joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006d00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x18], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x18]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [0x1800b73e0], rax
mov dword [rsp + 4], 0
jmp 0x180006d62
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
mov rax, qword [0x1800b73e0]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 4], eax
jae 0x180006e39
mov rax, qword [0x1800b73e0]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 4]
movzx eax, word [rax + rcx*2]
mov word [rsp], ax
mov rax, qword [0x1800b73e0]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 4]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov dword [rsp + 8], 0
jmp 0x180006dd7
mov eax, dword [rsp + 8]
inc eax
mov dword [rsp + 8], eax
movsxd rax, dword [rsp + 8]
mov rcx, qword [rsp + 0x10]
movsx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 8]
mov rdx, qword [rsp + 0x38]
movsx ecx, byte [rdx + rcx]
cmp eax, ecx
jne 0x180006e34
movsxd rax, dword [rsp + 8]
mov rcx, qword [rsp + 0x10]
movsx eax, byte [rcx + rax]
test eax, eax
jne 0x180006e32
mov rax, qword [0x1800b73e0]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
movzx ecx, word [rsp]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
jmp 0x180006e3b
jmp 0x180006dcd
jmp 0x180006d58
xor eax, eax
add rsp, 0x28
ret

Function at 0x180006e40
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov rax, qword [rax + 0x20]
mov qword [rsp], rax
jmp 0x180006e74
mov rax, qword [rsp]
mov rax, qword [rax]
mov qword [rsp], rax
mov rax, qword [rsp + 0x10]
add rax, 0x20
cmp qword [rsp], rax
je 0x180006edb
mov rax, qword [rsp]
sub rax, 0x10
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movzx eax, word [rax + 0x58]
cmp eax, 0x18
jne 0x180006ed9
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x60]
movabs rcx, 0x4e00520045004b
cmp qword [rax], rcx
je 0x180006ece
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x60]
movabs rcx, 0x6e00720065006b
cmp qword [rax], rcx
jne 0x180006ed9
mov rax, qword [rsp + 8]
mov rax, qword [rax + 0x30]
jmp 0x180006edd
jmp 0x180006e69
xor eax, eax
add rsp, 0x28
ret

Function at 0x180007a40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1800063b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x48
ret
Function at 0x18000a640
Capabilities:
Create directory
Delete directory
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2f0
lea rax, [rsp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.1800055d0
nop
lea rcx, [rsp + 0x50]
call fcn.1800055d0
nop
lea rcx, [rsp + 0x90]
call fcn.1800055d0
nop
lea rcx, [rsp + 0x70]
call fcn.1800055d0
nop
lea rdx, [rsp + 0xd0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.180005c40
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, 0xa
lea rdx, [rsp + 0x1e0]
mov ecx, eax
call fcn.18000aee0
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800061b0
lea rcx, [rsp + 0x20]
call fcn.180009640
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.180005ba0
lea rdx, str....._
lea rcx, [rsp + 0x50]
call fcn.1800061b0
lea rcx, [rsp + 0x50]
call fcn.180009640
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x90]
call fcn.180005ba0
lea rdx, str.....TemporaryFile
lea rcx, [rsp + 0x90]
call fcn.1800061b0
lea rcx, [rsp + 0x90]
call fcn.180009640
mov rdx, rax
mov rcx, qword [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.180005ba0
lea rdx, str.TemporaryFile
lea rcx, [rsp + 0x70]
call fcn.1800061b0
lea rcx, [rsp + 0x70]
call fcn.180009640
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.180009640
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, [rsp + 0x20]
call fcn.180009640
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
lea rcx, [rsp + 0x70]
call fcn.180005ad0
nop
lea rcx, [rsp + 0x90]
call fcn.180005ad0
nop
lea rcx, [rsp + 0x50]
call fcn.180005ad0
nop
lea rcx, [rsp + 0x20]
call fcn.180005ad0
nop
add rsp, 0x2f0
pop rdi
ret
Function at 0x18008c27e
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x1800b6e18]
syscall
ret
Function at 0x140003be0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x140003c47
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140003c4c
cmp r14, rdi
jne 0x140003c28
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x140003cbe
lea rcx, vtable.std::_Func_impl_no_alloc_long_int____cdecl___struct_HWND______ptr64__int__void____ptr64__unsigned_long_int__char____ptr64___long_int__struct_HWND______ptr64__int__void____ptr64__unsigned_long_int__char____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140003d0e
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140003d0a
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140003d0e
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140003d0e
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140003d1b
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140004850
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov r11d, r8d
cmp r8d, 4
jl 0x140004890
mov r10d, r8d
shr r10, 2
mov eax, r10d
neg eax
lea r8d, [r8 + rax*4]
imul eax, dword [rdx], 0x5bd1e995
add rdx, 4
imul r9d, r9d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r9d, ecx
sub r10, 1
jne 0x140004869
xor ecx, ecx
sub r8d, 1
je 0x1400048b4
sub r8d, 1
je 0x1400048ab
cmp r8d, 1
jne 0x1400048b9
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [rdx]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
imul r8d, r11d, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor ecx, eax
mov eax, r8d
shr eax, 0x18
xor eax, r8d
imul edx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor edx, eax
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret
Function at 0x140004908
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rdx + 0x3c]
or esi, 0xffffffff
xor edi, edi
mov r13d, r9d
mov rbx, rdx
mov r14d, dword [rax + rdx + 0x88]
add r14, rdx
mov ebp, dword [r14 + 0x20]
mov r15d, dword [r14 + 0x24]
add rbp, rdx
mov r12d, dword [r14 + 0x18]
add r15, rdx
sub r12d, 1
je 0x140004985
mov edx, dword [rbp]
mov r8d, r13d
mov r9d, dword [rsp + 0x70]
add rdx, rbx
call fcn.140004850
cmp dword [rsp + 0x60], eax
je 0x140004980
inc edi
add rbp, 4
cmp edi, r12d
jb 0x14000495a
jmp 0x140004985
movzx esi, word [r15 + rdi*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
cmp esi, ecx
jbe 0x140004994
xor eax, eax
jmp 0x14000499a
mov eax, dword [rcx + rsi*4]
add rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140008e84
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x140008eeb
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140008ef0
cmp r14, rdi
jne 0x140008ecc
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x140008f62
lea rcx, [0x1400b4430]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140008fb2
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140008fae
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140008fb2
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140008fb2
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140008fbf
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140008fdc
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x140009043
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009048
cmp r14, rdi
jne 0x140009024
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x1400090ba
lea rcx, [0x1400b42b8]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x14000910a
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140009106
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000910a
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x14000910a
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140009117
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140009134
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x14000919b
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400091a0
cmp r14, rdi
jne 0x14000917c
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x140009212
lea rcx, vtable.std::_Func_impl_no_alloc_long_int____cdecl___void____ptr64____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__unsigned_long_int___long_int__void____ptr64____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__unsigned_long_int_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140009262
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x14000925e
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140009262
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140009262
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000926f
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000928c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x1400092f3
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400092f8
cmp r14, rdi
jne 0x1400092d4
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x14000936a
lea rcx, [0x1400b43c0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x1400093ba
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x1400093b6
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400093ba
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x1400093ba
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x1400093c7
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400093e4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x14000944b
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009450
cmp r14, rdi
jne 0x14000942c
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x1400094c2
lea rcx, [0x1400b43f8]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140009512
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x14000950e
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140009512
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140009512
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000951f
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000953c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x1400095a3
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400095a8
cmp r14, rdi
jne 0x140009584
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x14000961a
lea rcx, [0x1400b44a0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x14000966a
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140009666
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000966a
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x14000966a
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140009677
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140009694
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x1400096fb
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009700
cmp r14, rdi
jne 0x1400096dc
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x140009772
lea rcx, [0x1400b4388]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x1400097c2
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x1400097be
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400097c2
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x1400097c2
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x1400097cf
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400097ec
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x80
mov rbx, rdx
mov rsi, rcx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.140004850
mov r15d, eax
mov r8, qword gs:[0x60]
mov rdx, qword [r8 + 0x18]
mov r14, qword [rdx + 0x18]
mov rdi, r14
mov rdi, qword [rdi]
cmp qword [rdi + 0x30], 0
je 0x140009853
lea rdx, [0x1400b3bb0]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140009858
cmp r14, rdi
jne 0x140009834
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400b3bd0]
call fcn.140004850
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rdi + 0x30]
call fcn.140004908
mov rcx, qword [rsi + 8]
call rax
mov ecx, dword [rsi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.140004908
and qword [rsp + 0x78], 0
test rax, rax
je 0x1400098ca
lea rcx, vtable.std::_Func_impl_no_alloc_unsigned_long_int____cdecl___void____ptr64__unsigned_long_int____ptr64___unsigned_long_int__void____ptr64__unsigned_long_int____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg rax
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x14000991a
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140009916
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000991a
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x14000991a
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140009927
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret