joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58eee0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x58eef8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x58eef8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x58ef00
xor eax, eax
ret
cmp rbx, 3
je 0x58ef0c
cmp rbx, 4
jne 0x58ef39
cmp al, 0x2c
ja 0x58ef26
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x58ef36
cmp al, 0x24
je 0x58ef36
nop dword [rax]
cmp al, 0x26
jae 0x58ef36
jmp 0x58ef39
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x58ef36
cmp al, 0x5b
je 0x58ef36
cmp al, 0x5d
jne 0x58ef39
xor eax, eax
ret
cmp al, 0x2f
ja 0x58ef72
nop dword [rax]
cmp al, 0x26
ja 0x58ef51
cmp al, 0x24
je 0x58ef91
cmp al, 0x26
je 0x58ef91
jmp 0x58f00b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x58ef91
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x58f008
cmp al, 0x2f
je 0x58ef91
jmp 0x58f00b
cmp al, 0x3d
ja 0x58ef89
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x58ef91
nop
cmp al, 0x3d
je 0x58ef91
jmp 0x58f00b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x58f000
cmp rbx, 2
jg 0x58efc7
cmp rbx, 1
je 0x58efc1
nop dword [rax]
cmp rbx, 2
jne 0x58f00b
cmp al, 0x2f
je 0x58efb2
cmp al, 0x3b
je 0x58efb2
cmp al, 0x2c
jne 0x58efb9
mov ecx, 1
jmp 0x58efbe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x58efea
cmp al, 0x40
je 0x58efd9
cmp al, 0x2f
je 0x58efd9
cmp al, 0x3f
jne 0x58efe2
mov ecx, 1
nop
jmp 0x58efe7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x58eff9
cmp rbx, 7
jne 0x58f00b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x58f008
cmp al, 0x7e
jne 0x58f00b
xor eax, eax
ret
cmp rbx, 7
jne 0x58f021
cmp al, 0x21
je 0x58f01d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x58f021
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x594e80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59508b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x594fa4
cmp rdx, 0x40
ja 0x59507d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x594f14
mov rax, rdx
mov rcx, rsi
call fcn.00473440
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x594f80
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00595300
xorps xmm15, xmm15
mov r14, qword [0x0095be10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x595075
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x594fa7
mov r8, rcx
cmp r8, 0x40
jl 0x595025
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.00595300
xorps xmm15, xmm15
mov r14, qword [0x0095be10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x595068
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x595064
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00473440
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.00472b20
mov rax, rdx
mov ecx, 0x40
call fcn.00472b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00470780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00594e80
Function at 0x5af160
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5af227
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5af18c
test r15, r15
je 0x5af26a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5af23c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5af19b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5b0840
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5b08e7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5b098a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5b08e7
cmp r9, 0
je 0x5b0a43
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5b09a0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x616920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x616abb
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x616941
inc rcx
cmp rbx, rcx
jle 0x616ab1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x61693e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0057da00
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x00906b20]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.00612ce0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x616aa5
test rdx, rdx
je 0x616a9a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403b20
xorps xmm15, xmm15
mov r14, qword [0x0095be10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x616a69
xor eax, eax
lea rbx, [0x006de1c0]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006de1d9]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.00450d80
jmp 0x616a90
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0075b230]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.00450cc0
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00470780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00616920
Function at 0x6577e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6578e2
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00592d60
test rdi, rdi
jne 0x657833
mov rbx, qword [0x00914720]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x00690ea0]
call fcn.004105e0
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call fcn.00657780
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403b20
xorps xmm15, xmm15
mov r14, qword [0x0095be10]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x6578b5
xor eax, eax
lea rbx, [0x006de1c0]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006de1d9]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.00450d80
jmp 0x6578dc
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0075b230]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.00450cc0
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00470780
mov rax, qword [rsp + 8]
jmp fcn.006577e0
Function at 0x14080d3cb
Capabilities:
Encode data using base64

Disassembly:
ror word [rsp + 0x26], 0x81
jo 0x14083ca71
neg dx
not byte [rsp + 0x18]
ror dword [rsp + 0x13], 0x9f
mov qword [rsp], 0xffffffffac88fe26
xor di, dx
dec dword [rsp + 0x11]
shl word [rsp + 4], 0x61
lea rdx, [rsp + rdx + 0x28]
mov word [rsp + 0x16], 0x18a0
mov dword [rdx], eax
jle 0x14084fdcd
movzx eax, byte [r11]
mov r10d, 0x77227c85
inc r10w
lea r11, [r11 + r10 - 0x77227c85]
bts r10, 0x90
push r10
pop r10
xor al, r9b
sar r10b, 0x47
xor al, r10b
ror r10b, 0x66
btr r10w, r10w
neg al
ror r10w, 0xc3
lea r10, [r10 + 0x1805a284]
and r10d, 0x21259587
inc al
shr r10d, 0xcf
ror r10w, 4
btc r10d, r10d
xor al, 0x3d
rol r10d, 0xb4
xor r9b, al
rol r10w, 0x21
jb 0x1408490a3
rol r10w, 0x61
adc rax, rsp
shl r10b, 0x46
adc r10b, r10b
mov r10b, byte [rax + r10 - 0x3400001]
push 0x31954d37
sbb rsi, 2
jmp 0x14083424c
not rbp
xor sil, r9b
add bpl, 0xb6
lea r9, [rsp + r9 + 8]
neg ebp
jbe 0x14084c1c2
jmp 0x1408437e0
add r9b, 0x24
rol r9b, 1
sub rbp, rbp
jno 0x140822b35
jmp 0x1408415cd
jmp 0x1408350e7
mov word [rsi], r10w
jmp 0x140854f34
sbb r11, 2
call fcn.14081e25a
lea rsp, [rsp + 0x10]
jmp fcn.14083b6b9
adc r10, 1
shl rbp, 8
bts bp, bp
bts rbp, rbp
xor r9b, sil
add r9b, 0xc
shl bpl, 0x42
shl bp, 0x25
push rbp
ror r9b, 1
xadd qword [rsp], rbp
and word [rsp + 3], bp
xor r9b, 7
dec ebp
ror r9b, 1
jmp 0x1408234c2
add rax, rsp
or edx, 0xc42ba1b4
sbb rdx, 0xffffffffc81a3b99
movzx dx, byte [rax + riz]
sbb rbp, 1
call fcn.14083366d
push 0x372f9985
not rdx
mov qword [rsp + 8], 0x6097e10e
ror dword [rsp + 2], 0x29
setb byte [rsp + 9]
not r11
jb 0x140854784
xor bpl, 0x18
mov qword [rsp], 0x7294a496
neg byte [rsp]
xor sil, bpl
shl qword [rsp + 0x20], 0x26
call fcn.14080f890
lea rsp, [rsp + 0x10]
jmp fcn.1408426fd
sub edx, edx
inc al
bswap rdx
shl dl, 0xe1
not al
sbb rdx, 0x522fbe29
xor r8b, al
jmp 0x1408285ec
mov bp, word [r9 + rbp - 0x4b]
push 0xffffffff831f13b8
jbe 0x140857e72
mov esi, 0xf2944dae
sub rbx, 2
sal sil, 0x21
lea rax, [rsi + rsi*4 - 0x24c703fa]
sar esi, 1
movzx esi, word [rbx + riz]
xor ax, 0x3c8d
xor si, di
inc si
not si
rol ax, 0xe7
xor ax, ax
ror al, 0x24
sbb si, 0x469e
not al
btc rax, 0xb6
add rax, rax
rol si, 1
ror eax, 0xe5
dec si
lea rax, [rax + rax - 0x506a50e2]
xor di, si
sal al, 0xe1
inc rax
adc rsi, rsp
ror eax, 0x4c
adc eax, 0x9d294a0f
bt rax, rax
mov ax, word [rsi + riz]
jae 0x14083c2a5
push 0x4c235415
mov rdi, qword [rsi]
call fcn.14083c801
or rdx, r11
push 0x4c3b7e96
call fcn.14084a8bd
mov qword [rsp + 0x10], rax
lea rax, [rax*2 - 0x3f423efb]
mov r14, qword [rsp + 0x48]
mov qword [rsp + 0x18], rax
mov r10, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
movsx r13d, al
lea rsi, [rax + rax*2 + 0x451fb412]
mov r13, qword [rsp + r13 + 3]
cbw
mov dword [rsp + 3], eax
pop rax
mov r9, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov r15d, 0xe0937c24
mov rcx, qword [rsp + 0x70]
push r15
not r15d
pop r15
mov r15, qword [rsp + 0x78]
call fcn.14082d6a9
call fcn.14081d308
inc bpl
jmp 0x140841f3d
Function at 0x14080ea96
Capabilities:
Encode data using base64

Disassembly:
push 0xffffffffcfbaf824
ror bl, 1
neg byte [rsp + 4]
neg bl
sal dword [rsp + 1], 6
xor r10b, bl
dec qword [rsp]
lea rbx, [rsp + rbx + 0x18]
jl 0x1408478f5
push 0xfffffffff883d831
mov dx, word [rbp + riz]
mov dword [rbx], r11d
lea rsp, [rsp + 0x18]
jnp fcn.140829481
mov di, word [rbp + riz]
mov ecx, 0xc216b538
btc rcx, rcx
dec ecx
mov cl, byte [rbp + riz + 2]
call fcn.140851fda

Function at 0x140838022
Capabilities:
Encode data using base64

Disassembly:
dec al
lea rdx, [rbp + 0x232331a1]
mov qword [rsp + rbx - 0x6049], 0x2b989b3b
ror al, 1
sar rbp, 0x78
sete byte [rsp + rbp*2 + 3]
rol bpl, 0x41
xor al, 0x97
neg byte [rsp + rbp + 4]
dec al
rol al, 1
neg dx
sbb al, 0x3d
sar rbp, 0x65
xor al, 0x15
xor edx, 0xba90e421
pop rdx
xor r10b, al
imul rdx, rdx
push rdi
rol rbx, 0x6d
rol bp, 0xc
ror bl, 0xa7
push r9
dec bl
push r10
shl bx, 6
sbb bx, 0x4e93
btc ebp, ebx
mov rbp, r8
shr dl, 0xa2
sar rdx, 0x89
or dx, bx
mov ebx, eax
push rdx
mov edx, ebx
push 0x252878a3
xor ecx, ecx
neg qword [rsp + 8]
call fcn.14083476d

Function at 0x140860b7d
Capabilities:
Encode data using base64

Disassembly:
mov ebp, 0x9e175cbd
lea r10, [rbp - 0x2055ed57]
lea r11, [r10 + r11 - 0x7dc16f5e]
movzx edi, r10b
call fcn.14085666b
setno byte [rsp]
adc r11, 2
dec qword [rsp]
jno 0x14080ff7a
mov bp, word [r9]
mov r11w, word [r9 + 2]
call fcn.14080ece7
adc r11, 2
shr rsi, cl
call fcn.14083121c
mov r8d, 0xac9cf8a3
mov eax, dword [r10 + riz]
push r8
add r10, 4
movzx r8d, word [r11 + riz]
ror word [rsp + 3], 0x81
jae 0x140850be5
mov eax, 0xa62bbb8e
mov rax, qword [r11 + riz]
jmp 0x14082a19f
Function at 0x140808680
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14080868d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14080869d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140808685
lea eax, [rcx + 1]
jmp 0x1408086ab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1408086be
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1408086a4
sub eax, 3
jb 0x1408086de
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14080872d
sar eax, 1
movsxd rbp, eax
jb 0x140808714
jmp 0x1408086ec
add ebx, ebx
jne 0x1408086ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140808714
inc ecx
add ebx, ebx
jne 0x1408086fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140808714
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14080870d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1408086fc
add ecx, 2
jmp 0x140808719
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140808642
jmp 0x14080868d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x801000]
mov eax, dword [rdi]
or eax, eax
je 0x14080878d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x8081d8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14080873d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140808787
mov qword [rbx], rax
add rbx, 8
jmp 0x14080875d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1408087d1
cmp al, 0xef
ja 0x1408087b9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140808799
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1408087a8
mov eax, dword [rdi]
add rdi, 4
jmp 0x1408087a8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140808850], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140808850
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140808840
sub rsp, 0xffffffffffffff80
jmp 0x140001500
Function at 0x4133a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41352b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0063fa50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413405
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413414
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x413433
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413443
cmp rbx, 0x1000
jae 0x41340b
jmp 0x4134ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413455
xor edx, edx
jmp 0x4134a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x0063fa50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x413439
jmp 0x413428
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0063fa50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00519835]
mov ebx, 0x18
nop dword [rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00519d51]
mov ebx, 0x19
nop dword [rax + rax]
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0051c3af]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x413560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413786
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0063fa50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4135d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4135e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x413605
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x413615
cmp rbx, 0x1000
jae 0x4135d9
nop
jmp 0x413698
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41362d
xor esi, esi
jmp 0x41368a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x0063fa50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41360b
jmp 0x4135f6
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x0063fa50]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x413720
nop dword [rax + rax]
call sym.runtime.printlock
lea rax, [0x00519d6a]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call sym.runtime.printuint
lea rax, [0x00519d51]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
nop
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0051637a]
mov ebx, 0xd
call sym.runtime.throw
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4136c0
call sym.runtime.printlock
lea rax, [0x00519d6a]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00519d51]
mov ebx, 0x19
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
nop dword [rax]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x0051bb13]
mov ebx, 0x1f
nop dword [rax + rax]
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp sym.runtime.sysUsedOS