joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009eb60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
sub rsp, 0xa8
movabs rax, 0x323105d908710
mov qword [rsp + 0x68], rax
movsx rax, word [0x1401779ac]
mov qword [rsp + 0x70], rax
mov eax, dword [0x1401779a8]
mov byte [rsp], al
movzx eax, word [0x14017798c]
mov word [rsp + 0x34], ax
movzx eax, word [0x1401779a4]
mov byte [rsp + 2], al
mov eax, 0xf5f7
mov word [rsp + 0x10], ax
mov dword [rsp + 0x40], 0xbeb2a2f8
mov dword [rsp + 0x50], 0x6026
mov eax, 0xffffe86f
mov word [rsp + 0x14], ax
mov qword [rsp + 0x78], 0xd
mov eax, dword [0x1401779f4]
mov dword [rsp + 0x44], eax
mov eax, 0xc35e
mov word [rsp + 0x38], ax
mov rax, qword [0x1401779b8]
mov qword [rsp + 0x48], rax
mov eax, 0xffffc89e
mov word [rsp + 0x3c], ax
movzx eax, word [0x1401779a4]
movzx eax, ax
mov dword [rsp + 0x18], eax
mov qword [rsp + 0x60], 0x55
mov dword [rsp + 0x54], 0xdbc096e2
mov byte [rsp + 1], 0xdf
movzx eax, word [0x1401779e8]
mov word [rsp + 0x24], ax
mov eax, dword [0x140177990]
mov dword [rsp + 0x20], eax
movzx eax, byte [0x14017791b]
mov word [rsp + 0x28], ax
mov byte [rsp + 8], 0x2d
mov byte [rsp + 9], 0xec
movzx eax, word [0x1401779d4]
mov word [rsp + 4], ax
mov byte [rsp + 0xa], 3
mov dword [rsp + 0x58], 0x1c4c87c7
movzx eax, byte [0x14017791b]
mov qword [rsp + 0x80], rax
movzx eax, byte [0x1401778f6]
movzx eax, al
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x88], 0x12
mov eax, 0x41fa
mov word [rsp + 0x2c], ax
mov byte [rsp + 0xb], 0x3f
movzx eax, byte [0x1401779c4]
mov byte [rsp + 0xc], al
movabs rax, 0xf156c2fa6626c
mov qword [rsp + 0x90], rax
mov eax, 0xffffd2d8
mov word [rsp + 0x30], ax
movzx eax, byte [0x1401779f0]
mov byte [rsp + 0xd], al
movzx eax, word [0x140177934]
mov qword [rsp + 0x98], rax
movzx eax, word [0x14017798c]
test eax, eax
je 0x14009ed1f
mov eax, dword [0x1401779d0]
movabs rcx, 0x635b375367d74
add rax, rcx
mov byte [rsp], al
movsx eax, byte [0x140177933]
imul eax, eax, 0xf2
mov dword [0x1401779b0], eax
jmp 0x14009ed62
movsxd rax, dword [rsp + 0x18]
mov rcx, qword [rsp + 0x60]
sub rax, rcx
mov dword [rsp + 0x18], eax
movsx rax, byte [0x140177933]
imul rax, qword [rsp + 0x48]
movsx rcx, byte [0x140177933]
add rcx, rax
mov rax, rcx
mov byte [0x140177933], al
mov eax, dword [rsp + 0x40]
sub eax, 0xbad6
mov word [0x1401779d4], ax
movzx eax, word [0x1401779ec]
movzx eax, ax
movabs rcx, 0x8ec4b46f33003
imul rax, rcx
mov word [rsp + 0x10], ax
mov eax, dword [0x1401779a8]
mov dword [rsp + 0x20], eax
movsx eax, word [rsp + 4]
movzx ecx, byte [rsp + 1]
sub eax, ecx
movsx ecx, word [rsp + 4]
add ecx, eax
mov eax, ecx
mov word [rsp + 4], ax
movzx eax, byte [rsp + 2]
and eax, 0xc9
mov ecx, dword [0x1401779d0]
add ecx, eax
mov eax, ecx
mov dword [0x1401779d0], eax
cmp qword [rsp + 0x48], 0
je 0x14009edd2
movsx eax, byte [0x140177905]
mov dword [rsp + 0x1c], eax
jmp 0x14009eddc
movzx eax, word [rsp + 0x14]
cwde
mov dword [rsp + 0x1c], eax
mov eax, dword [rsp + 0x1c]
mov dword [rsp + 0x20], eax
movzx eax, word [0x14017797c]
sub eax, dword [rsp + 0x44]
mov word [0x14017797c], ax
mov rax, qword [rsp + 0x68]
add rsp, 0xa8
ret
Function at 0x1400bf940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x14
mov byte [rsp + 0x30], 0xe1
mov byte [rsp + 0x31], 0x4a
mov byte [rsp + 0x32], 0x50
mov byte [rsp + 0x33], 0x66
mov byte [rsp + 0x34], 0x75
mov byte [rsp + 0x35], 0x4a
mov byte [rsp + 0x36], 0xd1
mov byte [rsp + 0x37], 0x6e
mov byte [rsp + 0x38], 0xc0
mov byte [rsp + 0x39], 0x6e
mov byte [rsp + 0x3a], 0x48
mov byte [rsp + 0x3b], 0x6f
mov byte [rsp + 0x3c], 0xca
mov byte [rsp + 0x3d], 0x5f
mov byte [rsp + 0x3e], 0x77
mov byte [rsp + 0x3f], 0x6b
mov byte [rsp + 0x40], 0x54
mov byte [rsp + 0x41], 0x4c
mov byte [rsp + 0x42], 0xc8
mov byte [rsp + 0x43], 0xb
mov eax, 0x8f8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1400bfa53
mov eax, 0x8f8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0x8f8
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x8e0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400bfbb0
lea rcx, [0x14013aec0]
call fcn.1401258bc
nop
mov eax, 0x8e0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret
Function at 0x1400c2230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov eax, 0xae208e5e
mov qword [rsp + 0x70], rax
movsx eax, word [0x140177af4]
mov dword [rsp + 0x44], eax
movzx eax, byte [0x140177aab]
movzx eax, al
mov dword [rsp + 0xc], eax
mov eax, 0xd666
mov word [rsp + 0x1c], ax
movzx eax, byte [0x140177aac]
mov byte [rsp + 1], al
movsx eax, word [0x140177b38]
mov dword [rsp + 0x3c], eax
movzx eax, word [0x140177af0]
cwde
mov dword [rsp + 0x40], eax
movzx eax, byte [0x140177b04]
mov byte [rsp + 2], al
mov dword [rsp + 0x48], 0x10dda008
movzx eax, byte [0x140177b2c]
mov byte [rsp], al
mov eax, 0xee
mov word [rsp + 0x20], ax
movzx eax, byte [0x140177a3e]
movsx rax, al
mov qword [rsp + 0x78], rax
movzx eax, byte [0x140177aab]
movzx eax, al
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x4c], 0x8b
mov rax, qword [0x140177b10]
mov qword [rsp + 0x80], rax
movzx eax, byte [0x140177a16]
movsx rax, al
mov qword [rsp + 0x88], rax
mov eax, 0x958e
mov word [rsp + 0x24], ax
mov qword [rsp + 0x90], 0xdf6b
mov rax, qword [0x140177af8]
mov qword [rsp + 0x98], rax
mov eax, 0x551c
mov word [rsp + 0x28], ax
movabs rax, 0x89043d936ade7
mov qword [rsp + 0x68], rax
movzx eax, word [0x140177ae4]
movzx eax, ax
mov dword [rsp + 0x50], eax
mov byte [rsp + 3], 0xc
mov qword [rsp + 0xa0], 0x58e28208
movzx eax, byte [0x140177a3e]
movsx ax, al
mov word [rsp + 0x2c], ax
movzx eax, word [0x140177ae4]
mov word [rsp + 0x30], ax
movsx eax, word [0x140177af4]
mov dword [rsp + 0x54], eax
mov qword [rsp + 0xa8], 0x1f78da26
mov qword [rsp + 0xb0], 6
mov dword [rsp + 0x58], 0xc0
mov rax, qword [0x140177ae8]
mov dword [rsp + 0x5c], eax
movzx eax, word [0x140177af0]
movsx rax, ax
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0x60], 0x77f38d28
mov byte [rsp + 4], 0x96
movzx eax, byte [0x140177ad7]
mov byte [rsp + 5], al
mov eax, 0x36
mov word [rsp + 0x34], ax
movzx eax, word [0x140177a54]
and eax, dword [0x140177b18]
mov eax, eax
mov qword [rsp + 0x68], rax
movzx eax, byte [rsp]
dec al
mov byte [rsp], al
mov eax, dword [0x140177b1c]
mov eax, eax
movabs rcx, 0x5bb5a6347f9f0
imul rax, rcx
mov byte [0x140177aab], al
mov eax, dword [rsp + 0x38]
sub eax, dword [rsp + 0x3c]
movzx ecx, byte [rsp]
sub eax, ecx
mov byte [rsp], al
movzx eax, byte [0x140177a7e]
movsx eax, al
test eax, eax
jne 0x1400c244f
mov dword [rsp + 0x10], 1
jmp 0x1400c2457
mov dword [rsp + 0x10], 0
mov eax, dword [rsp + 0xc]
add eax, 0x9d68
sub eax, dword [rsp + 0x10]
test eax, eax
jne 0x1400c2472
mov dword [rsp + 8], 1
jmp 0x1400c247a
mov dword [rsp + 8], 0
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x1400c248c
mov dword [rsp + 0x14], 1
jmp 0x1400c2494
mov dword [rsp + 0x14], 0
mov eax, dword [0x140177b30]
mov ecx, dword [0x140177b34]
xor ecx, eax
mov eax, ecx
not eax
imul eax, dword [rsp + 0x14]
test eax, eax
jne 0x1400c24b9
mov dword [rsp + 0x18], 1
jmp 0x1400c24c1
mov dword [rsp + 0x18], 0
mov eax, dword [rsp + 0x18]
mov ecx, dword [rsp + 8]
or ecx, eax
mov eax, ecx
not eax
mov dword [0x140177aac], eax
mov eax, dword [rsp + 0xc]
cdqe
add rsp, 0xc8
ret
Function at 0x1400c3250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0xc8
movzx eax, byte [0x140177b40]
mov byte [rsp + 0x20], al
mov dword [rsp + 0x50], 0x3ec
mov eax, 0x54af
mov word [rsp + 0x30], ax
mov qword [rsp + 0x70], 0x2c
mov byte [rsp + 0x21], 0x1d
movzx eax, byte [0x140177aab]
mov byte [rsp + 0x22], al
movzx eax, byte [0x140177aab]
movzx eax, al
mov word [rsp + 0x34], ax
mov eax, 0xfffff14a
mov word [rsp + 0x38], ax
mov byte [rsp + 0x23], 0x1c
movzx eax, byte [0x140177a3f]
movzx eax, al
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x54], 0xa4baa991
movzx eax, word [0x140177a14]
mov byte [rsp + 0x24], al
movzx eax, byte [0x140177ae2]
movzx eax, al
mov word [rsp + 0x40], ax
mov byte [rsp + 0x25], 0x15
mov eax, 0x7421
mov word [rsp + 0x2c], ax
movzx eax, word [0x140177b2c]
mov word [rsp + 0x44], ax
movzx eax, byte [0x140177a7e]
mov byte [rsp + 0x26], al
mov dword [rsp + 0x58], 0x5456a7bc
mov qword [rsp + 0x78], 0xe1
movzx eax, word [0x140177b40]
mov word [rsp + 0x48], ax
movzx eax, word [0x140177af0]
movsx rax, ax
mov qword [rsp + 0x80], rax
movzx eax, byte [0x140177ae3]
movsx rax, al
mov qword [rsp + 0x88], rax
movabs rax, 0xf369d6395bbe5
mov qword [rsp + 0x90], rax
movabs rax, 0xcd6b00468073f
mov qword [rsp + 0x98], rax
mov byte [rsp + 0x27], 0xc8
movzx eax, byte [0x140177aab]
movzx eax, al
mov dword [rsp + 0x5c], eax
mov byte [rsp + 0x28], 0x83
movsx rax, byte [0x140177a56]
mov qword [rsp + 0xa0], rax
movzx eax, byte [0x140177a3f]
movzx eax, al
mov qword [rsp + 0xa8], rax
movsx eax, word [0x140177b2c]
mov dword [rsp + 0x60], eax
movsx rax, byte [0x140177a57]
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0x29], 0x3b
mov eax, dword [0x140177b0c]
mov dword [rsp + 0x64], eax
movabs rax, 0xab5a7bf52c9f3
mov qword [rsp + 0xb8], rax
mov eax, dword [0x140177b24]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], 0x8739
movzx eax, byte [0x140177a3e]
movsx eax, al
add eax, 0x1c
mov word [0x140177b00], ax
movsx eax, byte [0x140177a57]
movzx ecx, word [rsp + 0x2c]
movzx ecx, cx
imul eax, ecx
mov byte [0x140177a7f], al
mov r8, qword [rsp + 0xd8]
xor edx, edx
mov ecx, dword [rsp + 0xd0]
call fcn.1400c3460
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
add rsp, 0xc8
ret
Function at 0x1400f1210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0xd
mov byte [rsp + 0x30], 0x40
mov byte [rsp + 0x31], 0x67
mov byte [rsp + 0x32], 0x73
mov byte [rsp + 0x33], 0x6e
mov byte [rsp + 0x34], 0x44
mov byte [rsp + 0x35], 0x4e
mov byte [rsp + 0x36], 0x10
mov byte [rsp + 0x37], 0x90
mov byte [rsp + 0x38], 0x25
mov byte [rsp + 0x39], 0x45
mov byte [rsp + 0x3a], 0xef
mov byte [rsp + 0x3b], 0x44
mov byte [rsp + 0x3c], 0x2b
mov eax, 0xac0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1400f1300
mov eax, 0xac0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0xac0
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xab0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140031450
lea rcx, [0x14013b040]
call fcn.1401258bc
nop
mov eax, 0xab0
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret

Function at 0x1400f1330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0xf
mov byte [rsp + 0x30], 0x40
mov byte [rsp + 0x31], 0x67
mov byte [rsp + 0x32], 0x73
mov byte [rsp + 0x33], 0x6e
mov byte [rsp + 0x34], 0x44
mov byte [rsp + 0x35], 0x4e
mov byte [rsp + 0x36], 0x41
mov byte [rsp + 0x37], 0xc3
mov byte [rsp + 0x38], 0x78
mov byte [rsp + 0x39], 0x44
mov byte [rsp + 0x3a], 0xad
mov byte [rsp + 0x3b], 0x4c
mov byte [rsp + 0x3c], 0x47
mov byte [rsp + 0x3d], 0x6e
mov byte [rsp + 0x3e], 1
mov eax, 0xad8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1400f142a
mov eax, 0xad8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0xad8
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xac8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140031530
lea rcx, [0x14013b1f0]
call fcn.1401258bc
nop
mov eax, 0xac8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret
Function at 0x1400f37f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0xf
mov byte [rsp + 0x30], 0x4e
mov byte [rsp + 0x31], 0x44
mov byte [rsp + 0x32], 0x77
mov byte [rsp + 0x33], 0xf1
mov byte [rsp + 0x34], 0xd9
mov byte [rsp + 0x35], 0x65
mov byte [rsp + 0x36], 0x42
mov byte [rsp + 0x37], 0x67
mov byte [rsp + 0x38], 0x52
mov byte [rsp + 0x39], 0xf1
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3b], 0x47
mov byte [rsp + 0x3c], 0x68
mov byte [rsp + 0x3d], 0x51
mov byte [rsp + 0x3e], 3
mov eax, 0x998
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1400f38ea
mov eax, 0x998
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0x998
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0x988
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140031530
lea rcx, [0x14013b220]
call fcn.1401258bc
nop
mov eax, 0x988
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret

Function at 0x1400f3910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x28], 0x13
mov byte [rsp + 0x30], 0xe2
mov byte [rsp + 0x31], 0x79
mov byte [rsp + 0x32], 0xe4
mov byte [rsp + 0x33], 0x68
mov byte [rsp + 0x34], 0x55
mov byte [rsp + 0x35], 0x46
mov byte [rsp + 0x36], 0x65
mov byte [rsp + 0x37], 0x4a
mov byte [rsp + 0x38], 0xef
mov byte [rsp + 0x39], 0x4c
mov byte [rsp + 0x3a], 0x6e
mov byte [rsp + 0x3b], 0xc2
mov byte [rsp + 0x3c], 0xd1
mov byte [rsp + 0x3d], 0x7b
mov byte [rsp + 0x3e], 0xe8
mov byte [rsp + 0x3f], 0x67
mov byte [rsp + 0x40], 0x46
mov byte [rsp + 0x41], 0x62
mov byte [rsp + 0x42], 0x23
mov eax, 0xa24
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1400f3a1e
mov eax, 0xa24
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0xa24
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xa10
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400310d0
lea rcx, [0x14013b250]
call fcn.1401258bc
nop
mov eax, 0xa10
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x58
ret
Function at 0x1400f8770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0xf
mov byte [rsp + 0x30], 0x4f
mov byte [rsp + 0x31], 0xf5
mov byte [rsp + 0x32], 0xfd
mov byte [rsp + 0x33], 0x79
mov byte [rsp + 0x34], 0x40
mov byte [rsp + 0x35], 0x41
mov byte [rsp + 0x36], 0x66
mov byte [rsp + 0x37], 0x63
mov byte [rsp + 0x38], 0xcc
mov byte [rsp + 0x39], 0xe5
mov byte [rsp + 0x3a], 0x5d
mov byte [rsp + 0x3b], 0x51
mov byte [rsp + 0x3c], 0x6e
mov byte [rsp + 0x3d], 0xed
mov byte [rsp + 0x3e], 0xa9
mov eax, 0xaf8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
and eax, 1
test eax, eax
jne 0x1400f886a
mov eax, 0xaf8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
mov eax, dword [rcx + rax]
or eax, 1
mov dword [rsp + 0x20], eax
mov eax, dword [0x141f20340]
mov rcx, qword gs:[0x58]
mov edx, 0xaf8
mov edx, edx
mov rax, qword [rcx + rax*8]
mov ecx, dword [rsp + 0x20]
mov dword [rdx + rax], ecx
mov eax, 0xae8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140031530
lea rcx, [0x14013b2e0]
call fcn.1401258bc
nop
mov eax, 0xae8
mov eax, eax
mov ecx, dword [0x141f20340]
mov rdx, qword gs:[0x58]
add rax, qword [rdx + rcx*8]
add rsp, 0x48
ret
Function at 0x1400f9d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0xb8
movzx eax, word [0x140177e48]
mov word [rsp + 0x18], ax
movzx eax, word [0x140177db4]
mov dword [rsp + 0x38], eax
movzx eax, word [0x140177df0]
mov word [rsp + 8], ax
movzx eax, word [0x140177e28]
mov word [rsp + 0x1c], ax
mov dword [rsp + 0x3c], 0xa0a7
mov dword [rsp + 0x40], 0x7393d94b
mov eax, 5
mov word [rsp + 4], ax
mov byte [rsp + 1], 0x3c
mov rax, qword [0x140177e28]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x34], 0xf4
mov eax, 0xe3c2b522
mov qword [rsp + 0x68], rax
mov rax, qword [0x140177e00]
mov word [rsp + 0x20], ax
mov qword [rsp + 0x70], 0xfb40
mov rax, qword [0x140177e00]
mov qword [rsp + 0x78], rax
mov eax, 0xfbb0f473
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], 0xe4
mov byte [rsp], 0x62
mov qword [rsp + 0x88], 0x3070
mov dword [rsp + 0x44], 0x14d9
mov eax, 0xf270
mov word [rsp + 0x10], ax
movzx eax, word [0x140177dc4]
mov word [rsp + 0xc], ax
movzx eax, word [0x140177e40]
movsx rax, ax
mov qword [rsp + 0x90], rax
movzx eax, word [0x140177de4]
mov word [rsp + 0x14], ax
mov eax, 0x8d
mov word [rsp + 0x24], ax
mov dword [rsp + 0x48], 0x33d957cd
movzx eax, byte [0x140177d86]
movsx ax, al
mov word [rsp + 0x28], ax
movzx eax, word [0x140177de0]
cwde
mov dword [rsp + 0x4c], eax
mov eax, dword [0x140177de8]
mov qword [rsp + 0x98], rax
movzx eax, word [0x140177e0c]
mov word [rsp + 0x2c], ax
movzx eax, word [0x140177d14]
mov word [rsp + 0x30], ax
movzx eax, byte [0x140177d3e]
mov byte [rsp + 2], al
mov qword [rsp + 0xa0], 0xe0
mov rax, qword [0x140177df8]
mov byte [rsp + 3], al
mov eax, dword [0x140177de8]
mov qword [rsp + 0xa8], rax
mov eax, dword [0x140177dc8]
mov dword [rsp + 0x50], eax
mov eax, dword [0x140177e10]
mov dword [rsp + 0x54], eax
movsx rax, byte [rsp]
mov rcx, qword [0x140177db8]
and rax, rcx
movsx rcx, byte [rsp]
sub rcx, rax
mov rax, rcx
mov byte [rsp], al
mov eax, dword [0x140177ddc]
add eax, 0x8d00
mov word [rsp + 4], ax
movsx eax, word [rsp + 8]
mov dword [rsp + 0x34], eax
movzx eax, word [rsp + 0xc]
cwde
add eax, 0xea997d1c
mov word [rsp + 0x10], ax
mov eax, dword [0x140177e44]
imul eax, dword [0x140177e44]
mov ecx, dword [0x140177e44]
add ecx, eax
mov eax, ecx
mov dword [0x140177e44], eax
mov eax, 4
imul rax, rax, 0x13
lea rcx, [0x14154bee0]
movzx eax, word [rcx + rax]
mov word [0x140177e3c], ax
mov eax, dword [0x140177e30]
cdqe
mov rcx, qword [rsp + 0x58]
lea rax, [rax + rcx + 0x53]
mov dword [0x140177e30], eax
movzx eax, byte [0x140177d3e]
movsx eax, al
mov ecx, dword [0x140177db0]
sub eax, ecx
movzx ecx, byte [0x140177d3e]
movsx ecx, cl
sub ecx, eax
mov eax, ecx
mov byte [0x140177d3e], al
movzx eax, word [rsp + 0x14]
cwde
add rsp, 0xb8
ret
Function at 0x1400fca10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
movzx eax, word [0x140177f74]
mov byte [rsp + 1], al
movzx eax, byte [0x140177f60]
mov byte [rsp + 2], al
movsx eax, word [0x140177fc0]
mov dword [rsp + 0x5c], eax
movabs rax, 0xbc5a89827b03f
mov qword [rsp + 0x68], rax
movabs rax, 0x476e268613c4d
mov qword [rsp + 0x70], rax
movzx eax, word [0x140177f74]
movzx eax, ax
mov qword [rsp + 0x60], rax
mov byte [rsp], 0xb1
movsxd rax, dword [0x140177f1c]
mov qword [rsp + 0x78], rax
movzx eax, byte [0x140177f64]
mov byte [rsp + 3], al
movzx eax, word [0x140177fd4]
mov word [rsp + 8], ax
mov eax, 0x9e95
mov word [rsp + 0x14], ax
mov byte [rsp + 4], 0x40
mov dword [rsp + 0x30], 0xc10e29f5
mov eax, dword [0x140177f04]
mov dword [rsp + 0x34], eax
movzx eax, word [0x140177fa8]
cwde
mov dword [rsp + 0x10], eax
mov rax, qword [0x140177fa0]
mov dword [rsp + 0x38], eax
mov rax, qword [0x140177fa0]
mov qword [rsp + 0x80], rax
mov eax, dword [0x140177fac]
mov dword [rsp + 0x24], eax
mov rax, qword [0x140177f80]
mov word [rsp + 0x18], ax
movzx eax, byte [0x141720c44]
movzx eax, al
mov qword [rsp + 0x88], rax
movzx eax, word [0x140177fd8]
mov word [rsp + 0x1c], ax
mov byte [rsp + 5], 0x61
mov eax, dword [0x140177f48]
mov dword [rsp + 0x3c], eax
mov eax, 0xd2
mov word [rsp + 0x20], ax
mov dword [rsp + 0x40], 0x688f9f8c
movzx eax, word [0x140177fd0]
cwde
mov dword [rsp + 0x44], eax
mov byte [rsp + 6], 0x32
movzx eax, byte [0x140177eb6]
mov qword [rsp + 0x90], rax
movabs rax, 0x81d64fce10393
mov qword [rsp + 0x98], rax
mov eax, dword [0x140177f7c]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], 0x1b1e
mov dword [rsp + 0x50], 0xc2c2b010
mov eax, dword [0x140177f1c]
mov dword [rsp + 0x54], eax
mov eax, 0xffffdfb3
mov word [rsp + 0xc], ax
mov rax, qword [0x140177f80]
mov qword [rsp + 0xa0], rax
movzx eax, byte [0x140177eb7]
movzx eax, al
mov dword [rsp + 0x58], eax
movzx eax, byte [0x140177eb6]
sub eax, 0xcf
mov word [rsp + 8], ax
movsxd rax, dword [0x140177f7c]
imul rax, qword [0x140177f38]
imul rax, qword [0x140177f88]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x10]
inc eax
mov dword [rsp + 0x10], eax
movzx eax, byte [0x141720c40]
mov byte [0x140177f1b], al
movsx eax, byte [rsp]
add eax, 0xa2cb
cdqe
mov qword [0x140177f48], rax
movzx eax, byte [0x140177edf]
movsx rax, al
sub rax, qword [rsp + 0x68]
test rax, rax
jne 0x1400fcc2f
mov qword [rsp + 0x28], 1
jmp 0x1400fcc38
mov qword [rsp + 0x28], 0
mov rax, qword [0x140177fb8]
not rax
mov rcx, qword [0x140177fb0]
imul rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x28]
and rcx, rax
mov rax, rcx
not rax
mov byte [0x140177eb7], al
mov eax, dword [0x141720c40]
mov dword [rsp + 0x24], eax
movzx eax, word [rsp + 0xc]
movsx rax, ax
add rsp, 0xb8
ret