joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push rbp
mov dh, 0x2a
invalid
popfq
je 0x14003f69a
jp 0x14003f69d
invalid
push rcx
mov edx, 0x31fadbc2
invalid
jmp qword [rbp + 0x58ae1ef1]
xchg edx, eax
cmpsd dword [rsi], dword [rdi]
pop rdi
invalid
sub r10b, r9b
cmp byte gs:[rcx], bh
mov ebx, dword [rdi + 0x14e323fe]
jmp 0x1049e9a3a
invalid
invalid
sbb al, 0x40
cdq
fmul dword [rbx]
mov cl, 0x9f
sub byte [rdi + 0x29d49ce6], bl
sbb al, 0x6a
add byte [rbp + 0x16], al
and byte [rbx + 0x6c], al
cmp ah, byte [rbx + rdx*4 + 0x40]
jo 0x14003f6dd
test eax, 0x2d615df8
pop rbp
invalid
sub eax, 0x637c7769
invalid
bnd jle str.0leO
jle str.0leO
invalid
ja 0x14003f792
invalid
mov eax, dword [r15 - 0x3f]
loopne 0x14003f76c
ror byte [rdi], cl
push rdi
push rsp
leave
imul eax, dword [rsi + 0x4f04d484], 0xb06da81d
xchg byte [rdx - 0x6bb08f82], al
xchg esp, eax
jmp 0xd3cc374d
enter 0xe93, 0x5e
lodsb al, byte [rsi]
xor byte [rbp + riz*2 + 0x4f], ch
mov dword [rbx + 0x4cf879ad], esi
adc eax, esi
jnp 0x14003f750
fcmovb st(0), st(6)
rol dword [rcx], 1
invalid
mov byte [rcx + 0x37b5806], al
or al, 0x3d
jno 0x14003f778
xchg ecx, eax
mov bh, al
int1
xchg dword [rbx - 0x313c5ee6], ebx
cmp ebx, dword [rbp + 0x2c]
cmp eax, 0x612d3c2d
jge 0x14003f801
or dword [rdi - 0x6d76c73], edx
jnp 0x14003f76b
jb 0x14003f76f
jg 0x14003f7df
mov eax, 0xd1463f65
invalid
sbb byte [rdx + 0x3a2989be], ch
sub dword [rdx], edi
or al, bh
mov edx, 0x1e9757cd
adc dword [rbx - 0x759f63f], ebx
push rsp
sub edi, dword [rcx - 0xd]
push rbx
push rdi
sal ch, cl
push rdx
cmpsd dword [rsi], dword [rdi]
sbb rax, 0x48a696ab
ret
cmpsb byte [rsi], byte [rdi]
ret
Function at 0x1400051dc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140005260
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400073d0]
cmp byte [rcx + rax], 0
je 0x140005260
dec r8
sub rdx, 1
jne 0x140005246
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140005fac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005ff6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005ff6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005ff6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005ff6
cmp dword [rcx + 0x84], 0xe
jbe 0x140005ff6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005ff8
xor al, al
add rsp, 0x28
ret
Function at 0x140002c96
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
mov dword [rcx], eax
lea rbx, [rsp + 0x50]
and dword [rbx], 0
mov qword [rcx + 8], rdx
and qword [rbx + 8], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rbx
and qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.CRYPT32.dll_CryptUnprotectData
mov rax, qword [rbx + 8]
mov ecx, dword [rbx]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rcx
mov rcx, rdi
call fcn.1400011f2
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400045f6
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
mov rax, rcx
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x140005103
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x1402023b8]
mov al, byte [rax]
cmp al, 1
jne 0x14000513f
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140005b94
lea r14, [rsp + 0x28]
mov rcx, r14
call fcn.14000cf48
mov rcx, r14
mov rdx, rbx
call fcn.140002dac
lea rbx, [rsp + 0x68]
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.14000da9f
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret
jmp fcn.140005054
Function at 0x140008418
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, r8
mov rcx, rdx
mov edi, 0xffffffff
test rsi, rsi
je 0x1400084a1
cmp rsi, rdi
mov edx, 0xffffffff
cmovb rdx, rsi
sub rsi, rdx
lea rbx, [rcx + rdx]
call sub.ADVAPI32.dll_SystemFunction036
mov rcx, rbx
test al, al
jne 0x14000842a
call fcn.14000786c
lea rcx, [rsp + 0x28]
mov qword [rcx], rax
lea rax, [rsp + 0x30]
mov qword [rax], rcx
lea rdx, [0x14015aea8]
lea rcx, [rsp + 0x40]
mov qword [rcx], rdx
mov edx, 1
mov qword [rcx + 8], rdx
and qword [rcx + 0x20], 0
lea r8, [case.0x140099e01.114]
mov qword [rax + 8], r8
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
lea rdx, str.C:Users55779.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rand_0.4.6_srcos.rscouldnt_generate_random_bytes:
call fcn.140149530
ud2
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret

Function at 0x14000cff8
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14002709a
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, r8d
mov rdi, rdx
mov rax, qword [rcx + 0xd8]
mov rdx, qword [rcx + 0xe0]
mov rcx, rax
call qword [rdx + 0xb8]
test rax, rax
je 0x1400270d6
mov rcx, rax
mov rdx, rdi
mov r8d, esi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140097f00
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140030145
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400299c8
mov al, byte [rbx]
cmp al, 0x14
jne 0x1400301a6
lea rbx, [rsp + 0x28]
movzx r8d, word [rbx + 2]
mov rcx, rbx
mov rdx, rdi
call fcn.1400297d4
cmp qword [rbx], 0
je 0x1400301e5
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
jmp 0x1400301cb
mov cl, byte [rsp + 0x29]
movzx edx, word [rsp + 0x2a]
mov r8d, dword [rsp + 0x3c]
mov dword [rsi + 0x1c], r8d
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsi + 0xc], xmm0
mov byte [rsi + 8], al
mov byte [rsi + 9], cl
mov word [rsi + 0xa], dx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r15, [rsp + 0x42]
mov rax, qword [r15 - 2]
movups xmm0, xmmword [r15 - 0x12]
lea rdi, [rsp + 0x80]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea rbx, [rsp + 0x48]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
lea r14, [rsp + 0x28]
mov rax, qword [rsp + 0x90]
cmp rax, qword [rsp + 0x88]
jae 0x1400302c5
mov rcx, r14
mov rdx, rdi
call fcn.14004e199
movzx ebp, word [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
cmp bp, 0x27
je 0x1400302e0
movzx eax, word [r15 + 4]
mov word [rsp + 0x24], ax
mov eax, dword [r15]
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x50]
jne 0x140030288
mov rcx, rbx
call fcn.14002e0b5
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x48]
shl rdx, 5
mov rcx, qword [rsp + 0x70]
mov qword [rax + rdx + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + rdx], xmm0
mov word [rax + rdx + 0x18], bp
mov ecx, dword [rsp + 0x20]
mov dword [rax + rdx + 0x1a], ecx
movzx ecx, word [rsp + 0x24]
mov word [rax + rdx + 0x1e], cx
inc qword [rsp + 0x58]
jmp 0x14003021a
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi + 8], xmm0
and qword [rsi], 0
jmp 0x1400301d2
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.14002f36e
mov rcx, rdi
call fcn.140009024
jmp 0x1400301d2
Function at 0x140030f4f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400299c8
mov al, byte [rbx]
cmp al, 0x14
jne 0x140030fb0
lea rbx, [rsp + 0x28]
movzx r8d, word [rbx + 2]
mov rcx, rbx
mov rdx, rdi
call fcn.1400297d4
cmp qword [rbx], 0
je 0x140030fef
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
jmp 0x140030fd5
mov cl, byte [rsp + 0x29]
movzx edx, word [rsp + 0x2a]
mov r8d, dword [rsp + 0x3c]
mov dword [rsi + 0x1c], r8d
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsi + 0xc], xmm0
mov byte [rsi + 8], al
mov byte [rsi + 9], cl
mov word [rsi + 0xa], dx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r15, [rsp + 0x42]
mov rax, qword [r15 - 2]
movups xmm0, xmmword [r15 - 0x12]
lea rdi, [rsp + 0x80]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea rbx, [rsp + 0x48]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
lea r14, [rsp + 0x28]
mov rax, qword [rsp + 0x90]
cmp rax, qword [rsp + 0x88]
jae 0x1400310cf
mov rcx, r14
mov rdx, rdi
call fcn.14004ca5a
movzx ebp, word [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
cmp bp, 0x28
je 0x1400310ea
movzx eax, word [r15 + 4]
mov word [rsp + 0x24], ax
mov eax, dword [r15]
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x50]
jne 0x140031092
mov rcx, rbx
call fcn.14002e0b5
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x48]
shl rdx, 5
mov rcx, qword [rsp + 0x70]
mov qword [rax + rdx + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + rdx], xmm0
mov word [rax + rdx + 0x18], bp
mov ecx, dword [rsp + 0x20]
mov dword [rax + rdx + 0x1a], ecx
movzx ecx, word [rsp + 0x24]
mov word [rax + rdx + 0x1e], cx
inc qword [rsp + 0x58]
jmp 0x140031024
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi + 8], xmm0
and qword [rsi], 0
jmp 0x140030fdc
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
lea rcx, [rsp + 0x48]
call fcn.14002e6e3
jmp 0x140030fdc
Function at 0x140031112
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x38]
mov rcx, rbx
call fcn.1400299c8
mov al, byte [rbx]
cmp al, 0x14
jne 0x140031175
lea rbx, [rsp + 0x38]
movzx r8d, word [rbx + 2]
mov rcx, rbx
mov rdx, rdi
call fcn.1400297d4
cmp qword [rbx], 0
je 0x1400311b6
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
jmp 0x14003119a
mov cl, byte [rsp + 0x39]
movzx edx, word [rsp + 0x3a]
mov r8d, dword [rsp + 0x4c]
mov dword [rsi + 0x1c], r8d
movups xmm0, xmmword [rsp + 0x3c]
movups xmmword [rsi + 0xc], xmm0
mov byte [rsi + 8], al
mov byte [rsi + 9], cl
mov word [rsi + 0xa], dx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r15, [rsp + 0x3a]
mov rax, qword [r15 + 0x16]
movups xmm0, xmmword [r15 + 6]
lea rdi, [rsp + 0x80]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea rbx, [rsp + 0x20]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
lea r14, [rsp + 0x38]
mov rax, qword [rsp + 0x90]
cmp rax, qword [rsp + 0x88]
jae 0x140031274
mov rcx, r14
mov rdx, rdi
call fcn.14004b4c1
movzx ebp, word [rsp + 0x38]
cmp bp, 0xf
je 0x14003128f
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0xe]
movups xmmword [rsp + 0x6e], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov r12, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
cmp rdx, qword [rsp + 0x28]
jne 0x140031244
mov rcx, rbx
call fcn.14002e09a
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
imul rcx, rdx, 0x28
mov word [rax + rcx], bp
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + rcx + 2], xmm0
movups xmm0, xmmword [rsp + 0x6e]
movups xmmword [rax + rcx + 0x10], xmm0
mov qword [rax + rcx + 0x20], r12
inc qword [rsp + 0x30]
jmp 0x1400311eb
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi + 8], xmm0
and qword [rsi], 0
jmp 0x1400311a1
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x76], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x66], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.14002f27d
mov rcx, rdi
call fcn.14002e1a8
jmp 0x1400311a1
Function at 0x1400315af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400299c8
mov al, byte [rbx]
cmp al, 0x14
jne 0x140031610
lea rbx, [rsp + 0x28]
movzx r8d, word [rbx + 2]
mov rcx, rbx
mov rdx, rdi
call fcn.1400297d4
cmp qword [rbx], 0
je 0x14003164f
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
jmp 0x140031635
mov cl, byte [rsp + 0x29]
movzx edx, word [rsp + 0x2a]
mov r8d, dword [rsp + 0x3c]
mov dword [rsi + 0x1c], r8d
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsi + 0xc], xmm0
mov byte [rsi + 8], al
mov byte [rsi + 9], cl
mov word [rsi + 0xa], dx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r15, [rsp + 0x42]
mov rax, qword [r15 - 2]
movups xmm0, xmmword [r15 - 0x12]
lea rdi, [rsp + 0x80]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea rbx, [rsp + 0x48]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
lea r14, [rsp + 0x28]
mov rax, qword [rsp + 0x90]
cmp rax, qword [rsp + 0x88]
jae 0x14003172f
mov rcx, r14
mov rdx, rdi
call fcn.14004db78
movzx ebp, word [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
cmp bp, 0x28
je 0x14003174a
movzx eax, word [r15 + 4]
mov word [rsp + 0x24], ax
mov eax, dword [r15]
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x50]
jne 0x1400316f2
mov rcx, rbx
call fcn.14002e0b5
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x48]
shl rdx, 5
mov rcx, qword [rsp + 0x70]
mov qword [rax + rdx + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + rdx], xmm0
mov word [rax + rdx + 0x18], bp
mov ecx, dword [rsp + 0x20]
mov dword [rax + rdx + 0x1a], ecx
movzx ecx, word [rsp + 0x24]
mov word [rax + rdx + 0x1e], cx
inc qword [rsp + 0x58]
jmp 0x140031684
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi + 8], xmm0
and qword [rsi], 0
jmp 0x14003163c
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.14002f2e3
mov rcx, rdi
call fcn.140009024
jmp 0x14003163c
Function at 0x140031c43
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400299c8
mov al, byte [rbx]
cmp al, 0x14
jne 0x140031ca4
lea rbx, [rsp + 0x28]
movzx r8d, word [rbx + 2]
mov rcx, rbx
mov rdx, rdi
call fcn.1400297d4
cmp qword [rbx], 0
je 0x140031ce3
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
jmp 0x140031cc9
mov cl, byte [rsp + 0x29]
movzx edx, word [rsp + 0x2a]
mov r8d, dword [rsp + 0x3c]
mov dword [rsi + 0x1c], r8d
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsi + 0xc], xmm0
mov byte [rsi + 8], al
mov byte [rsi + 9], cl
mov word [rsi + 0xa], dx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r15, [rsp + 0x42]
mov rax, qword [r15 - 2]
movups xmm0, xmmword [r15 - 0x12]
lea rdi, [rsp + 0x80]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea rbx, [rsp + 0x48]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
lea r14, [rsp + 0x28]
mov rax, qword [rsp + 0x90]
cmp rax, qword [rsp + 0x88]
jae 0x140031dc3
mov rcx, r14
mov rdx, rdi
call fcn.14004be58
movzx ebp, word [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
cmp bp, 0x29
je 0x140031dde
movzx eax, word [r15 + 4]
mov word [rsp + 0x24], ax
mov eax, dword [r15]
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x50]
jne 0x140031d86
mov rcx, rbx
call fcn.14002e0b5
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x48]
shl rdx, 5
mov rcx, qword [rsp + 0x70]
mov qword [rax + rdx + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + rdx], xmm0
mov word [rax + rdx + 0x18], bp
mov ecx, dword [rsp + 0x20]
mov dword [rax + rdx + 0x1a], ecx
movzx ecx, word [rsp + 0x24]
mov word [rax + rdx + 0x1e], cx
inc qword [rsp + 0x58]
jmp 0x140031d18
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi + 8], xmm0
and qword [rsi], 0
jmp 0x140031cd0
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.14002f55a
mov rcx, rdi
call fcn.140009024
jmp 0x140031cd0
Function at 0x140032270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.1400299c8
mov al, byte [rbx]
cmp al, 0x14
jne 0x1400322d1
lea rbx, [rsp + 0x28]
movzx r8d, word [rbx + 2]
mov rcx, rbx
mov rdx, rdi
call fcn.1400297d4
cmp qword [rbx], 0
je 0x140032310
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 8], xmm0
jmp 0x1400322f6
mov cl, byte [rsp + 0x29]
movzx edx, word [rsp + 0x2a]
mov r8d, dword [rsp + 0x3c]
mov dword [rsi + 0x1c], r8d
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsi + 0xc], xmm0
mov byte [rsi + 8], al
mov byte [rsi + 9], cl
mov word [rsi + 0xa], dx
mov qword [rsi], 1
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r15, [rsp + 0x42]
mov rax, qword [r15 - 2]
movups xmm0, xmmword [r15 - 0x12]
lea rdi, [rsp + 0x80]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], rax
lea rbx, [rsp + 0x48]
mov qword [rbx], 8
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
lea r14, [rsp + 0x28]
mov rax, qword [rsp + 0x90]
cmp rax, qword [rsp + 0x88]
jae 0x1400323f0
mov rcx, r14
mov rdx, rdi
call fcn.14004a3a5
movzx ebp, word [rsp + 0x40]
movups xmm0, xmmword [rsp + 0x28]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
cmp bp, 0xb
je 0x14003240b
movzx eax, word [r15 + 4]
mov word [rsp + 0x24], ax
mov eax, dword [r15]
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x50]
jne 0x1400323b3
mov rcx, rbx
call fcn.14002e0b5
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x48]
shl rdx, 5
mov rcx, qword [rsp + 0x70]
mov qword [rax + rdx + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + rdx], xmm0
mov word [rax + rdx + 0x18], bp
mov ecx, dword [rsp + 0x20]
mov dword [rax + rdx + 0x1a], ecx
movzx ecx, word [rsp + 0x24]
mov word [rax + rdx + 0x1e], cx
inc qword [rsp + 0x58]
jmp 0x140032345
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x18], rax
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsi + 8], xmm0
and qword [rsi], 0
jmp 0x1400322fd
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 1
lea rcx, [rsp + 0x48]
call fcn.14002e6c0
jmp 0x1400322fd