joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141c38058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141c381df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141c38089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c3806f
add dl, dl
jne 0x141c38096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c380f6
xor eax, eax
add dl, dl
jne 0x141c380a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c381ad
add dl, dl
jne 0x141c380b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c380c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c380d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c380dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141c380ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141c3807e
mov eax, 1
add dl, dl
jne 0x141c38106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c38113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c380fb
sub eax, ebx
mov ebx, 1
jne 0x141c3814c
mov ecx, 1
add dl, dl
jne 0x141c3812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c3813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c38123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c3807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141c38168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c38175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c3815d
cmp eax, 0x7d00
jae 0x141c3819b
cmp eax, 0x500
jb 0x141c38196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c3807e
cmp eax, 0x7f
ja 0x141c3819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c3807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141c381d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141c3807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180004a00
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
movsx eax, byte [rsp + 0x28]
cmp eax, 0x41
jl 0x180004a2d
movsx eax, byte [rsp + 0x28]
cmp eax, 0x5a
jg 0x180004a2d
movsx eax, byte [rsp + 0x28]
or eax, 0x20
mov dword [rsp], eax
jmp 0x180004a35
movsx eax, byte [rsp + 0x28]
mov dword [rsp], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
add rsp, 0x18
ret

Function at 0x1800073f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x48
mov eax, 4
imul rax, rax, 2
lea rcx, [0x1800d3628]
add rcx, rax
mov rax, rcx
mov ecx, 4
imul rcx, rcx, 1
lea rdx, [0x1800d3628]
add rdx, rcx
mov rcx, rdx
mov edx, 4
imul rdx, rdx, 0
lea r8, [0x1800d3628]
add r8, rdx
mov rdx, r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rdx
movss xmm2, dword [0x1800cf1f8]
movss xmm1, dword [0x1800cf1d8]
movss xmm0, dword [0x1800cccb0]
call fcn.180034fb0
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1800d3200]
cmp eax, 1
jb 0x1800074d9
mov eax, dword [0x1800d3200]
cmp dword [0x1800d31d8], eax
je 0x1800074cd
movss xmm0, dword [0x1800c4ff0]
mulss xmm0, dword [0x1800cccc0]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1800d3628]
movss xmm1, dword [rcx + rax]
addss xmm1, xmm0
movaps xmm0, xmm1
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1800d3628]
movss dword [rcx + rax], xmm0
mov eax, dword [0x1800d3200]
mov dword [0x1800d31d8], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1800d3200], eax
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1800d3628]
xorps xmm0, xmm0
comiss xmm0, dword [rcx + rax]
jbe 0x180007524
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1800d3628]
movss xmm0, dword [rcx + rax]
addss xmm0, dword [0x1800c50f8]
mov eax, 4
imul rax, rax, 0
lea rcx, [0x1800d3628]
movss dword [rcx + rax], xmm0
mov eax, 4
imul rax, rax, 2
lea rcx, [0x1800d3628]
mov edx, 4
imul rdx, rdx, 1
lea r8, [0x1800d3628]
mov r9d, 4
imul r9, r9, 0
mov qword [rsp + 0x30], r9
lea r10, [0x1800d3628]
lea r11, [0x1800cf1f8]
mov qword [rsp + 0x28], r11
lea r11, [0x1800cf1d8]
mov qword [rsp + 0x20], r11
lea r9, [0x1800cccb0]
movss xmm2, dword [rcx + rax]
movss xmm1, dword [r8 + rdx]
mov rax, qword [rsp + 0x30]
movss xmm0, dword [r10 + rax]
call fcn.1800350e0
nop
add rsp, 0x48
ret
Function at 0x180028600
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [0x1800d3100], 0
jne 0x18002874c
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x8c], 0x2e
mov byte [rsp + 0x8d], 0x74
mov byte [rsp + 0x8e], 0x65
mov byte [rsp + 0x8f], 0x78
mov byte [rsp + 0x90], 0x74
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x88], 0xff
mov byte [rsp + 0x89], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x8a]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0x88]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d3100], rax
mov rax, qword [0x1800d3100]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
lea rcx, [0x180081fd0]
call fcn.18002e610
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180082020
add rsp, 0xa0
pop rdi
ret
Function at 0x1800287c0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [0x1800d3158], 0
jne 0x180028911
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x8c], 0x2e
mov byte [rsp + 0x8d], 0x74
mov byte [rsp + 0x8e], 0x65
mov byte [rsp + 0x8f], 0x78
mov byte [rsp + 0x90], 0x74
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x88], 0xff
mov byte [rsp + 0x89], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x8a]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0x88]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d3158], rax
mov rax, qword [0x1800d3158]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
lea rcx, [0x180081fd0]
call fcn.18002e610
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180082020
add rsp, 0xa0
pop rdi
ret
Function at 0x1800289c0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [0x1800d31e8], 0
jne 0x180028b16
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x8c], 0x2e
mov byte [rsp + 0x8d], 0x74
mov byte [rsp + 0x8e], 0x65
mov byte [rsp + 0x8f], 0x78
mov byte [rsp + 0x90], 0x74
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x88], 0xff
mov byte [rsp + 0x89], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x8a]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0x88]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d31e8], rax
mov rax, qword [0x1800d31e8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
lea rcx, [0x180081fd0]
call fcn.18002e670
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180082020
add rsp, 0xa0
pop rdi
ret
Function at 0x180028ba0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0xb8], rax
cmp qword [0x1800d31f0], 0
jne 0x180028cf7
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0xac], 0x2e
mov byte [rsp + 0xad], 0x74
mov byte [rsp + 0xae], 0x65
mov byte [rsp + 0xaf], 0x78
mov byte [rsp + 0xb0], 0x74
lea rdx, [rsp + 0xac]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0xa8], 0xff
mov byte [rsp + 0xa9], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xaa]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0xa8]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d31f0], rax
mov rax, qword [0x1800d31f0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov rdi, rax
mov rsi, qword [rsp + 0xf0]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
movzx eax, byte [rsp + 0x100]
mov byte [rsp + 0x28], al
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
mov r8, qword [rsp + 0xe8]
lea rdx, [rsp + 0x90]
lea rcx, [0x180081fd0]
call fcn.18002e6d0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.180082020
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x180028da0
Capabilities:
Enumerate pe sections

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0xb8], rax
cmp qword [0x1800d3178], 0
jne 0x180028ef7
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0xac], 0x2e
mov byte [rsp + 0xad], 0x74
mov byte [rsp + 0xae], 0x65
mov byte [rsp + 0xaf], 0x78
mov byte [rsp + 0xb0], 0x74
lea rdx, [rsp + 0xac]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0xa8], 0xff
mov byte [rsp + 0xa9], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xaa]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0xa8]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d3178], rax
mov rax, qword [0x1800d3178]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov rdi, rax
mov rsi, qword [rsp + 0xf0]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x28], 0
movzx eax, byte [rsp + 0xf8]
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x70]
mov r8, qword [rsp + 0xe8]
lea rdx, [rsp + 0x90]
lea rcx, [0x180081fd0]
call fcn.18002e750
nop
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.180082020
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x180028fe0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [0x1800d3128], 0
jne 0x18002912c
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x8c], 0x2e
mov byte [rsp + 0x8d], 0x74
mov byte [rsp + 0x8e], 0x65
mov byte [rsp + 0x8f], 0x78
mov byte [rsp + 0x90], 0x74
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x88], 0xff
mov byte [rsp + 0x89], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x8a]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0x88]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d3128], rax
mov rax, qword [0x1800d3128]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
lea rcx, [0x180081fd0]
call fcn.18002e610
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180082020
add rsp, 0xa0
pop rdi
ret
Function at 0x180029340
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [0x1800d31a8], 0
jne 0x180029496
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x8c], 0x2e
mov byte [rsp + 0x8d], 0x74
mov byte [rsp + 0x8e], 0x65
mov byte [rsp + 0x8f], 0x78
mov byte [rsp + 0x90], 0x74
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x88], 0xff
mov byte [rsp + 0x89], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x8a]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0x88]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d31a8], rax
mov rax, qword [0x1800d31a8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
lea rcx, [0x180081fd0]
call fcn.18002e610
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180082020
add rsp, 0xa0
pop rdi
ret
Function at 0x180029520
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [0x1800d30e8], 0
jne 0x180029676
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x8c], 0x2e
mov byte [rsp + 0x8d], 0x74
mov byte [rsp + 0x8e], 0x65
mov byte [rsp + 0x8f], 0x78
mov byte [rsp + 0x90], 0x74
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x88], 0xff
mov byte [rsp + 0x89], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x8a]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0x88]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d30e8], rax
mov rax, qword [0x1800d30e8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
lea rdx, [rsp + 0x70]
lea rcx, [0x180081fd0]
call fcn.18002e610
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180082020
add rsp, 0xa0
pop rdi
ret
Function at 0x180029700
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1800cc040]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp qword [0x1800d31e0], 0
jne 0x180029847
mov rax, qword [0x1800cf2d0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
mov word [rsp + 0x30], ax
mov byte [rsp + 0x8c], 0x2e
mov byte [rsp + 0x8d], 0x74
mov byte [rsp + 0x8e], 0x65
mov byte [rsp + 0x8f], 0x78
mov byte [rsp + 0x90], 0x74
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x68]
call fcn.1800033a0
movzx ecx, word [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov r8, qword [rax]
mov rdx, rcx
mov rcx, qword [rsp + 0x48]
call fcn.18002e520
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x88], 0xff
mov byte [rsp + 0x89], 0x26
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x8a]
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx + 8]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
mov r9, rax
lea r8, [rsp + 0x88]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call fcn.18002e4c0
mov qword [0x1800d31e0], rax
mov rax, qword [0x1800d31e0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [0x180081fd0]
call fcn.18002e610
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180082020
add rsp, 0xa0
pop rdi
ret