joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c790
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000c887
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000c83f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000c83f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000c837
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000c820
cmp eax, 0x4986c7f1
je 0x14000c85e
inc r8d
cmp r8d, r10d
jb 0x14000c800
mov r11, qword [r11]
cmp r11, r14
jne 0x14000c7d0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000c890
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000c987
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000c93f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000c93f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000c937
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000c920
cmp eax, 0xa3bf64b4
je 0x14000c95e
inc r8d
cmp r8d, r10d
jb 0x14000c900
mov r11, qword [r11]
cmp r11, r14
jne 0x14000c8d0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000c990
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000ca87
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000ca3f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000ca3f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000ca37
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000ca20
cmp eax, 0x3870ca07
je 0x14000ca5e
inc r8d
cmp r8d, r10d
jb 0x14000ca00
mov r11, qword [r11]
cmp r11, r14
jne 0x14000c9d0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000ca90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000cb87
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000cb3f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000cb3f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000cb37
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000cb20
cmp eax, 0x90177f28
je 0x14000cb5e
inc r8d
cmp r8d, r10d
jb 0x14000cb00
mov r11, qword [r11]
cmp r11, r14
jne 0x14000cad0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000cb90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000cc87
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000cc3f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000cc3f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000cc37
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000cc20
cmp eax, 0xd034fc62
je 0x14000cc5e
inc r8d
cmp r8d, r10d
jb 0x14000cc00
mov r11, qword [r11]
cmp r11, r14
jne 0x14000cbd0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000cc90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000cd87
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000cd3f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000cd3f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000cd37
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000cd20
cmp eax, 0xca8d7527
je 0x14000cd5e
inc r8d
cmp r8d, r10d
jb 0x14000cd00
mov r11, qword [r11]
cmp r11, r14
jne 0x14000ccd0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000cd90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000ce87
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000ce3f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000ce3f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000ce37
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000ce20
cmp eax, 0x5fbff0fb
je 0x14000ce5e
inc r8d
cmp r8d, r10d
jb 0x14000ce00
mov r11, qword [r11]
cmp r11, r14
jne 0x14000cdd0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000ce90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000cf87
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000cf3f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000cf3f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000cf37
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000cf20
cmp eax, 0xcf31bb1f
je 0x14000cf5e
inc r8d
cmp r8d, r10d
jb 0x14000cf00
mov r11, qword [r11]
cmp r11, r14
jne 0x14000ced0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000cf90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000d046
mov r9, qword [rbx + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
jne 0x14000cfd4
mov rbx, qword [rbx]
jmp 0x14000cfb2
lea r10, [r9 + rcx]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
cmp r8d, dword [r10 + 0x18]
jae 0x14000d03e
mov ecx, dword [r10 + 0x20]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
mov qword [rsp + 0x28], rax
mov ecx, 0x1505
nop
movsx edx, byte [rax]
inc rax
mov qword [rsp + 0x28], rax
test edx, edx
je 0x14000d016
imul ecx, ecx, 0x21
add ecx, edx
jmp 0x14000d000
cmp ecx, 0x8b8e133d
jne 0x14000d039
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14000d04b
inc r8d
jmp 0x14000cfdb
mov rbx, qword [rbx]
jmp 0x14000cfb2
mov rax, qword [rsp + 0x40]
mov ecx, 0x99999999
call rax
nop
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000d070
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000d126
mov r9, qword [rbx + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
jne 0x14000d0b4
mov rbx, qword [rbx]
jmp 0x14000d092
lea r10, [r9 + rcx]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
cmp r8d, dword [r10 + 0x18]
jae 0x14000d11e
mov ecx, dword [r10 + 0x20]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
mov qword [rsp + 0x28], rax
mov ecx, 0x1505
nop
movsx edx, byte [rax]
inc rax
mov qword [rsp + 0x28], rax
test edx, edx
je 0x14000d0f6
imul ecx, ecx, 0x21
add ecx, edx
jmp 0x14000d0e0
cmp ecx, 0x3870ca07
jne 0x14000d119
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14000d12b
inc r8d
jmp 0x14000d0bb
mov rbx, qword [rbx]
jmp 0x14000d092
mov rax, qword [rsp + 0x40]
mov ecx, 0x99999999
call rax
nop
call fcn.14000cf90
test eax, eax
setne al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d1b0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000d2a7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000d25f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000d25f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000d257
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000d240
cmp eax, 0x6fa1320d
je 0x14000d27e
inc r8d
cmp r8d, r10d
jb 0x14000d220
mov r11, qword [r11]
cmp r11, r14
jne 0x14000d1f0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000d2b0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000d3a7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000d35f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000d35f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000d357
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000d340
cmp eax, 0x70ea2e03
je 0x14000d37e
inc r8d
cmp r8d, r10d
jb 0x14000d320
mov r11, qword [r11]
cmp r11, r14
jne 0x14000d2f0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000d3b0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000d4a7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000d45f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000d45f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000d457
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000d440
cmp eax, 0x3870ca07
je 0x14000d47e
inc r8d
cmp r8d, r10d
jb 0x14000d420
mov r11, qword [r11]
cmp r11, r14
jne 0x14000d3f0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000d580
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000d677
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000d62f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000d62f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000d627
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000d610
cmp eax, 0xa570578a
je 0x14000d64e
inc r8d
cmp r8d, r10d
jb 0x14000d5f0
mov r11, qword [r11]
cmp r11, r14
jne 0x14000d5c0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000d680
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000d777
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000d72f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000d72f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000d727
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000d710
cmp eax, 0x27b8f3c7
je 0x14000d74e
inc r8d
cmp r8d, r10d
jb 0x14000d6f0
mov r11, qword [r11]
cmp r11, r14
jne 0x14000d6c0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000d780
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000d877
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000d82f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000d82f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000d827
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000d810
cmp eax, 0x668fcf2e
je 0x14000d84e
inc r8d
cmp r8d, r10d
jb 0x14000d7f0
mov r11, qword [r11]
cmp r11, r14
jne 0x14000d7c0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret