joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003010
Capabilities:
Check os version

Disassembly:
push rbp
push rbx
push r12
push r13
mov rbp, rsp
sub rsp, 0x48
mov rax, qword [0x14034dac0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13d, edx
mov r12, rcx
call fcn.140002d30
mov rbx, rax
test rax, rax
jne 0x140003049
mov eax, 0xc00000bb
jmp 0x140003223
xor eax, eax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
lea r8, [rbp - 0x20]
mov qword [rbp - 0x28], rax
lea rdi, [rbp - 0x28]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
mov qword [rsp + 0x40], r15
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
xor esi, esi
cmp dword [rbp - 0x28], 6
jne 0x140003097
cmp dword [rbp - 0x24], 3
jne 0x140003097
mov r15d, 1
jmp 0x14000309b
seta r15b
test r15b, r15b
je 0x1400030b5
mov rdx, rbx
mov ecx, 4
call fcn.140002c60
test eax, eax
js 0x140003211
xor eax, eax
mov qword [rsp + 0x88], r14
mov r14d, dword [rbx]
lea rdi, [rbp - 0x28]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
mov dword [rbp - 0x18], esi
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
cmp dword [rbp - 0x28], 6
jne 0x1400030fc
cmp dword [rbp - 0x24], 2
jne 0x1400030fc
mov eax, 1
jmp 0x1400030ff
seta al
movzx edi, al
cmp r14d, dword [rbx + 4]
je 0x140003194
test r14d, r14d
je 0x140003161
cmp edi, r14d
jae 0x140003132
lea rax, [rdi + 1]
lea rcx, [rax + rax*2]
lea rax, [rbx + rcx*8]
cmp r12, qword [rax]
jb 0x140003134
inc edi
add rax, 0x18
cmp edi, r14d
jb 0x140003122
je 0x140003161
lea eax, [rdi + 1]
sub r14d, edi
mov ecx, eax
lea rdx, [rdi + 1]
add rcx, 2
lea rdx, [rdi + rdx*2]
lea rdx, [rbx + rdx*8]
lea r8, [r14 + r14*2]
shl r8, 3
lea rax, [rcx + rax*2]
lea rcx, [rbx + rax*8]
call fcn.140085990
lea rcx, [rdi + rdi*2]
mov r8d, 3
lea rdi, [rbx + rcx*8]
mov dl, 1
mov rcx, r12
lea r9, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
mov qword [rdi + 0x10], rax
mov eax, dword [rbp - 0x18]
mov dword [rdi + 0x24], eax
mov qword [rdi + 0x18], r12
mov dword [rdi + 0x20], r13d
inc dword [rbx]
jmp 0x1400031a8
test al, al
je 0x1400031a1
mov dword [rbx + 0xc], 1
jmp 0x1400031a8
mov dword [rbx + 8], 1
mov r14, qword [rsp + 0x88]
test r15b, r15b
je 0x1400031c6
mov rdx, rbx
mov ecx, 2
call fcn.140002c60
test eax, eax
js 0x140003211
xor eax, eax
lea rdi, [rbp - 0x28]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
cmp dword [rbp - 0x28], 6
jne 0x1400031f8
cmp dword [rbp - 0x24], 2
je 0x140003200
seta sil
test esi, esi
je 0x140003205
mov eax, dword [rbx + 0xc]
jmp 0x140003208
mov eax, dword [rbx + 8]
neg eax
sbb eax, eax
and eax, 0xc0000017
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006ee80
add rsp, 0x48
pop r13
pop r12
pop rbx
pop rbp
ret
Function at 0x14000aff0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rax, qword [0x14034dac0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov rbx, rcx
call fcn.14000b860
mov ebp, eax
test eax, eax
je 0x14000b1b6
test rbx, rbx
je 0x14000b1b6
mov edx, 0x40
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000b1b6
mov r15d, 0x5a4d
cmp word [rbx], r15w
jne 0x14000b1b6
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b1b6
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b1b6
cmp dword [rdi], 0x4550
jne 0x14000b1b6
test rdi, rdi
je 0x14000b1b6
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b1b6
mov r12d, 0x20b
cmp word [rdi + 0x18], r12w
jne 0x14000b1b6
mov qword [rsp + 0x98], r14
lea rax, vtable.peconv::default_func_resolver.0
test rsi, rsi
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
cmovne r14, rsi
mov qword [rsp + 0x38], rbp
xor esi, esi
mov edx, 0x40
mov rcx, rbx
mov dword [rsp + 0x41], esi
mov word [rsp + 0x45], si
mov byte [rsp + 0x47], sil
call fcn.14000c900
test al, al
jne 0x14000b148
cmp word [rbx], r15w
jne 0x14000b148
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b148
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b148
cmp dword [rdi], 0x4550
jne 0x14000b148
test rdi, rdi
je 0x14000b148
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b148
movzx esi, word [rdi + 0x18]
lea rax, vtable.FillImportThunks.0
mov qword [rsp + 0x48], r14
cmp si, r12w
mov qword [rsp + 0x28], rax
mov edx, 1
mov rcx, rbx
sete byte [rsp + 0x40]
call fcn.14000b640
mov r14, qword [rsp + 0x98]
test rax, rax
jne 0x14000b180
mov al, 1
jmp 0x14000b1b8
mov ecx, dword [rax]
lea r8, [rcx + rbx]
test r8, r8
je 0x14000b1b6
cmp r8, rbx
jb 0x14000b1b6
lea rax, [rcx + 0x14]
cmp rax, rbp
ja 0x14000b1b6
cmp rax, 0x14
jb 0x14000b1b6
cmp rax, rcx
jb 0x14000b1b6
lea r9, [rsp + 0x28]
mov rdx, rbp
mov rcx, rbx
call fcn.14000ac20
jmp 0x14000b1b8
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14006ee80
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b370
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x14000b395
test rdx, rdx
je 0x14000b3a7
cmp rdx, 0x40
jae 0x14000b3b5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call fcn.14000c900
test al, al
jne 0x14000b395
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14000b395
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000b395
lea rbx, [rax + rdi]
mov rcx, rax
test rsi, rsi
je 0x14000b3fa
test rbx, rbx
je 0x14000b395
cmp rbx, rdi
jb 0x14000b395
add rax, 0xf8
cmp rax, rsi
ja 0x14000b395
cmp rax, 0xf8
jb 0x14000b395
cmp rax, rcx
jb 0x14000b395
jmp 0x14000b40b
mov edx, 0xf8
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000b395
mov rsi, qword [rsp + 0x38]
xor eax, eax
cmp dword [rbx], 0x4550
cmovne rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b430
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000b52e
mov edx, 0x40
call fcn.14000c900
test al, al
jne 0x14000b52e
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x14000b52e
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b52e
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000c900
test al, al
jne 0x14000b52e
cmp dword [rsi], 0x4550
jne 0x14000b52e
test rsi, rsi
je 0x14000b52e
mov edx, 0x40
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000b51b
cmp word [rbx], di
jne 0x14000b51b
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b51b
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b51b
cmp dword [rdi], 0x4550
jne 0x14000b51b
test rdi, rdi
je 0x14000b51b
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b51b
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmovne rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b540
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000b623
mov edx, 0x40
call fcn.14000c900
test al, al
jne 0x14000b623
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x14000b623
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b623
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000c900
test al, al
jne 0x14000b623
cmp dword [rsi], 0x4550
jne 0x14000b623
test rsi, rsi
je 0x14000b623
mov edx, 0x40
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000b623
cmp word [rbx], di
jne 0x14000b623
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b623
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b623
cmp dword [rdi], 0x4550
jne 0x14000b623
test rdi, rdi
je 0x14000b623
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b623
xor eax, eax
mov ecx, 0x20b
cmp word [rdi + 0x18], cx
cmove rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b640
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov rbx, rcx
test rcx, rcx
je 0x14000b72c
mov edx, 0x40
call fcn.14000c900
test al, al
jne 0x14000b72c
mov edi, 0x5a4d
cmp word [rbx], di
jne 0x14000b72c
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b72c
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000c900
test al, al
jne 0x14000b72c
cmp dword [rsi], 0x4550
jne 0x14000b72c
test rsi, rsi
je 0x14000b72c
mov edx, 0x40
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000b71a
cmp word [rbx], di
jne 0x14000b71a
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b71a
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b71a
cmp dword [rdi], 0x4550
jne 0x14000b71a
test rdi, rdi
je 0x14000b71a
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b71a
mov eax, 0x20b
cmp word [rdi + 0x18], ax
lea rax, [rbp + 0x11]
je 0x14000b71e
lea rax, [rbp + 0xf]
lea rax, [rsi + rax*8]
xor ecx, ecx
cmp dword [rax], ecx
cmove rax, rcx
jmp 0x14000b72e
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b750
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 0x5a4d
test rcx, rcx
je 0x14000b7c7
mov edx, 0x40
call fcn.14000c900
test al, al
jne 0x14000b7c7
cmp word [rbx], di
jne 0x14000b7c7
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b7c7
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.14000c900
test al, al
jne 0x14000b7c7
cmp dword [rsi], 0x4550
jne 0x14000b7c7
test rsi, rsi
je 0x14000b7c7
mov edx, 0xf8
mov rcx, rsi
call fcn.14000c900
test al, al
je 0x14000b7c1
xor esi, esi
jmp 0x14000b7ce
movzx esi, word [rsi + 0x18]
jmp 0x14000b7ce
xor esi, esi
test rbx, rbx
je 0x14000b842
mov edx, 0x40
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000b842
cmp word [rbx], di
jne 0x14000b842
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b842
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b842
cmp dword [rdi], 0x4550
jne 0x14000b842
test rdi, rdi
je 0x14000b842
mov eax, 0x20b
cmp si, ax
jne 0x14000b82f
mov rax, qword [rdi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 0x34]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b860
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x14000b964
mov edx, 0x40
call fcn.14000c900
test al, al
jne 0x14000b964
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x14000b964
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b964
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b964
cmp dword [rdi], 0x4550
jne 0x14000b964
mov edx, 0x40
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000b949
cmp word [rbx], si
jne 0x14000b949
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000b949
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b949
cmp dword [rdi], 0x4550
jne 0x14000b949
test rdi, rdi
je 0x14000b949
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000b949
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14000b949
mov rcx, rbx
call fcn.14000b540
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.14000b430
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b980
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x14000ba51
call fcn.14000b370
mov rsi, rax
test rax, rax
je 0x14000ba51
mov edx, 0x40
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000ba12
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14000ba12
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x14000ba12
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000ba12
cmp dword [rdi], 0x4550
jne 0x14000ba12
test rdi, rdi
je 0x14000ba12
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000ba12
mov eax, 0x20b
lea rax, [rsi + 4]
test rax, rax
je 0x14000ba3a
cmp rax, rbx
jb 0x14000ba3a
mov rcx, rax
sub rcx, rbx
lea rdx, [rcx + 0x14]
cmp rdx, rbp
ja 0x14000ba3a
cmp rdx, 0x14
jb 0x14000ba3a
cmp rdx, rcx
jae 0x14000ba3c
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x14000bd70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
test rcx, rcx
je 0x14000bf7c
test r8, r8
je 0x14000bf7c
call fcn.14000b370
mov r15, rax
test rax, rax
je 0x14000bf7c
mov edx, 0x40
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000be19
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14000be19
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x14000be19
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000be19
cmp dword [rbx], 0x4550
jne 0x14000be19
test rbx, rbx
je 0x14000be19
mov edx, 0xf8
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000be19
mov eax, 0x20b
movzx eax, word [r15 + 0x14]
xor r11d, r11d
add rax, r15
mov r14d, r11d
movzx ebp, r11w
lea rdx, [rax + 0x18]
mov eax, dword [r15 + 0x54]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x60], eax
cmp r11w, word [r15 + 6]
jae 0x14000bf5f
nop word [rax + rax]
movzx eax, bp
lea rcx, [rax + rax*4]
lea rbx, [rdx + rcx*8]
test rbx, rbx
je 0x14000bf7c
cmp rbx, rdi
jb 0x14000bf7c
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + 0x28]
cmp rax, r13
ja 0x14000bf7c
cmp rax, 0x28
jb 0x14000bf7c
cmp rax, rcx
jb 0x14000bf7c
cmp rax, rsi
ja 0x14000bf7c
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x14000bf4d
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x14000bf4d
mov r9d, dword [rbx + 0xc]
mov edx, ecx
mov r8d, eax
add rcx, rdi
add rax, r9
lea r10, [r9 + r12]
cmp rax, rsi
jbe 0x14000beda
mov rax, rsi
mov r8, r11
sub rax, r9
cmp rsi, r9
cmova r8, rax
cmp r9, rsi
jb 0x14000bee8
test r8, r8
jne 0x14000bf7c
lea rax, [rdx + r8]
cmp rax, rsi
ja 0x14000bf7c
test rcx, rcx
je 0x14000bf48
cmp rcx, rdi
jb 0x14000bf48
cmp rax, r13
ja 0x14000bf48
cmp rax, r8
jb 0x14000bf48
cmp rax, rdx
jb 0x14000bf48
test r10, r10
je 0x14000bf48
cmp r10, r12
jb 0x14000bf48
lea rax, [r9 + r8]
cmp rax, rsi
ja 0x14000bf48
cmp rax, r8
jb 0x14000bf48
cmp rax, r9
jb 0x14000bf48
mov rdx, rcx
mov rcx, r10
call fcn.140085990
test r14d, r14d
je 0x14000bf41
cmp dword [rbx + 0x14], r14d
jae 0x14000bf45
mov r14d, dword [rbx + 0x14]
xor r11d, r11d
mov rdx, qword [rsp + 0x20]
inc bp
cmp bp, word [r15 + 6]
jb 0x14000be50
mov eax, dword [rsp + 0x60]
test eax, eax
cmove eax, r14d
mov r8d, eax
cmp r8, rsi
ja 0x14000bf7c
mov rdx, rdi
mov rcx, r12
call fcn.140085990
mov al, 1
jmp 0x14000bf7e
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000bfc0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r12, r8
mov edx, 5
mov rsi, rcx
call fcn.14000b640
test rax, rax
je 0x14000c232
test rsi, rsi
je 0x14000c232
cmp rax, rsi
jb 0x14000c232
mov rcx, rax
sub rcx, rsi
lea rdx, [rcx + 8]
cmp rdx, r14
ja 0x14000c232
cmp rdx, 8
jb 0x14000c232
cmp rdx, rcx
jb 0x14000c232
mov ecx, dword [rax + 4]
mov edx, 0x40
mov ebx, dword [rax]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
call fcn.14000c900
test al, al
jne 0x14000c096
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000c096
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x14000c096
lea rbx, [rsi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.14000c900
test al, al
jne 0x14000c092
cmp dword [rbx], 0x4550
jne 0x14000c092
test rbx, rbx
je 0x14000c092
mov edx, 0xf8
mov rcx, rbx
call fcn.14000c900
mov ebx, dword [rsp + 0x78]
mov r10d, dword [rsp + 0x20]
xor r13d, r13d
test r10d, r10d
je 0x14000c22e
mov r11d, 0x1000
nop dword [rax]
lea eax, [rbx + r13]
lea r15, [rax + rsi]
mov ecx, eax
test r15, r15
je 0x14000c232
cmp r15, rsi
jb 0x14000c232
add rax, 8
cmp rax, r14
ja 0x14000c232
cmp rax, 8
jb 0x14000c232
cmp rax, rcx
jb 0x14000c232
mov eax, dword [r15 + 4]
test eax, eax
je 0x14000c22e
mov r9d, dword [r15]
lea rbp, [rax - 8]
shr rbp, 1
lea rax, [r15 + 8]
mov dword [rsp + 0x24], r9d
test rax, rax
je 0x14000c232
cmp rax, rsi
jb 0x14000c232
sub rax, rsi
lea rbx, [rax + 2]
cmp rbx, r14
ja 0x14000c232
cmp rbx, 2
jb 0x14000c232
cmp rbx, rax
jb 0x14000c232
test rbp, rbp
je 0x14000c21d
xor r8d, r8d
test rbp, rbp
je 0x14000c21d
mov rax, rbx
nop dword [rax + rax]
lea rdx, [rsi - 2]
add rdx, rax
je 0x14000c199
cmp rdx, rsi
jb 0x14000c199
cmp rax, r14
ja 0x14000c199
cmp rax, 2
jb 0x14000c199
lea rcx, [rax - 2]
cmp rax, rcx
jb 0x14000c199
cmp word [rdx], r11w
jae 0x14000c199
add rax, 2
inc r8
cmp r8, rbp
jb 0x14000c160
jmp 0x14000c21d
xor edi, edi
nop dword [rax + rax]
lea rcx, [rsi - 2]
add rcx, rbx
je 0x14000c20d
cmp rcx, rsi
jb 0x14000c20d
cmp rbx, r14
ja 0x14000c20d
cmp rbx, 2
jb 0x14000c20d
lea rax, [rbx - 2]
cmp rbx, rax
jb 0x14000c20d
movzx eax, word [rcx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
test eax, eax
je 0x14000c20d
cmp eax, 3
je 0x14000c1de
cmp eax, 0xa
jne 0x14000c232
add ecx, r9d
cmp rcx, r14
jae 0x14000c232
test r12, r12
je 0x14000c201
mov rax, qword [r12]
lea rdx, [rcx + rsi]
mov rcx, r12
call qword [rax]
test al, al
je 0x14000c232
mov r9d, dword [rsp + 0x24]
add rbx, 2
inc rdi
cmp rdi, rbp
jb 0x14000c1a0
test rdi, rdi
je 0x14000c232
mov r10d, dword [rsp + 0x20]
mov r11d, 0x1000
add r13d, dword [r15 + 4]
mov ebx, dword [rsp + 0x78]
cmp r13d, r10d
jb 0x14000c0b0
mov al, 1
jmp 0x14000c234
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000c260
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r14, rcx
call fcn.14000b860
mov edi, eax
test eax, eax
je 0x14000c4ea
test rbp, rbp
jne 0x14000c291
mov ebp, edi
mov edx, 9
mov rcx, r14
call fcn.14000b640
test rax, rax
je 0x14000c4ea
mov eax, dword [rax]
test eax, eax
je 0x14000c4ea
mov ebx, eax
add rbx, r14
je 0x14000c4ea
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x14000c4ea
cmp rbx, r14
jb 0x14000c2ec
lea rax, [r14 + rdi]
cmp rbx, rax
jae 0x14000c2ec
mov rax, rbx
mov ecx, 0xffffffff
sub rax, r14
cmp rax, rcx
jae 0x14000c300
sub ebx, r14d
jmp 0x14000c302
cmp rbx, rdi
jae 0x14000c4ea
mov ecx, 0xffffffff
cmp rbx, rcx
cmovb ecx, ebx
mov ebx, ecx
test r14, r14
je 0x14000c44a
mov edx, 0x40
mov rcx, r14
call fcn.14000c900
test al, al
jne 0x14000c44a
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14000c44a
movsxd rax, dword [r14 + 0x3c]
cmp eax, 0x400
jg 0x14000c44a
lea rdi, [r14 + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
jne 0x14000c44a
cmp dword [rdi], 0x4550
jne 0x14000c44a
test rdi, rdi
je 0x14000c44a
mov edx, 0xf8
mov rcx, rdi
call fcn.14000c900
test al, al
mov eax, ebx
lea rcx, [rax + r14]
jne 0x14000c459
mov edx, 0x20b
cmp word [rdi + 0x18], dx
jne 0x14000c450
test rcx, rcx
je 0x14000c4e3
cmp rcx, r14
jb 0x14000c4e3
lea rbx, [rax + 8]
cmp rbx, rbp
ja 0x14000c4e3
cmp rbx, 8
jb 0x14000c4e3
cmp rbx, rax
jb 0x14000c4e3
mov rcx, r14
call fcn.14000b860
xor edi, edi
lea rcx, [r14 - 8]
add rcx, rbx
je 0x14000c4e5
cmp rcx, r14
jb 0x14000c4e5
cmp rbx, rbp
ja 0x14000c4e5
cmp rbx, 8
jb 0x14000c4e5
lea rax, [rbx - 8]
cmp rbx, rax
jb 0x14000c4e5
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000c4e5
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14000c434
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 8
jmp 0x14000c3d2
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.14000c750
inc rdi
add rbx, 8
jmp 0x14000c3d2
mov eax, ebx
lea rcx, [r14 + rax]
test r14, r14
je 0x14000c4e3
test rcx, rcx
je 0x14000c4e3
cmp rcx, r14
jb 0x14000c4e3
lea rbx, [rax + 4]
cmp rbx, rbp
ja 0x14000c4e3
cmp rbx, 4
jb 0x14000c4e3
cmp rbx, rax
jb 0x14000c4e3
mov rcx, r14
call fcn.14000b860
xor edi, edi
lea rcx, [r14 - 4]
add rcx, rbx
je 0x14000c4e5
cmp rcx, r14
jb 0x14000c4e5
cmp rbx, rbp
ja 0x14000c4e5
cmp rbx, 4
jb 0x14000c4e5
lea rax, [rbx - 4]
cmp rbx, rax
jb 0x14000c4e5
mov eax, dword [rcx]
test eax, eax
je 0x14000c4e5
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x40], rax
cmp rdx, qword [rsi + 0x10]
je 0x14000c4cd
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 4
jmp 0x14000c485
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.14000c750
inc rdi
add rbx, 4
jmp 0x14000c485
xor edi, edi
mov rax, rdi
jmp 0x14000c4ec
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret