joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017ae0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017b42
xor eax, eax
jmp 0x140017cc0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140017b8e
xor eax, eax
jmp 0x140017cc0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017bc5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140017bed
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140017c56
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x140017cbe
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0x97085561
jne 0x140017cbc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140017cc0
jmp 0x140017c49
xor eax, eax
add rsp, 0x78
ret
Function at 0x140017cd0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017d32
xor eax, eax
jmp 0x140017eb0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140017d7e
xor eax, eax
jmp 0x140017eb0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017db5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140017ddd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140017e46
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x140017eae
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0x3d71f40a
jne 0x140017eac
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140017eb0
jmp 0x140017e39
xor eax, eax
add rsp, 0x78
ret
Function at 0x140017ec0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017f22
xor eax, eax
jmp 0x1400180a0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140017f6e
xor eax, eax
jmp 0x1400180a0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017fa5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140017fcd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140018036
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001809e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xe054604a
jne 0x14001809c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x1400180a0
jmp 0x140018029
xor eax, eax
add rsp, 0x78
ret
Function at 0x1400180b0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018112
xor eax, eax
jmp 0x140018290
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14001815e
xor eax, eax
jmp 0x140018290
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018195
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x1400181bd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140018226
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001828e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xddeaabca
jne 0x14001828c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140018290
jmp 0x140018219
xor eax, eax
add rsp, 0x78
ret
Function at 0x1400182a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018302
xor eax, eax
jmp 0x140018480
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14001834e
xor eax, eax
jmp 0x140018480
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018385
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x1400183ad
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140018416
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001847e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0x4ecb007a
jne 0x14001847c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140018480
jmp 0x140018409
xor eax, eax
add rsp, 0x78
ret
Function at 0x140018490
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400184f2
xor eax, eax
jmp 0x140018670
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14001853e
xor eax, eax
jmp 0x140018670
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018575
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14001859d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140018606
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001866e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xde10f3da
jne 0x14001866c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140018670
jmp 0x1400185f9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140018680
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400186e2
xor eax, eax
jmp 0x140018860
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14001872e
xor eax, eax
jmp 0x140018860
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018765
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14001878d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x1400187f6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001885e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xd07708df
jne 0x14001885c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140018860
jmp 0x1400187e9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140018870
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400188d2
xor eax, eax
jmp 0x140018a50
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14001891e
xor eax, eax
jmp 0x140018a50
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018955
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14001897d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x1400189e6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x140018a4e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xe049c205
jne 0x140018a4c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140018a50
jmp 0x1400189d9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140018a60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018ac2
xor eax, eax
jmp 0x140018c40
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140018b0e
xor eax, eax
jmp 0x140018c40
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018b45
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140018b6d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140018bd6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x140018c3e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xe082843
jne 0x140018c3c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140018c40
jmp 0x140018bc9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140018c50
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018cb2
xor eax, eax
jmp 0x140018e30
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140018cfe
xor eax, eax
jmp 0x140018e30
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018d35
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140018d5d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140018dc6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x140018e2e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0x1a946df0
jne 0x140018e2c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140018e30
jmp 0x140018db9
xor eax, eax
add rsp, 0x78
ret