joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4636c0
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4637d0
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x5816058160581606
mov rsi, rdx
imul rbx
sar rbx, 0x3f
sar rdx, 5
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rbx + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
jmp 0x46373a
mov rdx, rax
cmp rdx, 0x57
jae 0x4637c9
lea rax, [rdx + rdx*2]
lea rbx, [0x00cb34e0]
mov rdi, qword [rbx + rax*8 + 8]
lea r8, [rsi + rdi]
lea r8, [r8 + 0x40]
cmp r8, 0xffffffffffffffc4
jge 0x463768
lea rax, [rdx + 1]
jmp 0x463737
cmp r8, 0xffffffffffffffe0
jle 0x463774
lea rax, [rdx - 1]
jmp 0x463737
mov qword [rsp + 0x20], rdx
mov rdx, rax
shl rax, 3
mov rdx, qword [rbx + rdx*8]
movzx eax, byte [rbx + rax + 0x10]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
call fcn.004632d0
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.0042c590
ud2
call fcn.004553d0
jmp fcn.004636c0
Function at 0x4d9dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4da02d
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 8], rcx
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x10], rdx
call fcn.004da040
mov eax, dword [rsp + 0x18]
mov ecx, dword [rsp + 0x1c]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
xor edi, edi
xor r8d, r8d
jmp 0x4d9e5b
lea r9, [rdi + 1]
imul r10d, r8d, 0x1000193
movzx r11d, byte [rdx + rdi]
lea r8d, [r11 + r10]
mov rdi, r9
cmp rdi, rsi
jge 0x4d9e6a
cmp rdi, rbx
jb 0x4d9e44
jmp 0x4da026
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], ecx
cmp r8d, eax
je 0x4d9f8a
mov rdi, rsi
cmp rsi, rbx
jge 0x4d9f74
imul r8d, r8d, 0x1000193
movzx r9d, byte [rdx + rsi]
add r8d, r9d
mov r9, rsi
sub rsi, rdi
cmp rsi, rbx
jae 0x4da018
movzx esi, byte [rdx + rsi]
imul esi, ecx
sub r8d, esi
lea rsi, [r9 + 1]
cmp r8d, eax
jne 0x4d9e7e
mov r9, rsi
sub rsi, rdi
test r9, r9
jl 0x4da011
cmp rsi, r9
ja 0x4da011
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x48], rsi
nop
mov rax, qword [rsp + 0x78]
sub rax, rsi
mov rbx, rax
neg rax
sar rax, 0x3f
and rax, rsi
add rax, rdx
mov qword [rsp], rax
sub r9, rsi
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rbx
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x28], r8
call fcn.004025d0
cmp byte [rsp + 0x30], 0
jne 0x4d9f5d
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x40]
jmp 0x4d9e7e
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x98], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 0x98], 0xffffffffffffffff
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov rdi, qword [rsp + 0x78]
cmp rsi, rdi
ja 0x4da01f
mov dword [rsp + 0x44], r8d
nop
mov qword [rsp], rdx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x28], rcx
call fcn.004025d0
cmp byte [rsp + 0x30], 0
jne 0x4d9ffb
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x44]
jmp 0x4d9e7b
mov qword [rsp + 0x98], 0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.0042c6d0
ud2
call fcn.0042c590
ud2
call fcn.0042c6d0
ud2
call fcn.0042c590
ud2
call fcn.004553d0
jmp fcn.004d9dd0
Function at 0x4fb510
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x4fb71e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
nop
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rdx, [rdx + rax]
lea rdx, [rdx + 7]
sar rdx, 3
mov rbx, qword [rsp + 0x60]
cmp rdx, rbx
jg 0x4fb672
test rdx, rdx
jl 0x4fb717
mov rcx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r8, rax
xor r9d, r9d
jmp 0x4fb594
bswap rax
mov qword [rcx + r9*8], rax
inc r9
mov rdi, r11
mov rax, r10
cmp rax, 8
jl 0x4fb5d4
cmp rax, rdi
ja 0x4fb710
nop
lea r10, [rax - 8]
sub rax, r10
mov r11, rdi
sub rdi, r10
neg rdi
sar rdi, 0x3f
and rdi, r10
nop
cmp rax, 7
jbe 0x4fb709
mov rax, qword [rsi + rdi]
cmp r9, rdx
jb 0x4fb584
jmp 0x4fb702
test rax, rax
jle 0x4fb62e
xor edi, edi
xor r9d, r9d
jmp 0x4fb609
cmp rdi, 0x40
sbb r11, r11
lea r12, [rdi + 8]
movzx r13d, byte [rax + rsi - 1]
mov rax, rcx
mov rcx, rdi
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rax
mov rax, r10
mov rdi, r12
test rax, rax
jle 0x4fb61c
lea r10, [rax - 1]
cmp r10, r8
jb 0x4fb5e0
jmp 0x4fb6fb
lea rax, [rdx - 1]
cmp rax, rdx
jae 0x4fb6f4
mov qword [rcx + rdx*8 - 8], r9
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rbx
call fcn.004f2370
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rdx
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
cmp rdx, 1
jne 0x4fb6b3
lea rax, [0x008509a0]
mov qword [rsp], rax
mov qword [rsp + 8], 1
mov qword [rsp + 0x10], 1
call fcn.0043ffe0
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x70]
mov edx, 1
mov ebx, 1
jmp 0x4fb572
mov qword [rsp + 0x30], rdx
lea rax, [0x008509a0]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
lea rax, [rdx + 4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x10], rax
call fcn.0043ffe0
mov rcx, qword [rsp + 0x18]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
jmp 0x4fb572
call fcn.0042c590
ud2
call fcn.0042c590
ud2
call fcn.0042c590
ud2
call fcn.0042c590
ud2
call fcn.0042c6d0
ud2
call fcn.0042c6d0
ud2
call fcn.004553d0
jmp fcn.004fb510
Function at 0x531e90
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x531fc8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, rax
sar rax, 0x3f
shr rax, 0x3d
add rax, rcx
sar rax, 3
shl rax, 3
sub rcx, rax
lea rax, [rcx - 8]
neg rax
cmp rax, 8
je 0x531fc1
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x531f9e
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
lea rax, [0x008513e0]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
call fcn.0043ffe0
mov rcx, qword [rsp + 0x28]
cmp rcx, 8
sbb eax, eax
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x40]
movzx esi, byte [rbx]
shr sil, cl
and esi, eax
mov byte [rdx], sil
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x20]
mov r8d, 1
jmp 0x531f80
cmp rdi, 0x20
sbb r9d, r9d
movzx r10d, byte [r8 + rbx - 1]
mov r11, rcx
mov rcx, rdi
shl r10d, cl
and r10d, r9d
mov byte [rdx + r8], r10b
movzx r9d, byte [rbx + r8]
mov rcx, r11
shr r9b, cl
and r9d, eax
or r10d, r9d
mov byte [rdx + r8], r10b
inc r8
cmp r8, rsi
jl 0x531f4b
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rsp + 0x48]
jmp 0x531f9e
call fcn.004553d0
jmp fcn.00531e90

Function at 0x5427b0
Capabilities:
Encrypt data using des

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5428ec
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
xor eax, eax
jmp 0x5428cc
mov rbx, qword [rsp + 0x28]
mov r8, rbx
shl rbx, 8
lea r9, [0x00d12a60]
add rbx, r9
mov dword [rbx + rdx*4], eax
lea rdx, [rdi + 1]
mov rax, r8
mov rcx, rsi
cmp rdx, 0x10
jge 0x5428b4
mov qword [rsp + 0x30], rdx
lea rbx, [rax - 7]
neg rbx
shl rbx, 2
cmp rbx, 0x40
sbb rsi, rsi
shl rax, 6
shl rcx, 4
lea r9, [0x00c862e0]
add rax, r9
add rax, rcx
movzx eax, byte [rax + rdx]
mov rcx, rbx
shl rax, cl
and rax, rsi
mov qword [rsp], rax
lea rax, [0x00c7e160]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], 0x20
call fcn.00542750
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov rbx, rdx
and rdx, 2
shl rdx, 4
mov rsi, rbx
and rbx, 1
or rdx, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, rbx
shl rbx, 1
or edx, ebx
mov rbx, rax
shl rax, 1
shr rbx, 0x1f
or rax, rbx
movzx edx, dl
cmp rdx, 0x40
jb 0x5427df
jmp 0x5428e5
inc rcx
cmp rcx, 4
jge 0x5428c9
mov qword [rsp + 0x38], rcx
xor edx, edx
jmp 0x542802
inc rax
cmp rax, 8
jge 0x5428db
mov qword [rsp + 0x28], rax
xor ecx, ecx
jmp 0x5428b7
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
call fcn.0042c590
ud2
call fcn.004553d0
jmp fcn.005427b0
Function at 0x56db90
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x56dba3
mov byte [rsp + 0x18], 0
ret
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x56db9d
lea ecx, [rax - 0x30]
cmp cl, 9
jbe 0x56db9d
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x56dd2f
cmp al, 0x2c
ja 0x56dd0e
lea edx, [rax - 0x21]
cmp dl, 1
ja 0x56dbd8
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x56dbd2
lea edx, [rax - 0x26]
cmp dl, 6
jbe 0x56dbd2
cmp al, 0x2f
ja 0x56dcd8
cmp al, 0x26
ja 0x56dcb1
cmp al, 0x24
jne 0x56dca7
cmp rcx, 2
jg 0x56dc5e
cmp rcx, 1
je 0x56dc56
cmp rcx, 2
jne 0x56dc39
cmp al, 0x2f
jne 0x56dc1c
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
jne 0x56dc27
mov eax, 1
jmp 0x56dc17
cmp al, 0x2c
jne 0x56dc32
mov eax, 1
jmp 0x56dc17
cmp al, 0x3f
sete al
jmp 0x56dc17
cmp rcx, 7
jne 0x56dc50
cmp al, 0x21
jne 0x56dc49
mov byte [rsp + 0x18], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x56dc43
mov byte [rsp + 0x18], 1
ret
cmp al, 0x3f
sete byte [rsp + 0x18]
ret
cmp rcx, 5
jne 0x56dc8f
cmp al, 0x40
jne 0x56dc72
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
jne 0x56dc7d
mov eax, 1
jmp 0x56dc6d
cmp al, 0x3f
jne 0x56dc88
mov eax, 1
jmp 0x56dc6d
cmp al, 0x3a
sete al
jmp 0x56dc6d
cmp rcx, 6
je 0x56dca1
cmp rcx, 7
jne 0x56dc39
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x56dbfc
jmp 0x56dc39
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x56dbfc
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x56dccb
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x56dbfc
jmp 0x56dc39
cmp al, 0x3d
ja 0x56dcf5
lea edx, [rax - 0x3a]
cmp dl, 1
jbe 0x56dbfc
cmp al, 0x3d
je 0x56dbfc
jmp 0x56dc39
lea edx, [rax - 0x3f]
cmp dl, 1
jbe 0x56dbfc
cmp al, 0x5f
je 0x56dcc5
cmp al, 0x7e
je 0x56dcc5
jmp 0x56dc39
lea edx, [rax - 0x3a]
cmp dl, 4
jbe 0x56dbd2
cmp al, 0x5b
je 0x56dbd2
cmp al, 0x5d
je 0x56dbd2
jmp 0x56dbe4
cmp rcx, 4
je 0x56dbc2
jmp 0x56dbe4
Function at 0x7b41b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x7b42db
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
xor edi, edi
xor r8d, r8d
jmp 0x7b4200
add rdi, 2
lea r8d, [r9 + 1]
cmp rdi, rax
jge 0x7b4278
lea r9, [rdi + 1]
cmp r9, rax
jae 0x7b42d4
mov r9d, dword [rcx + rdi*4 + 4]
cmp rdi, rax
jae 0x7b42d4
mov r10d, dword [rcx + rdi*4]
dec r10d
cmp r8d, r10d
jg 0x7b41f8
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x1c], r10d
call fcn.007b3be0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x40]
mov r9d, dword [rsp + 0x3c]
jmp 0x7b41f8
cmp r8d, 0x10ffff
jle 0x7b42a3
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x1c], 0x10ffff
call fcn.007b3be0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x7b4281
call fcn.0042c590
ud2
call fcn.004553d0
jmp fcn.007b41b0
Function at 0x7b42f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x7b4556
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
test rdx, rdx
jle 0x7b4539
mov qword [rsp + 0x58], rdx
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x90]
xor r8d, r8d
jmp 0x7b43bd
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rsi
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r9d
mov dword [rsp + 0x1c], r9d
call fcn.007b3be0
mov eax, dword [rsp + 0x3c]
mov r10d, dword [rsp + 0x4c]
lea r9d, [r10 + rax]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
mov r11d, dword [rsp + 0x48]
cmp r9d, r11d
jle 0x7b4352
inc r8
cmp r8, rdx
jge 0x7b43eb
add rcx, 6
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x50], r8
movzx r9d, word [rcx]
movzx r10d, word [rcx + 4]
movzx r11d, word [rcx + 2]
cmp r10d, 1
je 0x7b44f1
mov dword [rsp + 0x4c], r10d
mov dword [rsp + 0x48], r11d
jmp 0x7b43ac
mov rcx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
test rax, rax
jle 0x7b448f
mov qword [rsp + 0x58], rax
xor edx, edx
jmp 0x7b4468
mov dword [rsp + 0x38], r8d
mov qword [rsp], rsi
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x1c], r8d
call fcn.007b3be0
mov eax, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x44]
lea r8d, [r9 + rax]
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x40]
cmp r8d, r10d
jle 0x7b4405
inc rdx
cmp rdx, rax
jge 0x7b448f
add rcx, 0xc
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rdx
mov r8d, dword [rcx]
mov r9d, dword [rcx + 8]
mov r10d, dword [rcx + 4]
cmp r9d, 1
je 0x7b44b1
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r10d
jmp 0x7b4457
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xb0], rdi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp], rsi
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x1c], r10d
call fcn.007b3be0
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
jmp 0x7b445c
mov qword [rsp], rsi
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r9d
mov dword [rsp + 0x1c], r11d
call fcn.007b3be0
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
jmp 0x7b43b1
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
jmp 0x7b43eb
call fcn.004553d0
jmp fcn.007b42f0
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400e3980]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400e3990]
mov dword [rax], 1
mov rax, qword [0x1400e39a0]
mov dword [rax], 1
mov rax, qword [0x1400e38e0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400e3970]
mov dword [0x14010e00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1400e3a70]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1400e3a50]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400e2f30]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001606
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp - 0x54], 0x101
lea rdx, [rbp - 0x54]
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
test eax, eax
setne al
test al, al
je 0x140001680
lea rax, [rbp + 0xbe]
mov qword [rbp + 0xc8], rax
nop
nop
lea rcx, [rbp + 0xbe]
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xf0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0xbe]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
jmp 0x1400016fd
lea rax, [rbp + 0xbf]
mov qword [rbp + 0xc0], rax
nop
nop
lea rdx, [rbp + 0xbf]
mov rax, qword [rbp + 0xf0]
mov r8, rdx
lea rdx, str.UnknownUser
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0xbf]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
jmp 0x1400016fd
mov rax, qword [rbp + 0xf0]
add rsp, 0x158
pop rbx
pop rbp
ret
Function at 0x140002cea
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.getCurrentExecutablePath_abi:cxx11___
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.size___const
lea esi, [rax + 1]
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rbx, rax
lea rax, [0x14010e0a0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9d, 1
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x140002dbf
add rsp, 0x60
pop rbx
pop rsi
pop rbp
ret

Function at 0x140002dc7
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
lea rax, [0x14010e0a0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
nop
add rsp, 0x40
pop rbp
ret

Function at 0x140002e37
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rbp - 1], 0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x140002ed8
lea rax, [0x14010e0a0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
test eax, eax
sete al
test al, al
je 0x140002ec8
mov byte [rbp - 1], 1
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
movzx eax, byte [rbp - 1]
add rsp, 0x40
pop rbp
ret
Function at 0x140002f02
Capabilities:
Check mutex on windows
Log keystrokes via application hook

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
call dbg.__main
lea r8, str.GlobalTheAntiMalwareAppInstance
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateMutexW]
call rax
mov qword [rbp - 8], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
cmp eax, 0xb7
sete al
test al, al
je 0x140002f4c
mov eax, 1
jmp 0x140002ff6
call sym.initializeStartupSetting__
mov r9d, 0
mov r8d, 0
lea rax, [sym.KeyboardProc_int__unsigned_long_long__long_long_]
mov rdx, rax
mov ecx, 0xd
mov rax, qword [sym.imp.USER32.dll_SetWindowsHookExA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140002f97
mov eax, 1
jmp 0x140002ff6
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
lea rax, [rbp - 0x40]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMessageA]
call rax
test eax, eax
setne al
test al, al
jne 0x140002f87
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReleaseMutex]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x60
pop rbp
ret

Function at 0x140005c90
Capabilities:
Parse pe header

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [rcx + 0x18]
movzx edx, byte [rax]
cmp dl, 0x4c
je 0x140005d00
jg 0x140005cc0
sub edx, 0x49
cmp dl, 1
ja 0x140005d10
add rax, 1
mov qword [rcx + 0x18], rax
add rsp, 0x30
pop rsi
jmp sym.d_template_args_1
cmp dl, 0x58
jne 0x140005d10
add rax, 1
mov esi, dword [rcx + 0x4c]
mov dword [rcx + 0x4c], 1
mov qword [rcx + 0x18], rax
mov qword [rsp + 0x28], rcx
call sym.d_expression_1
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x18]
mov dword [rcx + 0x4c], esi
cmp byte [rdx], 0x45
jne 0x140005d20
add rdx, 1
mov qword [rcx + 0x18], rdx
add rsp, 0x30
pop rsi
ret
add rsp, 0x30
pop rsi
jmp sym.d_expr_primary
add rsp, 0x30
pop rsi
jmp sym.d_type
xor eax, eax
jmp 0x140005cfa