joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400085e0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x1400086d7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000868f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000868f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x140008687
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140008670
cmp eax, 0xd034fc62
je 0x1400086ae
inc r8d
cmp r8d, r10d
jb 0x140008650
mov r11, qword [r11]
cmp r11, r14
jne 0x140008620
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x1400086e0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x1400087d7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000878f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000878f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x140008787
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140008770
cmp eax, 0xca8d7527
je 0x1400087ae
inc r8d
cmp r8d, r10d
jb 0x140008750
mov r11, qword [r11]
cmp r11, r14
jne 0x140008720
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x140008a30
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
inc qword [0x140945930]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
nop dword [rax]
cmp rbx, rdi
je 0x140008af6
mov r9, qword [rbx + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
jne 0x140008a82
mov rbx, qword [rbx]
jmp 0x140008a60
lea r10, [r9 + rcx]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
cmp r8d, dword [r10 + 0x18]
jae 0x140008aee
mov ecx, dword [r10 + 0x20]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
mov qword [rsp + 0x28], rax
mov ecx, 0x1505
nop dword [rax]
movsx edx, byte [rax]
inc rax
mov qword [rsp + 0x28], rax
test edx, edx
je 0x140008ac6
imul ecx, ecx, 0x21
add ecx, edx
jmp 0x140008ab0
cmp ecx, 0x8b8e133d
jne 0x140008ae9
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140008afb
inc r8d
jmp 0x140008a89
mov rbx, qword [rbx]
jmp 0x140008a60
mov rax, qword [rsp + 0x40]
mov ecx, 0x99999999
call rax
nop
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140008b20
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140008bd6
mov r9, qword [rbx + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
jne 0x140008b64
mov rbx, qword [rbx]
jmp 0x140008b42
lea r10, [r9 + rcx]
xor r8d, r8d
mov dword [rsp + 0x20], r8d
cmp r8d, dword [r10 + 0x18]
jae 0x140008bce
mov ecx, dword [r10 + 0x20]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
mov qword [rsp + 0x28], rax
mov ecx, 0x1505
nop
movsx edx, byte [rax]
inc rax
mov qword [rsp + 0x28], rax
test edx, edx
je 0x140008ba6
imul ecx, ecx, 0x21
add ecx, edx
jmp 0x140008b90
cmp ecx, 0x3870ca07
jne 0x140008bc9
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140008bdb
inc r8d
jmp 0x140008b6b
mov rbx, qword [rbx]
jmp 0x140008b42
mov rax, qword [rsp + 0x40]
mov ecx, 0x99999999
call rax
nop
inc qword [0x140945930]
call fcn.140008a30
test eax, eax
setne al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140008c60
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x140008d57
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x140008d0f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x140008d0f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x140008d07
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140008cf0
cmp eax, 0x6fa1320d
je 0x140008d2e
inc r8d
cmp r8d, r10d
jb 0x140008cd0
mov r11, qword [r11]
cmp r11, r14
jne 0x140008ca0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x140008d60
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x140008e57
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x140008e0f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x140008e0f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x140008e07
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140008df0
cmp eax, 0x70ea2e03
je 0x140008e2e
inc r8d
cmp r8d, r10d
jb 0x140008dd0
mov r11, qword [r11]
cmp r11, r14
jne 0x140008da0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x140008e60
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x140008f57
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x140008f0f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x140008f0f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x140008f07
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140008ef0
cmp eax, 0x3870ca07
je 0x140008f2e
inc r8d
cmp r8d, r10d
jb 0x140008ed0
mov r11, qword [r11]
cmp r11, r14
jne 0x140008ea0
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x1400096c0
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x1400097b7
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000976f
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000976f
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x140009767
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140009750
cmp eax, 0xe19e5fe
je 0x14000978e
inc r8d
cmp r8d, r10d
jb 0x140009730
mov r11, qword [r11]
cmp r11, r14
jne 0x140009700
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x140009810
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x140009907
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x1400098bf
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x1400098bf
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x1400098b7
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1400098a0
cmp eax, 0xa570578a
je 0x1400098de
inc r8d
cmp r8d, r10d
jb 0x140009880
mov r11, qword [r11]
cmp r11, r14
jne 0x140009850
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x140009910
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x140009a07
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x1400099bf
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x1400099bf
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x1400099b7
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1400099a0
cmp eax, 0x27b8f3c7
je 0x1400099de
inc r8d
cmp r8d, r10d
jb 0x140009980
mov r11, qword [r11]
cmp r11, r14
jne 0x140009950
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x140009a10
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x140009b07
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x140009abf
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x140009abf
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x140009ab7
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140009aa0
cmp eax, 0x668fcf2e
je 0x140009ade
inc r8d
cmp r8d, r10d
jb 0x140009a80
mov r11, qword [r11]
cmp r11, r14
jne 0x140009a50
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000c310
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000c407
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000c3bf
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000c3bf
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000c3b7
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000c3a0
cmp eax, 0x6f22e8c8
je 0x14000c3de
inc r8d
cmp r8d, r10d
jb 0x14000c380
mov r11, qword [r11]
cmp r11, r14
jne 0x14000c350
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000c410
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000c507
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000c4bf
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000c4bf
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000c4b7
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000c4a0
cmp eax, 0xe21026f9
je 0x14000c4de
inc r8d
cmp r8d, r10d
jb 0x14000c480
mov r11, qword [r11]
cmp r11, r14
jne 0x14000c450
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x14000c510
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000c607
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000c5bf
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000c5bf
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000c5b7
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000c5a0
cmp eax, 0xb8932459
je 0x14000c5de
inc r8d
cmp r8d, r10d
jb 0x14000c580
mov r11, qword [r11]
cmp r11, r14
jne 0x14000c550
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret

Function at 0x14000c610
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push r14
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov r11, qword [r14]
cmp r11, r14
je 0x14000c707
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
nop word [rax + rax]
mov r9, qword [r11 + 0x20]
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x14000c6bf
mov r10d, dword [r9 + rcx + 0x18]
lea rdi, [r9 + rcx]
xor r8d, r8d
test r10d, r10d
je 0x14000c6bf
mov esi, dword [rdi + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r8*4]
mov ecx, dword [rax + r9]
mov eax, 0x1505
add rcx, r9
movsx edx, byte [rcx]
test edx, edx
je 0x14000c6b7
nop word [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000c6a0
cmp eax, 0xd812922a
je 0x14000c6de
inc r8d
cmp r8d, r10d
jb 0x14000c680
mov r11, qword [r11]
cmp r11, r14
jne 0x14000c650
mov rax, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [rdi + 0x24]
mov rsi, qword [rsp + 0x20]
add rcx, r9
mov rbx, qword [rsp + 0x18]
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
mov rdi, qword [rsp + 0x28]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
pop r14
ret
mov rax, qword [rsp + 0x10]
pop r14
ret
Function at 0x140010460
Capabilities:
Access peb ldr_data
Hash data using djb2
Resolve function by djb2 hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x48], 0xe19e5fe
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
jmp 0x1400104b1
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x20], rax
je 0x14001060a
mov rax, qword [rsp + 0x20]
sub rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0
mov eax, dword [rax + rcx + 0x88]
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0
jne 0x14001050e
jmp 0x1400104a4
mov eax, dword [rsp + 0x18]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp], 0
jmp 0x140010533
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp], eax
jae 0x140010605
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x20]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x14], 0x1505
mov dword [rsp + 0x10], 0
mov rax, qword [rsp + 0x38]
movsx eax, byte [rax]
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp dword [rsp + 0x30], 0
je 0x1400105b4
imul eax, dword [rsp + 0x14], 0x21
add eax, dword [rsp + 0x10]
mov dword [rsp + 0x14], eax
jmp 0x14001057d
cmp dword [rsp + 0x14], 0xe19e5fe
jne 0x140010600
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x24]
mov rdx, qword [rsp + 8]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x14001060a
jmp 0x14001052b
jmp 0x1400104a4
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret