joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, qword [0x1400be390]
mov rdi, rcx
movsxd rbp, edx
imul rbx, rbp, 0x70
add rbx, qword [rcx + 0x18]
cmp rbx, qword [rcx + 0x18]
jb 0x14004e1d5
cmp rbx, qword [rcx + 0x20]
jb 0x14004e1ef
mov r8d, 0x27d
lea rdx, str.D:TheVaultimgui_dockingimgui_internal.h
lea rcx, str.p___Data__p___DataEnd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r9, qword [rdi + 0x188]
mov dword [rdi + 0x74], ebp
test dword [rbx], 0x10000
movss xmm2, dword [rbx + 0x34]
je 0x14004e20e
addss xmm2, dword [rdi + 0x90]
movaps xmm0, xmm2
lea rbp, [r9 + 0x140]
subss xmm0, dword [r9 + 0x58]
movss dword [rbp], xmm2
movss xmm1, dword [rdi + 0x88]
addss xmm1, dword [rdi + 0x7c]
movss dword [r9 + 0x158], xmm2
subss xmm0, dword [r9 + 0x184]
movss dword [r9 + 0x148], xmm2
movss dword [r9 + 0x144], xmm1
movss dword [r9 + 0x188], xmm0
mov eax, dword [rdi + 0x8c]
mov dword [r9 + 0x178], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x198], eax
movss dword [r9 + 0x25c], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x258], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x260], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1fc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xf8], al
cmp byte [rbx + 0x68], 0
je 0x14004e2bb
xor eax, eax
mov dword [rsi + 0x4ab8], eax
mov dword [rsi + 0x4ac0], eax
test dword [rdi + 4], 0x100000
je 0x14004e2cf
mov r8d, 2
jmp 0x14004e34f
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2e0]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x278], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2e0]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x2e0]
mov rcx, qword [rdi + 0x1a0]
call fcn.140041b80
cmp byte [rsi + 0x61b8], 0
je 0x14004e38d
cmp byte [rbx + 0x68], 0
jne 0x14004e38d
xor r8d, r8d
lea rdx, [0x1400ac1f0]
mov rcx, rbp
call fcn.1400224a0
mov dword [rsi + 0x61e8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400507a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400be390]
mov ebx, ecx
mov rdi, qword [rax + 0x4f78]
cmp ecx, 0xffffffff
jne 0x1400507c6
cmp dword [rdi + 0x74], ecx
cmovne ebx, dword [rdi + 0x74]
mov eax, dword [rdi + 0x6c]
cmp ebx, eax
jne 0x1400507d4
mov ebx, 0xffffffff
jmp 0x1400507d9
cmp ebx, 0xffffffff
jl 0x1400507dd
cmp ebx, eax
jl 0x1400507f7
mov r8d, 0xcce
lea rdx, str.D:TheVaultimgui_dockingimgui_tables.cpp
lea rcx, str.column_n____1__column_n___table__ColumnsCount
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test byte [rdi + 4], 7
je 0x140050867
mov r10d, dword [rdi]
lea r8, [0x1400aca59]
movzx eax, word [rdi + 0x78]
lea r11, [0x1400a4160]
not r10d
mov byte [rdi + 0x23b], 1
mov ecx, r10d
mov word [rdi + 0x224], bx
mov word [rdi + 0x7a], ax
mov r9b, 0x23
nop dword [rax]
cmp r9b, 0x23
jne 0x140050843
cmp byte [r8], r9b
jne 0x140050843
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140050830
not ecx
call fcn.14001bb30
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140060710
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r10d, 0xffffffff
movaps xmmword [rsp + 0x30], xmm6
mov ecx, r10d
lea r8, [0x1400a10e1]
movaps xmm6, xmm3
lea rbx, [0x1400a4160]
mov r11, rdx
mov r9b, 0x23
cmp r9b, 0x23
jne 0x140060757
cmp byte [r8], r9b
jne 0x140060757
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140060744
not ecx
call fcn.14000e570
mov rbx, qword [0x1400be390]
mov rsi, rax
test r11, r11
jne 0x1400607bd
lea rdi, [rbx + 0x4c30]
cmp dword [rdi], r11d
jg 0x1400607b6
mov r8d, 0x7b6
lea rdx, str.D:TheVaultimgui_dockingimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [0x1400be390]
mov rax, qword [rdi + 8]
mov r11, qword [rax]
xor edi, edi
test rsi, rsi
je 0x1400607d1
cmp word [rsi + 0x100], di
jne 0x14006086b
movss xmm1, dword [r11 + 0x130]
movss xmm0, dword [r11 + 0x10]
movaps xmm3, xmm1
addss xmm3, dword [r11 + 8]
movss xmm2, dword [r11 + 0x134]
subss xmm0, xmm1
addss xmm2, dword [r11 + 0xc]
xorps xmm1, xmm1
addss xmm0, dword [r11 + 0x138]
or dword [rbx + 0x4af8], 3
mov qword [rbx + 0x4b14], rdi
mov dword [rbx + 0x4afc], 1
mov byte [rbx + 0x4b38], 1
maxss xmm1, xmm0
movaps xmm0, xmm3
unpcklps xmm0, xmm2
movsd qword [rbx + 0x4b0c], xmm0
mov dword [rbx + 0x4b00], 1
addss xmm1, xmm3
subss xmm1, xmm3
movaps xmm0, xmm1
unpcklps xmm0, xmm6
movsd qword [rbx + 0x4b1c], xmm0
addss xmm6, dword [r11 + 0x134]
movss dword [r11 + 0x134], xmm6
mov eax, dword [r11]
lea rcx, [rbx + 0x4ba8]
or dword [rbx + 0x4af8], 0x200
lea rdx, [rsp + 0x20]
mov dword [rbx + 0x4b64], eax
movss xmm0, dword [rbx + 0x3a10]
movss dword [rsp + 0x24], xmm0
mov dword [rsp + 0x20], 3
call fcn.140033ce0
mov dword [rbx + 0x3a10], edi
lea rdx, [rsp + 0x20]
mov rbx, qword [0x1400be390]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x3a18]
lea rcx, [rbx + 0x4ba8]
movss xmm0, dword [rbx + 0x3a1c]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.140033ce0
xor edx, edx
mov qword [rbx + 0x3a18], rdi
mov r8d, 0x8050f
lea rcx, str.MainMenuBar
call fcn.140011d20
mov ecx, 2
movzx ebx, al
call fcn.140005510
mov rsi, qword [rsp + 0x58]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x1400838e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov qword [rsp + 0x68], 0
mov r9, rdx
lea rcx, [rsp + 0x50]
mov edx, 1
mov rdi, r8
lea r8d, [rdx + 3]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 4
jne 0x140083a06
mov r9, rbx
lea edx, [rax - 3]
lea r8d, [rax + 2]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 6
jne 0x140083a06
mov r9, rbx
lea edx, [rax - 5]
lea r8d, [rax + 2]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 8
jne 0x140083a06
mov r9, rbx
lea edx, [rax - 7]
lea r8d, [rax + 8]
lea rcx, [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 0x10
jne 0x140083a06
mov ecx, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x20]
movups xmm0, xmmword [rsp + 0x28]
bswap ecx
mov eax, ecx
mov word [rdi + 2], cx
shr eax, 0x10
mov word [rdi], ax
bswap r8
bswap rdx
mov rax, rdx
mov rcx, r8
shr rax, 0x28
mov dword [rdi + 4], eax
mov rax, r8
shr rax, 0x2c
mov dword [rdi + 0xc], eax
mov rax, r8
shr rcx, 0x24
shr rax, 0x29
and cl, 0x1f
inc cl
shr rdx, 0x10
and al, 7
mov byte [rdi + 0x11], cl
inc al
and edx, 0xffffff
movabs rcx, 0xfffffffff
mov byte [rdi + 0x10], al
and r8, rcx
mov dword [rdi + 8], edx
mov qword [rdi + 0x18], r8
mov eax, 1
movups xmmword [rdi + 0x20], xmm0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x140083c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x60
mov rbx, rcx
mov dword [rcx + 0x18], 0
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov r8d, 4
call fcn.140071a10
cmp rax, 4
jne 0x140083d6a
mov ecx, dword [rsp + 0x88]
bswap ecx
mov edi, ecx
mov eax, ecx
shr edi, 0x1f
and ecx, 0xffffff
shr eax, 0x18
test al, 0x7f
jne 0x140083cc0
cmp ecx, 0x22
jne 0x140083cc0
mov rdx, qword [rsp + 0x90]
lea r8, [rsp + 0x30]
call fcn.1400838e0
test eax, eax
je 0x140083d6a
mov ecx, dword [rsp + 0x3c]
xor edi, 1
mov dword [rbx + 0x30], ecx
mov eax, 1
movzx ecx, byte [rsp + 0x40]
mov byte [rbx + 0x34], cl
movzx ecx, byte [rsp + 0x41]
mov byte [rbx + 0x35], cl
mov rcx, qword [rsp + 0x48]
mov qword [rbx + 0x38], rcx
movzx ecx, word [rsp + 0x32]
mov word [rbx + 0x40], cx
mov dword [rbx + 0x50], 1
mov dword [rbx + 0x54], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
cmp dword [rsp + 0xa0], 0
je 0x140083d6a
lea r8, [rbx + 0x10a8]
mov qword [rbx + 0x50], 0
lea rcx, [rbx + 0x58]
xor edx, edx
call fcn.140081c90
test eax, eax
je 0x140083d6a
cmp byte [rbx + 0x10bb], 0
je 0x140083d6a
movsx rdi, byte [rbx + 0x10ba]
mov eax, dword [rbx + 0x10b4]
mov dword [rbx + 0x30], eax
mov dword [rsp + 0x20], 0x4030201
mov dword [rsp + 0x24], 0x8070605
mov word [rsp + 0x28], 0x202
mov byte [rsp + 0x2a], 2
cmp dil, 0xa
jle 0x140083d42
mov r8d, 0x15d9
lea rdx, str.D:TheVaultimgui_dockingexamplesSnes_Seqdr_libs_masterdr_flac.h
lea rcx, str.channelAssignment___10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movzx eax, byte [rbx + 0x10bb]
movzx ecx, byte [rsp + rdi + 0x20]
mov byte [rbx + 0x35], al
mov eax, 1
mov byte [rbx + 0x34], cl
mov word [rbx + 0x40], 0xffff
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x140084b30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
je 0x140084cea
xor eax, eax
xorps xmm0, xmm0
mov dword [rcx + 0x1c], eax
xor edx, edx
movups xmmword [rcx + 0x30], xmm0
mov r8d, 0x1000
movups xmmword [rcx + 0x40], xmm0
mov qword [rcx + 0x50], rax
add rcx, 0x88
call sub.VCRUNTIME140.dll_memset
xor eax, eax
lea rcx, [rbx + 0x10a4]
xor edx, edx
mov qword [rbx + 0x1090], rax
mov r8d, 0x14c
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsp + 0x78]
lea rdx, [fcn.140071a10]
mov rax, qword [rsp + 0x80]
lea rcx, [0x1400853e0]
xor ebp, ebp
mov qword [rbx], rdx
mov qword [rbx + 8], rcx
mov r9, rdi
mov qword [rbx + 0x58], rdx
mov qword [rbx + 0x60], rcx
lea rcx, [rsp + 0x70]
lea edx, [rbp + 1]
mov qword [rbx + 0x10], rbp
lea r8d, [rbp + 4]
mov dword [rbx + 0x18], 2
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x68], rdi
mov dword [rbx + 0x80], 0x200
mov dword [rbx + 0x84], 0x40
mov qword [rbx + 0x1088], rbp
mov qword [rbx + 0x70], rbp
mov qword [rbx + 0x78], rbp
mov qword [rbx + 0x1098], rbp
mov dword [rbx + 0x10a0], ebp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 4
jne 0x140084cea
nop dword [rax]
add qword [rbx + 0x48], 4
mov eax, dword [rsp + 0x70]
cmp al, 0x49
jne 0x140084d01
cmp byte [rsp + 0x71], 0x44
jne 0x140084cea
cmp byte [rsp + 0x72], 0x33
jne 0x140084cea
mov edx, 1
lea rcx, [rsp + 0x68]
mov r9, rdi
lea r8d, [rdx + 5]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 6
jne 0x140084cea
add qword [rbx + 0x48], rax
mov r8d, 1
mov ecx, dword [rsp + 0x6a]
bswap ecx
mov edx, ecx
mov eax, ecx
shr edx, 1
and eax, 0x7f0000
and edx, 0x3f800000
or edx, eax
mov eax, ecx
shr edx, 1
and ecx, 0x7f
and eax, 0x7f00
or edx, eax
shr edx, 1
or edx, ecx
mov rcx, rdi
test byte [rsp + 0x69], 0x10
lea esi, [rdx + 0xa]
cmove esi, edx
mov edx, esi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140084cea
mov edx, 1
mov eax, esi
add qword [rbx + 0x48], rax
lea rcx, [rsp + 0x70]
mov r9, rdi
lea r8d, [rdx + 3]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 4
je 0x140084c30
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp al, 0x66
jne 0x140084d2d
cmp byte [rsp + 0x71], 0x4c
jne 0x140084cea
cmp byte [rsp + 0x72], 0x61
jne 0x140084cea
cmp byte [rsp + 0x73], 0x43
jne 0x140084cea
mov dword [rsp + 0x30], ebp
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.140083c00
jmp 0x140084cec
cmp al, 0x4f
jne 0x140084cea
cmp byte [rsp + 0x71], 0x67
jne 0x140084cea
cmp byte [rsp + 0x72], 0x67
jne 0x140084cea
cmp byte [rsp + 0x73], 0x53
jne 0x140084cea
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call fcn.1400846d0
jmp 0x140084cec
Function at 0x14008c9e0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov dword [r11 + 0x18], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r15d, r15d
mov qword [rcx + 0x10], 0xd
mov qword [rcx + 0x18], 0xf
movsd xmm0, qword [str.FileNotFound_]
movsd qword [rcx], xmm0
mov eax, dword [0x1400b0a28]
mov dword [rcx + 8], eax
movzx eax, byte [0x1400b0a2c]
mov byte [rcx + 0xc], al
mov byte [rcx + 0xd], r15b
mov dword [r11 + 0x18], 1
mov rcx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14008ca59
mov rcx, qword [rdx]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14008cb32
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rcx, eax
mov rdx, qword [rdi + 0x10]
cmp rcx, rdx
ja 0x14008cabb
mov qword [rdi + 0x10], rcx
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14008cab5
mov rax, qword [rdi]
mov byte [rax + rcx], 0
jmp 0x14008cb06
mov r14, rcx
sub r14, rdx
mov r8, qword [rdi + 0x18]
mov rax, r8
sub rax, rdx
cmp r14, rax
ja 0x14008caf8
mov qword [rdi + 0x10], rcx
mov rax, rdi
cmp r8, 0x10
jb 0x14008cae0
mov rax, qword [rdi]
lea rbx, [rax + rdx]
mov r8, r14
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov byte [r14 + rbx], 0
jmp 0x14008cb06
mov r9, r14
mov rdx, r14
mov rcx, rdi
call fcn.1400944d0
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14008cb13
mov rdx, qword [rdi]
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, dword [rdi + 0x10]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14008cb68
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14008cb63
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cb8e
mov rcx, r8
call fcn.1400982e8
mov rax, rdi
mov byte [rsi], 0
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], r15
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14009895c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400989a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400989a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400989a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400989a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400989a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400989a8
xor al, al
add rsp, 0x28
ret
Function at 0x140004560
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x14044f7b8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.140167df0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x14044f7b8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x1400046f0
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000470c
cmp rcx, r8
jl 0x1400046ff
mov qword [rdx + 0x80], rcx
test dword [0x140449058], 1
je 0x14000473b
cmp byte [rsp + 0xd0], 0
je 0x14000473b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140004260
mov rsp, r8
jmp rax
Function at 0x140004740
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x14044f7b8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140005170
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x14000ed00
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x14000ed3d
test rdx, rdx
je 0x14000ed3d
mov rax, qword [rax]
cmp rax, r9
jne 0x14000ed20
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret