joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f8b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400f8cbb
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x1400f8bbb
jmp 0x1400f8bdd
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.14007fb00
mov qword [rsp + 0x48], rax
inc rax
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x48], rdi
cmp rdi, 1
je 0x1400f8bea
jmp 0x1400f8c39
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax]
mov byte [rsp + 0x27], al
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], al
call fcn.1400052a0
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x30], 0
jmp 0x1400f8c44
jmp 0x1400f8c46
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
call fcn.1400fca00
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x1400f8c6c
jmp 0x1400f8c7c
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
inc qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdx
add rdx, rax
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x68]
sub rsi, rdx
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rdx, rsi
add rdx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
jmp 0x1400f8cb9
jmp 0x1400f8c44
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.1400f8b80
Function at 0x1400fdf00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400fdf73
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], al
call fcn.140005960
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.1400fdf00
Function at 0x1401039e0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x18], rax
mov byte [rsp + 0x20], bl
mov qword [rsp], 0
movzx ecx, byte [rsp + 0x20]
xor rax, rcx
mov qword [rsp + 0x18], rax
movabs rcx, 0x100000001b3
imul rax, rcx
mov qword [rsp + 0x18], rax
mov qword [rsp], rax
add rsp, 8
pop rbp
ret

Function at 0x140103a40
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x140103a6a
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x10], rcx
cmp qword [rsp + 8], rcx
jl 0x140103a7d
jmp 0x140103ab0
mov rcx, qword [rsp + 0x30]
add rcx, qword [rsp + 8]
movzx ecx, byte [rcx]
xor rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rcx
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x28], rcx
jmp 0x140103aa9
inc qword [rsp + 8]
jmp 0x140103a6a
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
add rsp, 0x18
pop rbp
ret

Function at 0x140103ac0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x140103ae5
cmp qword [rsp + 8], 8
jl 0x140103aef
jmp 0x140103b29
movzx ecx, byte [rsp + 0x28]
xor rcx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x28]
shr rdx, 8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x20], rcx
nop
jmp 0x140103b22
inc qword [rsp + 8]
jmp 0x140103ae5
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
add rsp, 0x10
pop rbp
ret

Function at 0x140103b40
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x140103b64
cmp qword [rsp + 8], 4
jl 0x140103b6e
jmp 0x140103ba4
movzx ecx, byte [rsp + 0x28]
xor qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x28]
shr ecx, 8
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x20]
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x20], rcx
jmp 0x140103b9d
inc qword [rsp + 8]
jmp 0x140103b64
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
add rsp, 0x10
pop rbp
ret
Function at 0x140128720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401287f9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0x2e
call fcn.140005980
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
setne byte [rsp + 0x2f]
jne 0x140128788
jmp 0x1401287a9
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x30], rdx
mov r8, qword [rsp + 0x60]
lea rdx, [rdx + r8]
lea rdx, [rdx - 1]
cmp byte [rdx], 0x2e
setne byte [rsp + 0x2f]
jmp 0x1401287ab
jmp 0x1401287ab
cmp byte [rsp + 0x2f], 0
jne 0x1401287b4
jmp 0x1401287dd
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor eax, eax
lea rdi, [0x1402bdb18]
mov esi, 1
call fcn.140057ea0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
jmp 0x1401287df
jmp 0x1401287df
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140128720
Function at 0x14014c5a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14014c66a
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
jmp 0x14014c5e3
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x48], rcx
cmp qword [rsp + 0x38], rcx
jl 0x14014c5f6
jmp 0x14014c65a
mov rax, qword [rsp + 0x60]
add rax, qword [rsp + 0x38]
movzx eax, byte [rax]
mov byte [rsp + 0x27], al
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], al
nop
call fcn.140005980
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
test rax, rax
jge 0x14014c648
jmp 0x14014c64f
inc qword [rsp + 0x30]
jmp 0x14014c651
jmp 0x14014c651
jmp 0x14014c653
inc qword [rsp + 0x38]
jmp 0x14014c5e3
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14014c5a0

Function at 0x14014cf80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14014d021
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
movups xmmword [rsp + 0x28], xmm15
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0x23
call fcn.140005980
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x20], rbx
nop dword [rax + rax]
cmp rbx, 0xffffffffffffffff
jne 0x14014cfe8
jmp 0x14014d007
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
add rsp, 0x48
pop rbp
ret
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14014cf80
Function at 0x14016e1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14016e275
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x10], 0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
cmp rsi, rcx
jne 0x14016e1ef
jmp 0x14016e201
mov qword [rsp + 0x10], 0
xor eax, eax
add rsp, 0x30
pop rbp
nop
ret
mov byte [rsp + 0xf], 0
mov qword [rsp + 0x18], 0
jmp 0x14016e211
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
cmp qword [rsp + 0x18], rcx
jl 0x14016e229
jmp 0x14016e259
movzx ecx, byte [rsp + 0xf]
mov rdx, qword [rsp + 0x40]
add rdx, qword [rsp + 0x18]
movzx edx, byte [rdx]
mov rsi, qword [rsp + 0x58]
add rsi, qword [rsp + 0x18]
movzx esi, byte [rsi]
xor edx, esi
or ecx, edx
mov byte [rsp + 0xf], cl
jmp 0x14016e252
inc qword [rsp + 0x18]
jmp 0x14016e211
movzx eax, byte [rsp + 0xf]
xor ebx, ebx
call fcn.14016e2c0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
add rsp, 0x30
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.14016e1a0
Function at 0x14016f300
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x90]
cmp r12, qword [r14 + 0x10]
jbe 0x14016f5eb
push rbp
mov rbp, rsp
sub rsp, 0x108
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0xd8], 0
movups xmmword [rsp + 0xe0], xmm15
mov rcx, qword [rsp + 0x118]
test byte [rcx], al
mov rdx, qword [rcx]
mov qword [rsp + 0x38], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0x38]
call fcn.14016ea00
mov qword [rsp + 0x27], 0
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc8], xmm15
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0xb0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0xb8], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0xc8], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xa0], 5
jmp 0x14016f3ef
mov rdx, qword [rsp + 0xa8]
nop word [rax + rax]
cmp qword [rsp + 0xa0], rdx
jg 0x14016f40f
jmp 0x14016f4d7
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x78], rdx
mov rsi, qword [rsp + 0xa8]
lea rsi, [rsp + rsi*8 + 0xb0]
mov rsi, qword [rsi]
mov qword [rsp + 0x68], rsi
imul rdx, rdx, 0x33
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x27]
test byte [rdx], al
mov qword [rsp + 0xf0], rdx
mov qword [rsp + 0xf8], 8
mov qword [rsp + 0x100], 8
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
mov rdx, rcx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rcx
and rdx, 0xfffffffffffffff8
sub rcx, rdx
shl rdi, cl
cmp rcx, 0x40
sbb rdx, rdx
and rdi, rdx
mov qword [rsp + 0x98], rdi
mov rax, qword [rsp + 0xf0]
mov ebx, 8
mov rcx, rbx
call fcn.1400b5700
mov rdx, qword [rsp + 0x27]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x88], 8
jmp 0x14016f53a
mov rdx, qword [rsp + 0x120]
test byte [rdx], al
mov qword [rsp + 0xf0], rdx
mov qword [rsp + 0xf8], 0x20
mov qword [rsp + 0x100], 0x20
mov qword [rsp + 0xd8], rdx
mov qword [rsp + 0xe0], 0x20
mov qword [rsp + 0xe8], 0x20
mov rax, qword [rsp + 0xd8]
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x108
pop rbp
ret
mov rdx, qword [rsp + 0x90]
cmp qword [rsp + 0x88], rdx
jg 0x14016f551
jmp 0x14016f5da
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x70], rdx
mov rdx, qword [rsp + 0x90]
lea rdx, [rsp + rdx + 0x30]
movzx edx, byte [rdx]
mov byte [rsp + 0x2f], dl
mov rdx, qword [rsp + 0x80]
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
add rdx, qword [rsp + 0x70]
mov qword [rsp + 0x60], rdx
cmp rdx, 0x20
jge 0x14016f5a0
jmp 0x14016f5a2
jmp 0x14016f5dc
mov rsi, qword [rsp + 0x120]
test byte [rsi], al
add rsi, rdx
mov r8, qword [rsp + 0x120]
test byte [r8], al
add rdx, r8
movzx edx, byte [rdx]
movzx r8d, byte [rsp + 0x2f]
or edx, r8d
mov byte [rsi], dl
jmp 0x14016f5cd
inc qword [rsp + 0x90]
jmp 0x14016f53a
jmp 0x14016f5dc
jmp 0x14016f5de
inc qword [rsp + 0xa8]
jmp 0x14016f3ef
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14016f300
Function at 0x140179440
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x140179657
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], r9
mov qword [rsp + 0xd8], r10
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x50], rdx
test rdx, rdx
sete byte [rsp + 0x4f]
nop
je 0x1401794c4
jmp 0x1401794c6
jmp 0x1401794d6
cmp qword [rsp + 0xd0], 0
sete byte [rsp + 0x4f]
jmp 0x1401794d6
cmp byte [rsp + 0x4f], 0
jne 0x1401794df
jmp 0x140179532
mov rdi, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
nop
call fcn.140178600
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
add rsp, 0x90
pop rbp
ret
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0x50]
inc rdi
call fcn.1401784a0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rcx
mov rsi, qword [rsp + 0xd8]
mov r8, qword [rsp + 0xd0]
mov r9, qword [rsp + 0xb8]
mov r10, qword [rsp + 0xc0]
mov r11, qword [rsp + 0xc8]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rsi
call fcn.140187f80
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x50]
shl rsi, 3
add rsi, qword [rsp + 0xa0]
mov qword [rsi], rdx
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
call fcn.1401783e0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
nop
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.140179440
Function at 0x1401796c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x1401798e5
push rbp
mov rbp, rsp
sub rsp, 0xb8
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rcx
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xf0], r8
mov qword [rsp + 0xf8], r9
mov qword [rsp + 0x100], r10
mov qword [rsp + 0x108], r11
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], r10
lea rbx, [rsi + r10]
mov qword [rsp + 0x50], rbx
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
nop dword [rax]
call fcn.140178380
mov rdx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0x108]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], rdx
jmp 0x1401797a5
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x70], rax
jg 0x1401797b6
jmp 0x1401798dc
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x78]
shl rcx, 3
add rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
test rcx, rcx
jne 0x1401797e5
nop
jmp 0x1401798ce
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x58], rcx
add rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x40]
sub rax, rcx
mov rdx, qword [rsp + 0xd8]
sub rdx, rcx
mov rbx, rdx
neg rdx
shl rcx, 3
sar rdx, 0x3f
and rcx, rdx
add rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xf0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
call fcn.140188040
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x50]
add rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
shl rcx, 3
add rcx, qword [rsp + 0xc8]
mov qword [rcx], rax
jmp 0x1401798d0
jmp 0x1401798d0
jmp 0x1401798d2
inc qword [rsp + 0x78]
jmp 0x1401797a5
add rsp, 0xb8
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.1401796c0
Function at 0x14017a060
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x14017a264
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r8
mov qword [rsp + 0xd0], r9
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], rcx
mov rdx, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc0]
mov r10, qword [rsp + 0xc8]
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r10
call fcn.140187c20
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x14017a15e
jmp 0x14017a259
mov rax, qword [rsp + 0xd0]
sar rax, 1
add rax, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0xd0]
sub rax, rcx
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
mov rbx, rdx
neg rdx
shl rcx, 3
sar rdx, 0x3f
and rcx, rdx
add rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xa8]
sub rcx, rax
mov rdx, qword [rsp + 0xb0]
sub rdx, rax
mov rbx, rdx
neg rdx
shl rax, 3
sar rdx, 0x3f
and rax, rdx
add rax, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rbx
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdx
nop dword [rax]
call fcn.140187d60
xorps xmm15, xmm15
mov r14, qword [0x140442a78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x14017a25b
jmp 0x14017a25b
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.14006e160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.14017a060