joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53ac60
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x53aec1
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x53aea5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x53acad
xor ebx, ebx
xor ecx, ecx
jmp 0x53acc0
mov rax, rdx
call fcn.0052c560
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x53add8
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0047e720
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006f0110]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044ed00
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004037a0
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x53ad9b
xor eax, eax
lea rbx, [0x006a2707]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006a279e]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044ede0
jmp 0x53adc8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x006f01a8]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044ed00
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.0047e720
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004037a0
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x53ae68
xor eax, eax
lea rbx, [0x006a2707]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006a279e]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044ede0
jmp 0x53ae95
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006f01a8]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044ed00
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006a2b07]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00463020
mov rax, qword [rsp + 8]
jmp fcn.0053ac60
Function at 0x544d60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x544e59
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
test rcx, rcx
jle 0x544e45
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call fcn.00545020
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
mov rbx, rdx
cmovl rdx, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
cmp rdi, rsi
jne 0x544df3
cmp rcx, rbx
jmp 0x544e28
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov rax, rsi
mov rbx, rdi
mov rcx, rdx
call fcn.00466040
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rbx, rcx
mov rsi, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x20]
jae 0x544e38
mov byte [rsi + rcx], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.004656a0
lea rax, [0x00667a20]
lea rbx, [0x006f1450]
call fcn.00436a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00544d60

Function at 0x556d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x556e19
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
test rcx, rcx
jle 0x556e05
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call fcn.00558ea0
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
mov rbx, rdx
cmovl rdx, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
cmp rdi, rsi
jne 0x556db3
cmp rcx, rbx
jmp 0x556de8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov rax, rsi
mov rbx, rdi
mov rcx, rdx
call fcn.00466040
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rbx, rcx
mov rsi, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x20]
jae 0x556df8
mov byte [rsi + rcx], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.004656a0
lea rax, [0x00667a20]
lea rbx, [0x006f1450]
call fcn.00436a40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00556d20
Function at 0x557640
Capabilities:
Access peb ldr_data

Disassembly:
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp rsp, qword [r14 + 0x10]
jbe 0x5577df
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov qword [rsp + 0x60], 0
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x10], rbx
mov rax, qword [0x006474e0]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a40
cmp byte [0x0086626b], 0
nop
je 0x5577d5
mov rax, qword [rsp + 0x28]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax]
call fcn.0040bb80
mov rbx, rax
lea rax, [0x006600e0]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
mov eax, dword [rsp + 0x30]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax]
call fcn.0040bb00
mov rbx, rax
lea rax, [0x00667120]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x0065fe60]
mov rbx, qword [rsp + 0x38]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x00660320]
mov rbx, qword [rsp + 0x40]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x0065e860]
mov rbx, qword [rsp + 0x48]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x0065ffe0]
mov rbx, qword [rsp + 0x50]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
lea rax, [0x0065ffe0]
mov rbx, qword [rsp + 0x58]
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.00404a00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
nop
call fcn.00463020
jmp fcn.00557640
Function at 0x559340
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x55947e
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x54], ecx
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x78], r9
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066aca0]
nop
call fcn.00405200
mov rax, qword [rsp + 0x58]
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066ae80]
nop dword [rax]
call fcn.00405200
lea rax, [0x00667c20]
mov rbx, qword [rsp + 0x80]
xor ecx, ecx
xor edi, edi
call fcn.00405200
lea rax, [0x0065fea0]
mov rbx, qword [rsp + 0x78]
lea rcx, [0x00665460]
lea rdi, [0x0063f908]
call fcn.00405200
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x40], rcx
call fcn.00557bc0
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00559340
Function at 0x5594e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x559686
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov rdx, qword [r10]
cmp qword [r10 + 8], 0
jbe 0x559678
mov dword [rsp + 0x54], r9d
mov qword [rsp + 0xd8], r10
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x78], rdx
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066aca0]
call fcn.00405200
mov rax, qword [rsp + 0x68]
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066ae80]
nop
call fcn.00405200
lea rax, [0x00667c20]
mov rbx, qword [rsp + 0x80]
xor ecx, ecx
xor edi, edi
call fcn.00405200
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.0040bca0
mov rbx, qword [rsp + 0x78]
lea rcx, [0x00663e60]
mov rdi, rax
lea rax, [0x0065fea0]
call fcn.00405200
lea rax, [0x0065fea0]
mov rbx, qword [rsp + 0x88]
lea rcx, [0x00665460]
lea rdi, [0x0063f908]
call fcn.00405200
mov rcx, qword [rsp + 0x70]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 8], rcx
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x40], rcx
call fcn.00557bc0
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004656a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.005594e0
Function at 0x559940
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x559a7e
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x54], ecx
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x78], r9
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066aca0]
nop
call fcn.00405200
mov rax, qword [rsp + 0x58]
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066ae80]
nop dword [rax]
call fcn.00405200
lea rax, [0x00667c20]
mov rbx, qword [rsp + 0x80]
xor ecx, ecx
xor edi, edi
call fcn.00405200
lea rax, [0x0065fea0]
mov rbx, qword [rsp + 0x78]
lea rcx, [0x00665460]
lea rdi, [0x0063f908]
call fcn.00405200
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x40], rcx
call fcn.00557e40
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00559940
Function at 0x559ae0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x559c86
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov rdx, qword [r10]
cmp qword [r10 + 8], 0
jbe 0x559c78
mov dword [rsp + 0x54], r9d
mov qword [rsp + 0xd8], r10
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x88], r11
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x78], rdx
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066aca0]
call fcn.00405200
mov rax, qword [rsp + 0x68]
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066ae80]
nop
call fcn.00405200
lea rax, [0x00667c20]
mov rbx, qword [rsp + 0x80]
xor ecx, ecx
xor edi, edi
call fcn.00405200
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.0040bca0
mov rbx, qword [rsp + 0x78]
lea rcx, [0x00663e60]
mov rdi, rax
lea rax, [0x0065fea0]
call fcn.00405200
lea rax, [0x0065fea0]
mov rbx, qword [rsp + 0x88]
lea rcx, [0x00665460]
lea rdi, [0x0063f908]
call fcn.00405200
mov rcx, qword [rsp + 0x70]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 8], rcx
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x40], rcx
call fcn.00557e40
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004656a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.00559ae0
Function at 0x55cf20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x55d04b
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x54], ecx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x68], r8
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066aca0]
nop
call fcn.00405200
mov rax, qword [rsp + 0x58]
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066ae20]
nop dword [rax]
call fcn.00405200
lea rax, [0x0065fea0]
mov rbx, qword [rsp + 0x70]
lea rcx, [0x00665460]
lea rdi, [0x0063f908]
nop
call fcn.00405200
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rcx
nop dword [rax]
call fcn.00557980
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.0055cf20
Function at 0x55d0a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x55d228
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov rdx, qword [r10]
cmp qword [r10 + 8], 0
jbe 0x55d21d
mov dword [rsp + 0x54], r9d
mov qword [rsp + 0x88], r8
mov qword [rsp + 0xd8], r10
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], r11
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x68], rdx
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066aca0]
call fcn.00405200
mov rax, qword [rsp + 0x58]
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066ae20]
nop
call fcn.00405200
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.0040bca0
mov rbx, qword [rsp + 0x68]
lea rcx, [0x00663e60]
mov rdi, rax
lea rax, [0x0065fea0]
call fcn.00405200
lea rax, [0x0065fea0]
mov rbx, qword [rsp + 0x78]
lea rcx, [0x00665460]
lea rdi, [0x0063f908]
call fcn.00405200
mov rcx, qword [rsp + 0x60]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 8], rcx
mov ecx, dword [rsp + 0x50]
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rsp + 0x54]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x40], rcx
call fcn.00557980
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
xor eax, eax
mov rcx, rax
call fcn.004656a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00463020
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.0055d0a0
Function at 0x560940
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x560ae6
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0xa8], r8
mov rdx, qword [rcx]
cmp qword [rcx + 8], 0
jbe 0x560ad9
mov r10, qword [rdi]
cmp qword [rdi + 8], 0
jbe 0x560acf
mov rdi, qword [rsi]
cmp qword [rsi + 8], 0
jbe 0x560ac5
test r9, r9
jbe 0x560ab7
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], r10
mov qword [rsp + 0xa8], r8
call fcn.0040bb80
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x0066ad00]
nop dword [rax + rax]
call fcn.00405200
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.0040bca0
mov rbx, qword [rsp + 0x58]
lea rcx, [0x00663e20]
mov rdi, rax
lea rax, [0x0065fe60]
call fcn.00405200
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.0040bca0
mov rbx, qword [rsp + 0x60]
lea rcx, [0x00663120]
mov rdi, rax
lea rax, [0x0065e860]
call fcn.00405200
mov rcx, qword [rsp + 0x48]
mov qword [rsp], rcx
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 8], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], rcx
call fcn.00557640
xorps xmm15, xmm15
mov r14, qword [0x00866470]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004656a0
xor eax, eax
mov rcx, rax
call fcn.004656a0
xor eax, eax
mov rcx, rax
call fcn.004656a0
xor eax, eax
mov rcx, rax
nop
call fcn.004656a0
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00463020
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.00560940