joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001a60
Capabilities:
Parse pe header

Disassembly:
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x14012aab8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov rdi, rcx
mov edx, 0xd
call fcn.140008a20
test rax, rax
jne 0x140001a93
mov al, 1
jmp 0x140001c59
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x60], rbp
test rdi, rdi
je 0x140001c4a
mov edx, 0x40
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140001c4a
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140001c4a
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140001c4a
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140001c4a
cmp dword [rbx], 0x4550
jne 0x140001c4a
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140001c4a
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x140001c4a
mov rcx, rdi
call fcn.140008c20
mov ebp, eax
mov edx, 0xd
lea rax, vtable.peconv::default_func_resolver.0
mov rcx, rdi
mov qword [rsp + 0x40], rax
call fcn.140008a20
test rax, rax
je 0x140001c4a
mov ecx, dword [rax]
mov r8d, dword [rax + 4]
lea rdx, [rcx + rdi]
cmp r8d, 0x20
jb 0x140001c4a
test rdx, rdx
je 0x140001c4a
cmp rdx, rdi
jb 0x140001c4a
lea rbx, [rcx + 0x20]
cmp rbx, rbp
ja 0x140001c4a
cmp rbx, 0x20
jb 0x140001c4a
cmp rbx, rcx
jb 0x140001c4a
mov qword [rsp + 0x58], rsi
xor esi, esi
mov qword [rsp + 0x50], r15
mov r15d, r8d
shr r15, 5
mov r8b, 1
test r15, r15
je 0x140001c3a
lea rdx, [rdi - 0x20]
add rdx, rbx
je 0x140001c3a
cmp rdx, rdi
jb 0x140001c3a
cmp rbx, rbp
ja 0x140001c3a
cmp rbx, 0x20
jb 0x140001c3a
lea rax, [rbx - 0x20]
cmp rbx, rax
jb 0x140001c3a
mov eax, dword [rdi + rbx - 0x1c]
test eax, eax
je 0x140001c3a
cmp rax, r14
jbe 0x140001be7
sub rax, r14
lea r9, [rdi + rax]
test r9, r9
je 0x140001c2a
cmp r9, rdi
jb 0x140001c2a
lea rcx, [rax + 1]
cmp rcx, rbp
ja 0x140001c2a
cmp rcx, 1
jb 0x140001c2a
cmp rcx, rax
jb 0x140001c2a
lea rax, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov qword [rsp + 0x28], rdx
mov rdx, rbp
call fcn.140001c70
movzx r8d, al
inc rsi
add rbx, 0x20
cmp rsi, r15
jb 0x140001bb5
mov r15, qword [rsp + 0x50]
movzx eax, r8b
mov rsi, qword [rsp + 0x58]
jmp 0x140001c4c
xor al, al
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400439e0
add rsp, 0x68
pop r14
pop rdi
ret
Function at 0x140001e50
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, r8
mov r13, rdx
mov r12, rcx
xor edi, edi
cmp qword [r8], rdi
je 0x140001f94
mov r8, qword [r8 + 8]
test r8, r8
je 0x140001f94
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140001eac
inc rcx
mov qword [rbx + 0x10], rcx
mov rax, qword [rbx + 0x18]
dec rax
mov qword [rbx + 0x18], rax
jmp 0x140001f28
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r15, rax
mov qword [rsp + 0x28], rdi
test rax, rax
je 0x140001f8d
movzx esi, word [rax + 0x14]
add rsi, 0x18
add rsi, rax
mov qword [rsp + 0x28], rsi
movzx r14d, di
mov word [rsp + 0x20], di
nop
cmp r14w, word [r15 + 6]
jae 0x140001f0d
mov r8d, 8
mov rdx, rsi
mov rcx, r13
call fcn.14002c348
test eax, eax
jne 0x140001f66
mov eax, dword [rsi + 0xc]
add rax, r12
mov qword [rbx + 0x10], rax
mov eax, dword [rsi + 8]
mov qword [rbx + 0x18], rax
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140001f7e
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140001f7e
mov r8, qword [rbx + 8]
cmp rax, r8
jb 0x140001f7e
mov r14, rcx
sub r14, r8
add r14, rax
cmp rcx, r14
ja 0x140001f7e
mov rsi, qword [rbx + 8]
mov rdx, rcx
mov rcx, qword [rbx]
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rsi
je 0x140001fa5
mov rcx, qword [rbx + 0x10]
inc rcx
mov qword [rbx + 0x10], rcx
mov rax, qword [rbx + 0x18]
dec rax
mov qword [rbx + 0x18], rax
mov r8, rsi
jmp 0x140001f31
add rsi, 0x28
mov qword [rsp + 0x28], rsi
inc r14w
mov word [rsp + 0x20], r14w
jmp 0x140001ee0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov edi, 0xc0000225
jmp 0x140001fa1
mov edi, 0xc00000ef
jmp 0x140001fa1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov edi, 0xc000000d
mov dword [rsp + 0x24], edi
jmp 0x140001fad
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x140002380
Capabilities:
Check os version

Disassembly:
push rbp
push rbx
push r12
push r13
mov rbp, rsp
sub rsp, 0x48
mov rax, qword [0x14012aab8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13d, edx
mov r12, rcx
call fcn.1400020a0
mov rbx, rax
test rax, rax
jne 0x1400023b9
mov eax, 0xc00000bb
jmp 0x140002591
xor eax, eax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
lea r8, [rbp - 0x20]
mov qword [rbp - 0x28], rax
lea rdi, [rbp - 0x28]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
mov qword [rsp + 0x40], r15
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
xor esi, esi
cmp dword [rbp - 0x28], 6
jne 0x140002405
cmp dword [rbp - 0x24], 3
jne 0x140002405
lea r15d, [rsi + 1]
jmp 0x140002409
seta r15b
test r15b, r15b
je 0x140002423
mov rdx, rbx
mov ecx, 4
call fcn.140001fd0
test eax, eax
js 0x14000257f
xor eax, eax
mov qword [rsp + 0x88], r14
mov r14d, dword [rbx]
lea rdi, [rbp - 0x28]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
mov dword [rbp - 0x18], esi
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
cmp dword [rbp - 0x28], 6
jne 0x14000246a
cmp dword [rbp - 0x24], 2
jne 0x14000246a
mov eax, 1
jmp 0x14000246d
seta al
movzx edi, al
cmp r14d, dword [rbx + 4]
je 0x140002502
test r14d, r14d
je 0x1400024cf
cmp edi, r14d
jae 0x1400024a0
lea rax, [rdi + 1]
lea rcx, [rax + rax*2]
lea rax, [rbx + rcx*8]
cmp r12, qword [rax]
jb 0x1400024a2
inc edi
add rax, 0x18
cmp edi, r14d
jb 0x140002490
je 0x1400024cf
lea eax, [rdi + 1]
sub r14d, edi
mov ecx, eax
lea rdx, [rdi + 1]
add rcx, 2
lea rdx, [rdi + rdx*2]
lea rdx, [rbx + rdx*8]
lea r8, [r14 + r14*2]
shl r8, 3
lea rax, [rcx + rax*2]
lea rcx, [rbx + rax*8]
call fcn.1400459a0
lea rcx, [rdi + rdi*2]
mov r8d, 3
lea rdi, [rbx + rcx*8]
mov dl, 1
mov rcx, r12
lea r9, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
mov qword [rdi + 0x10], rax
mov eax, dword [rbp - 0x18]
mov dword [rdi + 0x24], eax
mov qword [rdi + 0x18], r12
mov dword [rdi + 0x20], r13d
inc dword [rbx]
jmp 0x140002516
test al, al
je 0x14000250f
mov dword [rbx + 0xc], 1
jmp 0x140002516
mov dword [rbx + 8], 1
mov r14, qword [rsp + 0x88]
test r15b, r15b
je 0x140002534
mov rdx, rbx
mov ecx, 2
call fcn.140001fd0
test eax, eax
js 0x14000257f
xor eax, eax
lea rdi, [rbp - 0x28]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
cmp dword [rbp - 0x28], 6
jne 0x140002566
cmp dword [rbp - 0x24], 2
je 0x14000256e
seta sil
test esi, esi
je 0x140002573
mov eax, dword [rbx + 0xc]
jmp 0x140002576
mov eax, dword [rbx + 8]
neg eax
sbb eax, eax
and eax, 0xc0000017
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400439e0
add rsp, 0x48
pop r13
pop r12
pop rbx
pop rbp
ret
Function at 0x1400083f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rax, qword [0x14012aab8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov rbx, rcx
call fcn.140008c20
mov ebp, eax
test eax, eax
je 0x1400085a6
test rbx, rbx
je 0x1400085a6
mov edx, 0x40
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x1400085a6
mov r15d, 0x5a4d
cmp word [rbx], r15w
jne 0x1400085a6
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400085a6
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x1400085a6
cmp dword [rdi], 0x4550
jne 0x1400085a6
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x1400085a6
mov r12d, 0x20b
cmp word [rdi + 0x18], r12w
jne 0x1400085a6
mov qword [rsp + 0x98], r14
lea rax, vtable.peconv::default_func_resolver.0
test rsi, rsi
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
cmovne r14, rsi
mov qword [rsp + 0x38], rbp
xor esi, esi
mov rcx, rbx
mov dword [rsp + 0x41], esi
mov word [rsp + 0x45], si
mov byte [rsp + 0x47], sil
lea edx, [rsi + 0x40]
call fcn.140009d00
test al, al
jne 0x140008538
cmp word [rbx], r15w
jne 0x140008538
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008538
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008538
cmp dword [rdi], 0x4550
jne 0x140008538
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008538
movzx esi, word [rdi + 0x18]
lea rax, vtable.FillImportThunks.0
mov qword [rsp + 0x48], r14
cmp si, r12w
mov qword [rsp + 0x28], rax
mov edx, 1
mov rcx, rbx
sete byte [rsp + 0x40]
call fcn.140008a20
mov r14, qword [rsp + 0x98]
test rax, rax
jne 0x140008570
mov al, 1
jmp 0x1400085a8
mov ecx, dword [rax]
lea r8, [rcx + rbx]
test r8, r8
je 0x1400085a6
cmp r8, rbx
jb 0x1400085a6
lea rax, [rcx + 0x14]
cmp rax, rbp
ja 0x1400085a6
cmp rax, 0x14
jb 0x1400085a6
cmp rax, rcx
jb 0x1400085a6
lea r9, [rsp + 0x28]
mov rdx, rbp
mov rcx, rbx
call fcn.140008050
jmp 0x1400085a8
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400439e0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008760
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x140008785
test rdx, rdx
je 0x140008797
cmp rdx, 0x40
jae 0x1400087a5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call fcn.140009d00
test al, al
jne 0x140008785
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140008785
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140008785
lea rbx, [rax + rdi]
mov rcx, rax
test rsi, rsi
je 0x1400087ea
test rbx, rbx
je 0x140008785
cmp rbx, rdi
jb 0x140008785
add rax, 0xf8
cmp rax, rsi
ja 0x140008785
cmp rax, 0xf8
jb 0x140008785
cmp rax, rcx
jb 0x140008785
jmp 0x1400087fb
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140008785
mov rsi, qword [rsp + 0x38]
xor eax, eax
cmp dword [rbx], 0x4550
cmovne rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140008820
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140008910
mov edx, 0x40
call fcn.140009d00
test al, al
jne 0x140008910
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140008910
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008910
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140009d00
test al, al
jne 0x140008910
cmp dword [rsi], 0x4550
jne 0x140008910
mov edx, 0x40
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x1400088fd
cmp word [rbx], di
jne 0x1400088fd
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400088fd
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x1400088fd
cmp dword [rdi], 0x4550
jne 0x1400088fd
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x1400088fd
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmovne rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140008930
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140008a05
mov edx, 0x40
call fcn.140009d00
test al, al
jne 0x140008a05
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140008a05
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008a05
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140009d00
test al, al
jne 0x140008a05
cmp dword [rsi], 0x4550
jne 0x140008a05
mov edx, 0x40
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140008a05
cmp word [rbx], di
jne 0x140008a05
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008a05
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008a05
cmp dword [rdi], 0x4550
jne 0x140008a05
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008a05
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmove rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140008a20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
cmp edx, 0x10
jae 0x140008b14
test rcx, rcx
je 0x140008b14
mov edx, 0x40
call fcn.140009d00
test al, al
jne 0x140008b14
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x140008b14
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008b14
lea r14, [rbx + rax]
mov edx, 0xf8
mov rcx, r14
call fcn.140009d00
test al, al
jne 0x140008b14
cmp dword [r14], 0x4550
jne 0x140008b14
mov edx, 0x40
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140008aff
cmp word [rbx], di
jne 0x140008aff
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008aff
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008aff
cmp dword [rdi], 0x4550
jne 0x140008aff
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008aff
mov eax, 0x20b
cmp word [rdi + 0x18], ax
lea rax, [rsi*8 + 0x88]
je 0x140008b07
lea rax, [rsi*8 + 0x78]
add rax, r14
xor ecx, ecx
cmp dword [rax], ecx
cmove rax, rcx
jmp 0x140008b16
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140008b30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x5a4d
test rcx, rcx
je 0x140008bab
mov edx, 0x40
call fcn.140009d00
test al, al
jne 0x140008bab
cmp word [rbx], bp
jne 0x140008bab
movsxd rax, dword [rbx + 0x3c]
lea rdi, [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008bab
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140009d00
test al, al
jne 0x140008bab
cmp dword [rsi], 0x4550
jne 0x140008bab
mov edx, 0xf8
mov rcx, rsi
call fcn.140009d00
test al, al
je 0x140008ba5
xor esi, esi
jmp 0x140008bb6
movzx esi, word [rsi + 0x18]
jmp 0x140008bb6
xor esi, esi
lea rdi, [rbx + 0x3c]
test rbx, rbx
je 0x140008c08
mov edx, 0x40
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140008c08
cmp word [rbx], bp
jne 0x140008c08
movsxd rax, dword [rdi]
cmp eax, 0x400
jg 0x140008c08
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008c08
cmp dword [rdi], 0x4550
jne 0x140008c08
mov eax, 0x20b
cmp si, ax
jne 0x140008c03
mov rax, qword [rdi + 0x30]
jmp 0x140008c0a
mov eax, dword [rdi + 0x34]
jmp 0x140008c0a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140008c20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140008d1f
mov edx, 0x40
call fcn.140009d00
test al, al
jne 0x140008d1f
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x140008d1f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008d1f
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008d1f
cmp dword [rdi], 0x4550
jne 0x140008d1f
mov edx, 0x40
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140008d04
cmp word [rbx], si
jne 0x140008d04
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008d04
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008d04
cmp dword [rdi], 0x4550
jne 0x140008d04
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008d04
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140008d04
mov rcx, rbx
call fcn.140008930
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140008820
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140008d40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140008e0c
call fcn.140008760
mov rsi, rax
test rax, rax
je 0x140008e0c
mov edx, 0x40
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140008dcd
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140008dcd
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140008dcd
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008dcd
cmp dword [rdi], 0x4550
jne 0x140008dcd
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140008dcd
mov eax, 0x20b
lea rax, [rsi + 4]
test rax, rax
je 0x140008df5
cmp rax, rbx
jb 0x140008df5
mov rcx, rax
sub rcx, rbx
lea rdx, [rcx + 0x14]
cmp rdx, rbp
ja 0x140008df5
cmp rdx, 0x14
jb 0x140008df5
cmp rdx, rcx
jae 0x140008df7
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x1400090f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r13, r8
mov r15, rdx
mov rdi, rcx
test rcx, rcx
je 0x14000912d
test r8, r8
je 0x14000912d
test rdx, rdx
je 0x14000914c
cmp rdx, 0x40
jae 0x14000915a
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov edx, 0x40
call fcn.140009d00
test al, al
jne 0x14000912d
mov esi, 0x5a4d
cmp word [rdi], si
jne 0x14000912d
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000912d
lea rbx, [rax + rdi]
mov rcx, rax
test r15, r15
je 0x14000919f
test rbx, rbx
je 0x14000912d
cmp rbx, rdi
jb 0x14000912d
add rax, 0xf8
cmp rax, r15
ja 0x14000912d
cmp rax, 0xf8
jb 0x14000912d
cmp rax, rcx
jb 0x14000912d
jmp 0x1400091b4
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x14000912d
cmp dword [rbx], 0x4550
jne 0x14000912d
mov edx, 0x40
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140009214
cmp word [rdi], si
jne 0x140009214
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140009214
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140009d00
test al, al
jne 0x140009214
cmp dword [rsi], 0x4550
jne 0x140009214
mov edx, 0xf8
mov rcx, rsi
call fcn.140009d00
test al, al
jne 0x140009214
mov eax, 0x20b
xor r11d, r11d
lea r12, [rbx + 4]
mov eax, 0x10
mov rcx, r12
mov r14d, r11d
movzx esi, r11w
movzx edx, word [rax + rcx]
mov eax, dword [rbx + 0x54]
add rdx, 0x18
add rdx, rbx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rdx
cmp r11w, word [r12 + 2]
jae 0x140009360
nop dword [rax]
movzx eax, si
lea rcx, [rax + rax*4]
lea rbx, [rdx + rcx*8]
test rbx, rbx
je 0x14000912d
cmp rbx, rdi
jb 0x14000912d
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + 0x28]
cmp rax, r15
ja 0x14000912d
cmp rax, 0x28
jb 0x14000912d
cmp rax, rcx
jb 0x14000912d
cmp rax, rbp
ja 0x14000912d
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x14000934d
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x14000934d
mov r9d, dword [rbx + 0xc]
mov edx, ecx
mov r8d, eax
add rcx, rdi
add rax, r9
lea r10, [r9 + r13]
cmp rax, rbp
jbe 0x1400092da
mov rax, rbp
mov r8, r11
sub rax, r9
cmp rbp, r9
cmova r8, rax
cmp r9, rbp
jb 0x1400092e8
test r8, r8
jne 0x14000912d
lea rax, [rdx + r8]
cmp rax, rbp
ja 0x14000912d
test rcx, rcx
je 0x140009348
cmp rcx, rdi
jb 0x140009348
cmp rax, r15
ja 0x140009348
cmp rax, r8
jb 0x140009348
cmp rax, rdx
jb 0x140009348
test r10, r10
je 0x140009348
cmp r10, r13
jb 0x140009348
lea rax, [r9 + r8]
cmp rax, rbp
ja 0x140009348
cmp rax, r8
jb 0x140009348
cmp rax, r9
jb 0x140009348
mov rdx, rcx
mov rcx, r10
call fcn.1400459a0
test r14d, r14d
je 0x140009341
cmp dword [rbx + 0x14], r14d
jae 0x140009345
mov r14d, dword [rbx + 0x14]
xor r11d, r11d
mov rdx, qword [rsp + 0x20]
inc si
cmp si, word [r12 + 2]
jb 0x140009250
mov eax, dword [rsp + 0x60]
test eax, eax
cmovne r14d, eax
mov r8d, r14d
cmp r8, rbp
ja 0x14000912d
mov rdx, rdi
mov rcx, r13
call fcn.1400459a0
mov al, 1
jmp 0x14000912f
Function at 0x1400093b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r12, r8
mov edx, 5
mov rsi, rcx
call fcn.140008a20
test rax, rax
je 0x140009622
test rsi, rsi
je 0x140009622
cmp rax, rsi
jb 0x140009622
mov rcx, rax
sub rcx, rsi
lea rdx, [rcx + 8]
cmp rdx, r14
ja 0x140009622
cmp rdx, 8
jb 0x140009622
cmp rdx, rcx
jb 0x140009622
mov ecx, dword [rax + 4]
mov edx, 0x40
mov ebx, dword [rax]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
call fcn.140009d00
test al, al
jne 0x140009481
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140009481
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x140009481
lea rbx, [rsi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x14000947d
cmp dword [rbx], 0x4550
jne 0x14000947d
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
mov ebx, dword [rsp + 0x78]
mov r10d, dword [rsp + 0x20]
xor r13d, r13d
test r10d, r10d
je 0x14000961e
mov r11d, 0x1000
nop dword [rax + rax]
lea eax, [rbx + r13]
lea r15, [rax + rsi]
mov ecx, eax
test r15, r15
je 0x140009622
cmp r15, rsi
jb 0x140009622
add rax, 8
cmp rax, r14
ja 0x140009622
cmp rax, 8
jb 0x140009622
cmp rax, rcx
jb 0x140009622
mov eax, dword [r15 + 4]
test eax, eax
je 0x14000961e
mov r9d, dword [r15]
lea rbp, [rax - 8]
shr rbp, 1
lea rax, [r15 + 8]
mov dword [rsp + 0x24], r9d
test rax, rax
je 0x140009622
cmp rax, rsi
jb 0x140009622
sub rax, rsi
lea rbx, [rax + 2]
cmp rbx, r14
ja 0x140009622
cmp rbx, 2
jb 0x140009622
cmp rbx, rax
jb 0x140009622
test rbp, rbp
je 0x14000960d
xor r8d, r8d
test rbp, rbp
je 0x14000960d
mov rax, rbx
nop dword [rax + rax]
lea rdx, [rsi - 2]
add rdx, rax
je 0x140009589
cmp rdx, rsi
jb 0x140009589
cmp rax, r14
ja 0x140009589
cmp rax, 2
jb 0x140009589
lea rcx, [rax - 2]
cmp rax, rcx
jb 0x140009589
cmp word [rdx], r11w
jae 0x140009589
add rax, 2
inc r8
cmp r8, rbp
jb 0x140009550
jmp 0x14000960d
xor edi, edi
nop dword [rax + rax]
lea rcx, [rsi - 2]
add rcx, rbx
je 0x1400095fd
cmp rcx, rsi
jb 0x1400095fd
cmp rbx, r14
ja 0x1400095fd
cmp rbx, 2
jb 0x1400095fd
lea rax, [rbx - 2]
cmp rbx, rax
jb 0x1400095fd
movzx eax, word [rcx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
test eax, eax
je 0x1400095fd
cmp eax, 3
je 0x1400095ce
cmp eax, 0xa
jne 0x140009622
add ecx, r9d
cmp rcx, r14
jae 0x140009622
test r12, r12
je 0x1400095f1
mov rax, qword [r12]
lea rdx, [rcx + rsi]
mov rcx, r12
call qword [rax]
test al, al
je 0x140009622
mov r9d, dword [rsp + 0x24]
add rbx, 2
inc rdi
cmp rdi, rbp
jb 0x140009590
test rdi, rdi
je 0x140009622
mov r10d, dword [rsp + 0x20]
mov r11d, 0x1000
add r13d, dword [r15 + 4]
mov ebx, dword [rsp + 0x78]
cmp r13d, r10d
jb 0x1400094a0
mov al, 1
jmp 0x140009624
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret