joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018d90
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400bb040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x58]
mov r12d, edx
mov r14d, ecx
mov rdi, qword [rax]
mov eax, 8
mov ebp, eax
cmp byte [rdi + rax], 0
jne 0x140018ddf
call fcn.140082398
mov eax, 0x10
mov r15d, eax
mov rbx, qword [rax + rdi]
mov r13, qword [rbx + 0x4148]
movsxd rsi, dword [rbx + 0x4c08]
test r12b, 0x20
je 0x140018e13
mov edx, 0x80
xor ecx, ecx
call fcn.140018b40
test al, al
jne 0x140018f80
movsxd rcx, dword [r13 + 0x130]
xor eax, eax
mov r12d, dword [rbx + 0x40a0]
xorps xmm0, xmm0
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x4ca8]
mov qword [rsp + 0x38], rax
mov rax, qword [r13 + 0x138]
movdqu xmmword [rsp + 0x4c], xmm0
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x28], r14d
mov ecx, dword [rax + rcx*4 - 4]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x44], r12d
call fcn.14001b200
movsd xmm0, qword [rax]
lea rax, [rbx + 0xe50]
movsd qword [rsp + 0x4c], xmm0
test rax, rax
jne 0x140018e9a
cmp byte [rdi + rbp], al
jne 0x140018e90
call fcn.140082398
mov rax, qword [r15 + rdi]
add rax, 0xe50
movss xmm0, dword [rax]
movss xmm1, dword [0x1400adefc]
comiss xmm0, xmm1
movss xmm2, dword [rax + 4]
jb 0x140018ebc
comiss xmm2, xmm1
lea rax, [rbx + 0xe50]
jae 0x140018ec1
lea rax, [rsp + 0x4c]
test byte [rbx + 0x61fc], 4
movss xmm0, dword [rax]
movss dword [rsp + 0x54], xmm0
movss xmm1, dword [rax + 4]
movss dword [rsp + 0x58], xmm1
je 0x140018eee
mov edx, r14d
lea rcx, str._popup__OpenPopupEx_0x_08X__n
call fcn.14002cab0
lea rcx, [rbx + 0x4bf8]
lea eax, [rsi + 1]
cmp dword [rcx], eax
jl 0x140018f76
mov rdx, qword [rbx + 0x4c00]
imul rcx, rsi, 0x38
cmp dword [rcx + rdx], r14d
jne 0x140018f22
mov eax, dword [rbx + 0x40a0]
dec eax
cmp dword [rcx + rdx + 0x1c], eax
jne 0x140018f22
mov dword [rcx + rdx + 0x1c], r12d
jmp 0x140018f80
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, 8
cmp byte [rax + rdi], 0
jne 0x140018f3e
call fcn.140082398
mov eax, 0x10
mov rdi, qword [rax + rdi]
test byte [rdi + 0x61fc], 4
je 0x140018f61
xor r8d, r8d
lea rcx, str._popup__ClosePopupToLevel__d___restore_focus_to_window_under_popup_d_n
mov edx, esi
call fcn.14002cab0
lea rcx, [rdi + 0x4bf8]
mov edx, esi
call fcn.14002dc10
lea rcx, [rbx + 0x4bf8]
lea rdx, [rsp + 0x28]
call fcn.14002db50
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400820c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001cfc0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov r12d, 8
mov rbx, qword [rax]
cmp byte [rbx + r12], 0
jne 0x14001cff7
call fcn.140082398
mov r15d, 0x10
mov qword [rsp + 0x90], rsi
mov rdi, qword [r15 + rbx]
mov eax, dword [rdi + 8]
test al, 2
je 0x14001d01b
test byte [rdi + 0xc], 1
je 0x14001d01b
mov sil, 1
jmp 0x14001d01e
xor sil, sil
test al, 1
je 0x14001d038
xor r8d, r8d
mov edx, 0xffffffff
mov ecx, 0x20e
call fcn.140014660
test al, al
jne 0x14001d05b
test sil, sil
je 0x14001d22b
xor r8d, r8d
mov edx, 0xffffffff
mov ecx, 0x27a
call fcn.140014660
test al, al
je 0x14001d22b
test byte [rdi + 0x61fc], 8
je 0x14001d070
lea rcx, str._nav__NavUpdateCancelRequest___n
call fcn.14002cab0
cmp dword [rdi + 0x41ac], 0
je 0x14001d087
xor edx, edx
xor ecx, ecx
call fcn.140007b40
jmp 0x14001d22b
cmp dword [rdi + 0x4ce0], 0
je 0x14001d0bc
xor ecx, ecx
call fcn.14001afd0
cmp byte [rbx + r12], 0
jne 0x14001d0a3
call fcn.140082398
mov rax, qword [r15 + rbx]
mov word [rax + 0x4cf1], 1
mov byte [rax + 0x4cf3], 1
jmp 0x14001d22b
mov rbx, qword [rdi + 0x4ca8]
test rbx, rbx
je 0x14001d1d3
cmp rbx, qword [rbx + 0x3c0]
je 0x14001d1d3
test dword [rbx + 0x14], 0x4000000
jne 0x14001d1d3
mov rsi, qword [rbx + 0x3b0]
test rsi, rsi
je 0x14001d1d3
movaps xmmword [rsp + 0x60], xmm6
xor edx, edx
movss xmm6, dword [rbx + 0x60]
mov rcx, rsi
movaps xmmword [rsp + 0x50], xmm7
movss xmm7, dword [rbx + 0x64]
movaps xmmword [rsp + 0x40], xmm8
movss xmm8, dword [rbx + 0x58]
movaps xmmword [rsp + 0x30], xmm9
movss xmm9, dword [rbx + 0x5c]
call fcn.140012cc0
movss xmm2, dword [rsi + 0x150]
lea r9, [rsp + 0x20]
movss xmm3, dword [rsi + 0x154]
movaps xmm0, xmm8
mov ecx, dword [rbx + 0xbc]
addss xmm8, xmm6
movaps xmm1, xmm9
subss xmm0, xmm2
addss xmm9, xmm7
xor r8d, r8d
subss xmm1, xmm3
xor edx, edx
subss xmm8, xmm2
movss dword [rsp + 0x20], xmm0
subss xmm9, xmm3
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm8
movss dword [rsp + 0x2c], xmm9
call fcn.140019ef0
mov rax, qword gs:[0x58]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
mov rbx, qword [rax]
movaps xmm6, xmmword [rsp + 0x60]
cmp byte [r12 + rbx], 0
jne 0x14001d1bd
call fcn.140082398
mov rcx, qword [r15 + rbx]
mov word [rcx + 0x4cf1], 1
mov byte [rcx + 0x4cf3], 1
jmp 0x14001d22b
movsxd rdx, dword [rdi + 0x4bf8]
test edx, edx
jle 0x14001d209
mov rax, qword [rdi + 0x4c00]
imul rcx, rdx, 0x38
mov r8, qword [rcx + rax - 0x30]
test r8, r8
je 0x14001d209
test dword [r8 + 0x14], 0x8000000
jne 0x14001d209
lea ecx, [rdx - 1]
mov dl, 1
call fcn.1400190e0
jmp 0x14001d22b
xor ecx, ecx
test rbx, rbx
je 0x14001d225
mov eax, dword [rbx + 0x14]
bt eax, 0x1a
jb 0x14001d21f
bt eax, 0x18
jb 0x14001d225
mov dword [rbx + 0x3f0], ecx
mov dword [rdi + 0x4cb0], ecx
mov rsi, qword [rsp + 0x90]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14001f010
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword gs:[0x58]
mov rsi, rcx
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm8
mov rbx, qword [rax]
mov eax, 8
movaps xmmword [rsp + 0x30], xmm9
cmp byte [rax + rbx], 0
jne 0x14001f057
call fcn.140082398
movups xmm6, xmmword [rsi]
mov eax, 0x10
movss xmm0, dword [0x1400add7c]
movaps xmm9, xmm6
movaps xmm8, xmm6
shufps xmm8, xmm6, 0x55
movaps xmm7, xmm6
mov rax, qword [rax + rbx]
shufps xmm7, xmm6, 0xaa
shufps xmm6, xmm6, 0xff
mov rdi, qword [rax + 0x4148]
movss xmm1, dword [rdi + 0x278]
movss xmm3, dword [rdi + 0x27c]
maxss xmm9, xmm1
movss xmm2, dword [rdi + 0x280]
maxss xmm8, xmm3
minss xmm6, dword [rdi + 0x284]
minss xmm7, xmm2
subss xmm9, xmm0
subss xmm8, xmm0
addss xmm6, xmm0
addss xmm7, xmm0
comiss xmm9, xmm1
jb 0x14001f0ed
comiss xmm8, xmm3
jb 0x14001f0ed
comiss xmm2, xmm7
jb 0x14001f0ed
movss xmm0, dword [rdi + 0x284]
comiss xmm0, xmm6
jb 0x14001f0ed
xor bpl, bpl
jmp 0x14001f14b
mov rcx, qword [rdi + 0x2e0]
lea r8, [rsp + 0x90]
xor r9d, r9d
lea rdx, [rsp + 0x98]
mov bpl, 1
mov rax, qword [rcx + 0x38]
movss xmm0, dword [rax + 0x24]
movss xmm1, dword [rax + 0x28]
movss dword [rsp + 0x90], xmm0
movss xmm0, dword [rax + 0x1c]
movss dword [rsp + 0x94], xmm1
movss xmm1, dword [rax + 0x20]
movss dword [rsp + 0x98], xmm0
movss dword [rsp + 0x9c], xmm1
call fcn.140036c00
movss xmm1, dword [0x1400add1c]
mov ecx, 0x32
mov rbx, qword [rdi + 0x2e0]
call fcn.140003e00
mov r14d, eax
test eax, 0xff000000
je 0x14001f21a
movss xmm0, dword [0x1400adcd4]
lea r8, [rsp + 0x90]
xor esi, esi
addss xmm9, xmm0
test byte [rbx + 0x30], 1
addss xmm8, xmm0
xorps xmm3, xmm3
mov dword [rsp + 0x20], esi
lea rdx, [rsp + 0x98]
mov rcx, rbx
movss dword [rsp + 0x98], xmm9
movss dword [rsp + 0x9c], xmm8
je 0x14001f1c4
subss xmm7, xmm0
subss xmm6, xmm0
jmp 0x14001f1d4
subss xmm7, dword [0x1400adcd0]
subss xmm6, dword [0x1400adcd0]
movss dword [rsp + 0x90], xmm7
movss dword [rsp + 0x94], xmm6
call fcn.140038e40
movss xmm0, dword [0x1400add50]
mov r9d, r14d
mov r8d, dword [rbx + 0x78]
mov rcx, rbx
mov rdx, qword [rbx + 0x80]
movss dword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 1
call fcn.140037040
mov dword [rbx + 0x78], esi
test bpl, bpl
je 0x14001f256
mov rcx, qword [rdi + 0x2e0]
mov eax, dword [rcx + 0x58]
sub eax, 1
mov dword [rcx + 0x58], eax
jne 0x14001f23b
mov rax, qword [rcx + 0x38]
add rax, 0x1c
jmp 0x14001f247
dec eax
cdqe
shl rax, 4
add rax, qword [rcx + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rcx + 0x88], xmm0
call fcn.140036990
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14001f280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x61c0], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x14001f303
xor edx, edx
add rcx, 0x61c8
call fcn.14002daa0
mov r8, rsi
lea rcx, [rbx + 0x61c8]
mov rdx, rbp
call fcn.140003cc0
mov eax, dword [rbx + 0x61c8]
xor edx, edx
mov r9, qword [rbx + 0x61c0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x61d0]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x1400bc1df]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14001f30f
add rcx, 0x61c8
call fcn.140003cc0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f6e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
push r12
push r13
push r15
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov r13d, 8
mov rsi, qword [rax]
cmp byte [rsi + r13], 0
jne 0x14001f70b
call fcn.140082398
mov r12d, 0x10
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov rbx, qword [r12 + rsi]
cmp byte [rbx + 0x6100], 0
jne 0x14001f81d
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001f816
lea rdx, [0x1400a3ab0]
call fcn.140003390
mov rdi, rax
test rax, rax
je 0x14001f816
mov rcx, rax
mov qword [rsp + 0x68], r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov r14d, eax
cmp eax, 0xffffffff
je 0x14001f808
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001f808
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rbp, eax
cmp ebp, 0xffffffff
je 0x14001f808
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001f808
cmp rbp, 0xffffffffffffffff
je 0x14001f808
mov rcx, rbp
call fcn.1400082f0
mov r14, rax
test rax, rax
je 0x14001f808
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rbp
je 0x14001f7e8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r14
call fcn.1400083f0
jmp 0x14001f811
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rbp, rbp
je 0x14001f7fe
mov rdx, rbp
mov rcx, r14
call fcn.14001f9b0
mov rcx, r14
call fcn.1400083f0
jmp 0x14001f811
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r14, qword [rsp + 0x68]
mov byte [rbx + 0x6100], 1
movss xmm0, dword [rbx + 0x6104]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001f8c0
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x6104], xmm0
jb 0x14001f8c0
mov rdi, qword [rbx + 0x20]
xor ebp, ebp
test rdi, rdi
je 0x14001f8b3
cmp byte [rsi + r13], bpl
jne 0x14001f85f
call fcn.140082398
mov rax, qword [rsi + r12]
jmp 0x14001f863
mov rax, qword [r12 + rsi]
lea rcx, [rsp + 0x50]
mov dword [rax + 0x6104], ebp
mov qword [rsp + 0x50], rbp
call fcn.14001fc10
lea rdx, [0x1400a3ab4]
mov rcx, rdi
mov rsi, rax
call fcn.140003390
mov rdi, rax
test rax, rax
je 0x14001f8ba
mov r8, qword [rsp + 0x50]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001f8ba
mov byte [rbx + 0xd6], 1
mov dword [rbx + 0x6104], ebp
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r13
pop r12
pop rsi
pop rbx
ret
Function at 0x14001f8e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rdi, rcx
mov rbx, qword [rax]
mov eax, 8
cmp byte [rax + rbx], 0
jne 0x14001f909
call fcn.140082398
movzx r9d, byte [rdi]
lea r8, [rdi + 1]
mov r10d, 0x10
mov r11d, 0xffffffff
mov eax, r11d
mov r10, qword [r10 + rbx]
test r9b, r9b
je 0x14001f95f
lea rbx, [0x1400a48c0]
cmp r9b, 0x23
jne 0x14001f943
cmp byte [r8], r9b
jne 0x14001f943
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001f930
movsxd rcx, dword [r10 + 0x6118]
not eax
mov r8, qword [r10 + 0x6120]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001f98f
nop dword [rax]
cmp dword [r8 + 8], eax
je 0x14001f99c
add r8, 0x48
cmp r8, rcx
jne 0x14001f980
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov rax, r8
add rsp, 0x20
pop rdi
ret
Function at 0x140023e80
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x1400240ce
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400bb040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400a48c0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x140024096
mov rcx, rbp
call fcn.140023430
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140023f51
movsxd rdx, dword [rbp + 0x60c0]
mov r8, qword [rbp + 0x60c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140023f41
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140023f39
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x140023f3c
mov rdx, rcx
test rdx, rdx
jne 0x140023f10
cmp r8, r10
je 0x140023f51
cmp dword [r8], r9d
jne 0x140023f51
mov rcx, qword [r8 + 8]
jmp 0x140023f53
xor ecx, ecx
mov qword [rbx + 0x18], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xc8]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xc8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test rcx, rcx
je 0x140023fe7
cmp qword [rcx + 0x20], 0
jne 0x140023fdc
mov qword [rcx + 0x20], rbx
jmp 0x140023fe7
cmp qword [rcx + 0x28], 0
jne 0x140023fe7
mov qword [rcx + 0x28], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xbc], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 6]
mov eax, dword [rbx + 0xc]
and ecx, 0x3fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14002402c
nop word [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x140024020
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.1400030f0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x140024088
cmp r9b, 0x23
jne 0x14002406b
cmp byte [r8], r9b
jne 0x14002406b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140024058
not ecx
call fcn.14000c6c0
mov qword [rbx + 0x88], rax
add rdi, 0x24
sub rsi, 1
jne 0x140023ed0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400820c0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14002c130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x14002c17d
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x14002c182
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x14002c1ad
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14002c1ad
mov rax, qword [rax + 0x3b0]
test rax, rax
je 0x14002c1ad
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jmp 0x14002c1b2
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x14002c1cc
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x14002c1d1
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
lea rdx, [rsp + 0x20]
and eax, 0x3fc20
mov byte [rsp + 0x31], dil
mov dword [rsp + 0x34], eax
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
lea rcx, [rsi + 0x20]
mov word [rsp + 0x42], ax
call fcn.14002dfa0
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x14002c241
lea r8d, [rdi + 1]
mov rcx, rsi
call fcn.14002c130
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x14002c251
inc edi
jmp 0x14002c160
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x14003f920
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1400bb040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x58]
mov rdi, rdx
mov ebp, 8
mov rsi, rcx
mov rbx, qword [rax]
cmp byte [rbx + rbp], 0
jne 0x14003f963
call fcn.140082398
mov r14d, 0x10
cmp qword [r14 + rbx], 0
je 0x14003f988
cmp byte [rbx + rbp], 0
jne 0x14003f97b
call fcn.140082398
mov rax, qword [r14 + rbx]
mov rbx, qword [rax + 0xa0]
jmp 0x14003f98a
xor ebx, ebx
movss xmm0, dword [rsi + 0x28]
lea r8, [rsp + 0x38]
movss xmm1, dword [rsi + 0x2c]
mov edx, 1
mov rax, qword [rdi]
mov rcx, rdi
movss dword [rsp + 0x40], xmm0
movss dword [rsp + 0x44], xmm1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0x3f800000
mov qword [rsp + 0x38], 0
call qword [rax + 0x160]
mov rax, qword [rdi]
mov rcx, rdi
mov dword [rsp + 0x34], 0x14
mov dword [rsp + 0x30], 0
mov rdx, qword [rbx + 0x30]
call qword [rax + 0x88]
mov rax, qword [rdi]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea r9, [rbx + 0x18]
xor edx, edx
lea rcx, [rsp + 0x34]
mov qword [rsp + 0x20], rcx
mov rcx, rdi
lea r8d, [rdx + 1]
call qword [rax + 0x90]
mov rax, qword [rdi]
xor r9d, r9d
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
lea r8d, [r9 + 0x39]
call qword [rax + 0x98]
mov rax, qword [rdi]
mov edx, 4
mov rcx, rdi
call qword [rax + 0xc0]
mov rax, qword [rdi]
xor r9d, r9d
mov rdx, qword [rbx + 0x28]
xor r8d, r8d
mov rcx, rdi
call qword [rax + 0x58]
mov rax, qword [rdi]
lea r9, [rbx + 0x38]
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call qword [rax + 0x38]
mov rax, qword [rdi]
xor r9d, r9d
mov rdx, qword [rbx + 0x40]
xor r8d, r8d
mov rcx, rdi
call qword [rax + 0x48]
mov rax, qword [rdi]
lea r9, [rbx + 0x48]
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call qword [rax + 0x50]
mov rax, qword [rdi]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rax + 0xb8]
mov rax, qword [rdi]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rax + 0x1e0]
mov rax, qword [rdi]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rax + 0x200]
mov rax, qword [rdi]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rax + 0x228]
mov rax, qword [rdi]
lea r8, [rsp + 0x50]
xorps xmm0, xmm0
mov r9d, 0xffffffff
movups xmmword [rsp + 0x50], xmm0
mov rdx, qword [rbx + 0x60]
mov rcx, rdi
call qword [rax + 0x118]
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, qword [rbx + 0x68]
mov rcx, rdi
call qword [rax + 0x120]
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, qword [rbx + 0x58]
call qword [rax + 0x158]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400820c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400414a0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov edi, 8
mov rbx, qword [rax]
cmp byte [rdi + rbx], 0
jne 0x1400414cb
call fcn.140082398
mov esi, 0x10
cmp qword [rsi + rbx], 0
je 0x1400414ef
cmp byte [rdi + rbx], 0
jne 0x1400414e2
call fcn.140082398
mov rax, qword [rsi + rbx]
mov rbx, qword [rax + 0x98]
jmp 0x1400414f1
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14004151c
mov dword [rbx + 0x2c], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret