joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018e40
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018ea2
xor eax, eax
jmp 0x140019020
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140018eee
xor eax, eax
jmp 0x140019020
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018f25
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140018f4d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140018fb6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001901e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0x3546aa24
jne 0x14001901c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140019020
jmp 0x140018fa9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140019030
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019092
xor eax, eax
jmp 0x140019210
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1400190de
xor eax, eax
jmp 0x140019210
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019115
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14001913d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x1400191a6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001920e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xd8133d9d
jne 0x14001920c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140019210
jmp 0x140019199
xor eax, eax
add rsp, 0x78
ret
Function at 0x140019790
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400197f2
xor eax, eax
jmp 0x140019970
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14001983e
xor eax, eax
jmp 0x140019970
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019875
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14001989d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140019906
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001996e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xa623a735
jne 0x14001996c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140019970
jmp 0x1400198f9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140019980
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400199e2
xor eax, eax
jmp 0x140019b60
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140019a2e
xor eax, eax
jmp 0x140019b60
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019a65
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140019a8d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140019af6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x140019b5e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xb63ca8f7
jne 0x140019b5c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140019b60
jmp 0x140019ae9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140019b70
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019bd2
xor eax, eax
jmp 0x140019d50
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140019c1e
xor eax, eax
jmp 0x140019d50
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019c55
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140019c7d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140019ce6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x140019d4e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xec608ae5
jne 0x140019d4c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140019d50
jmp 0x140019cd9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140019d60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019dc2
xor eax, eax
jmp 0x140019f40
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140019e0e
xor eax, eax
jmp 0x140019f40
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019e45
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140019e6d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x140019ed6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x140019f3e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0x2b68792f
jne 0x140019f3c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140019f40
jmp 0x140019ec9
xor eax, eax
add rsp, 0x78
ret
Function at 0x140019f50
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019fb2
xor eax, eax
jmp 0x14001a130
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x140019ffe
xor eax, eax
jmp 0x14001a130
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001a035
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14001a05d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14001a0c6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001a12e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0x60f680f
jne 0x14001a12c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14001a130
jmp 0x14001a0b9
xor eax, eax
add rsp, 0x78
ret
Function at 0x14001a300
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a362
xor eax, eax
jmp 0x14001a4e0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14001a3ae
xor eax, eax
jmp 0x14001a4e0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001a3e5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14001a40d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14001a476
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001a4de
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0xb4831b16
jne 0x14001a4dc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14001a4e0
jmp 0x14001a469
xor eax, eax
add rsp, 0x78
ret
Function at 0x14001a4f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a552
xor eax, eax
jmp 0x14001a6d0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14001a59e
xor eax, eax
jmp 0x14001a6d0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001a5d5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14001a5fd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14001a666
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14001a6ce
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140013bd0
cmp eax, 0x6a12920e
jne 0x14001a6cc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14001a6d0
jmp 0x14001a659
xor eax, eax
add rsp, 0x78
ret

Function at 0x14001c258
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c2a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c2a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c2a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c2a2
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c2a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001c2a4
xor al, al
add rsp, 0x28
ret