joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d5d0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x34], ecx
mov qword [rsp + 0x58], 0
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rax, qword [rax + 0x20]
nop word [rax + rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x48]
je 0x14000d6b3
mov rax, qword [rsp + 0x28]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x14000d690
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
je 0x14000d6a9
jmp 0x14000d6bb
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 2
cmp dword [rsp + 0x24], 0
jne 0x14000d6bb
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x14000d640
mov dword [rsp + 0x24], 2
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x80], rcx
mov r8d, dword [rsp + 0x34]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0xd8]
call fcn.140007020
mov edi, dword [rax]
mov rcx, qword [rsp + 0xd0]
call fcn.140007020
mov ebx, dword [rax]
mov rcx, qword [rsp + 0x70]
call fcn.140007020
mov r14, qword [rax]
mov rcx, qword [rsp + 0x68]
call fcn.140007020
mov rcx, qword [rax]
mov rdx, r14
mov r8d, ebx
mov r9d, edi
call rsi
mov dword [rsp + 0x24], 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000df80
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x3c], ecx
mov qword [rsp + 0x60], 0
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 0
mov rax, qword [rax + 0x20]
nop dword [rax + rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, qword [rsp + 0x50]
je 0x14000e063
mov rax, qword [rsp + 0x30]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x14000e040
mov dword [rsp + 0x2c], 0
cmp dword [rsp + 0x2c], 0
je 0x14000e059
jmp 0x14000e06b
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x2c], 2
cmp dword [rsp + 0x2c], 0
jne 0x14000e06b
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
jmp 0x14000dff0
mov dword [rsp + 0x2c], 2
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x88], rcx
mov r8d, dword [rsp + 0x3c]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0xf0]
call fcn.140007020
mov r14d, dword [rax]
mov rcx, qword [rsp + 0xe8]
call fcn.140007020
mov rdi, qword [rax]
mov rcx, qword [rsp + 0xe0]
call fcn.140007020
mov rbx, qword [rax]
mov rcx, qword [rsp + 0x78]
call fcn.140007020
mov ebp, dword [rax]
mov rcx, qword [rsp + 0x70]
call fcn.140007020
mov rcx, qword [rax]
mov dword [rsp + 0x20], r14d
mov edx, ebp
mov r8, rbx
mov r9, rdi
call rsi
mov dword [rsp + 0x2c], 1
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14000f310
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x34], ecx
mov qword [rsp + 0x58], 0
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rax, qword [rax + 0x20]
nop word [rax + rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x48]
je 0x14000f3f3
mov rax, qword [rsp + 0x28]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x14000f3d0
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
je 0x14000f3e9
jmp 0x14000f3fb
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 2
cmp dword [rsp + 0x24], 0
jne 0x14000f3fb
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x14000f380
mov dword [rsp + 0x24], 2
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x80], rcx
mov r8d, dword [rsp + 0x34]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x70]
call fcn.140007020
mov edi, dword [rax]
mov rcx, qword [rsp + 0x68]
call fcn.140007020
mov rcx, qword [rax]
mov edx, edi
call rsi
mov dword [rsp + 0x24], 1
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x14000fd70
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x44], ecx
mov qword [rsp + 0x68], 0
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x68], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], 0
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x58]
je 0x14000fe53
mov rax, qword [rsp + 0x38]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x48], rcx
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x14000fe30
mov dword [rsp + 0x34], 0
cmp dword [rsp + 0x34], 0
je 0x14000fe49
jmp 0x14000fe5b
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x34], 2
cmp dword [rsp + 0x34], 0
jne 0x14000fe5b
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
jmp 0x14000fde0
mov dword [rsp + 0x34], 2
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x48], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x90], rcx
mov r8d, dword [rsp + 0x44]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x108]
call fcn.140007020
mov r14d, dword [rax]
mov rcx, qword [rsp + 0x100]
call fcn.140007020
mov r15, qword [rax]
mov rcx, qword [rsp + 0xf8]
call fcn.140007020
mov edi, dword [rax]
mov rcx, qword [rsp + 0xf0]
call fcn.140007020
mov rbx, qword [rax]
mov rcx, qword [rsp + 0x80]
call fcn.140007020
mov ebp, dword [rax]
mov rcx, qword [rsp + 0x78]
call fcn.140007020
mov ecx, dword [rax]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov edx, ebp
mov r8, rbx
mov r9d, edi
call rsi
mov dword [rsp + 0x34], 1
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400113b0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x34], ecx
mov qword [rsp + 0x58], 0
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rax, qword [rax + 0x20]
nop dword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x48]
je 0x140011493
mov rax, qword [rsp + 0x28]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x140011470
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
je 0x140011489
jmp 0x14001149b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 2
cmp dword [rsp + 0x24], 0
jne 0x14001149b
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x140011420
mov dword [rsp + 0x24], 2
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x80], rcx
mov r8d, dword [rsp + 0x34]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0xd8]
call fcn.140007020
mov edi, dword [rax]
mov rcx, qword [rsp + 0xd0]
call fcn.140007020
mov rbx, qword [rax]
mov rcx, qword [rsp + 0x70]
call fcn.140007020
mov ebp, dword [rax]
mov rcx, qword [rsp + 0x68]
call fcn.140007020
mov rcx, qword [rax]
mov edx, ebp
mov r8, rbx
mov r9d, edi
call rsi
mov dword [rsp + 0x24], 1
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140011df0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x34], ecx
mov qword [rsp + 0x58], 0
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rax, qword [rax + 0x20]
nop word [rax + rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x48]
je 0x140011ed3
mov rax, qword [rsp + 0x28]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x140011eb0
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
je 0x140011ec9
jmp 0x140011edb
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 2
cmp dword [rsp + 0x24], 0
jne 0x140011edb
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x140011e60
mov dword [rsp + 0x24], 2
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x80], rcx
mov r8d, dword [rsp + 0x34]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0xd8]
call fcn.140007020
mov edi, dword [rax]
mov rcx, qword [rsp + 0xd0]
call fcn.140007020
movzx ebx, word [rax]
mov rcx, qword [rsp + 0x70]
call fcn.140007020
mov r14, qword [rax]
mov rcx, qword [rsp + 0x68]
call fcn.140007020
mov rcx, qword [rax]
mov rdx, r14
mov r8d, ebx
mov r9d, edi
call rsi
mov dword [rsp + 0x24], 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140012cc0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x4c], ecx
mov qword [rsp + 0x70], 0
lea rsi, [rsp + 0x68]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x70], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x68], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], 0
mov rax, qword [rax + 0x20]
nop word cs:[rax + rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, qword [rsp + 0x60]
je 0x140012db3
mov rax, qword [rsp + 0x40]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x140012d90
mov dword [rsp + 0x3c], 0
cmp dword [rsp + 0x3c], 0
je 0x140012da9
jmp 0x140012dbb
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x3c], 2
cmp dword [rsp + 0x3c], 0
jne 0x140012dbb
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
jmp 0x140012d40
mov dword [rsp + 0x3c], 2
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x50], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x98], rcx
mov r8d, dword [rsp + 0x4c]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x120]
call fcn.140007020
mov ebp, dword [rax]
mov rcx, qword [rsp + 0x118]
call fcn.140007020
mov r15, qword [rax]
mov rcx, qword [rsp + 0x110]
call fcn.140007020
mov r12, qword [rax]
mov rcx, qword [rsp + 0x108]
call fcn.140007020
mov rdi, qword [rax]
mov rcx, qword [rsp + 0x100]
call fcn.140007020
mov rbx, qword [rax]
mov rcx, qword [rsp + 0x88]
call fcn.140007020
mov r14, qword [rax]
mov rcx, qword [rsp + 0x80]
call fcn.140007020
mov rcx, qword [rax]
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
mov rdx, r14
mov r8, rbx
mov r9, rdi
call rsi
mov dword [rsp + 0x3c], 1
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140014240
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x4c], ecx
mov qword [rsp + 0x70], 0
lea rsi, [rsp + 0x68]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x70], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x68], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], 0
mov rax, qword [rax + 0x20]
nop word cs:[rax + rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, qword [rsp + 0x60]
je 0x140014333
mov rax, qword [rsp + 0x40]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x140014310
mov dword [rsp + 0x3c], 0
cmp dword [rsp + 0x3c], 0
je 0x140014329
jmp 0x14001433b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x3c], 2
cmp dword [rsp + 0x3c], 0
jne 0x14001433b
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
jmp 0x1400142c0
mov dword [rsp + 0x3c], 2
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x50], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x98], rcx
mov r8d, dword [rsp + 0x4c]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x120]
call fcn.140007020
mov r15, qword [rax]
mov rcx, qword [rsp + 0x118]
call fcn.140007020
mov ebp, dword [rax]
mov rcx, qword [rsp + 0x110]
call fcn.140007020
mov r12d, dword [rax]
mov rcx, qword [rsp + 0x108]
call fcn.140007020
mov rdi, qword [rax]
mov rcx, qword [rsp + 0x100]
call fcn.140007020
mov ebx, dword [rax]
mov rcx, qword [rsp + 0x88]
call fcn.140007020
mov r14, qword [rax]
mov rcx, qword [rsp + 0x80]
call fcn.140007020
mov rcx, qword [rax]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
mov rdx, r14
mov r8d, ebx
mov r9, rdi
call rsi
mov dword [rsp + 0x3c], 1
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140014d30
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
sub rsp, 0x90
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x3c], ecx
mov qword [rsp + 0x60], 0
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 0
mov rax, qword [rax + 0x20]
nop word cs:[rax + rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp rax, qword [rsp + 0x50]
je 0x140014e13
mov rax, qword [rsp + 0x30]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x140014df0
mov dword [rsp + 0x2c], 0
cmp dword [rsp + 0x2c], 0
je 0x140014e09
jmp 0x140014e1b
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x2c], 2
cmp dword [rsp + 0x2c], 0
jne 0x140014e1b
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
jmp 0x140014da0
mov dword [rsp + 0x2c], 2
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x40], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x88], rcx
mov r8d, dword [rsp + 0x3c]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x78]
call fcn.140007020
mov rcx, qword [rsp + 0x70]
call fcn.140007020
mov rcx, qword [rax]
xor edx, edx
call rsi
mov dword [rsp + 0x2c], 1
add rsp, 0x90
pop rsi
ret
Function at 0x1400159b0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x34], ecx
mov qword [rsp + 0x58], 0
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rax, qword [rax + 0x20]
nop word [rax + rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x48]
je 0x140015a93
mov rax, qword [rsp + 0x28]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x140015a70
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
je 0x140015a89
jmp 0x140015a9b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 2
cmp dword [rsp + 0x24], 0
jne 0x140015a9b
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x140015a20
mov dword [rsp + 0x24], 2
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x80], rcx
mov r8d, dword [rsp + 0x34]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x70]
call fcn.140007020
mov rdi, qword [rax]
mov rcx, qword [rsp + 0x68]
call fcn.140007020
mov rcx, qword [rax]
mov rdx, rdi
call rsi
mov dword [rsp + 0x24], 1
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1400164a0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x34], ecx
mov qword [rsp + 0x58], 0
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], 0
mov rax, qword [rax + 0x20]
nop word [rax + rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x48]
je 0x140016583
mov rax, qword [rsp + 0x28]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x140016560
mov dword [rsp + 0x24], 0
cmp dword [rsp + 0x24], 0
je 0x140016579
jmp 0x14001658b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 2
cmp dword [rsp + 0x24], 0
jne 0x14001658b
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
jmp 0x140016510
mov dword [rsp + 0x24], 2
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x38], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x80], rcx
mov r8d, dword [rsp + 0x34]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0xd8]
call fcn.140007020
mov rdi, qword [rax]
mov rcx, qword [rsp + 0xd0]
call fcn.140007020
mov ebx, dword [rax]
mov rcx, qword [rsp + 0x70]
call fcn.140007020
mov r14, qword [rax]
mov rcx, qword [rsp + 0x68]
call fcn.140007020
mov rcx, qword [rax]
mov rdx, r14
mov r8d, ebx
mov r9, rdi
call rsi
mov dword [rsp + 0x24], 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140017270
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x44], ecx
mov qword [rsp + 0x68], 0
lea rsi, [rsp + 0x60]
mov rcx, rsi
mov dl, 0x60
call fcn.140006d40
mov rcx, rsi
call fcn.140006d70
movzx eax, al
mov rax, qword gs:[rax]
mov qword [rsp + 0x68], rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x60], rax
lea rcx, [rax + 0x20]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], 0
mov rax, qword [rax + 0x20]
nop dword [rax]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x58]
je 0x140017353
mov rax, qword [rsp + 0x38]
lea rcx, [rax - 0x10]
mov qword [rsp + 0x48], rcx
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rax + 0x50]
call fcn.1400028d0
test eax, eax
je 0x140017330
mov dword [rsp + 0x34], 0
cmp dword [rsp + 0x34], 0
je 0x140017349
jmp 0x14001735b
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x34], 2
cmp dword [rsp + 0x34], 0
jne 0x14001735b
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
jmp 0x1400172e0
mov dword [rsp + 0x34], 2
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x30]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x48], rdx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
mov qword [rsp + 0x90], rcx
mov r8d, dword [rsp + 0x44]
call fcn.140006d90
mov rsi, rax
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0xf8]
call fcn.140007020
mov rcx, qword [rsp + 0xf0]
call fcn.140007020
mov ebp, dword [rax]
mov rcx, qword [rsp + 0xe8]
call fcn.140007020
mov rcx, qword [rsp + 0xe0]
call fcn.140007020
mov rdi, qword [rax]
mov rcx, qword [rsp + 0x80]
call fcn.140007020
mov rbx, qword [rax]
mov rcx, qword [rsp + 0x78]
call fcn.140007020
mov rcx, qword [rax]
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x28], 0
mov rdx, rbx
mov r8, rdi
xor r9d, r9d
call rsi
mov dword [rsp + 0x34], 1
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
ret