joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c4975
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x70], rax
xor ecx, ecx
xor edx, edx
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x4c4780
dec rbx
mov r10, rbx
neg r10
sar r10, 0x3f
and r10d, 1
add rax, r10
mov rcx, r9
nop dword [rax + rax]
test rbx, rbx
je 0x4c494d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x46], r8b
movzx r9d, byte [rax]
mov byte [rsp + 0x47], r9b
cmp r9b, 0x20
jbe 0x4c48a9
cmp r9b, 0x22
je 0x4c47c5
cmp r9b, 0x5c
jne 0x4c48ba
lea r9, [rcx + 1]
nop
jmp 0x4c490c
mov qword [rsp + 0x48], rcx
mov r8, rcx
shr rcx, 0x3f
lea r9, [r8 + rcx]
sar r9, 1
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
mov rdi, r9
call fcn.004c46a0
mov rdx, qword [rsp + 0x48]
bt edx, 0
jb 0x4c4865
movzx edx, byte [rsp + 0x46]
test dl, dl
je 0x4c4856
mov r8, qword [rsp + 0x50]
cmp r8, 1
jle 0x4c484f
mov r9, qword [rsp + 0x58]
cmp byte [r9 + 1], 0x22
jne 0x4c484a
inc rbx
cmp rcx, rbx
jae 0x4c483c
mov edi, 1
lea rsi, [0x0056e060]
call fcn.00456240
movzx edx, byte [rsp + 0x46]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
mov byte [rbx + rax - 1], 0x22
lea rsi, [r9 + 1]
dec r8
jmp 0x4c4860
mov rsi, r9
jmp 0x4c4860
mov rsi, qword [rsp + 0x58]
jmp 0x4c4860
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
xor edx, 1
jmp 0x4c4892
inc rbx
cmp rcx, rbx
jae 0x4c487e
mov edi, 1
lea rsi, [0x0056e060]
call fcn.00456240
mov byte [rbx + rax - 1], 0x22
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
movzx edx, byte [rsp + 0x46]
xor r9d, r9d
mov rdi, rax
mov rax, rsi
mov rsi, rbx
mov rbx, r8
mov r8d, edx
mov rdx, rcx
jmp 0x4c490c
cmp r9b, 9
je 0x4c48b5
cmp r9b, 0x20
jne 0x4c48ba
test r8b, r8b
je 0x4c4918
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.004c46a0
inc rbx
cmp rcx, rbx
jae 0x4c48e5
mov edi, 1
lea rsi, [0x0056e060]
nop
call fcn.00456240
movzx r10d, byte [rsp + 0x47]
mov byte [rbx + rax - 1], r10b
mov rdx, rcx
mov rsi, rbx
xor r9d, r9d
mov rdi, rax
movzx r8d, byte [rsp + 0x46]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
cmp rbx, 1
jae 0x4c4764
jmp 0x4c4968
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.004c46a0
mov rsi, qword [rsp + 0x50]
dec rsi
mov rdx, rsi
neg rdx
sar rdx, 0x3f
and edx, 1
mov r8, qword [rsp + 0x58]
lea rdi, [rdx + r8]
add rsp, 0x60
pop rbp
ret
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.004c46a0
xor edi, edi
xor esi, esi
add rsp, 0x60
pop rbp
ret
mov eax, 1
xor ecx, ecx
call fcn.00473080
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004c4740
Function at 0x4c6140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c6334
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rsp + 0x30], rax
nop word [rax + rax]
cmp rbx, 2
jl 0x4c6229
movzx edx, byte [rax]
cmp byte [rax + 1], 0x3a
jne 0x4c619a
lea esi, [rdx - 0x30]
cmp sil, 9
jbe 0x4c618f
lea esi, [rdx - 0x61]
nop
cmp sil, 0x19
jbe 0x4c618f
lea esi, [rdx - 0x41]
cmp sil, 0x19
ja 0x4c619a
mov ebx, 2
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
cmp rbx, 5
jge 0x4c61ae
xor ecx, ecx
jmp 0x4c61c1
mov eax, edx
call fcn.004c5fa0
mov rbx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x30]
test cl, cl
jne 0x4c61c9
xor ecx, ecx
jmp 0x4c61e0
movzx ecx, byte [rax + 1]
mov eax, ecx
call fcn.004c5fa0
mov rbx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x30]
test cl, cl
je 0x4c620a
cmp rbx, 2
jbe 0x4c6326
movzx ecx, byte [rax + 2]
mov eax, ecx
call fcn.004c5fa0
xor eax, 1
mov rbx, qword [rsp + 0x38]
mov ecx, eax
mov rax, qword [rsp + 0x30]
jmp 0x4c620c
xor ecx, ecx
test cl, cl
je 0x4c6233
cmp rbx, 2
jbe 0x4c6319
cmp byte [rax + 2], 0x2e
nop
je 0x4c6233
mov ecx, 3
jmp 0x4c624f
xor eax, eax
xor ebx, ebx
add rsp, 0x20
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x20
pop rbp
ret
mov rcx, qword [rsp + 0x10]
inc rcx
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
lea rdx, [rbx - 1]
cmp rcx, rdx
jge 0x4c6233
mov qword [rsp + 0x10], rcx
movzx edx, byte [rax + rcx]
mov eax, edx
call fcn.004c5fa0
test al, al
je 0x4c623d
mov rax, qword [rsp + 0x10]
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x38]
nop word [rax + rax]
cmp rcx, rdx
jbe 0x4c6311
mov qword [rsp + 0x18], rdx
mov rcx, qword [rsp + 0x30]
movzx edx, byte [rcx + rax + 1]
mov eax, edx
call fcn.004c5fa0
nop
test al, al
jne 0x4c6233
mov rsi, qword [rsp + 0x10]
mov rax, qword [rsp + 0x30]
movzx esi, byte [rax + rsi + 1]
cmp sil, 0x2e
je 0x4c6233
mov rcx, qword [rsp + 0x18]
jmp 0x4c62d1
mov rcx, qword [rsp + 0x10]
inc rcx
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
cmp rdx, rcx
jle 0x4c6301
mov qword [rsp + 0x10], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.004c5fa0
test al, al
je 0x4c62c4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x10]
cmp rdx, rcx
mov rax, qword [rsp + 0x30]
jb 0x4c630c
mov rbx, rcx
add rsp, 0x20
pop rbp
ret
call fcn.00473000
mov rax, rdx
call fcn.00472fc0
mov eax, 2
mov rcx, rax
call fcn.00472fc0
mov eax, 2
mov rcx, rax
call fcn.00472fc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004c6140

Function at 0x4d2400
Capabilities:
Hash data using fnv

Disassembly:
movzx ecx, bl
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
ret

Function at 0x4d2420
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x4d2441
movzx esi, byte [rbx + rdx]
xor rax, rsi
inc rdx
movabs rsi, 0x100000001b3
imul rax, rsi
cmp rcx, rdx
jg 0x4d2429
ret
Function at 0x4d2460
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x4d2480
movzx edx, bl
xor rax, rdx
inc rcx
shr rbx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 8
jl 0x4d2464
ret

Function at 0x4d24a0
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x4d24c0
movzx edx, bl
xor rax, rdx
inc rcx
shr ebx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 4
jl 0x4d24a4
ret
Function at 0x4d7e60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d80ad
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
cmp rsi, r10
jl 0x4d8061
test rsi, rsi
je 0x4d8058
nop dword [rax]
test r10, r10
je 0x4d804d
mov qword [rsp + 0xb0], r10
mov qword [rsp + 0xb8], r11
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rsi
lea rdi, [rsi + 1]
nop dword [rax]
call fcn.004d7c00
mov rdx, qword [rsp + 0xb0]
cmp rcx, rdx
jb 0x4d809e
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x18], rbx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x20], rsi
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rdi
mov r8, qword [rsp + 0xa8]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rdx
mov r8, qword [rsp + 0xb8]
mov qword [rsp + 0x40], r8
call fcn.004e1c20
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xb0]
cmp rcx, rdx
jle 0x4d8027
mov rbx, qword [rsp + 0x58]
cmp rbx, rcx
jb 0x4d8096
sub rcx, rdx
sub rbx, rdx
mov r8, rdx
shl rdx, 3
mov r9, rbx
neg rbx
sar rbx, 0x3f
and rbx, rdx
mov r10, qword [rsp + 0x60]
add rbx, r10
mov qword [rsp], rbx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], r9
mov rbx, qword [rsp + 0xa0]
sub rbx, r8
mov r8, rbx
neg rbx
sar rbx, 0x3f
and rbx, rdx
mov rdx, qword [rsp + 0x90]
add rdx, rbx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rax
call fcn.004e1d60
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x50]
cmp rbx, rcx
jbe 0x4d808b
mov rdx, qword [rsp + 0x60]
mov qword [rdx + rcx*8], rax
mov rax, rdx
mov rcx, qword [rsp + 0x58]
call fcn.004d7bc0
add rsp, 0x68
pop rbp
ret
call fcn.004d7da0
add rsp, 0x68
pop rbp
ret
xor ebx, ebx
add rsp, 0x68
pop rbp
nop
ret
mov rdx, rdi
mov rdi, r9
mov r12, rsi
mov rsi, r10
mov r13, r8
mov r8, r11
mov r9, rdx
mov r10, r12
mov r11, r13
nop dword [rax]
call fcn.004d7e60
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.00472fc0
mov rdx, rbx
call fcn.00473040
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00473040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004d7e60
Function at 0x4d8120
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d835e
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
cmp rsi, r10
jl 0x4d834a
test rsi, rsi
je 0x4d8316
nop dword [rax]
test r10, r10
je 0x4d830b
mov qword [rsp + 0xb8], r11
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xb0], r10
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x90], rdi
mov rdi, rsi
nop dword [rax]
call fcn.004d7c00
mov rdx, qword [rsp + 0xb0]
cmp rcx, rdx
jb 0x4d833c
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x18], rbx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x20], rsi
mov rdi, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rdi
mov r8, qword [rsp + 0xa8]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], rdx
mov r8, qword [rsp + 0xb8]
mov qword [rsp + 0x40], r8
call fcn.004e1cc0
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xb0]
cmp rcx, rdx
jle 0x4d82e7
mov rbx, qword [rsp + 0x50]
cmp rbx, rdx
jb 0x4d8331
mov rsi, qword [rsp + 0x58]
sub rsi, rdx
sub rbx, rdx
mov r9, rdx
shl rdx, 3
mov r10, rsi
neg rsi
sar rsi, 0x3f
and rsi, rdx
mov r11, qword [rsp + 0x60]
add rsi, r11
mov qword [rsp], rsi
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], r10
mov rbx, qword [rsp + 0xa0]
sub rbx, r9
sub rcx, r9
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and rbx, rdx
mov rdx, qword [rsp + 0x90]
add rdx, rbx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
call fcn.004e1e00
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x4d831e
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
nop dword [rax + rax]
call fcn.004d7bc0
add rsp, 0x68
pop rbp
ret
call fcn.004d7da0
add rsp, 0x68
pop rbp
ret
xor ebx, ebx
add rsp, 0x68
pop rbp
ret
lea rax, [0x0056dfe0]
lea rbx, [0x005dd830]
call fcn.0043fc80
mov rax, rdx
mov rcx, rbx
call fcn.00473080
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00473040
lea rax, [0x0056dfe0]
lea rbx, [0x005dd830]
call fcn.0043fc80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
nop dword [rax]
jmp fcn.004d8120
Function at 0x4d8620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d87a9
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], r9
lea r11, [r10 + rsi]
cmp rcx, r11
jb 0x4d879d
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x88], r8
mov rbx, r11
call fcn.004d7b60
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
xor eax, eax
nop
jmp 0x4d86a5
inc rax
cmp rdx, rax
jle 0x4d8785
mov rbx, qword [rsi + rax*8]
test rbx, rbx
je 0x4d86a2
mov rdi, qword [rsp + 0x80]
lea rcx, [rdi + rax]
mov r8, qword [rsp + 0x70]
cmp r8, rcx
jb 0x4d8795
cmp rax, rcx
ja 0x4d8790
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rcx, rax
shl rax, 3
sub r8, rcx
mov rsi, r8
neg r8
sar r8, 0x3f
and rax, r8
mov r8, qword [rsp + 0x60]
add rax, r8
mov qword [rsp], rax
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rdi
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rbx
call fcn.004e2040
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
cmp rcx, rax
jbe 0x4d878b
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rax*8], rbx
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
nop dword [rax + rax]
jmp 0x4d86a2
add rsp, 0x50
pop rbp
ret
call fcn.00472fc0
call fcn.00473080
mov rdx, r8
call fcn.00473040
mov rdx, rcx
mov rcx, r11
call fcn.00473040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004d8620
Function at 0x4d8d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d8e46
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4d8e36
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004e1c20
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4d8e1b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4d8e31
cmp rsi, rcx
ja 0x4d8e29
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4d8e21
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.004e1d60
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.00473080
mov rax, rsi
call fcn.00473080
call fcn.00473040
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.00473040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004d8d00
Function at 0x4d8ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d8fe6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4d8fd6
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004e1cc0
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4d8fbb
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4d8fd1
cmp rsi, rcx
ja 0x4d8fc9
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4d8fc1
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.004e1e00
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.00473080
mov rax, rsi
call fcn.00473080
call fcn.00473040
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.00473040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004d8ea0
Function at 0x4db480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db6f4
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r8
nop word [rax + rax]
test r9, r9
jne 0x4db55d
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x78], rax
nop
call fcn.004db440
test al, al
jne 0x4db6b9
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa0]
call fcn.004d9880
nop
test al, al
je 0x4db681
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
nop dword [rax]
test rsi, rsi
je 0x4db679
shr r9, 6
mov qword [rsp + 0x58], r9
lea r8, [r9 + rsi]
mov qword [rsp + 0x40], r8
lea rdi, [r9 + rsi]
lea rdi, [rdi + 1]
call fcn.004d7c00
mov rdx, qword [rsp + 0x40]
cmp rcx, rdx
jb 0x4db6e5
mov rsi, qword [rsp + 0x58]
nop dword [rax + rax]
cmp rsi, rdx
ja 0x4db6d9
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
sub rcx, rsi
mov rbx, rcx
neg rcx
shl rsi, 3
sar rcx, 0x3f
and rsi, rcx
lea rcx, [rax + rsi]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0xa8]
and ecx, 0x3f
mov qword [rsp + 0x30], rcx
call fcn.004e1ea0
xorps xmm15, xmm15
mov r14, qword [0x0077cf80]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
cmp rcx, rax
jbe 0x4db6d4
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rax*8], rdx
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call fcn.004d7b60
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.004d7bc0
add rsp, 0x68
pop rbp
ret
xor ebx, ebx
add rsp, 0x68
pop rbp
ret
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa0]
call fcn.004d7da0
add rsp, 0x68
pop rbp
ret
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
add rsp, 0x68
pop rbp
ret
call fcn.00472fc0
mov rax, rsi
mov rcx, rdx
nop
call fcn.00473080
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00473040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00470ce0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop
jmp fcn.004db480
Function at 0x4e2460
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4e24e5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4e2646
cmp rcx, 0xe
jne 0x4e2560
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4e2646
cmp rcx, 0xf
jne 0x4e25d7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4e2646
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret