joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f6bc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140035498
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140035498
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14003f80c
cmp rax, 0xffffffffffffffff
je 0x14003f80c
xor edi, edi
test rbp, rbp
jle 0x14003f7b7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14002edd4
mov rbx, rax
test rax, rax
jne 0x14003f744
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14003f7ad
mov edx, 0x8000
mov ecx, r14d
call fcn.14002aa1c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140033524
cmp eax, 0xffffffff
je 0x14003f78d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14003f754
mov edx, r15d
mov ecx, r14d
call fcn.14002aa1c
jmp 0x14003f7ad
cmp byte [rsi + 0x38], dil
je 0x14003f7a4
cmp dword [rsi + 0x34], 5
jne 0x14003f7a4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14003f7ad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14002ee4c
jmp 0x14003f820
jns 0x14003f820
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140035498
cmp rax, 0xffffffffffffffff
jne 0x14003f7d8
cmp byte [rsi + 0x30], dil
je 0x14003f820
mov edi, dword [rsi + 0x2c]
jmp 0x14003f820
mov ecx, r14d
call fcn.140032aec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14003f820
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14003f820
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14003f819
mov eax, dword [rsi + 0x2c]
jmp 0x14003f81e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140035498
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400291bc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c7b4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c7b4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002930c
cmp rax, 0xffffffffffffffff
je 0x14002930c
xor edi, edi
test rbp, rbp
jle 0x1400292b7
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f0c8
mov rbx, rax
test rax, rax
jne 0x140029244
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400292ad
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a0e8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d490
cmp eax, 0xffffffff
je 0x14002928d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140029254
mov edx, r15d
mov ecx, r14d
call fcn.14001a0e8
jmp 0x1400292ad
cmp byte [rsi + 0x38], dil
je 0x1400292a4
cmp dword [rsi + 0x34], 5
jne 0x1400292a4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400292ad
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001ae7c
jmp 0x140029320
jns 0x140029320
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c7b4
cmp rax, 0xffffffffffffffff
jne 0x1400292d8
cmp byte [rsi + 0x30], dil
je 0x140029320
mov edi, dword [rsi + 0x2c]
jmp 0x140029320
mov ecx, r14d
call fcn.1400185a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029320
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029320
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029319
mov eax, dword [rsi + 0x2c]
jmp 0x14002931e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c7b4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1405ee1e4
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1405ee20d
pop rbp
sub rbp, 0x29
sub rbp, 0x5ee1e4
jmp 0x1405ee26d
sub rsp, 0x20
jmp 0x1405ee27d
mov rax, 0x5ee1e4
add rax, rbp
add rax, 0xcb
mov rcx, 0x64a
mov rdx, 0xffffffffbc96a9c7
xor byte [rax], dl
inc rax
dec rcx
jne 0x1405ee29c
jmp 0x1405ee2b3
invalid
Function at 0x1406636f0
Capabilities:
Encode data using xor

Disassembly:
not rdi
mov rdi, qword [rsp + rdi*2 + 0xfc]
call fcn.14069580d
mov rcx, qword [rbx]
mov ebp, 0xfaa15d04
sar bp, 0x25
mov rbp, qword [rbx + 8]
push 0x74320492
adc rbx, 0xc
xor r8d, r8d
test rbp, rbp
lea rsp, [rsp + 8]
je 0x14066378f
mov edx, 0xd2af1c2b
dec dx
push r9
lea r9, [0x1406a1bf0]
mov edx, 0x282acbf
movzx edx, byte [rcx + rdx*2 - 0x505597e]
push 0xffffffffa9af3e30
xor edx, r8d
and edx, 0xff
mov edx, dword [r9 + rdx*4]
shr r8d, 8
xor r8d, edx
inc rcx
xor r8d, 0xf7ab549b
shr dword [rsp + 2], 0xce
sar word [rsp + 3], 0x6d
dec rbp
lea rsp, [rsp + 8]
jne 0x14066373e
mov r9d, 0x6bbaa5aa
pop r9
call fcn.1406969b9

Function at 0x140003ae0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003b14
cmp word [rcx], 0x5a4d
jne 0x140003b14
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003b14
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003b14
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003a20
test eax, eax
jne 0x140003b30
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003a90
test rax, rax
je 0x140003b25
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.1400042dc
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x1400041e0
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004180
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004d90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004db3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004db3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004e61
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1428101d0]
mov r8, rcx
mov rcx, r9
call fcn.140004d90
test eax, eax
je 0x140004e8d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004db4
xor eax, eax
add rsp, 0x28
ret
Function at 0x180001360
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
test ebx, ebx
je 0x1800013c6
cmp ebx, 1
jne 0x1800013e3
lea rcx, [0x180001180]
call fcn.180001834
xor eax, eax
lea r8, [0x1800011a0]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, rdi
mov qword [0x1800056d0], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp byte [0x180005034], 0
je 0x1800013d6
mov byte [0x180005034], 0
mov rcx, qword [0x1800056d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x18001b058
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadResource]
test rax, rax
je 0x18001b0cf
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18001b0cf
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18001b0bc
cmp rbx, rcx
jae 0x18001b0cf
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18001b0a7
cmp rbx, rcx
jae 0x18001b0cf
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x18001b0d1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180024798
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
sub rsp, 0x58
lea rbx, [rax + 0x18]
mov rdi, rcx
mov qword [rax - 0x28], rbx
mov rax, qword [0x180044f08]
movabs r10, 0xb1a8ae8f5a5da170
mov rax, qword [rax + 0x18]
lea rcx, [0x180044f08]
call qword [case.0x18001e99a.40]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x38]
add rax, 0x18
mov r8, rbx
mov qword [rsp + 0x38], rax
call fcn.18002329c
mov rbx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov rdx, rbx
and qword [rsp + 0x20], 0
mov r8d, dword [rbx - 0x10]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_WriteFile]
test eax, eax
jne 0x18002481f
call fcn.180007b20
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18002484a
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x18001e99a.40]
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180026178
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x228
mov r9, r8
movsxd rax, dword [rcx + 0x3c]
mov r8d, edx
mov rdi, rcx
mov esi, r8d
mov rbp, r9
mov r10d, dword [rax + rcx + 0x88]
mov edx, dword [r10 + rcx + 0x20]
mov eax, dword [r10 + rcx + 0x1c]
add rdx, rcx
mov r11d, dword [r10 + rcx + 0x24]
add rax, rcx
add r11, rcx
xor r10d, r10d
mov r13, rax
mov r12, rdx
mov rbx, r10
mov r14, r11
jmp 0x1800261d2
inc rbx
mov edx, 0x208
lea rcx, [rsp + 0x20]
mov r15d, dword [r12 + rbx*4]
add r15, rdi
call fcn.180026398
mov rcx, r15
call fcn.1800258d8
mov r8d, eax
test eax, eax
je 0x1800262ed
cmp eax, 6
jbe 0x180026288
mov r10d, eax
lea r9, [rsp + r10*2 + 0x20]
lea rdx, [r15 + r10]
sub r9, rdx
lea rcx, [r10 + r10]
cmp r9, rcx
jg 0x180026224
neg r9
cmp r9, r10
jle 0x180026288
mov r10d, eax
xor r9d, r9d
mov ecx, 1
xor r8d, r8d
shr r10d, 1
je 0x180026266
inc r9d
lea edx, [rax + r8]
movsx ecx, byte [rdx + r15]
lea r11d, [rax + r8 - 1]
mov word [rsp + rdx*2 + 0x20], cx
add r8d, 0xfffffffe
movsx edx, byte [r11 + r15]
mov word [rsp + r11*2 + 0x20], dx
cmp r9d, r10d
jb 0x180026237
lea ecx, [r9 + r9 + 1]
lea edx, [rcx - 1]
cmp edx, eax
jae 0x18002627d
neg ecx
add ecx, eax
inc ecx
movsx edx, byte [rcx + r15]
mov word [rsp + rcx*2 + 0x20], dx
lea edx, [rax + 1]
sub eax, edx
lea r8d, [rax + 1]
jmp 0x1800262ed
mov r11d, eax
xor r10d, r10d
mov ecx, 1
xor r9d, r9d
shr r11d, 1
je 0x1800262d4
inc r10d
lea edx, [rax + r9]
movsx ecx, byte [rdx + r15]
lea r8d, [rax + r9 - 1]
mov word [rsp + rdx*2 + 0x20], cx
add r9d, 0xfffffffe
movsx edx, byte [r8 + r15]
mov word [rsp + r8*2 + 0x20], dx
cmp r10d, r11d
jb 0x18002629b
lea r8d, [r10 + r10]
neg r8d
lea ecx, [r10 + r10 + 1]
add r8d, eax
lea edx, [rcx - 1]
cmp edx, eax
jae 0x1800262ed
sub eax, ecx
mov r8d, eax
lea edx, [rax + 1]
movsx ecx, byte [rdx + r15]
mov word [rsp + rdx*2 + 0x20], cx
lea rcx, [rsp + 0x20]
movsx r15d, byte [r8 + r15]
mov word [rsp + r8*2 + 0x20], r15w
call fcn.180025915
xor r11d, r11d
test eax, eax
jbe 0x180026367
mov r8d, eax
mov edx, 1
mov r9d, dword [rbp + 0x118]
xor r10d, r10d
shr r8d, 1
je 0x18002634e
imul r11d, r9d
lea r15d, [r10 + r10]
movsxd r15, r15d
inc r10d
movzx edx, word [rsp + r15*2 + 0x20]
add r11d, edx
imul r11d, r9d
movzx r15d, word [rsp + r15*2 + 0x22]
add r11d, r15d
cmp r10d, r8d
jb 0x180026320
lea edx, [r10 + r10 + 1]
lea r15d, [rdx - 1]
cmp r15d, eax
jae 0x180026367
imul r9d, r11d
movsxd rdx, edx
movzx r11d, word [rsp + rdx*2 + 0x1e]
add r11d, r9d
movzx r15d, word [r14 + rbx*2]
mov eax, dword [r13 + r15*4]
add rax, rdi
cmp esi, r11d
jne 0x1800261cf
add rsp, 0x228
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800263f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rax]
mov rsi, qword [rax + 0x60]
test rsi, rsi
invalid
je 0x1800263ef
test edx, edx
je 0x180026448
movzx r10d, word [rsi]
mov ebx, r9d
xor ecx, ecx
test r10d, r10d
je 0x180026438
movzx r11d, word [rsi + rcx*2]
cmp r11d, 0x41
jl 0x180026424
cmp r11d, 0x5a
lea r10d, [r11 + 0x20]
cmovle r11d, r10d
inc rcx
movzx r10d, r11w
add ebx, r10d
movzx r11d, word [rsi + rcx*2]
test r11d, r11d
jne 0x18002640d
nop dword [rax + rax]
nop dword [rax]
cmp edx, ebx
jne 0x1800263ef
mov r15, qword [rax + 0x30]
mov eax, 0x60
mov edx, dword [rdi + 0xe8]
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
xor r10d, r10d
add rax, 0x10
mov rax, qword [rax]
mov r9, qword [rax + 0x60]
test r9, r9
je 0x180026466
test edx, edx
je 0x1800264c0
movzx r11d, word [r9]
mov esi, r10d
xor ebx, ebx
test r11d, r11d
je 0x1800264b0
movzx r12d, word [r9 + rbx*2]
cmp r12d, 0x41
jl 0x18002649c
cmp r12d, 0x5a
lea r11d, [r12 + 0x20]
cmovle r12d, r11d
inc rbx
movzx r11d, r12w
add esi, r11d
movzx r12d, word [r9 + rbx*2]
test r12d, r12d
jne 0x180026484
nop dword [rax + rax]
nop dword [rax]
cmp edx, esi
jne 0x180026466
mov r14, qword [rax + 0x30]
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x98]
call fcn.180026178
mov qword [rsp + 0x878], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x108]
call fcn.180026178
mov r13, rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xf0]
call fcn.180026178
mov qword [rsp + 0x888], rax
mov rcx, r14
mov r8, rdi
mov edx, dword [rdi + 8]
call fcn.180026178
mov qword [rsp + 0x890], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x114]
call fcn.180026178
mov qword [rsp + 0x898], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xd8]
call fcn.180026178
mov rsi, rax
mov rcx, r14
mov r8, rdi
mov edx, dword [rdi + 0x134]
call fcn.180026178
mov qword [rsp + 0x8a8], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x11c]
call fcn.180026178
mov qword [rsp + 0x8b0], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x34]
call fcn.180026178
mov qword [rsp + 0x8b8], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xbc]
call fcn.180026178
mov r12, rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x80]
call fcn.180026178
mov qword [rsp + 0x8c0], rax
movsxd rax, dword [r15 + 0x3c]
mov edx, dword [rdi + 0x6c]
mov qword [rsp + 0x8a0], rsi
mov ebx, dword [rax + r15 + 0x88]
mov qword [rsp + 0x880], r13
mov r13d, edx
mov qword [rsp + 0x870], r14
mov eax, dword [rbx + r15 + 0x20]
xor ebx, ebx
add rax, r15
mov qword [rsp + 0x40], rbp
mov rsi, rax
xor ebp, ebp
jmp 0x180026605
Function at 0x180026438
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rax]
mov rsi, qword [rax + 0x60]
test rsi, rsi
invalid
je 0x1800263ef
test edx, edx
je 0x180026448
movzx r10d, word [rsi]
mov ebx, r9d
xor ecx, ecx
test r10d, r10d
je 0x180026438
movzx r11d, word [rsi + rcx*2]
cmp r11d, 0x41
jl 0x180026424
cmp r11d, 0x5a
lea r10d, [r11 + 0x20]
cmovle r11d, r10d
inc rcx
movzx r10d, r11w
add ebx, r10d
movzx r11d, word [rsi + rcx*2]
test r11d, r11d
jne 0x18002640d
nop dword [rax + rax]
nop dword [rax]
cmp edx, ebx
jne 0x1800263ef
mov r15, qword [rax + 0x30]
mov eax, 0x60
mov edx, dword [rdi + 0xe8]
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
xor r10d, r10d
add rax, 0x10
mov rax, qword [rax]
mov r9, qword [rax + 0x60]
test r9, r9
je 0x180026466
test edx, edx
je 0x1800264c0
movzx r11d, word [r9]
mov esi, r10d
xor ebx, ebx
test r11d, r11d
je 0x1800264b0
movzx r12d, word [r9 + rbx*2]
cmp r12d, 0x41
jl 0x18002649c
cmp r12d, 0x5a
lea r11d, [r12 + 0x20]
cmovle r12d, r11d
inc rbx
movzx r11d, r12w
add esi, r11d
movzx r12d, word [r9 + rbx*2]
test r12d, r12d
jne 0x180026484
nop dword [rax + rax]
nop dword [rax]
cmp edx, esi
jne 0x180026466
mov r14, qword [rax + 0x30]
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x98]
call fcn.180026178
mov qword [rsp + 0x878], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x108]
call fcn.180026178
mov r13, rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xf0]
call fcn.180026178
mov qword [rsp + 0x888], rax
mov rcx, r14
mov r8, rdi
mov edx, dword [rdi + 8]
call fcn.180026178
mov qword [rsp + 0x890], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x114]
call fcn.180026178
mov qword [rsp + 0x898], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xd8]
call fcn.180026178
mov rsi, rax
mov rcx, r14
mov r8, rdi
mov edx, dword [rdi + 0x134]
call fcn.180026178
mov qword [rsp + 0x8a8], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x11c]
call fcn.180026178
mov qword [rsp + 0x8b0], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x34]
call fcn.180026178
mov qword [rsp + 0x8b8], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xbc]
call fcn.180026178
mov r12, rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x80]
call fcn.180026178
mov qword [rsp + 0x8c0], rax
movsxd rax, dword [r15 + 0x3c]
mov edx, dword [rdi + 0x6c]
mov qword [rsp + 0x8a0], rsi
mov ebx, dword [rax + r15 + 0x88]
mov qword [rsp + 0x880], r13
mov r13d, edx
mov qword [rsp + 0x870], r14
mov eax, dword [rbx + r15 + 0x20]
xor ebx, ebx
add rax, r15
mov qword [rsp + 0x40], rbp
mov rsi, rax
xor ebp, ebp
jmp 0x180026605
Function at 0x180026600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rax]
mov rsi, qword [rax + 0x60]
test rsi, rsi
invalid
je 0x1800263ef
test edx, edx
je 0x180026448
movzx r10d, word [rsi]
mov ebx, r9d
xor ecx, ecx
test r10d, r10d
je 0x180026438
movzx r11d, word [rsi + rcx*2]
cmp r11d, 0x41
jl 0x180026424
cmp r11d, 0x5a
lea r10d, [r11 + 0x20]
cmovle r11d, r10d
inc rcx
movzx r10d, r11w
add ebx, r10d
movzx r11d, word [rsi + rcx*2]
test r11d, r11d
jne 0x18002640d
nop dword [rax + rax]
nop dword [rax]
cmp edx, ebx
jne 0x1800263ef
mov r15, qword [rax + 0x30]
mov eax, 0x60
mov edx, dword [rdi + 0xe8]
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
xor r10d, r10d
add rax, 0x10
mov rax, qword [rax]
mov r9, qword [rax + 0x60]
test r9, r9
je 0x180026466
test edx, edx
je 0x1800264c0
movzx r11d, word [r9]
mov esi, r10d
xor ebx, ebx
test r11d, r11d
je 0x1800264b0
movzx r12d, word [r9 + rbx*2]
cmp r12d, 0x41
jl 0x18002649c
cmp r12d, 0x5a
lea r11d, [r12 + 0x20]
cmovle r12d, r11d
inc rbx
movzx r11d, r12w
add esi, r11d
movzx r12d, word [r9 + rbx*2]
test r12d, r12d
jne 0x180026484
nop dword [rax + rax]
nop dword [rax]
cmp edx, esi
jne 0x180026466
mov r14, qword [rax + 0x30]
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x98]
call fcn.180026178
mov qword [rsp + 0x878], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x108]
call fcn.180026178
mov r13, rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xf0]
call fcn.180026178
mov qword [rsp + 0x888], rax
mov rcx, r14
mov r8, rdi
mov edx, dword [rdi + 8]
call fcn.180026178
mov qword [rsp + 0x890], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x114]
call fcn.180026178
mov qword [rsp + 0x898], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xd8]
call fcn.180026178
mov rsi, rax
mov rcx, r14
mov r8, rdi
mov edx, dword [rdi + 0x134]
call fcn.180026178
mov qword [rsp + 0x8a8], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x11c]
call fcn.180026178
mov qword [rsp + 0x8b0], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x34]
call fcn.180026178
mov qword [rsp + 0x8b8], rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0xbc]
call fcn.180026178
mov r12, rax
mov rcx, r15
mov r8, rdi
mov edx, dword [rdi + 0x80]
call fcn.180026178
mov qword [rsp + 0x8c0], rax
movsxd rax, dword [r15 + 0x3c]
mov edx, dword [rdi + 0x6c]
mov qword [rsp + 0x8a0], rsi
mov ebx, dword [rax + r15 + 0x88]
mov qword [rsp + 0x880], r13
mov r13d, edx
mov qword [rsp + 0x870], r14
mov eax, dword [rbx + r15 + 0x20]
xor ebx, ebx
add rax, r15
mov qword [rsp + 0x40], rbp
mov rsi, rax
xor ebp, ebp
jmp 0x180026605
Function at 0x180026680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc rbx
mov edx, 0x208
lea rcx, [rsp + 0x50]
mov r14d, dword [rsi + rbx*4]
add r14, r15
call fcn.180026398
mov rcx, r14
call fcn.1800258d8
mov edx, eax
test eax, eax
je 0x180026727
cmp eax, 6
jbe 0x1800266c1
mov ecx, eax
lea r11, [rsp + rcx*2 + 0x50]
lea r9, [r14 + rcx]
sub r11, r9
lea r10, [rcx + rcx]
cmp r11, r10
jg 0x180026655
neg r11
cmp r11, rcx
jle 0x1800266c1
mov r10d, eax
mov r9d, ebp
mov r11d, 1
mov edx, r9d
shr r10d, 1
je 0x180026698
inc r9d
lea r11d, [rax + rdx]
movsx ecx, byte [r11 + r14]
mov word [rsp + r11*2 + 0x50], cx
lea r11d, [rax + rdx - 1]
movsx r8d, byte [r11 + r14]
add edx, 0xfffffffe
mov word [rsp + r11*2 + 0x50], r8w
cmp r9d, r10d
jb 0x180026669
lea r11d, [r9 + r9 + 1]
lea r9d, [r11 - 1]
cmp r9d, eax
jae 0x1800266b5
neg r11d
add r11d, eax
inc r11d
movsx r9d, byte [r11 + r14]
mov word [rsp + r11*2 + 0x50], r9w
push rax
push rax
lea r9d, [rax + 1]
sub eax, r9d
lea edx, [rax + 1]
jmp 0x180026727
mov r11d, eax
mov r10d, ebp
mov ecx, 1
mov r9d, r10d
shr r11d, 1
je 0x18002670b
inc r10d
lea edx, [rax + r9]
movsx ecx, byte [rdx + r14]
lea r8d, [rax + r9 - 1]
mov word [rsp + rdx*2 + 0x50], cx
add r9d, 0xfffffffe
movsx edx, byte [r8 + r14]
mov word [rsp + r8*2 + 0x50], dx
cmp r10d, r11d
jb 0x1800266d4
lea edx, [r10 + r10]
neg edx
lea ecx, [r10 + r10 + 1]
add edx, eax
lea r9d, [rcx - 1]
cmp r9d, eax
jae 0x180026727
sub eax, ecx
mov edx, eax
lea r9d, [rax + 1]
movsx r10d, byte [r9 + r14]
mov word [rsp + r9*2 + 0x50], r10w
lea rcx, [rsp + 0x50]
movsx r14d, byte [rdx + r14]
mov word [rsp + rdx*2 + 0x50], r14w
call fcn.180025915
mov r11d, eax
mov r9d, ebp
test r11d, r11d
jbe 0x1800267a4
mov eax, r11d
mov r14d, 1
mov edx, dword [rdi + 0x118]
mov r10d, ebp
shr eax, 1
je 0x18002678b
imul r9d, edx
lea r14d, [r10 + r10]
movsxd r14, r14d
inc r10d
movzx ecx, word [rsp + r14*2 + 0x50]
add r9d, ecx
imul r9d, edx
movzx r14d, word [rsp + r14*2 + 0x52]
add r9d, r14d
cmp r10d, eax
jb 0x18002675d
lea r14d, [r10 + r10 + 1]
lea r10d, [r14 - 1]
cmp r10d, r11d
jae 0x1800267a4
imul edx, r9d
movsxd r14, r14d
movzx r9d, word [rsp + r14*2 + 0x4e]
add r9d, edx
cmp r13d, r9d
jne 0x180026602
mov r14, qword [rsp + 0x870]
xor ebx, ebx
movsxd rdx, dword [r14 + 0x3c]
mov eax, dword [rdx + r14 + 0x88]
mov r8d, dword [rdi + 0xc]
mov ebp, r8d
mov ecx, dword [rax + r14 + 0x20]
mov edx, dword [rax + r14 + 0x1c]
add rcx, r14
mov eax, dword [rax + r14 + 0x24]
add rdx, r14
add rax, r14
mov rsi, rcx
mov qword [rsp + 0xca0], r12
mov r13, rax
mov qword [rsp + 0x48], r15
mov r12, rdx
jmp 0x1800267fd