movzx edx, byte [rsi + 2]
cmp dl, 0xb1
je 0x1401db438
cmp dl, 0x8a
je 0x1401db348
movaps xmm6, xmmword [rsp + 0x60]
mov rdx, rsi
mov rcx, rbx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.1401dfac0
mov rdx, qword [rsi + 0x20]
mov rdx, qword [rdx + 0x20]
mov edi, dword [rdx]
cmp edi, 1
je 0x1401db324
cmp al, 0x8a
mov dword [r8], 0
je 0x1401db448
mov eax, dword [rbx + 0x38]
lea ebp, [rax + 1]
add eax, edi
test edi, edi
mov dword [rbx + 0x38], eax
jle 0x1401db41b
lea rax, [0x14014ab50]
xor r13d, r13d
lea rcx, [0x140162db0]
movq xmm0, rax
lea r12, [rsp + 0x30]
movq xmm6, rcx
punpcklqdq xmm6, xmm0
jmp 0x1401db3d1
mov rdx, r14
mov rcx, r12
mov dword [rsp + 0x2c], r8d
call fcn.140163c70
cmp word [rsp + 0x54], 0
mov r8d, dword [rsp + 0x2c]
jne 0x1401db407
mov rdx, r14
mov rcx, rbx
add r13d, 1
call fcn.1401ddfc0
cmp r13d, edi
je 0x1401db41b
lea r8d, [rbp + r13]
movsxd rax, r13d
shl rax, 5
add rax, qword [rsi + 0x20]
cmp byte [rbx + 0x23], 0
mov r14, qword [rax + 8]
je 0x1401db3bd
mov eax, 2
test r14, r14
movups xmmword [rsp + 0x38], xmm6
mov word [rsp + 0x54], ax
mov dword [rsp + 0x58], 0
jne 0x1401db3a0
mov rdx, r14
mov rcx, rbx
add r13d, 1
call fcn.1401dee40
cmp r13d, edi
jne 0x1401db3d1
movaps xmm6, xmmword [rsp + 0x60]
mov eax, ebp
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [rsi + 0x20]
mov edi, dword [rdx]
jmp 0x1401db352
movaps xmm6, xmmword [rsp + 0x60]
mov rdx, rsi
mov rcx, rbx
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.1401daea0
Function at 0x1401dee40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r14, qword [rcx + 0x58]
mov r13d, r8d
mov rdi, rcx
mov rsi, rdx
shr r13d, 0x1f
test r14, r14
mov ebp, r8d
je 0x1401deed8
test r13b, r13b
je 0x1401deed8
mov eax, dword [r14]
lea rbx, [r14 + 8]
test eax, eax
jle 0x1401deed8
sub eax, 1
shl rax, 5
lea r12, [r14 + rax + 0x28]
jmp 0x1401dee91
add rbx, 0x20
cmp rbx, r12
je 0x1401deed8
test byte [rbx + 0x14], 8
je 0x1401dee88
mov rdx, qword [rbx]
test rdx, rdx
je 0x1401def78
test rsi, rsi
je 0x1401def78
xor ecx, ecx
mov r9d, 0xffffffff
mov r8, rsi
call fcn.140188cc0
test eax, eax
jne 0x1401dee88
mov eax, dword [rbx + 0x18]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test rsi, rsi
mov rcx, qword [rdi]
je 0x1401def70
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call fcn.14016b9b0
test rax, rax
mov rbx, rax
je 0x1401def70
test byte [rax + 4], 8
jne 0x1401def90
mov rdx, r14
mov r8, rbx
mov rcx, rdi
call fcn.140176790
mov rdx, rax
mov eax, ebp
test rdx, rdx
je 0x1401def59
mov eax, dword [rdx]
shl r13d, 3
sub eax, 1
cdqe
mov rcx, rax
shl rcx, 5
lea r8, [rdx + rcx + 0x10]
movzx ecx, byte [r8 + 0xc]
and ecx, 0xfffffff7
or ecx, r13d
test ebp, ebp
mov byte [r8 + 0xc], cl
jns 0x1401def4f
mov esi, dword [rdi + 0x38]
lea ebp, [rsi + 1]
mov dword [rdi + 0x38], ebp
shl rax, 5
mov dword [rdx + rax + 0x20], ebp
mov eax, ebp
mov qword [rdi + 0x58], rdx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ebx, ebx
jmp 0x1401def04
cmp rdx, rsi
jne 0x1401dee88
mov eax, dword [rbx + 0x18]
jmp 0x1401deec3
mov rsi, qword [rdi + 0x10]
movsxd r12, dword [rsi + 0x90]
cmp r12d, dword [rsi + 0x94]
jge 0x1401df066
lea eax, [r12 + 1]
mov dword [rsi + 0x90], eax
movsxd rax, r12d
lea rdx, [rax + rax*2]
mov rax, qword [rsi + 0x88]
lea rax, [rax + rdx*8]
mov qword [rax], 0xf
mov qword [rax + 8], 0
mov qword [rax + 0x10], 0
mov rcx, qword [rdi]
mov byte [rdi + 0x23], 0
mov eax, ebp
cmp byte [rcx + 0x67], 0
jne 0x1401df00f
test ebp, ebp
js 0x1401df05b
cmp qword [rdi + 0x10], 0
je 0x1401df00f
mov r8d, eax
mov rcx, rdi
mov rdx, rbx
mov dword [rsp + 0x3c], eax
call fcn.1401dd5a0
mov rcx, qword [rdi]
mov eax, dword [rsp + 0x3c]
mov rdx, rbx
mov byte [rdi + 0x23], 1
mov dword [rsp + 0x3c], eax
call fcn.14015e330
mov r8, qword [rsi]
lea rdx, [0x14041e460]
mov ecx, dword [rsi + 0x90]
mov eax, dword [rsp + 0x3c]
cmp byte [r8 + 0x67], 0
jne 0x1401df049
mov rdx, qword [rsi + 0x88]
lea r8, [r12 + r12*2]
lea rdx, [rdx + r8*8]
mov dword [rdx + 8], ecx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [rdi + 0x38]
add eax, 1
mov dword [rdi + 0x38], eax
jmp 0x1401defef
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf
mov rcx, rsi
call fcn.1401771f0
movsxd r12, eax
jmp 0x1401defdc
Function at 0x1401df090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x60
cmp byte [rcx + 0x23], 0
mov rbx, rcx
je 0x1401df0fc
mov eax, 2
test rdx, rdx
mov dword [rsp + 0x58], 0
mov word [rsp + 0x54], ax
lea rcx, [0x140162db0]
lea rax, [0x14014ab50]
movq xmm0, rcx
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
je 0x1401df110
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], r8d
mov qword [rsp + 0x20], rdx
call fcn.140163c70
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x20]
mov r8d, dword [rsp + 0x2c]
jne 0x1401df110
mov rcx, rbx
add rsp, 0x60
pop rbx
jmp fcn.1401ddfc0
mov rcx, rbx
add rsp, 0x60
pop rbx
jmp fcn.1401dee40

Function at 0x1401dfac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
test rdx, rdx
mov rbx, rcx
mov rsi, r8
jne 0x1401dfae5
jmp 0x1401dfaff
mov rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401dfaff
mov eax, dword [rdx + 4]
test eax, 0x82000
je 0x1401dfb60
test eax, 0x80000
jne 0x1401dfad8
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x1401dfae5
movzx eax, byte [rbx + 0x1f]
test al, al
je 0x1401dfbf0
sub eax, 1
mov byte [rbx + 0x1f], al
movzx eax, al
mov edi, dword [rbx + rax*4 + 0xe8]
mov r8d, edi
mov rcx, rbx
call fcn.1401db6d0
cmp eax, edi
je 0x1401dfbe0
test edi, edi
jne 0x1401dfb40
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
movzx edx, byte [rbx + 0x1f]
cmp dl, 7
ja 0x1401dfb32
lea ecx, [rdx + 1]
mov byte [rbx + 0x1f], cl
mov dword [rbx + rdx*4 + 0xe8], edi
jmp 0x1401dfb32
cmp byte [rbx + 0x23], 0
je 0x1401dfaff
cmp byte [rdx], 0xb0
je 0x1401dfaff
lea rcx, [rsp + 0x30]
mov eax, 2
mov qword [rsp + 0x28], rdx
mov word [rsp + 0x54], ax
lea rdi, [0x140162db0]
lea rax, [0x14014ab50]
movq xmm0, rdi
mov dword [rsp + 0x58], 0
movq xmm1, rax
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x38], xmm0
call fcn.140163c70
cmp word [rsp + 0x54], 0
mov rdx, qword [rsp + 0x28]
je 0x1401dfaff
mov r8d, 0xffffffff
mov rcx, rbx
mov dword [rsi], 0
add rsp, 0x60
pop rbx
pop rsi
pop rdi
jmp fcn.1401dee40
mov dword [rsi], edi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [rbx + 0x38]
lea edi, [rax + 1]
mov dword [rbx + 0x38], edi
jmp 0x1401dfb1b
Function at 0x1401dfc00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
mov r11, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov r10, rcx
movzx ecx, byte [rdx]
cmp cl, 0xb0
je 0x1401dfc28
cmp cl, 0x8a
je 0x1401dfc70
xor eax, eax
cmp cl, 0xb1
je 0x1401dfc50
pop rbx
ret
movzx eax, byte [rdx + 2]
cmp al, 0xb1
je 0x1401dfcb0
cmp al, 0x8a
mov rcx, rdx
je 0x1401dfc90
mov eax, dword [rdx + 0x2c]
mov qword [r11], rcx
add eax, r8d
pop rbx
ret
movsxd rax, r8d
mov rcx, r10
mov r8, rbx
shl rax, 5
add rax, qword [rdx + 0x20]
mov rdx, qword [rax + 8]
mov qword [r11], rdx
pop rbx
jmp fcn.1401dfac0
mov rdx, qword [rdx + 0x20]
movsxd rax, r8d
shl rax, 5
add rax, qword [rdx + 0x20]
mov rax, qword [rax + 8]
mov qword [r11], rax
lea eax, [r8 + r9]
pop rbx
ret
mov rax, qword [rdx + 0x20]
mov r9, qword [rax + 0x20]
cmp dword [r9], 1
jle 0x1401dfc3b
movsxd rax, r8d
shl rax, 5
mov rcx, qword [r9 + rax + 8]
jmp 0x1401dfc3b
mov rcx, qword [rdx + 0x20]
cmp dword [rcx], 1
jle 0x1401dfcca
movsxd rax, r8d
shl rax, 5
mov rcx, qword [rcx + rax + 8]
jmp 0x1401dfc3b
mov rcx, rdx
jmp 0x1401dfc3b