joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cd90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000ce87
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000ce3f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000ce3f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000ce37
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000ce20
cmp eax, 0x6f22e8c8
je 0x14000ce5e
inc r8d
cmp r8d, r10d
jb 0x14000ce00
mov r11, qword [r11]
cmp r11, r14
jne 0x14000cdd0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000ce90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000cf87
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000cf3f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000cf3f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000cf37
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000cf20
cmp eax, 0xe21026f9
je 0x14000cf5e
inc r8d
cmp r8d, r10d
jb 0x14000cf00
mov r11, qword [r11]
cmp r11, r14
jne 0x14000ced0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000cf90
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000d087
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000d03f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000d03f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000d037
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000d020
cmp eax, 0xb8932459
je 0x14000d05e
inc r8d
cmp r8d, r10d
jb 0x14000d000
mov r11, qword [r11]
cmp r11, r14
jne 0x14000cfd0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000d090
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000d187
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000d13f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000d13f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000d137
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000d120
cmp eax, 0xd812922a
je 0x14000d15e
inc r8d
cmp r8d, r10d
jb 0x14000d100
mov r11, qword [r11]
cmp r11, r14
jne 0x14000d0d0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x140010730
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0xb769339e
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x140010781
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x1400108da
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
jne 0x1400107de
jmp 0x140010774
mov eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x140010803
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x1400108d5
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x14], 0x1505
mov dword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsx eax, byte [rax]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x30], 0
je 0x140010884
imul eax, dword [rsp + 0x14], 0x21
add eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
jmp 0x14001084d
cmp dword [rsp + 0x14], 0xb769339e
jne 0x1400108d0
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x1400108da
jmp 0x1400107fb
jmp 0x140010774
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x1400108f0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0x87ae6a46
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x140010941
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x140010a9a
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
jne 0x14001099e
jmp 0x140010934
mov eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x1400109c3
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x140010a95
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x14], 0x1505
mov dword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsx eax, byte [rax]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x30], 0
je 0x140010a44
imul eax, dword [rsp + 0x14], 0x21
add eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
jmp 0x140010a0d
cmp dword [rsp + 0x14], 0x87ae6a46
jne 0x140010a90
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x140010a9a
jmp 0x1400109bb
jmp 0x140010934
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140010ab0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0xe03908c0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x140010b01
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x140010c5a
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
jne 0x140010b5e
jmp 0x140010af4
mov eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x140010b83
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x140010c55
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x14], 0x1505
mov dword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsx eax, byte [rax]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x30], 0
je 0x140010c04
imul eax, dword [rsp + 0x14], 0x21
add eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
jmp 0x140010bcd
cmp dword [rsp + 0x14], 0xe03908c0
jne 0x140010c50
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x140010c5a
jmp 0x140010b7b
jmp 0x140010af4
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140010c70
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0x60af076d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x140010cc1
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x140010e1a
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
jne 0x140010d1e
jmp 0x140010cb4
mov eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x140010d43
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x140010e15
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x14], 0x1505
mov dword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsx eax, byte [rax]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x30], 0
je 0x140010dc4
imul eax, dword [rsp + 0x14], 0x21
add eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
jmp 0x140010d8d
cmp dword [rsp + 0x14], 0x60af076d
jne 0x140010e10
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x140010e1a
jmp 0x140010d3b
jmp 0x140010cb4
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140010e30
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0xca8d7527
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x140010e81
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x140010fda
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
jne 0x140010ede
jmp 0x140010e74
mov eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x140010f03
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x140010fd5
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x14], 0x1505
mov dword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsx eax, byte [rax]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x30], 0
je 0x140010f84
imul eax, dword [rsp + 0x14], 0x21
add eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
jmp 0x140010f4d
cmp dword [rsp + 0x14], 0xca8d7527
jne 0x140010fd0
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x140010fda
jmp 0x140010efb
jmp 0x140010e74
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140010ff0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0x6f0bdb18
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x140011041
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x14001119a
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
jne 0x14001109e
jmp 0x140011034
mov eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x1400110c3
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x140011195
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x14], 0x1505
mov dword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsx eax, byte [rax]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x30], 0
je 0x140011144
imul eax, dword [rsp + 0x14], 0x21
add eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
jmp 0x14001110d
cmp dword [rsp + 0x14], 0x6f0bdb18
jne 0x140011190
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x14001119a
jmp 0x1400110bb
jmp 0x140011034
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140011370
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0xe19e5fe
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x1400113c1
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x14001151a
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
jne 0x14001141e
jmp 0x1400113b4
mov eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x140011443
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x140011515
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x14], 0x1505
mov dword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsx eax, byte [rax]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x30], 0
je 0x1400114c4
imul eax, dword [rsp + 0x14], 0x21
add eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
jmp 0x14001148d
cmp dword [rsp + 0x14], 0xe19e5fe
jne 0x140011510
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x14001151a
jmp 0x14001143b
jmp 0x1400113b4
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret