joyce8/EMBER2024-capa huggingface dataset:
Function at 0x619a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x619bdb
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x619a61
inc rcx
cmp rbx, rcx
jle 0x619bd1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x619a5e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00583000
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x00922b18]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.00615e00
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x619bc5
test rdx, rdx
je 0x619bba
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403b20
xorps xmm15, xmm15
mov r14, qword [0x0097ffd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x619b89
xor eax, eax
lea rbx, [0x006eec9d]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006eecb6]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.00451080
jmp 0x619bb0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0076f698]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.00450fc0
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00470ae0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00619a40
Function at 0x65a900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x65aa02
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00598360
test rdi, rdi
jne 0x65a953
mov rbx, qword [0x009387c8]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0069fbc0]
call fcn.004105e0
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call fcn.0065a8a0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403b20
xorps xmm15, xmm15
mov r14, qword [0x0097ffd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x65a9d5
xor eax, eax
lea rbx, [0x006eec9d]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006eecb6]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.00451080
jmp 0x65a9fc
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0076f698]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.00450fc0
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00470ae0
mov rax, qword [rsp + 8]
jmp fcn.0065a900
Function at 0x1400110a0
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x1400180e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e228]
call fcn.140011645
nop
lea rdx, str.NtCreateSection
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400284f0], rax
lea rdx, str.NtMapViewOfSection
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400284f8], rax
lea rdx, str.NtUnmapViewOfSection
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028500], rax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028508], rax
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028510], rax
lea rdx, str.RtlCreateProcessParameters
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028518], rax
lea rdx, str.RtlCreateUserProcess
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028520], rax
lea rdx, str.RtlCreateUserThread
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028528], rax
lea rdx, str.NtWaitForSingleObject
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028530], rax
lea rdx, str.NtClose
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028538], rax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400110e6
Capabilities:
Terminate process

Disassembly:
jmp 0x140018090
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14002e228]
call fcn.140011645
nop
cmp dword [rbp + 0xe0], 0
jge 0x1400180c4
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x140011366
Capabilities:
Terminate process

Disassembly:
jmp 0x140018fc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14001145b
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001a9c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001a9e0
xor al, al
jmp 0x14001aa61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001a9f3
xor al, al
jmp 0x14001aa61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001aa1d
xor al, al
jmp 0x14001aa61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001aa31
xor al, al
jmp 0x14001aa61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001aa43
xor al, al
jmp 0x14001aa61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001aa5f
xor al, al
jmp 0x14001aa61
mov al, 1
add rsp, 0x38
ret
Function at 0x140019cc0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011681
movzx eax, al
test eax, eax
jne 0x140019ce0
mov ecx, 7
call fcn.14001153c
nop
mov byte [rsp + 0x20], 0
call fcn.140011578
mov byte [rsp + 0x21], al
cmp dword [0x140028550], 1
jne 0x140019d04
mov ecx, 7
call fcn.14001153c
nop
jmp 0x140019d5c
cmp dword [0x140028550], 0
jne 0x140019d57
mov dword [0x140028550], 1
lea rdx, [0x140022770]
lea rcx, [0x140022440]
call fcn.1400112cb
test eax, eax
je 0x140019d38
mov eax, 0xff
jmp 0x140019e61
lea rdx, [0x140022330]
lea rcx, [section..rdata]
call fcn.14001155f
mov dword [0x140028550], 2
jmp 0x140019d5c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011523
call fcn.140011483
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140019db9
mov rcx, qword [rsp + 0x30]
call fcn.14001124e
movzx eax, al
test eax, eax
je 0x140019db9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002f020]
nop
call fcn.1400114ce
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140019ded
mov rcx, qword [rsp + 0x38]
call fcn.14001124e
movzx eax, al
test eax, eax
je 0x140019ded
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011618
nop
call fcn.140019ed0
mov dword [rsp + 0x28], eax
call fcn.14001145b
movzx eax, al
test eax, eax
jne 0x140019e0c
mov ecx, dword [rsp + 0x28]
call fcn.14001106e
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140019e1b
call fcn.140011631
nop
xor edx, edx
mov cl, 1
call fcn.14001122b
mov eax, dword [rsp + 0x28]
jmp 0x140019e61
add rsp, 0x68
ret
Function at 0x1400031c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000321d
lea rbx, [0x14004bd90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003204
cmp r10, 2
jb 0x140003204
cmp byte [r9], r8b
jne 0x140003204
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400031e0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000325f
lea rbx, [0x14004bd90]
cmp r8b, 0x23
jne 0x140003243
cmp byte [r9], r8b
jne 0x140003243
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003230
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003420
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000344f
mov r8d, 0x78f
lea rdx, str.C:0x9_projectmenuloaderloaderglass_loaderglass_loader_black_glass_loader_simpleimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000345b
mov qword [rdi], 0
lea rdx, [0x14004b5e8]
mov rcx, rbx
call fcn.140003270
mov rbx, rax
test rax, rax
jne 0x14000347d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140003556
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003556
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140003556
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003556
cmp rsi, 0xffffffffffffffff
je 0x140003556
mov rax, qword [0x14016a040]
test rax, rax
je 0x1400034f3
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140003556
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140003543
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14016a040]
test rax, rax
je 0x140003538
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000355f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140003551
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140003561
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140006c00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x140006c37
mov r8d, 0x704
lea rdx, str.C:0x9_projectmenuloaderloaderglass_loaderglass_loader_black_glass_loader_simpleimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x14004bd90]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x14016a040]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140006cb6
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001ce40
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140015dd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14016a040]
mov edi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x140015e22
cmp byte [rbx + 0x4a5e], 0
jne 0x140015e22
movsx r9d, word [rbx + 0x5b5a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003080
test dil, 1
je 0x140015f48
jmp 0x140015ead
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400531f4]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x1400531e0]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mulss xmm0, dword [0x140053158]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b5a]
call fcn.140003080
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140015f00
lea r11, [0x14004bd90]
nop dword [rax]
cmp r9b, 0x23
jne 0x140015ee3
cmp byte [r8], r9b
jne 0x140015ee3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140015ed0
not ecx
call fcn.14000b2d0
test rax, rax
je 0x140015f48
cmp byte [rax + 0xae], 0
je 0x140015f48
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b5a]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b5a]
call fcn.140003080
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000dd80
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001b4a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c40], 0
lea rbx, [rcx + 0x5c48]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001b547
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001b4fa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001dd20
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400039b0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c40]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c50]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14016a038]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001b54f
mov rcx, rbx
call fcn.1400039b0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001bbf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x14016a040]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001bc54
lea r10, [0x14004bd90]
cmp r8b, 0x23
jne 0x14001bc37
cmp byte [rdx], r8b
jne 0x14001bc37
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001bc24
mov eax, dword [r14 + 0x5bb8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001bcb5
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001bc7a
cmp edi, eax
jl 0x14001bc94
mov r8d, 0x6fb
lea rdx, str.C:0x9_projectmenuloaderloaderglass_loaderglass_loader_black_glass_loader_simpleimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5bc0]
cmp dword [rax + rbp + 8], ebx
je 0x14001bcd2
mov eax, dword [r14 + 0x5bb8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001bc71
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001bcdf
cmp edi, dword [r14 + 0x5bb8]
jl 0x14001bcf9
mov r8d, 0x6fb
lea rdx, str.C:0x9_projectmenuloaderloaderglass_loaderglass_loader_black_glass_loader_simpleimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5bc0]
lea rax, [rax + rcx*8]
jmp 0x14001bcb7
Function at 0x140044b7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140044bc6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140044bc6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140044bc6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140044bc6
cmp dword [rcx + 0x84], 0xe
jbe 0x140044bc6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140044bc8
xor al, al
add rsp, 0x28
ret
Function at 0x1800019c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
cmp qword [rsp + 0x20], 0
je 0x180001a33
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
cmp qword [rsp], 0
je 0x180001a33
mov rax, qword [rsp]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x180001a33
mov rax, qword [rsp]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
cmp dword [rax], 0x4550
jne 0x180001a33
cmp qword [rsp + 0x28], 0
je 0x180001a2d
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 8]
mov qword [rax], rcx
mov rax, qword [rsp]
jmp 0x180001a35
xor eax, eax
add rsp, 0x18
ret
Function at 0x180005780
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea rax, str.kernelbase.dll
mov qword [rsp + 0x48], rax
lea rax, str.ntdll.dll
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
mov qword [sym.ArPotEx64.dll_AXS], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x34]
or eax, 2
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0x34], eax
mov rcx, qword [rsp + 0x60]
call fcn.180003e90
test eax, eax
jne 0x180005998
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x34]
and eax, 0x40
test eax, eax
je 0x180005998
cmp dword [0x180076264], 0xa
jb 0x180005998
mov rcx, qword [rsp + 0x60]
call fcn.180003e20
test eax, eax
jne 0x180005998
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x38]
and eax, 0x800000
test eax, eax
jne 0x180005848
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x38]
and eax, 0x20000000
test eax, eax
jne 0x180005848
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x38]
and eax, 0x80000000
test eax, eax
jne 0x180005848
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x38]
and eax, 0x40000000
test eax, eax
je 0x180005884
mov qword [rsp + 0x30], 0
lea rax, [0x180003020]
mov qword [rsp + 0x28], rax
lea rax, str.NtCreateThreadEx
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, qword [0x180075c38]
mov rcx, qword [rsp + 0x60]
call fcn.180002110
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x38]
and eax, 0x200000
test eax, eax
je 0x18000590d
mov qword [rsp + 0x30], 0
lea rax, [0x1800035a0]
mov qword [rsp + 0x28], rax
lea rax, [0x180073b10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, qword [0x180075c38]
mov rcx, qword [rsp + 0x60]
call fcn.180002110
mov qword [rsp + 0x30], 0
lea rax, [0x180003350]
mov qword [rsp + 0x28], rax
lea rax, str.NtCreateFile
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, qword [0x180075c38]
mov rcx, qword [rsp + 0x60]
call fcn.180002110
mov qword [rsp + 0x30], 0
lea rax, [0x1800039f0]
mov qword [rsp + 0x28], rax
lea rax, str.LdrLoadDll
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, qword [0x180075c38]
mov rcx, qword [rsp + 0x60]
call fcn.180002110
mov qword [rsp + 0x30], 0
lea rax, [0x180002b80]
mov qword [rsp + 0x28], rax
lea rax, [0x180073ad8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rdx, qword [0x180075c38]
mov rcx, qword [rsp + 0x60]
call fcn.180002110
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x34]
or eax, 4
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0x34], eax
jmp 0x18000599a
add rsp, 0x58
ret
Function at 0x1800069f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800069a0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180006b09
mov rax, qword [0x1800743e0]
cmp qword [rsp + 0x20], rax
jb 0x180006a4b
mov rax, qword [0x1800743e8]
cmp qword [rsp + 0x20], rax
ja 0x180006a4b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180006a0d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18005d420
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180006a7d
jmp 0x180006b09
cmp dword [rsp + 0x50], 0x10000
jne 0x180006ae7
cmp qword [rsp + 0x48], 0x10000
jb 0x180006ae7
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180006ac4
mov rax, qword [rsp + 0x28]
jmp 0x180006b0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
jne 0x180006ad5
xor eax, eax
jmp 0x180006b0b
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180006b04
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800069a0
mov qword [rsp + 0x20], rax
jmp 0x180006a0d
xor eax, eax
add rsp, 0x68
ret

Function at 0x180006b10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180006960
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180006c2d
mov rax, qword [0x1800743e0]
cmp qword [rsp + 0x20], rax
jb 0x180006b74
mov rax, qword [0x1800743e8]
cmp qword [rsp + 0x20], rax
ja 0x180006b74
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180006b36
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18005d420
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180006ba6
jmp 0x180006c2d
cmp dword [rsp + 0x50], 0x10000
jne 0x180006c10
cmp qword [rsp + 0x48], 0x10000
jb 0x180006c10
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180006bed
mov rax, qword [rsp + 0x28]
jmp 0x180006c2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
jne 0x180006bfe
xor eax, eax
jmp 0x180006c2f
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180006c28
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180006960
mov qword [rsp + 0x20], rax
jmp 0x180006b36
xor eax, eax
add rsp, 0x68
ret