joyce8/EMBER2024-capa huggingface dataset:
Function at 0x583840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x583a93
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.0054c320
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
nop word [rax + rax]
test rdx, rdx
jle 0x583997
cmp rdx, 0x40
ja 0x583a85
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
nop dword [rax]
cmp rbx, rdx
je 0x583904
mov rax, rdx
mov rcx, rsi
call fcn.0045ace0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x58396e
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00584000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x583a76
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x5839a4
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x583a2a
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.00584000
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x583a65
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x583a61
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.0045ace0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
nop dword [rax]
call fcn.0045a3e0
mov rax, rdx
mov ecx, 0x40
call fcn.0045a3e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00457c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00583840
Function at 0x5981c0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5981d8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5981d8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5981e0
xor eax, eax
ret
cmp rbx, 3
je 0x5981ec
cmp rbx, 4
jne 0x598219
cmp al, 0x2c
ja 0x598206
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x598216
cmp al, 0x24
je 0x598216
nop dword [rax]
cmp al, 0x26
jae 0x598216
jmp 0x598219
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x598216
cmp al, 0x5b
je 0x598216
cmp al, 0x5d
jne 0x598219
xor eax, eax
ret
cmp al, 0x2f
ja 0x598252
nop dword [rax]
cmp al, 0x26
ja 0x598231
cmp al, 0x24
je 0x598271
cmp al, 0x26
je 0x598271
jmp 0x5982eb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x598271
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5982e8
cmp al, 0x2f
je 0x598271
jmp 0x5982eb
cmp al, 0x3d
ja 0x598269
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x598271
nop
cmp al, 0x3d
je 0x598271
jmp 0x5982eb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5982e0
cmp rbx, 2
jg 0x5982a7
cmp rbx, 1
je 0x5982a1
nop dword [rax]
cmp rbx, 2
jne 0x5982eb
cmp al, 0x2f
je 0x598292
cmp al, 0x3b
je 0x598292
cmp al, 0x2c
jne 0x598299
mov ecx, 1
jmp 0x59829e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x5982ca
cmp al, 0x40
je 0x5982b9
cmp al, 0x2f
je 0x5982b9
cmp al, 0x3f
jne 0x5982c2
mov ecx, 1
nop
jmp 0x5982c7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x5982d9
cmp rbx, 7
jne 0x5982eb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5982e8
cmp al, 0x7e
jne 0x5982eb
xor eax, eax
ret
cmp rbx, 7
jne 0x598301
cmp al, 0x21
je 0x5982fd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x598301
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x59d1a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59d3bf
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x59d2d0
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x59d3b1
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x59d242
mov rax, rdx
mov rcx, rsi
call fcn.0045ace0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x59d2ac
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0059d660
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x59d3a9
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x59d2d6
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x59d355
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.0059d660
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x59d398
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x59d394
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
nop dword [rax + rax]
call fcn.0045ace0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.0045a3e0
mov rax, rdx
mov ecx, 0x40
call fcn.0045a3e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00457c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0059d1a0
Function at 0x5b15a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b16f4
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.005b09c0
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x5b1644
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x5b1695
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x5b16c0
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x5b163e
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x5b163e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x5b16ac
mov rax, rsi
mov ecx, 0x20
call fcn.0045a320
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00457c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005b15a0
Function at 0x5bfea0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x5c0103
sub rsp, 0xc8
mov qword [rsp + 0xc0], rbp
lea rbp, [rsp + 0xc0]
mov qword [rsp + 0x180], rax
lea rdi, [rsp + 0xd0]
lea rdi, [rdi - 0x10]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045a5ef
mov rbp, qword [rbp]
lea rdi, [rsp + 0x10]
lea rdi, [rdi - 0x10]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045a5ef
mov rbp, qword [rbp]
test byte [rax], al
nop
lea rcx, [rax + 0x20]
mov qword [rsp], rcx
nop
call fcn.00461820
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp dword [rsp + 8], 1
sete byte [rsp + 0x12]
mov rax, qword [rsp + 0x180]
movzx ecx, word [rax + 0x40]
mov word [rsp + 0x10], cx
mov rcx, qword [rax + 0x148]
mov rdx, qword [rax + 0x150]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdx
movzx ecx, byte [rax + 0x58]
mov byte [rsp + 0x13], cl
mov byte [rsp + 0x28], 1
mov rcx, qword [rax + 0xc0]
mov rdx, qword [rax + 0xc8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rdx
movzx ecx, word [rax + 0x5a]
mov word [rsp + 0x14], cx
mov rcx, qword [rax + 0x90]
mov rdx, qword [rax + 0x98]
mov rbx, qword [rax + 0xa0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rbx
mov rcx, qword [rax + 0xa8]
mov rdx, qword [rax + 0xb0]
mov rbx, qword [rax + 0xb8]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rbx
mov rcx, qword [rax + 0x78]
mov rdx, qword [rax + 0x80]
mov rbx, qword [rax + 0x88]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax + 0x60]
mov rdx, qword [rax + 0x68]
mov rbx, qword [rax + 0x70]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x98], rbx
cmp byte [rax + 0x58], 0
jne 0x5c0092
cmp word [rax + 0x40], 0x304
je 0x5c0092
cmp byte [rax + 0x110], 0
nop
je 0x5c006b
lea rcx, [rax + 0x129]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], 0xc
mov qword [rsp + 0xb0], 0xc
jmp 0x5c0092
lea rcx, [rax + 0x135]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], 0xc
mov qword [rsp + 0xb0], 0xc
mov rcx, qword [rax + 0x48]
cmp qword [rcx + 0x120], 0
nop
je 0x5c00b3
lea rax, [0x00742990]
mov qword [rsp + 0xb8], rax
jmp 0x5c00c2
mov rax, qword [rax + 0xd8]
mov qword [rsp + 0xb8], rax
lea rdi, [rsp + 0xd0]
lea rsi, [rsp + 0x10]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045a926
mov rbp, qword [rbp]
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
mov qword [rsp + 0xb8], rax
call fcn.00457c40
mov rax, qword [rsp + 0xb8]
jmp fcn.005bfea0
Function at 0x5fa060
Capabilities:
Check for software breakpoints

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fa22c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
call fcn.005f98a0
nop dword [rax + rax]
test rbx, rbx
jne 0x5fa1e4
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
call fcn.005fe600
test rbx, rbx
jne 0x5fa1d8
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x5fa0e6
mov rsi, qword [rsp + 0x68]
xor ecx, ecx
jmp 0x5fa1f3
mov rdx, rax
movzx esi, byte [rax]
cmp sil, 0xe9
je 0x5fa0f8
cmp sil, 0xff
jne 0x5fa125
inc rdx
cmp dword [rdx], 0x10
nop
jae 0x5fa115
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rsi, [rdx + 1]
movzx esi, byte [rsi]
cmp sil, 0xff
je 0x5fa138
cmp sil, 0xcc
jne 0x5fa148
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
lea rsi, [rdx + 2]
cmp byte [rsi], 0xcc
je 0x5fa15a
add rdx, 3
cmp byte [rdx], 0xcc
jne 0x5fa16a
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rdx, qword [0x008eb088]
mov rdx, qword [rdx + 0x20]
test rdx, rdx
jbe 0x5fa1c5
mov rsi, qword [rsp + 0x30]
nop
cmp rsi, rdx
jne 0x5fa1c5
movzx edx, byte [rax + 4]
mov esi, dword [rax]
mov dword [rsp + 0x2b], esi
mov byte [rsp + 0x2f], dl
cmp byte [rsp + 0x2b], 0x4c
jne 0x5fa1b5
cmp byte [rsp + 0x2c], 0x8b
nop
jne 0x5fa1b5
cmp byte [rsp + 0x2d], 0xd1
jne 0x5fa1b5
cmp byte [rsp + 0x2e], 0xb8
jne 0x5fa1b5
cmp dl, 0x51
je 0x5fa1c5
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rcx
cmp rdx, rcx
jle 0x5fa219
lea rdi, [rcx + rax]
movzx edi, byte [rdi]
movzx r8d, byte [rsi + rcx]
cmp r8b, dil
je 0x5fa1f0
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, 1
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00457c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.005fa060
Function at 0x604580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x604770
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x80], r9d
mov dword [rsp + 0x84], r10d
mov byte [rsp + 0x88], r11b
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x50], rax
mov rax, rcx
mov rbx, rdi
call fcn.00601740
test rdi, rdi
je 0x6045e2
xor eax, eax
nop
jmp 0x6045ef
test rbx, rbx
jbe 0x604765
xor edi, edi
xor esi, esi
test rdi, rdi
jne 0x604745
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
call fcn.00601740
test rdi, rdi
je 0x604615
xor eax, eax
jmp 0x604622
test rbx, rbx
jbe 0x604757
xor edi, edi
xor esi, esi
test rdi, rdi
jne 0x604733
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0
mov rax, qword [0x008f2050]
nop
call fcn.005fe3a0
mov qword [rsp + 0x28], rax
lea rax, [0x006c1e00]
call fcn.0040bf40
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov ecx, dword [rsp + 0x58]
movsxd rcx, ecx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x68]
shl rcx, 1
mov qword [rax + 0x18], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x20], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 1
mov qword [rax + 0x28], rcx
mov ecx, dword [rsp + 0x80]
mov ecx, ecx
mov qword [rax + 0x30], rcx
mov ecx, dword [rsp + 0x84]
mov ecx, ecx
mov qword [rax + 0x38], rcx
lea rcx, [rsp + 0x24]
mov qword [rax + 0x40], rcx
movzx ecx, byte [rsp + 0x88]
movzx ecx, cl
mov qword [rax + 0x48], rcx
mov rbx, rax
mov ecx, 0xa
mov rdi, rcx
mov rax, qword [rsp + 0x28]
call fcn.004567c0
test rax, rax
jne 0x604721
nop
test rcx, rcx
jne 0x6046ee
lea rax, [0x0079e918]
jmp 0x60470a
cmp rcx, 0x3e5
jne 0x604702
lea rax, [0x0079e8e8]
nop
jmp 0x60470a
mov rax, rcx
call fcn.00409aa0
lea rbx, [0x007a0260]
mov rcx, rax
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov eax, dword [rsp + 0x24]
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
mov rbx, rdi
mov rcx, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
mov rbx, rdi
mov rcx, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045a320
xor eax, eax
mov rcx, rax
call fcn.0045a320
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x3c], r10d
mov byte [rsp + 0x40], r11b
nop dword [rax]
call fcn.00457c40
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x38]
mov r10d, dword [rsp + 0x3c]
movzx r11d, byte [rsp + 0x40]
jmp fcn.00604580
Function at 0x6159e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x615b2a
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
xor ecx, ecx
nop
jmp 0x615a05
inc rcx
cmp rbx, rcx
jle 0x615b1c
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x615a02
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
call fcn.004b9220
test rsi, rsi
mov edx, 0
cmovne rdi, rdx
mov edx, 0
cmovne rcx, rdx
mov rsi, qword [rsp + 0x80]
cmovne rbx, rsi
mov rsi, qword [rsp + 0x78]
cmovne rax, rsi
test rdi, rdi
je 0x615b0d
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00402e80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x615ad8
xor eax, eax
lea rbx, [0x0071f66c]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x0071f6b9]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.004471c0
jmp 0x615aff
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0071f664]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.004470e0
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor ecx, ecx
mov rdi, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00457c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.006159e0
Function at 0x63be80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63bff8
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
lea rcx, [0x0071f677]
mov edi, 2
call fcn.004cc2c0
cmp rax, 0xffffffffffffffff
je 0x63bed1
mov rdx, qword [rsp + 0x88]
cmp rax, rdx
jbe 0x63bed9
jmp 0x63bfef
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov rbx, rax
mov rax, qword [rsp + 0x80]
call fcn.004b9220
test rsi, rsi
je 0x63bf09
nop
nop
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x58]
xor ecx, ecx
jmp 0x63bfd2
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x68], rcx
nop
xor edx, edx
jmp 0x63bf20
inc rdx
nop dword [rax + rax]
cmp rbx, rdx
jle 0x63bf2f
movzx esi, byte [rax + rdx]
cmp sil, 0x7f
jbe 0x63bf18
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402e80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x63bf9e
xor eax, eax
lea rbx, [0x0071f66c]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
lea r8, [0x0071f6b9]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x50]
call fcn.004471c0
jmp 0x63bfc5
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0071f664]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x50]
call fcn.004470e0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
inc rcx
cmp rcx, rbx
jge 0x63bfe5
movzx edx, byte [rcx + rax]
nop dword [rax + rax]
cmp dl, 0x7f
jbe 0x63bfcf
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rcx, rax
call fcn.0045a360
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00457c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0063be80
Function at 0x653b40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x653c7a
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
mov rax, rcx
call fcn.0059c3a0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x48], rbx
nop
xor ecx, ecx
jmp 0x653b80
inc rcx
nop
cmp rbx, rcx
jle 0x653b8e
movzx edx, byte [rax + rcx]
cmp dl, 0x7f
jbe 0x653b7c
nop
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx + 0x28]
mov rbx, qword [rcx + 0x30]
nop dword [rax]
call fcn.0059c3a0
test rdi, rdi
jne 0x653bd0
mov rbx, qword [0x008f1a70]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x006d15a0]
call fcn.00411180
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402e80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x653c49
xor eax, eax
lea rbx, [0x0071f66c]
mov ecx, 1
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r8, [0x0071f6b9]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x50]
call fcn.004471c0
jmp 0x653c70
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0071f664]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x50]
call fcn.004470e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
nop
call fcn.00457c40
mov rax, qword [rsp + 8]
jmp fcn.00653b40