joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d6f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000d752
xor eax, eax
jmp 0x14000d8d0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000d79e
xor eax, eax
jmp 0x14000d8d0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000d7d5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000d7fd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000d866
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000d8ce
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xde10f3da
jne 0x14000d8cc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000d8d0
jmp 0x14000d859
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000d8e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000d942
xor eax, eax
jmp 0x14000dac0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000d98e
xor eax, eax
jmp 0x14000dac0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000d9c5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000d9ed
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000da56
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000dabe
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xd07708df
jne 0x14000dabc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000dac0
jmp 0x14000da49
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000dad0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000db32
xor eax, eax
jmp 0x14000dcb0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000db7e
xor eax, eax
jmp 0x14000dcb0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000dbb5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000dbdd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000dc46
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000dcae
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xe049c205
jne 0x14000dcac
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000dcb0
jmp 0x14000dc39
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000dcc0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000dd22
xor eax, eax
jmp 0x14000dea0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000dd6e
xor eax, eax
jmp 0x14000dea0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000dda5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000ddcd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000de36
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000de9e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xe082843
jne 0x14000de9c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000dea0
jmp 0x14000de29
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000deb0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000df12
xor eax, eax
jmp 0x14000e090
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000df5e
xor eax, eax
jmp 0x14000e090
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000df95
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000dfbd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000e026
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000e08e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0x1a946df0
jne 0x14000e08c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000e090
jmp 0x14000e019
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000e0a0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000e102
xor eax, eax
jmp 0x14000e280
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000e14e
xor eax, eax
jmp 0x14000e280
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000e185
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000e1ad
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000e216
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000e27e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0x3546aa24
jne 0x14000e27c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000e280
jmp 0x14000e209
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000e290
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000e2f2
xor eax, eax
jmp 0x14000e470
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000e33e
xor eax, eax
jmp 0x14000e470
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000e375
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000e39d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000e406
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000e46e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xd8133d9d
jne 0x14000e46c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000e470
jmp 0x14000e3f9
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000ea20
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000ea82
xor eax, eax
jmp 0x14000ec00
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000eace
xor eax, eax
jmp 0x14000ec00
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000eb05
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000eb2d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000eb96
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000ebfe
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xa623a735
jne 0x14000ebfc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000ec00
jmp 0x14000eb89
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000ec10
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000ec72
xor eax, eax
jmp 0x14000edf0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000ecbe
xor eax, eax
jmp 0x14000edf0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000ecf5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000ed1d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000ed86
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000edee
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xb63ca8f7
jne 0x14000edec
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000edf0
jmp 0x14000ed79
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000ee00
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000ee62
xor eax, eax
jmp 0x14000efe0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000eeae
xor eax, eax
jmp 0x14000efe0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000eee5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000ef0d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000ef76
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000efde
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xec608ae5
jne 0x14000efdc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000efe0
jmp 0x14000ef69
xor eax, eax
add rsp, 0x78
ret