joyce8/EMBER2024-capa huggingface dataset:
Function at 0x579900
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x579918
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x579918
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x579920
xor eax, eax
ret
cmp rbx, 3
je 0x57992c
cmp rbx, 4
jne 0x579959
cmp al, 0x2c
ja 0x579946
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x579956
cmp al, 0x24
je 0x579956
nop dword [rax]
cmp al, 0x26
jae 0x579956
jmp 0x579959
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x579956
cmp al, 0x5b
je 0x579956
cmp al, 0x5d
jne 0x579959
xor eax, eax
ret
cmp al, 0x2f
ja 0x579992
nop dword [rax]
cmp al, 0x26
ja 0x579971
cmp al, 0x24
je 0x5799b1
cmp al, 0x26
je 0x5799b1
jmp 0x579a2b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5799b1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x579a28
cmp al, 0x2f
je 0x5799b1
jmp 0x579a2b
cmp al, 0x3d
ja 0x5799a9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5799b1
nop
cmp al, 0x3d
je 0x5799b1
jmp 0x579a2b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x579a20
cmp rbx, 2
jg 0x5799e7
cmp rbx, 1
je 0x5799e1
nop dword [rax]
cmp rbx, 2
jne 0x579a2b
cmp al, 0x2f
je 0x5799d2
cmp al, 0x3b
je 0x5799d2
cmp al, 0x2c
jne 0x5799d9
mov ecx, 1
jmp 0x5799de
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x579a0a
cmp al, 0x40
je 0x5799f9
cmp al, 0x2f
je 0x5799f9
cmp al, 0x3f
jne 0x579a02
mov ecx, 1
nop
jmp 0x579a07
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x579a19
cmp rbx, 7
jne 0x579a2b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x579a28
cmp al, 0x7e
jne 0x579a2b
xor eax, eax
ret
cmp rbx, 7
jne 0x579a41
cmp al, 0x21
je 0x579a3d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x579a41
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x57e7a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57e9bf
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x57e8d0
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x57e9b1
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x57e842
mov rax, rdx
mov rcx, rsi
call fcn.00465a20
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x57e8ac
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0057ec60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x57e9a9
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x57e8d6
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x57e955
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.0057ec60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x57e998
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x57e994
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
nop dword [rax + rax]
call fcn.00465a20
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.00465140
mov rax, rdx
mov ecx, 0x40
call fcn.00465140
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0057e7a0
Function at 0x590b80
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x590cd4
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.0058ffa0
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x590c24
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x590c75
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x590ca0
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x590c1e
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x590c1e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x590c8c
mov rax, rsi
mov ecx, 0x20
call fcn.00465080
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00590b80
Function at 0x5d2ac0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5d2b95
movdqa xmm0, xmmword [0x0070ae40]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5d2b01
movdqa xmm0, xmmword [0x0070ae50]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5d2c17
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5d2beb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0070a7a8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0070b290]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5e0600
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e07af
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5e0627
inc rcx
cmp rbx, rcx
jle 0x5e07a1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5e0624
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0056b1e0
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x008756f8]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005dc6a0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5e0790
test rdx, rdx
je 0x5e0781
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004032a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5e074b
xor eax, eax
lea rbx, [0x00690e74]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x00690f21]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044f3e0
jmp 0x5e0772
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00690e66]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044f300
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004629a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e0600
Function at 0x1400116fe
Capabilities:
Terminate process

Disassembly:
jmp 0x14002e850
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400118a7
Capabilities:
Parse pe header

Disassembly:
jmp 0x14002f5e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14002f600
xor al, al
jmp 0x14002f681
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14002f613
xor al, al
jmp 0x14002f681
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002f63d
xor al, al
jmp 0x14002f681
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14002f651
xor al, al
jmp 0x14002f681
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14002f663
xor al, al
jmp 0x14002f681
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002f67f
xor al, al
jmp 0x14002f681
mov al, 1
add rsp, 0x38
ret
Function at 0x140301fa0
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x58
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov r15, r9
mov r14, r8
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14030200d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1403020ce
movzx eax, ax
or eax, 0x80070000
jmp 0x1403020ce
mov qword [rsp + 0x88], rsi
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x50], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x1000
mov esi, eax
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14030205a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1403020b6
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1403020b6
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
mov r8d, esi
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1403020b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14030208c
movzx ebx, ax
or ebx, 0x80070000
xor edx, edx
mov r8d, 0x4000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1403020b6
mov qword [r14], rdi
mov dword [r15], esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x50]
mov eax, ebx
mov rsi, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140303d20
add rsp, 0x58
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x140303a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rbx, rcx
mov r8d, dword [rax + rcx + 0x88]
mov r14d, dword [rax + rcx + 0x8c]
test r8d, r8d
je 0x140303b02
mov r11d, r8d
add r11, rcx
je 0x140303b02
mov r9d, dword [r11 + 0x18]
xor r10d, r10d
mov qword [rsp + 0x10], rsi
mov esi, dword [r11 + 0x24]
mov qword [rsp + 0x18], rdi
add rsi, rcx
mov edi, dword [r11 + 0x20]
add rdi, rcx
sub r9d, 1
js 0x140303ab3
lea r8d, [r9 + r10]
sar r8d, 1
movsxd rax, r8d
mov edx, dword [rdi + rax*4]
mov rax, rbp
add rdx, rbx
sub rdx, rbp
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x140303a99
inc rax
test cl, cl
jne 0x140303a86
xor eax, eax
jmp 0x140303a9e
sbb eax, eax
or eax, 1
test eax, eax
jns 0x140303aa8
lea r9d, [r8 - 1]
jmp 0x140303aae
jle 0x140303acc
lea r10d, [r8 + 1]
cmp r9d, r10d
jge 0x140303a70
xor eax, eax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
pop r14
ret
cmp r9d, r10d
jl 0x140303ab3
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
cmp ecx, dword [r11 + 0x14]
jae 0x140303ab3
movzx edx, cx
mov ecx, dword [r11 + 0x1c]
add rcx, rbx
mov r8d, dword [rcx + rdx*4]
add r8, rbx
cmp r8, r11
jb 0x140303afd
lea rax, [r11 + r14]
cmp r8, rax
jbe 0x140303ab3
mov rax, r8
jmp 0x140303ab5
mov rbx, qword [rsp + 0x20]
xor eax, eax
mov rbp, qword [rsp + 0x28]
pop r14
ret
Function at 0x1403092e8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1403090bc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1403090bc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1403090bc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1403090bc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1403090bc
cmp dword [rcx + 0x84], 0xe
jbe 0x1403090bc
cmp dword [rcx + 0xf8], esi
je 0x1403090bc
mov ecx, r14d
call fcn.140309204
mov ecx, 2
call fcn.14030b128
nop
cmp byte [0x14031f308], 0
jne 0x140309186
mov r15d, 1
mov eax, r15d
xchg dword [0x14031f2f8], eax
test ebx, ebx
jne 0x14030912f
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14031f300]
cmp rcx, rax
je 0x140309126
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [str.00_]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14031f348]
jmp 0x14030913b
cmp ebx, r15d
jne 0x140309141
lea rcx, [0x14031f360]
call fcn.140309830
nop
test ebx, ebx
jne 0x140309158
lea rdx, [0x140312310]
lea rcx, [0x1403122f0]
call fcn.140308f7c
lea rdx, [0x140312320]
lea rcx, [0x140312318]
call fcn.140308f7c
movzx eax, byte [0x14031f308]
test esi, esi
cmove eax, r15d
mov byte [0x14031f308], al
jmp 0x140309186
mov ecx, 2
call fcn.14030b17c
test esi, esi
jne 0x14030919d
mov ecx, r14d
call fcn.1403091b8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14030904c
Function at 0x140001ea0
Capabilities:
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, r8
mov rsi, rcx
lea rax, [rsp + 0x30]
mov rcx, qword [rbx]
mov rdi, rdx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov dword [rsp + 0x68], 0x380
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140001f06
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_in_CryptCreateHash___u__n
mov edx, eax
call fcn.140003498
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov rdx, rdi
lea r8d, [r9 + 0x10]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140001f43
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_in_CryptHashData___u__n
mov edx, eax
call fcn.140003498
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov r8, qword [rsp + 0x30]
mov rcx, qword [rbx]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x140001f8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_in_CryptDeriveKey___u__n
mov edx, eax
call fcn.140003498
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x140001fd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Failed_in_CryptDecrypt___u__n
mov edx, eax
call fcn.140003498
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140004678
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400044e0
Function at 0x1400011b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rax, qword gs:[0x60]
mov rsi, rdx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400012dd
xor ebp, ebp
nop dword [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x104
call fcn.1400061d0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.1400061d0
mov r8, qword [rbx + 0x40]
lea rax, [rsp + 0x150]
mov qword [rsp + 0x38], rbp
mov r9d, 0xffffffff
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x28], 0x104
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, rsi
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.14000a970
lea r8, [rsp + 0x40]
mov edx, 0x104
lea rcx, [rsp + 0x260]
call fcn.14000a970
lea r8, [rsp + 0x150]
mov edx, 0x104
lea rcx, [rsp + 0x370]
call fcn.14000a970
lea rcx, [rsp + 0x260]
call fcn.14000abf4
lea rcx, [rsp + 0x370]
call fcn.14000abf4
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x370]
call fcn.140005cbc
test rax, rax
jne 0x140001308
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140001200
xor eax, eax
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140004120
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x1400012df

Function at 0x140001310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movsxd rax, dword [rdx + 0x3c]
mov rdi, r8
mov r11, rdx
cmp dword [rax + rdx + 0x8c], 0
je 0x140001393
mov eax, dword [rax + rdx + 0x88]
xor r9d, r9d
add rax, rdx
mov esi, dword [rax + 0x1c]
mov ebp, dword [rax + 0x24]
add rsi, rdx
mov r10d, dword [rax + 0x20]
add rbp, rdx
mov ebx, dword [rax + 0x18]
add r10, rdx
test ebx, ebx
je 0x140001393
nop
mov eax, dword [r10]
mov r8, rdi
add rax, r11
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001383
inc rax
test ecx, ecx
jne 0x140001370
test edx, edx
je 0x1400013aa
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x140001360
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x140001395
Function at 0x1400013c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [0x14014d628]
xor ecx, ecx
cmp dword [0x140150018], 2
mov rbx, rdx
movsd xmm0, qword [0x14014d620]
mov dword [rbp - 0x18], eax
movzx eax, byte [0x14014d62c]
mov byte [rbp - 0x14], al
movsd qword [rbp - 0x20], xmm0
jl 0x140001517
movdqa xmm2, xmmword [0x14014d750]
mov eax, 5
movdqa xmm3, xmmword [0x14014d760]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14014d7f0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x40], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14014d790]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x14014d620]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.77777777777777779999999999999999]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x40]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14014d790]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x1c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.77777777777777779999999999999999]
xorps xmm2, xmm0
movd dword [rbp - 0x1c], xmm2
movsxd rax, ecx
lea r8, [rbp - 0x20]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0xd
jl 0x140001530
cmp byte [0x14014d611], 0
movsd xmm0, qword [str.YL_VW]
movzx eax, word [0x14014d610]
movsd qword [rbp - 0x30], xmm0
mov word [rbp - 0x28], ax
je 0x1400015a8
xor byte [rbp - 0x2f], 0x38
xor byte [rbp - 0x2e], 0x39
xor byte [rbp - 0x2d], 0x3a
xor byte [rbp - 0x2c], 0x3b
xor byte [rbp - 0x2b], 0x3c
xor byte [rbp - 0x2a], 0x3d
xor byte [rbp - 0x29], 0x3e
xor byte [rbp - 0x28], 0x3f
xor byte [rbp - 0x27], 0x40
mov byte [rbp - 0x30], 0x6e
lea rdx, [rbp - 0x30]
call fcn.1400011b0
lea r8, [rbp - 0x20]
mov rdx, rax
call fcn.140001310
test rax, rax
je 0x1400015c7
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret