joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4532f8
movzx edx, byte [rax]
nop
test edx, edx
jne 0x4531bc
test r8b, r8b
jne 0x4531bc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x4531cf
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4532b8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x4532a6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x45329c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x453223
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x453266
mov eax, 1
cmp rax, rbx
ja 0x453255
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00466d40
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x453294
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x45325d
mov r8d, eax
mov eax, r10d
jmp 0x453228
mov rcx, rbx
call fcn.00466c80
xor eax, eax
mov rcx, rax
call fcn.00466c80
mov eax, r8d
mov rcx, rbx
call fcn.00466d40
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4532ee
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x4532b1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4531d5
mov eax, edx
mov rcx, rbx
call fcn.00466c80
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00466c80
nop
int3
Function at 0x45ae00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45aeb9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045af00]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004644e0
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045ae00
Function at 0x4666c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403b8f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.0040a5a0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00464620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403b60
cmp byte [0x00b21364], 0
je 0x4666d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x463720
jmp 0x403b60

Function at 0x4666e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00b21880]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00b21364], 0
je 0x466715
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00b21c00]
aesenc xmm0, xmmword [0x00b21c10]
aesenc xmm0, xmmword [0x00b21c20]
movq rax, xmm0
ret
jmp 0x40a7a0

Function at 0x466720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00b21880]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00b21364], 0
je 0x466756
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00b21c00]
aesenc xmm0, xmmword [0x00b21c10]
aesenc xmm0, xmmword [0x00b21c20]
movq rax, xmm0
ret
jmp 0x40a800

Function at 0x4681a0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00b21b80]
mov qword [rsp + 8], rdx
lea r8d, [0x00b213e4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00466600
add rsp, 0x30
ret

Function at 0x4686e0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x468710
mov rcx, 0x28
jmp 0x46871b
shl rcx, 3
add rcx, 0x1480
mov qword [0x00b21660], rcx
ret
Function at 0x4904a0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4906eb
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x49054c
mov qword [rsp + 0x88], rax
lea rbx, [0x00766e40]
mov rcx, rax
lea rax, [0x00acccc0]
call fcn.004700a0
test cl, cl
jne 0x490531
mov rax, qword [rsp + 0x88]
call fcn.0048d1e0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x008067b0]
call fcn.0044f380
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.00491a80
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x49056d
lea rdx, [0x00766b80]
cmp rax, rdx
jne 0x49055b
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.00461ec0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x007172e0]
call fcn.0040b340
inc rdx
cmp rbx, rdx
jle 0x4905b8
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x49056a
lea rax, [0x00acccc0]
lea rbx, [0x00766e40]
lea rdi, [0x00766b80]
call fcn.00470260
lea rdx, [0x00766b80]
nop dword [rax]
cmp rax, rdx
jne 0x4906db
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x00702640]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x007351a0]
nop
call fcn.0040e120
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00b217f0], 0
jne 0x49061a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x490629
mov rbx, rax
lea rax, [0x007351a0]
call fcn.00414600
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.0048cc80
call fcn.00461fc0
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x490676
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x490668
mov dword [rsi + 0x10], edx
cmp dword [0x00b217f0], 0
jne 0x49068e
mov qword [rsi + 0x30], rcx
jmp 0x490697
lea rdi, [rsi + 0x30]
call fcn.004668e0
lea rax, [0x00acccc0]
lea rbx, [0x00766e40]
lea rdi, [0x00766b80]
call fcn.00470260
lea rdx, [0x00766b80]
cmp rax, rdx
jne 0x4906cc
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x007172e0]
call fcn.0040b340
mov rbx, rdx
lea rcx, [0x007172e0]
call fcn.0040b340
nop
mov qword [rsp + 8], rax
call fcn.00464620
mov rax, qword [rsp + 8]
jmp fcn.004904a0
Function at 0x5332a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53347c
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], r10
test rsi, rsi
je 0x5333d7
test r9, r9
je 0x5333d7
mov qword [rsp + 0x98], rsi
lea rbx, [rsi + 1]
mov qword [rsp + 0x58], rbx
cmp rcx, rbx
jl 0x5332fc
jae 0x53335b
jmp 0x533470
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xa0], r8
lea rcx, [rsi + 5]
mov qword [rsp + 0x50], rcx
lea rax, [0x00709be0]
call fcn.0044b460
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
mov r10, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x50]
nop dword [rax + rax]
cmp rsi, rcx
ja 0x533465
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.00544180
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x58]
cmp rcx, rdx
jae 0x533459
mov rsi, qword [rsp + 0x60]
mov qword [rsi + rcx*8], rax
jmp 0x533422
test r10, r10
jne 0x5333e2
xor edx, edx
nop
jmp 0x533412
nop
cmp rcx, 1
jge 0x53340a
lea rax, [0x00709be0]
mov ebx, 1
mov rcx, rbx
call fcn.0044b460
mov r10, qword [rsp + 0xb0]
mov ecx, 1
mov qword [rax], r10
mov edx, 1
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
dec rdx
test rdx, rdx
jle 0x533431
mov rdi, qword [rsi + rdx*8 - 8]
test rdi, rdi
je 0x53341f
mov rcx, qword [rsp + 0x48]
cmp rdx, rcx
ja 0x53344b
mov rax, rsi
mov rbx, rdx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rdx
mov rdx, rax
call fcn.00466d00
mov rax, rcx
mov rcx, rdx
nop
call fcn.00466c80
mov rdx, rcx
mov rcx, rsi
call fcn.00466d00
mov rdx, rcx
mov rcx, rbx
call fcn.00466d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00464620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.005332a0
Function at 0x533d00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x533e51
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x533e45
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00543e20
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x533e21
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x533e40
cmp rsi, rcx
ja 0x533e33
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x533e2b
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00543f60
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00466d40
mov rax, rsi
call fcn.00466d40
nop dword [rax + rax]
call fcn.00466d00
mov rdx, rcx
mov rcx, r9
call fcn.00466d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00464620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00533d00
Function at 0x533ec0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x534011
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
cmp rcx, r9
jb 0x534005
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.00543ec0
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x533fe1
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x534000
cmp rsi, rcx
ja 0x533ff3
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
nop dword [rax]
cmp rcx, r8
jb 0x533feb
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.00544000
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, r8
call fcn.00466d40
mov rax, rsi
call fcn.00466d40
nop dword [rax + rax]
call fcn.00466d00
mov rdx, rcx
mov rcx, r9
call fcn.00466d00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00464620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.00533ec0
Function at 0x545020
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x545038
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x545038
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x545040
xor eax, eax
ret
cmp rbx, 3
je 0x54504c
cmp rbx, 4
jne 0x545079
cmp al, 0x2c
ja 0x545066
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x545076
cmp al, 0x24
je 0x545076
nop dword [rax]
cmp al, 0x26
jae 0x545076
jmp 0x545079
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x545076
cmp al, 0x5b
je 0x545076
cmp al, 0x5d
jne 0x545079
xor eax, eax
ret
cmp al, 0x2f
ja 0x5450b2
nop dword [rax]
cmp al, 0x26
ja 0x545091
cmp al, 0x24
je 0x5450d1
cmp al, 0x26
je 0x5450d1
jmp 0x54514b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5450d1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x545148
cmp al, 0x2f
je 0x5450d1
jmp 0x54514b
cmp al, 0x3d
ja 0x5450c9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5450d1
nop
cmp al, 0x3d
je 0x5450d1
jmp 0x54514b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x545140
cmp rbx, 2
jg 0x545107
cmp rbx, 1
je 0x545101
nop dword [rax]
cmp rbx, 2
jne 0x54514b
cmp al, 0x2f
je 0x5450f2
cmp al, 0x3b
je 0x5450f2
cmp al, 0x2c
jne 0x5450f9
mov ecx, 1
jmp 0x5450fe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x54512a
cmp al, 0x40
je 0x545119
cmp al, 0x2f
je 0x545119
cmp al, 0x3f
jne 0x545122
mov ecx, 1
nop
jmp 0x545127
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x545139
cmp rbx, 7
jne 0x54514b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x545148
cmp al, 0x7e
jne 0x54514b
xor eax, eax
ret
cmp rbx, 7
jne 0x545161
cmp al, 0x21
je 0x54515d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x545161
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x586320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x586537
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x58644e
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x586529
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x5863c2
mov rax, rdx
mov rcx, rsi
call fcn.00467660
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x58642a
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005867c0
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x586521
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x586454
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x5864d1
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.005867c0
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x58650f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x58650b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00467660
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00466d40
mov rax, rdx
mov ecx, 0x40
call fcn.00466d40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00586320
Function at 0x58be60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58c09c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.004afd80
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x58bfaa
nop
cmp rdx, 0x40
ja 0x58c08e
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x58bf19
mov rax, rdx
mov rcx, rsi
nop
call fcn.00467660
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x58bf81
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0058c4c0
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x58c083
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x58bfb7
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x58c037
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.0058c4c0
xorps xmm15, xmm15
mov r14, qword [0x00b21660]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x58c072
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x58c06e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00467660
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00466d40
mov rax, rdx
mov ecx, 0x40
call fcn.00466d40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00464620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0058be60