joyce8/EMBER2024-capa huggingface dataset:
Function at 0x693b00
Capabilities:
Get keyboard layout

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
nop
mov byte [0x00742c48], 0
mov word [rbp + 0x54], 0
lea rcx, [rbp + 0x54]
call sub.user32.dll_GetKeyboardLayoutNameW
mov rcx, qword [0x00573870]
mov dl, 1
call fcn.00574fa0
mov qword [rbp + 0x70], rax
nop
mov rcx, qword [rbp + 0x70]
mov rdx, 0xffffffff80000002
call fcn.00575270
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0x54]
mov r8d, 0xa
call fcn.0040fa70
lea rcx, [rbp + 0x30]
lea rdx, [0x00693d20]
mov r8, qword [rbp + 0x28]
call fcn.0040fdd0
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x30]
call fcn.00575680
test al, al
je 0x693c3c
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x68]
lea r8, [0x00693d94]
call fcn.00576380
mov rcx, qword [rbp + 0x68]
mov edx, 0x8000
call fcn.0043fd60
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x693c3c
nop
mov rcx, qword [rbp + 0x78]
lea rdx, [0x00693dac]
call fcn.0041cb70
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x693c32
call qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x693c32
mov rcx, qword [rbp + 0x90]
call fcn.00693a70
test eax, eax
je 0x693c16
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
jmp 0x693c20
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
and eax, 1
cmp eax, 1
sete al
mov byte [0x00742c48], al
nop
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_FreeLibrary_2
nop
mov rcx, qword [rbp + 0x70]
call fcn.0040b260
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040e710
lea rcx, [rbp + 0x68]
call fcn.0040e630
lea rsp, [rbp + 0x80]
pop rbp
ret

Function at 0x693e30
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx bx, byte [rbp + 0x28]
test bx, bx
je 0x693e8e
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x693e69
add bx, 0x2000
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x693e7e
add bx, 0x4000
mov eax, dword [rbp + 0x30]
test eax, 0x20000000
je 0x693e8e
add bx, 0x8000
mov eax, ebx
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6a58f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x006a5958]
mov eax, ecx
test ax, 4
je 0x6a590a
or bx, 1
mov eax, ecx
test ax, 8
je 0x6a5917
or bx, 4
mov eax, ecx
test ax, 1
je 0x6a5924
or bx, 8
mov eax, ecx
test ax, 2
je 0x6a5931
or bx, 0x10
test cx, 0x10
je 0x6a593c
or bx, 0x20
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6a5950
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x6a5960
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x006a59b0]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6a5984
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6a5998
or si, 4
test ebx, 0x20000000
je 0x6a59a4
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6b3ef0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6b4122
mov rcx, qword [0x004d01b8]
mov dl, 1
call fcn.00502160
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040e630
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x6b40fa
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.005d1ae0
test al, al
je 0x6b40e4
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x006b41b4]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00433600
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x6b40e4
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006b4222]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6b40d7
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.0040fa70
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x6b40d7
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.0040fa70
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x6b3f98
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.00502010
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040e630
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6b54b0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007564d0]
cmp byte [rax + 0x159], 0
jne 0x6b5553
cmp qword [0x00756508], 0
jne 0x6b54f6
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x00744df8]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x00756508], rax
cmp qword [0x00756500], 0
jne 0x6b5518
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x00756500], rax
cmp qword [0x00756510], 0
jne 0x6b5553
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x00744df0]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x00756510], rax
add rsp, 0x48
ret

Function at 0x6b67a0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2d0], 0
je 0x6b6886
cmp dword [rbx + 0x128], 0
jne 0x6b687c
mov rax, qword [rbx + 0x2d0]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006b6680]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6b687c
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6b682a
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6b687b
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.004fa720
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6b683b
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6b6bd0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007564d0]
cmp qword [rax + 0x2d0], 0
je 0x6b6daa
test sil, sil
jne 0x6b6cc9
cmp dword [rbx + 0x138], 0
jne 0x6b6cba
mov rcx, rbx
call fcn.006bb310
lea rcx, [0x006b6a70]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6b6c7c
mov rax, qword [0x007564d0]
cmp byte [rax + 0x193], 0
je 0x6b6c7c
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6b6c55
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6b6c7b
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6b6c5d
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6b6cb9
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004fa720
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6b6c8d
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6b6daa
cmp dword [rbx + 0x138], 0
jle 0x6b6daa
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6b6daa
cmp qword [rbx + 0xa8], 0
je 0x6b6d49
mov rax, qword [0x007564d0]
cmp byte [rax + 0x193], 0
je 0x6b6d49
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6b6d1f
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6b6d48
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6b6d27
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6b6d86
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004fa720
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6b6d5a
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006a0b08]
call fcn.00411a10
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6b7fb0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6b801f
cmp byte [rbx + 0x193], 0
jne 0x6b801f
mov rcx, qword [rbx + 0x2d0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.0040e8f0
xor rax, rax
cmp qword [rsi], 0
je 0x6b800a
mov rax, qword [rsi]
mov eax, dword [rax - 4]
test eax, eax
jne 0x6b802e
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040ec60
jmp 0x6b802e
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040ec60
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6bb710
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
cmp sil, byte [rbx + 0x193]
je 0x6bb8e1
mov byte [rbx + 0x193], sil
cmp qword [rbx + 0xa8], 0
je 0x6bb842
mov rcx, qword [rbx + 0xa8]
call fcn.005c7e20
test al, al
je 0x6bb842
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6bb842
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6bb842
test sil, sil
je 0x6bb7bf
mov rcx, qword [rbx + 0x2d0]
xor rdx, rdx
xor r8, r8
call fcn.006a52c0
mov rcx, qword [rbx + 0xa8]
call fcn.005c7820
mov rcx, rax
mov dl, 1
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006a52c0
jmp 0x6bb82a
call sub.user32.dll_GetForegroundWindow
mov rdi, rax
mov rcx, qword [rbx + 0xa8]
call fcn.005c7820
cmp rdi, rax
sete dil
mov rcx, qword [rbx + 0xa8]
call fcn.005c7820
mov rcx, rax
xor rdx, rdx
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006a52c0
mov rcx, qword [rbx + 0x2d0]
mov dl, 1
mov r8b, 1
call fcn.006a52c0
test dil, dil
je 0x6bb82a
mov rcx, qword [rbx + 0xa8]
call fcn.005c7820
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rcx, qword [rbx + 0xa8]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005bb230
test sil, sil
je 0x6bb88c
mov rax, qword [rbx + 0x2d0]
mov rsi, qword [rbx + 0x2d0]
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
or rax, 0x80
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rcx, qword [rbx + 0x2d0]
xor rdx, rdx
call sub.user32.dll_SetWindowTextW
jmp 0x6bb8e1
mov rax, qword [rbx + 0x2d0]
mov rsi, qword [rbx + 0x2d0]
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
and rax, 0xffffffffffffff7f
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rsi, qword [rbx + 0x2d0]
mov rax, qword [rbx + 0x118]
mov rcx, rax
call fcn.0040f9a0
mov rcx, rsi
mov rdx, rax
call sub.user32.dll_SetWindowTextW
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x6c47c0
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6c4876
mov rcx, qword [rbx + 0x10]
call fcn.005c7820
mov rcx, qword [0x005dae38]
mov dl, 1
mov r8, rax
call fcn.005be4f0
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005e1b90
lea rax, [rsi + 0x4b0]
mov qword [rax + 8], rbx
lea rcx, [0x006c3e30]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005c7820
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005c7820
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6c4921
mov rcx, qword [rbx + 0x10]
call fcn.005c7820
mov rcx, qword [0x005dae38]
mov dl, 1
mov r8, rax
call fcn.005be4f0
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005e1b90
lea rax, [rsi + 0x4b0]
mov qword [rax + 8], rbx
lea rcx, [0x006c3e90]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005c7820
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005c7820
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6c49bd
mov rcx, qword [rbx + 0x10]
call fcn.005c7820
mov rcx, qword [0x005dbe10]
mov dl, 1
mov r8, rax
call fcn.005be4f0
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x480], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005c7820
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005c7820
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x140002020
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000206a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000206a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000206a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000206a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000206a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000206c
xor al, al
add rsp, 0x28
ret
Function at 0x1400037b0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x14033551c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1400e0090
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14033551c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140003940
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000395c
cmp rcx, r8
jl 0x14000394f
mov qword [rdx + 0x80], rcx
test dword [0x14032d030], 1
je 0x14000398b
cmp byte [rsp + 0xd0], 0
je 0x14000398b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400034b0
mov rsp, r8
jmp rax
Function at 0x140003990
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x14033551c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400047a0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x14000de00
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x14000de3d
test rdx, rdx
je 0x14000de3d
mov rax, qword [rax]
cmp rax, r9
jne 0x14000de20
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret