joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140198030
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140194170
xor ebx, ebx
cmp qword [0x1401f4850], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x14019815c
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x14019826f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14019826f
mov rcx, rax
call fcn.1401940a0
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1401f4850], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1401940a0
lea rdx, [0x1401d07a0]
mov rcx, rsi
mov qword [0x1401f4858], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1401940a0
lea rcx, [rsp + 0x98]
mov qword [0x1401f4860], rax
call fcn.140194cf0
test eax, eax
je 0x14019810f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140195300
cmp dword [rsp + 0x98], 2
jne 0x14019815c
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1401940a0
test rax, rax
mov qword [0x1401f4870], rax
je 0x14019815c
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1401940a0
mov qword [0x1401f4868], rax
mov rcx, qword [0x1401f4868]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x140198208
cmp qword [0x1401f4870], rbp
je 0x140198208
call fcn.140194260
mov rcx, qword [0x1401f4870]
mov rsi, rax
call fcn.140194260
test rsi, rsi
mov r12, rax
je 0x140198208
test rax, rax
je 0x140198208
call rsi
test rax, rax
je 0x1401981d3
lea rcx, [rsp + 0x34]
mov r9d, recv
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1401981d3
test byte [rsp + 0x40], 1
jne 0x140198208
lea rcx, [rsp + 0x30]
call fcn.140194d40
test eax, eax
je 0x1401981f5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.140195300
cmp dword [rsp + 0x30], 4
jb 0x140198202
bts edi, 0x15
jmp 0x140198246
bts edi, 0x12
jmp 0x140198246
mov rcx, qword [0x1401f4858]
cmp rcx, rbp
je 0x140198246
call fcn.140194260
test rax, rax
je 0x140198246
call rax
test rax, rax
mov rbx, rax
je 0x140198246
mov rcx, qword [0x1401f4860]
cmp rcx, rbp
je 0x140198246
call fcn.140194260
test rax, rax
je 0x140198246
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401f4850]
call fcn.140194260
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x14019826f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140198271
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x140199640
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140199687
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.140199940
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x38
ret
Function at 0x140011037
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x14001c240
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x468]
mov rax, qword [0x140040040]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14004b139]
call fcn.140011e6a
mov qword [rbp + 8], 0
mov edx, dword [rbp + 0x440]
mov ecx, 0x18
call fcn.1400116db
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x14001c2fa
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400110f5
test eax, eax
je 0x14001c2fa
mov rdx, qword [rbp + 0x448]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x14001c2e9
mov rax, qword [rbp + 0x68]
mov qword [rbp + 8], rax
jmp 0x14001c2fa
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.14001142e
test eax, eax
jne 0x14001c2c7
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140035b30]
call fcn.140011bfe
mov rax, rdi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.140011708
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret

Function at 0x140011807
Capabilities:
Terminate process

Disassembly:
jmp 0x14002cde0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011a46
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002c1b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002c1d0
xor al, al
jmp 0x14002c251
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002c1e3
xor al, al
jmp 0x14002c251
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002c20d
xor al, al
jmp 0x14002c251
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002c221
xor al, al
jmp 0x14002c251
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002c233
xor al, al
jmp 0x14002c251
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002c24f
xor al, al
jmp 0x14002c251
mov al, 1
add rsp, 0x38
ret
Function at 0x140011ec9
Capabilities:
Print debug messages

Disassembly:
jmp 0x140029674
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140011b1d
and qword [rdi + 0x50], 0
lea rax, [0x140000000]
and dword [rdi + 0x58], 0
lea rcx, [rdi + 0x28]
and dword [rdi + 0x5c], 0
xor r8d, r8d
mov qword [rdi + 0x10], rax
xor edx, edx
mov qword [rdi + 8], rax
lea rax, [0x1400390e8]
mov qword [rdi + 0x20], rax
mov dword [rdi], 0x60
mov dword [rdi + 0x18], 0xe00
call fcn.1400116c2
test eax, eax
jne 0x14002970b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x14002970b
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140029704
lea rcx, str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x140042fd0], 1
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140001860
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x470
movdqa xmm0, xmmword [0x140031410]
mov rbx, rcx
movzx eax, word [0x1400311e0]
lea rcx, [rsp + 0x60]
movdqu xmmword [rsp + 0x50], xmm0
xor edi, edi
mov word [rsp + 0x48], ax
movsd xmm0, qword [str.installPath]
xor edx, edx
movzx eax, byte [0x1400311e2]
mov r8d, 0x410
movsd qword [rsp + 0x40], xmm0
mov byte [rsp + 0x4a], al
mov dword [rsp + 0x4c], edi
mov byte [rsp + 0x4b], dil
mov dword [rsp + 0x490], 1
call fcn.1400246d0
lea rax, [rsp + 0x488]
mov dword [rsp + 0x488], 0x410
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x60]
mov r9d, 0x20002
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareWallpaperEngine_
lea rax, [rsp + 0x490]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
test eax, eax
jne 0x14000199a
mov qword [rbx + 0x18], rdi
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140001937
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140005660
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001986
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001981
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400019d9
call fcn.1400068d4
mov rax, rbx
mov rbx, qword [rsp + 0x480]
add rsp, 0x470
pop rdi
ret
mov rdx, qword [rsp + 0x58]
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
cmp rdx, 0xf
jbe 0x140001986
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001981
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001981
call fcn.14000e1c4
int3
Function at 0x140007200
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000724a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000724a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000724a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000724a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000724a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000724c
xor al, al
add rsp, 0x28
ret

Function at 0x14000861c
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [0x140037538], 0
mov rbp, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
jne 0x1400086c9
cmp dword [0x14003750c], 0
jne 0x1400086c9
cmp edx, 0x10
je 0x1400087ee
cmp edx, 0x8000
je 0x1400087ba
cmp dword [0x14003754c], 0
jne 0x1400086c9
mov eax, 0x104
cmp edx, eax
ja 0x1400086ef
je 0x140008746
cmp edx, 0x18
je 0x1400086bd
cmp edx, 0x1c
je 0x1400086b5
cmp edx, 0x20
je 0x1400086a6
cmp edx, 0x48
je 0x14000869d
cmp edx, 0x100
jmp 0x140008744
cmp rdi, 3
jmp 0x140008744
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x1400086da
test rdi, rdi
jmp 0x140008744
test edi, edi
je 0x1400086c9
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov r9, rbp
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_DefWindowProcA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov eax, ebx
sub eax, 0x200
je 0x14000875b
sub eax, 1
je 0x140008746
sub eax, 3
je 0x140008746
sub eax, 3
je 0x140008746
cmp eax, 0x11
jne 0x1400086c9
mov rax, rdi
test rdi, rdi
je 0x1400086ae
sub rax, 6
je 0x14000873c
sub rax, 1
je 0x14000873c
sub rax, 1
je 0x14000873c
sub rax, 2
je 0x1400086c9
sub rax, 8
je 0x14000873c
cmp rax, 0x8001
je 0x1400086c9
jmp 0x140008746
mov eax, 1
test al, bpl
jne 0x1400086c9
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1400086c9
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [rsp + 0x20]
sub ecx, dword [0x1400387e0]
cmp ecx, 0xffffffff
jg 0x140008777
neg ecx
mov eax, dword [rsp + 0x24]
sub eax, dword [0x1400387e4]
cmp eax, 0xffffffff
jg 0x140008788
neg eax
add eax, ecx
cmp eax, dword [0x1400360f4]
jbe 0x1400086c9
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [rsp + 0x20]
mov qword [0x1400387e0], rax
jmp 0x1400086c9
cmp dword [0x140037554], 0
je 0x1400086c9
mov rax, qword [0x140037520]
test rax, rax
je 0x1400086ae
movabs r10, 0xca208e0a765e4b70
call qword [0x1400263f8]
cdqe
jmp 0x1400086da
cmp dword [0x140037554], 0
je 0x1400086c9
call fcn.1400088a0
test eax, eax
jne 0x1400086c9
lea rcx, [0x1400387e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
jmp 0x1400086da
Function at 0x140011224
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140011293
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140011293
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140011293
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140011293
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140011293
cmp dword [rcx + 0x84], 0xe
jbe 0x140011293
cmp dword [rcx + 0xf8], 0
je 0x140011293
mov ecx, ebx
call fcn.140011344
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140011120
nop
cmp dword [rbp + 0x20], 0
je 0x1400112e1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400112ec
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140011224
Function at 0x140019ba8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140019bd8
xor eax, eax
jmp 0x140019c9b
mov rbp, rbx
cmp word [rax], si
je 0x140019bfd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140019be4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140019be0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140019ac8
movsxd r14, eax
test eax, eax
jne 0x140019c3b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140019bd1
mov rcx, r14
call fcn.14001611c
mov rdi, rax
test rax, rax
jne 0x140019c54
xor ecx, ecx
call fcn.1400160e0
jmp 0x140019c30
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140019ac8
test eax, eax
jne 0x140019c85
mov rcx, rdi
call fcn.1400160e0
jmp 0x140019c8f
xor ecx, ecx
call fcn.1400160e0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14001c6ac
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140015d80
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14001c74d
cmp ebx, dword [rsp + 0x30]
je 0x14001c746
test esi, esi
je 0x14001c746
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14001c721
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14001c72e
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14001c70b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14001c732
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14001c74f
mov eax, 1
jmp 0x14001c74f
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140024110
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140024138
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140024138
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140005250
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x14000f530
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x14000f56d
test rdx, rdx
je 0x14000f56d
mov rax, qword [rax]
cmp rax, r9
jne 0x14000f550
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret
Function at 0x140005fd0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x280
movdqa xmmword [rsp + 0x2e0], xmm6
movdqa xmmword [rsp + 0x2f0], xmm7
movdqa xmmword [rsp + 0x300], xmm8
movdqa xmmword [rsp + 0x310], xmm9
movdqa xmmword [rsp + 0x320], xmm10
movdqa xmmword [rsp + 0x330], xmm11
movdqa xmmword [rsp + 0x340], xmm12
movdqa xmmword [rsp + 0x350], xmm13
movdqa xmmword [rsp + 0x360], xmm14
movdqa xmmword [rsp + 0x370], xmm15
mov eax, dword [0x140418318]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x280]
mov qword [rdx + 8], r8
call fcn.140112f20
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x140418318]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140006160
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000617c
cmp rcx, r8
jl 0x14000616f
mov qword [rdx + 0x80], rcx
test dword [0x140411c48], 1
je 0x1400061ab
cmp byte [rsp + 0xd0], 0
je 0x1400061ab
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x140005cd0
mov rsp, r8
jmp rax
Function at 0x1400061b0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x140418318]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret