joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50d760
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d854
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00516580
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x50d84e
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
sub rcx, rdx
mov rbx, rcx
neg rcx
sar rcx, 0x3f
mov rsi, rdx
shl rdx, 3
and rdx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rsp], rcx
mov rdx, rsi
sar rsi, 1
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
call fcn.005166c0
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop
jmp fcn.0050d760
Function at 0x50d8c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d9b4
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00516620
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x50d9ae
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
sub rcx, rdx
mov rbx, rcx
neg rcx
sar rcx, 0x3f
mov rsi, rdx
shl rdx, 3
and rdx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rsp], rcx
mov rdx, rsi
sar rsi, 1
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
call fcn.00516760
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop
jmp fcn.0050d8c0
Function at 0x50e200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e333
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
test rsi, rsi
je 0x50e32d
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
sub rcx, r9
mov r10, rcx
neg rcx
mov r11, r9
shl r9, 3
sar rcx, 0x3f
and r9, rcx
lea rcx, [rax + r9]
mov qword [rsp], rcx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], r10
mov qword [rsp + 0x18], rcx
sub rbx, r11
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00516580
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x50e32d
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x90]
add rcx, rdx
mov rdx, qword [rsp + 0x68]
cmp rdx, rcx
jle 0x50e32d
mov rbx, qword [rsp + 0x70]
sub rbx, rcx
sub rdx, rcx
mov rsi, rbx
neg rbx
shl rcx, 3
sar rbx, 0x3f
and rbx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
call fcn.005166c0
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop
jmp fcn.0050e200
Function at 0x50fb20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50fd61
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rdi
nop word [rax + rax]
test r9, r9
jne 0x50fc05
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0050fae0
test al, al
jne 0x50fd42
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
nop
call fcn.0050e1c0
test al, al
je 0x50fd07
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa8]
mov r9, qword [rsp + 0xb0]
test rsi, rsi
je 0x50fcff
shr r9, 6
mov qword [rsp + 0x60], r9
lea r8, [r9 + rsi]
mov qword [rsp + 0x40], r8
lea rdi, [r9 + rsi]
lea rdi, [rdi + 1]
call fcn.0050c860
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x60]
sub rcx, rdx
shl rdx, 3
mov qword [rsp + 0x48], rdx
mov r9, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdx
lea r10, [rax + rcx]
mov qword [rsp], r10
mov r10, qword [rsp + 0xa0]
mov qword [rsp + 8], r10
mov qword [rsp + 0x10], r9
mov r9, qword [rsp + 0x98]
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], r10
mov r9, qword [rsp + 0xa8]
mov qword [rsp + 0x28], r9
mov r9, qword [rsp + 0xb0]
and r9d, 0x3f
mov qword [rsp + 0x30], r9
call fcn.00516800
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x68]
mov qword [rax + rsi*8], rdx
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x50fcea
mov rbx, qword [rsp + 0x48]
nop dword [rax]
call fcn.00476b20
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.0050c840
add rsp, 0x70
pop rbp
ret
xor ebx, ebx
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
call fcn.0050ca00
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
add rsp, 0x70
pop rbp
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.0050fb20
Function at 0x5127a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5128c2
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], r8
lea rdx, [rsi + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rdx, [rdx + rsi]
lea rdx, [rdx + 7]
sar rdx, 3
mov rdi, rdx
call fcn.0050c860
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x78]
xor esi, esi
nop
jmp 0x512868
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x80]
mov rsi, rcx
sub rsi, rdx
add rsi, 8
mov rdi, rsi
neg rsi
sar rsi, 0x3f
add rdx, 0xfffffffffffffff8
mov qword [rsp + 0x28], rdx
and rsi, rdx
mov r8, qword [rsp + 0x70]
lea rax, [r8 + rsi]
mov ebx, 8
mov rcx, rdi
call fcn.00512740
mov rsi, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov qword [rdx + rsi*8], rax
inc rsi
mov rax, rdx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
cmp rdx, 8
jge 0x512802
test rdx, rdx
jle 0x51287f
mov rsi, qword [rsp + 0x70]
xor edi, edi
xor r8d, r8d
jmp 0x5128b4
nop
call fcn.0050c840
add rsp, 0x48
pop rbp
ret
movzx r9d, byte [rdx + rsi - 1]
mov r10, rcx
mov rcx, rdi
shl r9, cl
lea r11, [rcx + 8]
dec rdx
cmp rcx, 0x40
sbb r12, r12
and r9, r12
or r8, r9
mov rcx, r10
mov rdi, r11
test rdx, rdx
jg 0x51288b
mov qword [rax + rbx*8 - 8], r8
nop
jmp 0x51287f
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005127a0
Function at 0x516ce0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x516f25
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
test rax, rax
je 0x516d27
mov rdx, qword [rax + 8]
mov r8, qword [0x00b9cb40]
mov r9, qword [r8]
mov r10d, dword [rax + 0x10]
jmp 0x516ec4
mov rdx, rax
test rax, rax
jne 0x516eac
mov rcx, qword [rdx + 0x30]
mov rax, rbx
call rcx
mov rcx, qword [rax + 0x28]
lea rdx, [rcx + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rcx, [rdx + rcx]
lea rcx, [rcx + 7]
sar rcx, 3
lea rdx, [rcx + rcx]
lea rdx, [rdx + 1]
mov rbx, qword [rsp + 0x68]
cmp rbx, rdx
jne 0x516ea1
mov rdx, qword [rsp + 0x60]
cmp byte [rdx], 4
jne 0x516e96
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x30]
mov rax, qword [rsp + 0x58]
call rdx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
lea rax, [0x006a1920]
call fcn.0040ee40
mov rdi, qword [rsp + 0x70]
lea rcx, [rdi - 1]
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and ecx, 1
mov rbx, qword [rsp + 0x60]
add rcx, rbx
mov rbx, rcx
mov rcx, qword [rsp + 0x20]
mov rdi, rdx
call fcn.0050a180
mov qword [rsp + 0x38], rax
lea rax, [0x006a1920]
nop
call fcn.0040ee40
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
sub rdi, rcx
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
dec rdi
dec rdx
mov rbx, rdi
neg rbx
sar rbx, 0x3f
inc rcx
and rbx, rcx
mov rcx, qword [rsp + 0x60]
add rbx, rcx
mov rcx, rdx
nop dword [rax + rax]
call fcn.0050a180
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
call fcn.00509f40
test rax, rax
jge 0x516e52
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
call fcn.00509f40
test rax, rax
jl 0x516e5d
xor eax, eax
mov rbx, rax
add rsp, 0x40
pop rbp
ret
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x28]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call rdx
test al, al
je 0x516e8b
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x40
pop rbp
ret
xor eax, eax
mov rbx, rax
add rsp, 0x40
pop rbp
ret
xor eax, eax
mov rbx, rax
add rsp, 0x40
pop rbp
ret
xor eax, eax
mov rbx, rax
add rsp, 0x40
pop rbp
ret
mov rdx, qword [rax + 0x18]
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
mov rdi, rsi
call rdx
add rsp, 0x40
pop rbp
ret
mov r11, r10
and r10, r9
shl r10, 4
mov r12, qword [r10 + r8 + 8]
cmp r12, rdx
je 0x516f12
lea r10, [r11 + 1]
nop dword [rax]
test r12, r12
jne 0x516ec4
lea rax, [0x00b9cb40]
mov rbx, rdx
call fcn.0040c5e0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
jmp 0x516d2a
mov r8, qword [r10 + r8 + 0x10]
mov rdx, rax
mov rax, r8
nop dword [rax]
jmp 0x516d2a
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop
jmp fcn.00516ce0
Function at 0x51db00
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x51db85
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x51dce6
cmp rcx, 0xe
jne 0x51dc00
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x51dce6
cmp rcx, 0xf
jne 0x51dc77
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x51dce6
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x5241c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5242a5
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov rdx, rdi
sar rdi, 0x3f
shr rdi, 0x3d
lea rsi, [rdi + rdx]
and rsi, 0xfffffffffffffff8
sub rdx, rsi
lea rsi, [rdx - 8]
neg rsi
cmp rsi, 8
je 0x524258
test rbx, rbx
je 0x524258
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x38], rax
cmp rsi, 8
sbb edx, edx
mov byte [rsp + 0x1f], dl
lea rax, [0x00675f60]
mov rcx, rbx
call fcn.00470240
mov rdx, qword [rsp + 0x38]
movzx esi, byte [rdx]
mov rcx, qword [rsp + 0x28]
shr sil, cl
movzx edi, byte [rsp + 0x1f]
and esi, edi
mov byte [rax], sil
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov r8d, 1
jmp 0x524297
add rsp, 0x40
pop rbp
ret
movzx r9d, byte [r8 + rdx - 1]
mov r10, rcx
mov rcx, rsi
shl r9d, cl
lea r11, [r8 + 1]
cmp rcx, 0x20
sbb r12d, r12d
and r9d, r12d
mov byte [rax + r8], r9b
movzx r12d, byte [rdx + r8]
mov rcx, r10
shr r12b, cl
and r12d, edi
or r9d, r12d
mov byte [rax + r8], r9b
mov r8, r11
cmp rbx, r8
jg 0x52425e
mov rcx, rbx
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005241c0
Function at 0x536fa0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x537206
push rbp
mov rbp, rsp
sub rsp, 0xa0
movzx ecx, byte [rbx + 0x1f]
shl rcx, 0x38
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
shl rdx, 0x30
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
shl rsi, 0x28
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
shl rdi, 0x20
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
shl r8, 0x18
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
shl r9, 0x10
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
shl r10, 8
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
shl r12, 0x38
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
shl r13, 0x30
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
shl r15, 0x28
mov qword [rsp + 0x48], r15
movzx ecx, byte [rbx + 0x14]
shl rcx, 0x20
mov qword [rsp + 0x40], rcx
movzx edx, byte [rbx + 0x13]
shl rdx, 0x18
mov qword [rsp + 0x38], rdx
movzx esi, byte [rbx + 0x12]
shl rsi, 0x10
mov qword [rsp + 0x30], rsi
movzx edi, byte [rbx + 0x11]
shl rdi, 8
mov qword [rsp + 0x28], rdi
movzx r8d, byte [rbx + 0x10]
mov qword [rsp + 0x20], r8
movzx r9d, byte [rbx + 0xf]
shl r9, 0x38
mov qword [rsp + 0x18], r9
movzx r10d, byte [rbx + 0xe]
shl r10, 0x30
mov qword [rsp + 0x10], r10
movzx r11d, byte [rbx + 0xd]
shl r11, 0x28
mov qword [rsp + 8], r11
movzx r12d, byte [rbx + 0xc]
shl r12, 0x20
mov qword [rsp], r12
movzx r13d, byte [rbx + 0xb]
shl r13, 0x18
movzx r15d, byte [rbx + 0xa]
shl r15, 0x10
movzx ecx, byte [rbx + 9]
shl rcx, 8
movzx edx, byte [rbx + 8]
movzx esi, byte [rbx + 7]
shl rsi, 0x38
movzx edi, byte [rbx + 6]
shl rdi, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r9d, byte [rbx + 4]
shl r9, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r11d, byte [rbx + 2]
shl r11, 0x10
movzx r12d, byte [rbx + 1]
shl r12, 8
movzx ebx, byte [rbx]
add rbx, r12
add rbx, r11
add rbx, r10
add rbx, r9
add rbx, r8
add rbx, rdi
add rbx, rsi
mov qword [rax], rbx
add rcx, rdx
add rcx, r15
add rcx, r13
mov rdx, qword [rsp]
add rcx, rdx
mov rdx, qword [rsp + 8]
add rcx, rdx
mov rdx, qword [rsp + 0x10]
add rcx, rdx
mov rdx, qword [rsp + 0x18]
add rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
add rcx, rdx
mov rdx, qword [rsp + 0x30]
add rcx, rdx
mov rdx, qword [rsp + 0x38]
add rcx, rdx
mov rdx, qword [rsp + 0x40]
add rcx, rdx
mov rdx, qword [rsp + 0x48]
add rcx, rdx
mov rdx, qword [rsp + 0x50]
add rcx, rdx
mov rdx, qword [rsp + 0x58]
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
add rcx, rdx
mov rdx, qword [rsp + 0x70]
add rcx, rdx
mov rdx, qword [rsp + 0x78]
add rcx, rdx
mov rdx, qword [rsp + 0x80]
add rcx, rdx
mov rdx, qword [rsp + 0x88]
add rcx, rdx
mov rdx, qword [rsp + 0x90]
add rcx, rdx
mov rdx, qword [rsp + 0x98]
add rcx, rdx
mov qword [rax + 0x18], rcx
add rsp, 0xa0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00536fa0
Function at 0x53a120
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a315
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
call fcn.004de0c0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
nop dword [rax]
test rdx, rdx
jle 0x53a242
lea rsi, [rdx - 0x40]
mov rdi, rsi
sar rsi, 0x3f
and rsi, rdx
lea rdx, [rcx + rsi]
lea rdx, [rdx + 0x20]
neg rdi
cmp rax, rdi
cmovl rdi, rax
mov qword [rsp + 0x28], rdi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x53a1b9
mov rax, rdx
mov rcx, rdi
nop
call fcn.00476e20
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rdi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x53a221
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0053a8e0
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x70]
sub rdx, rdi
mov rsi, rdx
neg rdx
sar rdx, 0x3f
and rdx, rdi
mov r8, rax
sub r8, rdi
add rbx, rdx
nop
jmp 0x53a24f
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x53a2cd
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rsi
call fcn.0053a8e0
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
sub r8, rdx
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x53a30b
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x53a307
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00476e20
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00474300
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0053a120
Function at 0x553ca0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x553db2
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x00ba4b98]
call fcn.0048cec0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
lea rcx, [0x00553dc0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00404a60
xorps xmm15, xmm15
mov r14, qword [0x00bef178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp + 0x18]
cmp rbx, 0xffffffffffffffff
je 0x553d87
mov qword [rsp + 0x20], rbx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
sub rbx, rsi
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
inc rsi
and rsi, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rsi]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
call fcn.00474300
jmp fcn.00553ca0