joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400024d8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140002551
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140002556
cmp r14, rsi
jne 0x140002532
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x1400025e2
lea rcx, vtable.std::_Func_impl_no_alloc_long_int____cdecl___struct_HWND______ptr64__int__void____ptr64__unsigned_long_int__char____ptr64___long_int__struct_HWND______ptr64__int__void____ptr64__unsigned_long_int__char____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140002631
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x14000262d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140002631
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140002631
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000263b
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400027f0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov r11d, r8d
cmp r8d, 4
jl 0x140002830
mov r10d, r8d
shr r10, 2
mov eax, r10d
neg eax
lea r8d, [r8 + rax*4]
imul eax, dword [rdx], 0x5bd1e995
add rdx, 4
imul r9d, r9d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r9d, ecx
sub r10, 1
jne 0x140002809
xor ecx, ecx
sub r8d, 1
je 0x140002854
sub r8d, 1
je 0x14000284b
cmp r8d, 1
jne 0x140002859
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [rdx]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
imul r8d, r11d, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor ecx, eax
mov eax, r8d
shr eax, 0x18
xor eax, r8d
imul edx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor edx, eax
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x1400028a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r10d, r9d
mov rbx, rdx
movsxd rax, dword [rdx + 0x3c]
mov r14d, dword [rax + rdx + 0x88]
add r14, rdx
mov r15d, dword [r14 + 0x20]
add r15, rdx
mov r12d, dword [r14 + 0x24]
add r12, rdx
or esi, 0xffffffff
xor edi, edi
mov r13d, dword [r14 + 0x18]
sub r13d, 1
je 0x140002930
mov edx, dword [r15]
add rdx, rbx
mov r9d, dword [rsp + 0x80]
mov r8d, r10d
call fcn.1400027f0
cmp dword [rsp + 0x70], eax
je 0x14000292b
inc edi
add r15, 4
cmp edi, r13d
mov r10d, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
jb 0x1400028f8
jmp 0x140002930
movzx esi, word [r12 + rdi*2]
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
cmp esi, ecx
jbe 0x14000293f
xor eax, eax
jmp 0x140002949
mov eax, dword [rcx + rsi*4]
add rax, rbx
jmp 0x140002949
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004118
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140004191
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004196
cmp r14, rsi
jne 0x140004172
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140004222
lea rcx, [0x140096ac8]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140004271
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x14000426d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004271
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140004271
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000427b
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400042a8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140004321
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004326
cmp r14, rsi
jne 0x140004302
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x1400043b2
lea rcx, [0x140096b38]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140004401
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x1400043fd
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004401
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140004401
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000440b
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140004438
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x1400044b1
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400044b6
cmp r14, rsi
jne 0x140004492
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140004542
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___void____ptr64___int__void____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140004591
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x14000458d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004591
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140004591
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000459b
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400045c8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140004641
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004646
cmp r14, rsi
jne 0x140004622
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x1400046d2
lea rcx, vtable.std::_Func_impl_no_alloc_long_int____cdecl___void____ptr64____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__unsigned_long_int___long_int__void____ptr64____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__unsigned_long_int_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140004721
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x14000471d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004721
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140004721
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x14000472b
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140004758
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x1400047d1
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400047d6
cmp r14, rsi
jne 0x1400047b2
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140004862
lea rcx, [0x140096b00]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x1400048b1
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x1400048ad
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400048b1
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x1400048b1
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x1400048bb
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400048e8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140004961
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004966
cmp r14, rsi
jne 0x140004942
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x1400049f2
lea rcx, [0x140096a20]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140004a41
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140004a3d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004a41
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140004a41
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140004a4b
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140004a78
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140004af1
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004af6
cmp r14, rsi
jne 0x140004ad2
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140004b82
lea rcx, [0x140096a58]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140004bd1
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140004bcd
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004bd1
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140004bd1
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140004bdb
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140004c08
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140004c81
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004c86
cmp r14, rsi
jne 0x140004c62
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140004d12
lea rcx, vtable.std::_Func_impl_no_alloc_unsigned_long_int____cdecl___void____ptr64__unsigned_long_int____ptr64___unsigned_long_int__void____ptr64__unsigned_long_int____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140004d61
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140004d5d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004d61
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140004d61
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140004d6b
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140004d98
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400b9fb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.1400027f0
mov r15d, eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rsi, r14
mov rsi, qword [rsi]
cmp qword [rsi + 0x30], 0
je 0x140004e11
lea rdx, [0x1400966d8]
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140004e16
cmp r14, rsi
jne 0x140004df2
mov r9d, 0xa
lea r14d, [r9 + 2]
mov r8d, r14d
lea rdx, [0x1400966f8]
mov rcx, rdi
call fcn.1400027f0
mov dword [rsp + 0x20], 0xa
mov r9d, r14d
mov r8d, eax
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
call fcn.1400028a8
mov rcx, qword [rdi + 8]
call rax
mov rdx, rax
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rcx, rdi
call fcn.1400028a8
mov rdi, rax
mov qword [rsp + 0x38], rax
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x38]
call fcn.140001708
test al, al
je 0x140004ea2
lea rcx, [0x140096b70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x78], rcx
neg al
sbb rcx, rcx
lea rax, [rsp + 0x40]
and rcx, rax
mov qword [rbx + 0x38], 0
je 0x140004ef1
lea rax, [rsp + 0x40]
cmp rcx, rax
jne 0x140004eed
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov qword [rbx + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004ef1
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
jmp 0x140004ef1
mov qword [rbx + 0x38], rcx
mov rax, rbx
jmp 0x140004efb
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006d6b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret