joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47dd80
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47dfdb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x18], rcx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x11
jne 0x47ddd1
bt edx, 8
jae 0x47dfc7
mov rcx, qword [rax + 0x40]
mov rax, qword [rax + 0x38]
jmp 0x47dde5
cmp rcx, 0x17
jne 0x47dee0
mov r8, qword [rbx]
mov rcx, qword [rbx + 0x10]
mov rbx, r8
test rdi, rdi
jl 0x47dfb4
cmp rsi, rdi
jl 0x47dfb4
nop word [rax + rax]
cmp rsi, rcx
jg 0x47dfb4
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x10], rcx
lea rax, [0x004e8ea0]
nop
call fcn.0040d140
mov qword [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x10]
sub rcx, rdx
mov qword [rax + 0x10], rcx
test rcx, rcx
jle 0x47de7e
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsi + 0x30]
mov r8, qword [r8]
imul rdx, r8
mov r8, qword [rsp + 0x28]
add rdx, r8
cmp dword [0x00630760], 0
jne 0x47de74
mov qword [rax], rdx
jmp 0x47dea3
mov rdi, rax
call fcn.00463620
jmp 0x47dea3
cmp dword [0x00630760], 0
jne 0x47de91
mov rdx, qword [rsp + 0x28]
mov qword [rax], rdx
jmp 0x47de9e
mov rdi, rax
mov rdx, qword [rsp + 0x28]
call fcn.00463620
mov rsi, qword [rsp + 0x20]
test byte [rsi], al
mov rdx, qword [rsp + 0x18]
test rdx, 0x60
mov ecx, 0
mov edx, 0x20
cmovne rcx, rdx
or rcx, 0x97
mov rbx, rax
mov rax, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp rcx, 0x18
jne 0x47df79
test rdi, rdi
jl 0x47df66
cmp rsi, rdi
jl 0x47df66
cmp qword [rbx + 8], rsi
jl 0x47df66
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x004f51c0]
call fcn.0040d140
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
nop word [rax + rax]
cmp qword [rdx + 8], rcx
jle 0x47df4f
mov rdx, qword [rdx]
mov rsi, qword [rsp + 0x70]
sub rsi, rcx
nop
mov qword [rax + 8], rsi
add rdx, rcx
cmp dword [0x00630760], 0
jne 0x47df47
mov qword [rax], rdx
jmp 0x47df4f
mov rdi, rax
call fcn.00463620
mov rbx, rax
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rax, [0x004ea4e0]
lea rbx, [0x005362c8]
call fcn.00436620
mov qword [rsp + 0x18], rcx
lea rax, [0x004f59e0]
call fcn.0040d140
mov qword [rax + 8], 0x13
lea rcx, [0x0050c584]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x18]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x004ede80]
call fcn.00436620
lea rax, [0x004ea4e0]
lea rbx, [0x005362e8]
call fcn.00436620
lea rax, [0x004ea4e0]
lea rbx, [0x005362b8]
call fcn.00436620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0047dd80
Function at 0x47e3e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e48e
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
test rax, rax
je 0x47e47a
lea rdx, [0x00537f00]
cmp rax, rdx
jne 0x47e467
mov qword [rsp + 0x38], rbx
mov rax, rbx
nop dword [rax + rax]
call fcn.0047a120
movzx ecx, byte [rax + 0x17]
test cl, 0x20
je 0x47e454
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
call fcn.0045d2c0
mov rbx, rax
mov ecx, 0x16
mov rax, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x004ea4e0]
lea rbx, [0x00536318]
call fcn.00436620
lea rbx, [0x00505620]
lea rcx, [0x00501fa0]
call fcn.0040a6e0
lea rax, [0x004ea4e0]
lea rbx, [0x00536308]
call fcn.00436620
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047e3e0
Function at 0x49bc40
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49bd3c
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
jmp 0x49bc5d
mov rax, rbx
mov rcx, qword [rax]
bt ecx, 0
jb 0x49bca4
mov rdx, rcx
or rcx, 1
add rcx, 8
test rcx, 0x7ffff8
je 0x49bd28
movabs rsi, 0x80000000007fffff
and rcx, rsi
mov rbx, rax
mov rax, rdx
lock cmpxchg qword [rbx], rcx
sete cl
test cl, cl
je 0x49bc5a
mov qword [rsp + 0x18], rbx
jmp 0x49bccf
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 8]
call fcn.0045f1c0
mov rdx, qword [rsp + 0x10]
add rdx, 0xffffffffff800000
mov rbx, qword [rsp + 0x18]
movabs rcx, 0x7ffff800000
test rdx, rcx
jne 0x49bcb0
nop
jmp 0x49bd0a
mov qword [rsp + 0x10], rdx
lea rax, [rbx + 0xc]
call fcn.0045f1c0
mov rcx, qword [rsp + 0x10]
movabs rdx, 0xfffff80000000000
add rcx, rdx
mov rbx, qword [rsp + 0x18]
mov rdx, rcx
movabs rcx, 0x7ffff80000000000
test rdx, rcx
jne 0x49bce2
mov eax, 1
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x004ea4e0]
lea rbx, [0x00536118]
call fcn.00436620
nop
mov qword [rsp + 8], rax
call fcn.004612c0
mov rax, qword [rsp + 8]
jmp fcn.0049bc40

Function at 0x49bd60
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49be8f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
test bl, bl
je 0x49bd98
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
mov ebx, 0x800000
movabs rsi, 0x7ffff800000
jmp 0x49bdb7
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x80000000000
movabs rsi, 0x7ffff80000000000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdx
jmp 0x49bdd5
mov rax, r9
mov rdi, qword [rax]
bt edi, 0
jb 0x49be5c
nop
test rdi, rdx
jne 0x49bdfd
mov r8, rdi
or rdi, rdx
add rdi, 8
test rdi, 0x7ffff8
jne 0x49be0f
jmp 0x49be7b
lea r8, [rbx + rdi]
test rsi, r8
je 0x49be68
mov r9, r8
mov r8, rdi
mov rdi, r9
mov r9, rax
mov rax, r8
lock cmpxchg qword [r9], rdi
sete dil
nop
test dil, dil
je 0x49bdd2
test r8, rdx
je 0x49be4d
mov rax, rcx
call fcn.0045f0a0
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov r9, qword [rsp + 0x40]
jmp 0x49bdd2
mov eax, 1
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x004ea4e0]
lea rbx, [0x00536118]
call fcn.00436620
lea rax, [0x004ea4e0]
lea rbx, [0x00536118]
call fcn.00436620
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.004612c0
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
jmp fcn.0049bd60
Function at 0x49c580
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c7b9
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x90], rdi
mov r13, 0
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x1f], 0
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
mov r8, qword [rsp + 0x48]
bt r8, 0x3f
jae 0x49c5ed
mov r8, qword [rsp + 0x48]
shl r8, 1
shr r8, 0x1f
movabs r9, 0xdd7b17f80
add r8, r9
jmp 0x49c5f2
mov r8, qword [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x78], rax
nop dword [rax]
test r8, r8
jne 0x49c61a
mov r8, qword [rsp + 0x48]
and r8d, 0x3fffffff
test r8d, r8d
jne 0x49c61a
xor ecx, ecx
jmp 0x49c643
mov rax, rbx
mov rbx, rcx
mov rcx, rdi
call fcn.00495380
test rax, rax
mov rdx, 0xffffffffffffffff
cmove rax, rdx
mov rsi, qword [rsp + 0x20]
mov rcx, rax
mov rax, qword [rsp + 0x78]
test byte [rax], al
jmp 0x49c64a
mov rax, rdx
mov rdi, qword [rax]
bt edi, 0
jb 0x49c68b
lea r8, [rdi + 8]
nop word [rax + rax]
test r8, 0x7ffff8
je 0x49c788
mov rdx, rax
mov rax, rdi
lock cmpxchg qword [rdx], r8
sete r8b
nop dword [rax]
test r8b, r8b
je 0x49c647
bt edi, 0
jmp 0x49c68e
mov rdx, rax
jae 0x49c6b9
cmp byte [rdx + 0x21f], 0
je 0x49c6a9
mov rdi, qword [0x005dbd00]
mov r8, qword [0x005dbd08]
jmp 0x49c6c0
lea rdi, [0x005369c8]
lea r8, [0x00630668]
jmp 0x49c6c0
xor edi, edi
xor r8d, r8d
nop
test rdi, rdi
jne 0x49c76e
movups xmmword [rsp + 0x38], xmm15
lea rdi, [0x0049c800]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x1f], 1
mov rax, qword [rdx + 0x1b8]
test rax, rax
jne 0x49c736
mov rax, qword [0x005dbd10]
mov rcx, qword [0x005dbd18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rbx, rcx
mov rcx, rsi
nop dword [rax]
call fcn.0045dc20
movups xmmword [rsp + 0x28], xmm15
mov byte [rsp + 0x1f], 0
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rdx]
call rsi
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, r8
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
lea rax, [0x004ea4e0]
lea rbx, [0x00536118]
call fcn.00436620
nop
nop dword [rax]
call fcn.004359e0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.0049c580
Function at 0x49ece0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ee41
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov r13, 0
mov qword [rsp + 0x48], r13
mov byte [rsp + 0x23], 0
movups xmmword [rsp + 0x28], xmm15
test byte [rax], al
jmp 0x49ed16
mov rax, rsi
mov rdx, qword [rax]
bt edx, 0
jb 0x49ed4b
lea r8, [rdx + 8]
test r8, 0x7ffff8
je 0x49ee13
mov rsi, rax
mov rax, rdx
lock cmpxchg qword [rsi], r8
sete r8b
nop
test r8b, r8b
je 0x49ed13
bt edx, 0
jmp 0x49ed4e
mov rsi, rax
jae 0x49ed79
cmp byte [rsi + 0x21f], 0
je 0x49ed69
mov rdx, qword [0x005dbd00]
mov r8, qword [0x005dbd08]
jmp 0x49ed80
lea rdx, [0x005369c8]
lea r8, [0x00630668]
jmp 0x49ed80
xor edx, edx
xor r8d, r8d
nop
test rdx, rdx
je 0x49ed9f
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov rax, rdx
mov rbx, r8
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
movups xmmword [rsp + 0x38], xmm15
lea rdx, [0x0049ee80]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rsi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x48], rdx
mov byte [rsp + 0x23], 1
mov rax, qword [rsi + 0x10]
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x24], edi
lea rdi, [rsp + 0x24]
mov esi, 4
nop
call fcn.00489000
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x23], 0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
lea rax, [0x004ea4e0]
lea rbx, [0x00536118]
call fcn.00436620
nop
call fcn.004359e0
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004612c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0049ece0
Function at 0x49eee0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f029
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov r13, 0
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x4f], 0
movups xmmword [rsp + 0x50], xmm15
test byte [rax], al
jmp 0x49ef16
mov rax, r13
mov rdx, qword [rax]
bt edx, 0
jb 0x49ef4b
lea r12, [rdx + 8]
test r12, 0x7ffff8
je 0x49effc
mov r13, rax
mov rax, rdx
lock cmpxchg qword [r13], r12
sete r12b
test r12b, r12b
je 0x49ef13
bt edx, 0
jmp 0x49ef4e
mov r13, rax
jae 0x49ef7a
cmp byte [r13 + 0x21f], 0
je 0x49ef6a
mov rdx, qword [0x005dbd00]
mov r12, qword [0x005dbd08]
jmp 0x49ef80
lea rdx, [0x005369c8]
lea r12, [0x00630668]
jmp 0x49ef80
xor edx, edx
xor r12d, r12d
nop
test rdx, rdx
je 0x49ef9f
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r12
mov rax, rdx
mov rbx, r12
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x0049f0a0]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r13
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x4f], 1
mov rax, qword [r13 + 0x10]
call fcn.00488180
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x4f], 0
mov rdx, qword [rsp + 0x70]
mov r12, qword [rdx]
call r12
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rax, [0x004ea4e0]
lea rbx, [0x00536118]
call fcn.00436620
nop
call fcn.004359e0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.004612c0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edi, dword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.0049eee0
Function at 0x4bc1e0
Capabilities:
Reference http user-agent string

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc2f4
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rax, qword [0x005d3db0]
cmp qword [rax + 0x18], 1
jle 0x4bc25b
movzx ecx, byte [rax + 2]
mov byte [rsp + 0x17], cl
movzx eax, byte [rax + 1]
mov byte [rsp + 0x16], al
call fcn.00438680
lea rax, [0x00510424]
mov ebx, 0x21
call fcn.00438f80
movzx eax, byte [rsp + 0x17]
call fcn.00438920
lea rax, [0x00509dd0]
mov ebx, 0xa
call fcn.00438f80
movzx eax, byte [rsp + 0x16]
call fcn.00438920
call fcn.004388e0
call fcn.00438700
mov rax, qword [0x005d3db0]
cmp byte [rax + 1], 0
je 0x4bc2ac
cmp byte [0x00630443], 0
je 0x4bc28e
call fcn.00438680
lea rax, [0x00513b5b]
mov ebx, 0x44
call fcn.00438f80
call fcn.00438700
jmp 0x4bc2ea
call fcn.00438680
lea rax, [0x00513966]
mov ebx, 0x3d
nop
call fcn.00438f80
call fcn.00438700
jmp 0x4bc2ea
cmp byte [rax], 0
je 0x4bc2ce
call fcn.00438680
lea rax, [0x005115e0]
mov ebx, 0x27
call fcn.00438f80
call fcn.00438700
jmp 0x4bc2ea
call fcn.00438680
lea rax, [0x00512f5f]
mov ebx, 0x32
nop
call fcn.00438f80
call fcn.00438700
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.004612c0
jmp fcn.004bc1e0

Function at 0x4bd2c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd42b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
lea rax, [0x0050947a]
mov ebx, 6
call fcn.004b5380
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004bd440]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
nop
call fcn.00402ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
nop
cmp rcx, 0xffffffffffffffff
je 0x4bd3e9
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4bd425
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
nop
cmp rbx, rcx
jb 0x4bd418
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.00463a60
call fcn.004639e0
nop
call fcn.004612c0
jmp fcn.004bd2c0
Function at 0x4d6e60
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4d70c3
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4d70a7
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4d6ead
xor ebx, ebx
xor ecx, ecx
jmp 0x4d6ec0
mov rax, rdx
call fcn.004ca580
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4d6fdb
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00477480
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00508d79]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e3c0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4d6f9e
xor eax, eax
lea rbx, [0x00508d91]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00508e06]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e4a0
jmp 0x4d6fcb
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00508d84]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e3c0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00477480
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4d706a
xor eax, eax
lea rbx, [0x00508d91]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00508e06]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e4a0
jmp 0x4d7097
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00508d84]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e3c0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x0050915f]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.004612c0
mov rax, qword [rsp + 8]
jmp fcn.004d6e60
Function at 0x4d8180
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4d83e3
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4d83c7
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4d81cd
xor ebx, ebx
xor ecx, ecx
jmp 0x4d81e0
mov rax, rdx
call fcn.004ca580
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4d82fb
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00477480
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00508d79]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e3c0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4d82be
xor eax, eax
lea rbx, [0x00508d91]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00508e06]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e4a0
jmp 0x4d82eb
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00508d84]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e3c0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00477480
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4d838a
xor eax, eax
lea rbx, [0x00508d91]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00508e06]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e4a0
jmp 0x4d83b7
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00508d84]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e3c0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x0050915f]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.004612c0
mov rax, qword [rsp + 8]
jmp fcn.004d8180
Function at 0x416460
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4165eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434920
xorps xmm15, xmm15
mov r14, qword [0x005eb370]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x4164c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x4164d4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4164f3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416503
cmp rbx, 0x1000
jae 0x4164cb
jmp 0x41656d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416515
xor edx, edx
jmp 0x416564
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00434920
xorps xmm15, xmm15
mov r14, qword [0x005eb370]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x4164f9
jmp 0x4164e8
call fcn.00467500
xorps xmm15, xmm15
mov r14, qword [0x005eb370]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004389c0
lea rax, [0x004bd535]
mov ebx, 0x18
nop dword [rax]
call fcn.00439240
mov rax, qword [rsp + 0x38]
call fcn.00438f80
lea rax, [0x004bda05]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00439240
mov rax, qword [rsp + 0x30]
call fcn.00438f80
call fcn.00438c00
call fcn.00438a20
lea rax, [0x004bfd94]
mov ebx, 0x21
call fcn.00436f20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463de0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416460