joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400093b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process filename

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0xb8
mov rax, qword [0x140097080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x38], Ordinal_26
mov dword [rsp + 0x3c], Ordinal_26
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
mov rax, qword gs:[0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov eax, reloc.WS2_32.dll_recv
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x30], 0
je 0x1400094f8
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x98]
call fcn.140003d20
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x98]
call fcn.140008f00
nop
lea rcx, [rsp + 0x98]
call fcn.140008fb0
mov qword [rsp + 0x90], rax
call fcn.1400095b0
mov rcx, rax
call fcn.140009640
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x60], rax
lea rdx, [0x140089c40]
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x68]
test eax, eax
jne 0x1400094eb
lea rcx, [rsp + 0x98]
call fcn.140008f90
jmp 0x140009508
lea rcx, [rsp + 0x98]
call fcn.140008f90
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x30], rax
jne 0x140009439
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x70], rax
mov r8d, 0xa
mov edx, listen
lea rcx, [0x140089c60]
call fcn.14000a440
mov dword [rsp + 0x28], eax
mov r9d, 0xa
mov r8d, listen
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call fcn.140009250
mov qword [0x1400b0b98], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140009220
mov qword [rsp + 0x78], rax
mov r9d, dword [rsp + 0xd8]
mov r8d, dword [rsp + 0xd0]
mov edx, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
call fcn.140009250
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400760a0
add rsp, 0xb8
ret
Function at 0x140009640
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400096a2
xor eax, eax
jmp 0x140009820
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1400096ee
xor eax, eax
jmp 0x140009820
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140009725
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000974d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x1400097b6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000981e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xb3c5b296
jne 0x14000981c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x140009820
jmp 0x1400097a9
xor eax, eax
add rsp, 0x78
ret

Function at 0x140009890
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x18
movsx eax, byte [rsp + 0x28]
cmp eax, 0x41
jl 0x1400098bd
movsx eax, byte [rsp + 0x28]
cmp eax, 0x5a
jg 0x1400098bd
movsx eax, byte [rsp + 0x28]
or eax, 0x20
mov dword [rsp], eax
jmp 0x1400098c5
movsx eax, byte [rsp + 0x28]
mov dword [rsp], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
add rsp, 0x18
ret
Function at 0x14000a440
Capabilities:
Hash data using murmur2

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x14], 0x5bd1e995
mov dword [rsp + Ordinal_26], 0x18
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0xc], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x50]
mov dword [rsp], eax
cmp dword [rsp + 0x48], 4
jl 0x14000a4eb
mov rax, qword [rsp + 0x20]
mov eax, dword [rax]
mov dword [rsp + 8], eax
imul eax, dword [rsp + 8], 0x5bd1e995
mov dword [rsp + 8], eax
mov eax, dword [rsp + 8]
shr eax, 0x18
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
imul eax, dword [rsp + 8], 0x5bd1e995
mov dword [rsp + 8], eax
imul eax, dword [rsp], 0x5bd1e995
mov dword [rsp], eax
mov eax, dword [rsp + 8]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov rax, qword [rsp + 0x20]
add rax, 4
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x48]
sub eax, 4
mov dword [rsp + 0x48], eax
jmp 0x14000a47b
mov dword [rsp + 4], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x10], eax
cmp dword [rsp + 0x10], 1
je 0x14000a554
cmp dword [rsp + 0x10], 2
je 0x14000a533
cmp dword [rsp + 0x10], 3
je 0x14000a512
jmp 0x14000a572
mov eax, 1
imul rax, rax, 2
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
shl eax, 0x10
mov ecx, dword [rsp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
shl eax, 8
mov ecx, dword [rsp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
imul eax, dword [rsp + 4], 0x5bd1e995
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 0x18
mov ecx, dword [rsp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 4], eax
imul eax, dword [rsp + 4], 0x5bd1e995
mov dword [rsp + 4], eax
imul eax, dword [rsp], 0x5bd1e995
mov dword [rsp], eax
mov eax, dword [rsp + 4]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
imul eax, dword [rsp + 0xc], 0x5bd1e995
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
shr eax, 0x18
mov ecx, dword [rsp + 0xc]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0xc], eax
imul eax, dword [rsp + 0xc], 0x5bd1e995
mov dword [rsp + 0xc], eax
imul eax, dword [rsp], 0x5bd1e995
mov dword [rsp], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
shr eax, 0xd
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
imul eax, dword [rsp], 0x5bd1e995
mov dword [rsp], eax
mov eax, dword [rsp]
shr eax, 0xf
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
add rsp, 0x38
ret
Function at 0x14000cb30
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000cb92
xor eax, eax
jmp 0x14000cd10
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000cbde
xor eax, eax
jmp 0x14000cd10
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000cc15
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000cc3d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000cca6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000cd0e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xbf21a4fa
jne 0x14000cd0c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000cd10
jmp 0x14000cc99
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000cd40
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000cda2
xor eax, eax
jmp 0x14000cf20
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000cdee
xor eax, eax
jmp 0x14000cf20
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000ce25
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000ce4d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000ceb6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000cf1e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0x97085561
jne 0x14000cf1c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000cf20
jmp 0x14000cea9
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000cf30
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000cf92
xor eax, eax
jmp 0x14000d110
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000cfde
xor eax, eax
jmp 0x14000d110
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000d015
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000d03d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000d0a6
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000d10e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0x3d71f40a
jne 0x14000d10c
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000d110
jmp 0x14000d099
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000d120
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000d182
xor eax, eax
jmp 0x14000d300
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000d1ce
xor eax, eax
jmp 0x14000d300
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000d205
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000d22d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000d296
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000d2fe
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xe054604a
jne 0x14000d2fc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000d300
jmp 0x14000d289
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000d310
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000d372
xor eax, eax
jmp 0x14000d4f0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000d3be
xor eax, eax
jmp 0x14000d4f0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000d3f5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000d41d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000d486
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000d4ee
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0xddeaabca
jne 0x14000d4ec
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000d4f0
jmp 0x14000d479
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000d500
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000d562
xor eax, eax
jmp 0x14000d6e0
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x14000d5ae
xor eax, eax
jmp 0x14000d6e0
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14000d5e5
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x78]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x14000d60d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
jmp 0x14000d676
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp qword [rsp + 0x28], rax
jae 0x14000d6de
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.140009830
cmp eax, 0x4ecb007a
jne 0x14000d6dc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
movzx eax, word [rax + rcx*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000d6e0
jmp 0x14000d669
xor eax, eax
add rsp, 0x78
ret