joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53e660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53e759
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
test rcx, rcx
jle 0x53e745
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call fcn.00540aa0
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
mov rbx, rdx
cmovl rdx, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
cmp rdi, rsi
jne 0x53e6f3
cmp rcx, rbx
jmp 0x53e728
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov rax, rsi
mov rbx, rdi
mov rcx, rdx
call fcn.00466180
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rbx, rcx
mov rsi, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x20]
jae 0x53e738
mov byte [rsi + rcx], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.004657e0
lea rax, [0x00650580]
lea rbx, [0x006d4870]
call fcn.00436b80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0053e660
Function at 0x53eec0
Capabilities:
Access peb ldr_data

Disassembly:
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp rsp, qword [r14 + 0x10]
jbe 0x53f05f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x60], 0
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x10], rbx
mov rax, qword [0x006303b0]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a40
cmp byte [0x0083a76b], 0
nop
je 0x53f055
mov rax, qword [rsp + 0x28]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax]
call fcn.0040bd80
mov rbx, rax
lea rax, [0x00649180]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
mov eax, dword [rsp + 0x30]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax]
call fcn.0040bd00
mov rbx, rax
lea rax, [0x0064fc40]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x00648f40]
mov rbx, qword [rsp + 0x38]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x006493c0]
mov rbx, qword [rsp + 0x40]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x00647d40]
mov rbx, qword [rsp + 0x48]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x006490c0]
mov rbx, qword [rsp + 0x50]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x006490c0]
mov rbx, qword [rsp + 0x58]
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop
call fcn.00463160
jmp fcn.0053eec0
Function at 0x541640
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x541706
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], rdi
test byte [rcx], al
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653dc0]
call fcn.00405200
lea rax, [0x00651e40]
mov rbx, qword [rsp + 0x60]
call fcn.0040bc00
mov rbx, qword [rsp + 0x60]
lea rcx, [0x00651e40]
mov rdi, rax
lea rax, [0x00648f40]
call fcn.00405200
mov rcx, qword [rsp + 0x50]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 8], rcx
mov dword [rsp + 0x10], 0x40
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
call fcn.0053fa00
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x28]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00541640
Function at 0x542840
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x542a06
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0xd0], r9
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xd8], r10
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], r8
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbx]
mov qword [rsp + 0x50], rdx
test r9, r9
je 0x5428d0
mov qword [rsp + 0x68], r9
lea rax, [0x00653ca0]
mov rbx, r10
mov rcx, rbx
call fcn.0044af40
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xd8]
xor ebx, ebx
jmp 0x5429e3
xor ebx, ebx
mov qword [rsp + 0x60], rbx
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653b80]
call fcn.00405200
mov rax, qword [rsp + 0x50]
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653d00]
call fcn.00405200
lea rax, [0x00648f80]
mov rbx, qword [rsp + 0x60]
xor ecx, ecx
xor edi, edi
nop dword [rax]
call fcn.00405200
lea rax, [0x00648f80]
mov rbx, qword [rsp + 0x98]
lea rcx, [0x0064e200]
lea rdi, [0x006287e8]
call fcn.00405200
mov rcx, qword [rsp + 0x58]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0xd8]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x40], rcx
call fcn.0053f200
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rsi, qword [rdx + rbx*8]
mov rsi, qword [rsi]
mov qword [rax + rbx*8], rsi
inc rbx
cmp rcx, rbx
jg 0x5429d5
test rcx, rcx
jbe 0x5429fa
mov rbx, rax
mov rax, qword [rsp + 0x58]
jmp 0x5428d2
xor eax, eax
mov rcx, rax
nop
call fcn.004657e0
nop
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], r11
call fcn.00463160
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
jmp fcn.00542840
Function at 0x542e00
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x542fe6
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0xc8], r9
mov byte [rsp + 0xa8], cl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x78], r8
mov qword [rsp + 0xd0], r10
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbx]
mov qword [rsp + 0x50], rdx
nop dword [rax]
test r9, r9
je 0x542e96
mov qword [rsp + 0xc8], r9
lea rax, [0x00653ca0]
mov rbx, r10
mov rcx, rbx
call fcn.0044af40
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
xor ebx, ebx
jmp 0x542fc3
xor ebx, ebx
mov qword [rsp + 0x70], rbx
nop dword [rax]
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653b80]
call fcn.00405200
mov rax, qword [rsp + 0x50]
nop dword [rax]
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653d60]
call fcn.00405200
lea rax, [0x00650780]
mov rbx, qword [rsp + 0x78]
xor ecx, ecx
xor edi, edi
call fcn.00405200
lea rax, [0x00648f80]
mov rbx, qword [rsp + 0x70]
xor ecx, ecx
xor edi, edi
nop dword [rax]
call fcn.00405200
lea rax, [0x00648f80]
mov rbx, qword [rsp + 0x90]
lea rcx, [0x0064e200]
lea rdi, [0x006287e8]
call fcn.00405200
mov rcx, qword [rsp + 0x58]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 8], rcx
movzx ecx, byte [rsp + 0xa8]
movzx ecx, cl
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0xd0]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x40], rcx
call fcn.0053f6c0
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rsi, qword [rdx + rbx*8]
mov rsi, qword [rsi]
mov qword [rax + rbx*8], rsi
inc rbx
cmp rcx, rbx
jg 0x542fb5
test rcx, rcx
jbe 0x542fda
mov rbx, rax
mov rax, qword [rsp + 0x58]
jmp 0x542e98
xor eax, eax
mov rcx, rax
nop
call fcn.004657e0
nop
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rbx
mov byte [rsp + 0x20], cl
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], r11
call fcn.00463160
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
movzx ecx, byte [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
jmp fcn.00542e00
Function at 0x543300
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5434e6
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov qword [rsp + 0xc8], r9
mov byte [rsp + 0xa8], cl
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x78], r8
mov qword [rsp + 0xd0], r10
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbx]
mov qword [rsp + 0x50], rdx
nop dword [rax]
test r9, r9
je 0x543396
mov qword [rsp + 0xc8], r9
lea rax, [0x00653ca0]
mov rbx, r10
mov rcx, rbx
call fcn.0044af40
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
xor ebx, ebx
jmp 0x5434c3
xor ebx, ebx
mov qword [rsp + 0x70], rbx
nop dword [rax]
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653b80]
call fcn.00405200
mov rax, qword [rsp + 0x50]
nop dword [rax]
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653d60]
call fcn.00405200
lea rax, [0x00650780]
mov rbx, qword [rsp + 0x78]
xor ecx, ecx
xor edi, edi
call fcn.00405200
lea rax, [0x00648f80]
mov rbx, qword [rsp + 0x70]
xor ecx, ecx
xor edi, edi
nop dword [rax]
call fcn.00405200
lea rax, [0x00648f80]
mov rbx, qword [rsp + 0x90]
lea rcx, [0x0064e200]
lea rdi, [0x006287e8]
call fcn.00405200
mov rcx, qword [rsp + 0x58]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 8], rcx
movzx ecx, byte [rsp + 0xa8]
movzx ecx, cl
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0xd0]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x40], rcx
call fcn.0053f440
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov rsi, qword [rdx + rbx*8]
mov rsi, qword [rsi]
mov qword [rax + rbx*8], rsi
inc rbx
cmp rcx, rbx
jg 0x5434b5
test rcx, rcx
jbe 0x5434da
mov rbx, rax
mov rax, qword [rsp + 0x58]
jmp 0x543398
xor eax, eax
mov rcx, rax
nop
call fcn.004657e0
nop
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rbx
mov byte [rsp + 0x20], cl
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], r11
call fcn.00463160
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
movzx ecx, byte [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x40]
mov r10, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
jmp fcn.00543300
Function at 0x5445e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x544706
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rdx, qword [rbx]
mov rax, qword [rax]
mov rdx, qword [rdx]
mov rbx, qword [rcx + 8]
mov rsi, qword [rcx]
test rbx, rbx
jbe 0x5446f8
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653e20]
call fcn.00405200
mov rax, qword [rsp + 0x38]
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653c40]
call fcn.00405200
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.0040bea0
mov rbx, qword [rsp + 0x50]
lea rcx, [0x0064da80]
mov rdi, rax
lea rax, [0x00650780]
call fcn.00405200
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov dword [rsp + 0x10], 0x1183
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
call fcn.00540000
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004657e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005445e0
Function at 0x5457e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x545986
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x98], rbx
mov rax, qword [rax]
mov rdx, qword [rsi]
cmp qword [rsi + 8], 0
jbe 0x545979
mov rbx, qword [r8]
cmp qword [r8 + 8], 0
jbe 0x54596f
mov rdi, qword [r9]
cmp qword [r9 + 8], 0
jbe 0x545965
mov r8, qword [rsp + 0x80]
test r8, r8
jbe 0x54595a
mov qword [rsp + 0x60], r10
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xc0], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rbx
call fcn.0040bd80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x00653be0]
call fcn.00405200
mov rcx, qword [rsp + 0xb0]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.0040bea0
mov rbx, qword [rsp + 0x50]
lea rcx, [0x0064cd40]
mov rdi, rax
lea rax, [0x00648f40]
call fcn.00405200
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.0040bea0
mov rbx, qword [rsp + 0x58]
lea rcx, [0x0064c100]
mov rdi, rax
lea rax, [0x00647d40]
call fcn.00405200
mov rcx, qword [rsp + 0x40]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 8], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
call fcn.0053eec0
xorps xmm15, xmm15
mov r14, qword [0x0083a970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor eax, eax
mov rcx, rax
nop
call fcn.004657e0
xor eax, eax
mov rcx, rax
call fcn.004657e0
xor eax, eax
mov rcx, rax
call fcn.004657e0
xor eax, eax
mov rcx, rax
nop
call fcn.004657e0
nop
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r10
call fcn.00463160
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov r10, qword [rsp + 0x58]
nop dword [rax + rax]
jmp fcn.005457e0

Function at 0x555e10
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [0x0083e990], rax
je 0x555e45
lea rcx, [0x0083e9a0]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 2
call qword [fcn.006196d0]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
Function at 0x5600d2
Capabilities:
Hash data using sha256

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
lea r8, [0x007a26a0]
lea rdx, [0x007a2600]
mov rcx, qword [rbp + 0x10]
call fcn.00556340
nop
add rsp, 0x20
pop rbp
ret

Function at 0x5601ab
Capabilities:
Hash data using sha384

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
lea r8, [0x007a26c0]
lea rdx, [0x007a2620]
mov rcx, qword [rbp + 0x10]
call fcn.0055a1ff
nop
add rsp, 0x20
pop rbp
ret

Function at 0x560284
Capabilities:
Hash data using sha512

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
lea r8, [0x007a26c0]
lea rdx, [0x007a2660]
mov rcx, qword [rbp + 0x10]
call fcn.0055a1ff
nop
add rsp, 0x20
pop rbp
ret
Function at 0x6151f1
Capabilities:
Hash data using sha384

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
sub rax, 0xffffffffffffff80
mov r8d, 0x40
lea rdx, [0x007dfd80]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 8]
mov qword [rax + 0xc0], 0
nop
add rsp, 0x30
pop rbp
ret

Function at 0x615238
Capabilities:
Hash data using sha512

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
sub rax, 0xffffffffffffff80
mov r8d, 0x40
lea rdx, [0x007dfdc0]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 8]
mov qword [rax + 0xc0], 0
nop
add rsp, 0x30
pop rbp
ret

Function at 0x618420
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0083efe4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6185a8
mov rax, qword [0x0083efe8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x61846c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6184f5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x618450
mov rcx, rbx
call fcn.006190c0
test rax, rax
mov r12, rax
je 0x6185dd
mov rax, qword [0x0083efe8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.006191f0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0083efe8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6185c0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6184ee
sub eax, 0x40
and eax, 0xffffffbf
jne 0x618550
add dword [0x0083efe4], 1
cmp edi, 8
jae 0x618523
test dil, 4
jne 0x618594
test edi, edi
je 0x618518
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6185af
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x618518
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x61853c
jmp 0x618518
add rsi, qword [0x0083efe8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6184ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00619750
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x618518
xor esi, esi
jmp 0x618477
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x618518
mov rax, qword [0x0083efe8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00619750
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00619750
nop
nop dword [rax]
Function at 0x618d30
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0083f2c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0083f2a0]
test rbx, rbx
je 0x618d84
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x618d7b
test rsi, rsi
je 0x618d7b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x618d60
lea rcx, [0x0083f2c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6190c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x007e0260]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x61912d
mov rcx, r8
call fcn.00618fa0
test eax, eax
je 0x61912d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x61912d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x619124
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x61912f
add rax, 0x28
cmp rax, r9
jne 0x619110
xor eax, eax
add rsp, 0x28
ret

Function at 0x619750
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.006196d0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.006196d0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530