joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f7f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f80a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4f8096
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call sym.math_big.addVV.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4f807b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4f8091
cmp rsi, rcx
ja 0x4f8089
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4f8081
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call sym.math_big.addVW.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call sym.runtime.panicSliceB
mov rax, rsi
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAcap
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.math_big.karatsubaAdd
Function at 0x4f8100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8246
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4f8236
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call sym.math_big.subVV.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4f821b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4f8231
cmp rsi, rcx
ja 0x4f8229
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4f8221
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call sym.math_big.subVW.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call sym.runtime.panicSliceB
mov rax, rsi
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAcap
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.math_big.karatsubaSub
Function at 0x521f80
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5220b0
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call sym.crypto_internal_edwards25519_field._Element_.reduce
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x522014
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x522057
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x522083
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
test byte [rbx], al
movzx edi, byte [rsp + rcx + 0x10]
movzx r9d, byte [rbx + rsi]
or r9d, edi
mov byte [rbx + rsi], r9b
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x52200e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x52200e
nop
jb 0x52206a
mov rax, rsi
mov ecx, 0x20
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.crypto_internal_edwards25519_field._Element_.bytes
Function at 0x523480
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x523505
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x523666
cmp rcx, 0xe
jne 0x523580
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x523666
cmp rcx, 0xf
jne 0x5235f7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x523666
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x529a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x529c5b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call sym.crypto_internal_boring_sig.StandardCrypto.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x529b6a
nop dword [rax]
cmp rdx, 0x40
ja 0x529c4d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x529ad9
mov rax, rdx
mov rcx, rsi
nop
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x529b41
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x529c42
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x529b77
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x529bf5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_sha256.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x529c38
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x529c34
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_sha256._digest_.Write
Function at 0x52dce0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x52dcf8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x52dcf8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x52dd00
xor eax, eax
ret
cmp rbx, 3
je 0x52dd0c
cmp rbx, 4
jne 0x52dd39
cmp al, 0x2c
ja 0x52dd26
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x52dd36
cmp al, 0x24
je 0x52dd36
nop dword [rax]
cmp al, 0x26
jae 0x52dd36
jmp 0x52dd39
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x52dd36
cmp al, 0x5b
je 0x52dd36
cmp al, 0x5d
jne 0x52dd39
xor eax, eax
ret
cmp al, 0x2f
ja 0x52dd72
nop dword [rax]
cmp al, 0x26
ja 0x52dd51
cmp al, 0x24
je 0x52dd91
cmp al, 0x26
je 0x52dd91
jmp 0x52de0b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x52dd91
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x52de08
cmp al, 0x2f
je 0x52dd91
jmp 0x52de0b
cmp al, 0x3d
ja 0x52dd89
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x52dd91
nop
cmp al, 0x3d
je 0x52dd91
jmp 0x52de0b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x52de00
cmp rbx, 2
jg 0x52ddc7
cmp rbx, 1
je 0x52ddc1
nop dword [rax]
cmp rbx, 2
jne 0x52de0b
cmp al, 0x2f
je 0x52ddb2
cmp al, 0x3b
je 0x52ddb2
cmp al, 0x2c
jne 0x52ddb9
mov ecx, 1
jmp 0x52ddbe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x52ddea
cmp al, 0x40
je 0x52ddd9
cmp al, 0x2f
je 0x52ddd9
cmp al, 0x3f
jne 0x52dde2
mov ecx, 1
nop
jmp 0x52dde7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x52ddf9
cmp rbx, 7
jne 0x52de0b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x52de08
cmp al, 0x7e
jne 0x52de0b
xor eax, eax
ret
cmp rbx, 7
jne 0x52de21
cmp al, 0x21
je 0x52de1d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x52de21
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x530600
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53080b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x530724
cmp rdx, 0x40
ja 0x5307fd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x530694
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x530700
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x5307f5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x530727
mov r8, rcx
cmp r8, 0x40
jl 0x5307a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x00787c90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x5307e8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x5307e4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013e80
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001129e
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400151c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400151e0
xor al, al
jmp 0x140015261
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400151f3
xor al, al
jmp 0x140015261
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001521d
xor al, al
jmp 0x140015261
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015231
xor al, al
jmp 0x140015261
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015243
xor al, al
jmp 0x140015261
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001525f
xor al, al
jmp 0x140015261
mov al, 1
add rsp, 0x38
ret
Function at 0x140011429
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140016d00
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x298]
lea rcx, [0x1400240a3]
call fcn.1400113b1
nop
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 8], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x34], 0
jmp 0x140016d6a
mov eax, dword [rbp + 0x34]
inc eax
mov dword [rbp + 0x34], eax
movsxd rax, dword [rbp + 0x34]
cmp rax, 2
jae 0x140016ecb
movsxd rax, dword [rbp + 0x34]
cmp qword [rbp + rax*8 + 8], 0
jne 0x140016d86
jmp 0x140016d62
movsxd rax, dword [rbp + 0x34]
mov rax, qword [rbp + rax*8 + 8]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x98], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x98]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xf8], rax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x118], rax
mov dword [rbp + 0x134], 0
jmp 0x140016e47
mov eax, dword [rbp + 0x134]
inc eax
mov dword [rbp + 0x134], eax
mov rax, qword [rbp + 0xb8]
mov eax, dword [rax + 0x18]
cmp dword [rbp + 0x134], eax
jae 0x140016ec6
mov eax, dword [rbp + 0x134]
mov rcx, qword [rbp + 0xd8]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x158]
call fcn.140011424
cmp eax, dword [rbp + 0x270]
jne 0x140016ec1
mov eax, dword [rbp + 0x134]
mov rcx, qword [rbp + 0xf8]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rbp + 0x118]
mov eax, dword [rcx + rax*4]
mov dword [rbp + 0x174], eax
mov eax, dword [rbp + 0x174]
mov rcx, qword [rbp + 0x58]
add rcx, rax
mov rax, rcx
jmp 0x140016ecd
jmp 0x140016e39
jmp 0x140016d62
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bd80]
call fcn.140011339
mov rax, rdi
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret
Function at 0x1400130b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113d9
movzx eax, al
test eax, eax
jne 0x1400130d0
mov ecx, 7
call fcn.140011343
nop
mov byte [rsp + 0x20], 0
call fcn.140011357
mov byte [rsp + 0x21], al
cmp dword [0x14001f868], 1
jne 0x1400130f4
mov ecx, 7
call fcn.140011343
nop
jmp 0x14001314c
cmp dword [0x14001f868], 0
jne 0x140013147
mov dword [0x14001f868], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111b3
test eax, eax
je 0x140013128
mov eax, 0xff
jmp 0x140013251
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.14001134d
mov dword [0x14001f868], 2
jmp 0x14001314c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001132a
call fcn.1400112c1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400131a9
mov rcx, qword [rsp + 0x30]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x1400131a9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.1400112f3
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400131dd
mov rcx, qword [rsp + 0x38]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x1400131dd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011398
nop
call fcn.140013300
mov dword [rsp + 0x28], eax
call fcn.14001129e
movzx eax, al
test eax, eax
jne 0x1400131fc
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001320b
call fcn.1400113a2
nop
xor edx, edx
mov cl, 1
call fcn.140011159
mov eax, dword [rsp + 0x28]
jmp 0x140013251
add rsp, 0x68
ret

Function at 0x180578a52
Capabilities:
Encode data using xor

Disassembly:
mov r11, qword [rdi + 8]
add rdi, 0xc
xor ecx, ecx
push 0x13236b4
test r11, r11
jmp 0x18056958b
mov r10d, 0x9406c731
pop r10
jmp 0x18057c03a
lea rsp, [rsp + 8]
je 0x1805691c3
mov ebx, 0x18dca18
push r10
movzx r10d, bx
jmp 0x18057543f
lea r10, [0x180582498]
mov ebx, 0xab94f78f
movzx ebx, byte [rax]
push 0xffffffffbb825b3c
sar dword [rsp + 1], 0x28
xor ebx, ecx
not byte [rsp + 4]
and ebx, 0xff
mov ebx, dword [r10 + rbx*4]
and qword [rsp], 0xffffffff8c9de897
shr ecx, 8
xor ecx, ebx
inc rax
xor ecx, 0x1d1a7e99
dec r11
lea rsp, [rsp + 8]
jne 0x180575446
jmp 0x1805691bb
mov eax, 0x2894feaf
mov qword [rsp + rax - 0x2894feaf], rax
mov eax, dword [rdi + rax*2 - 0x5129fd5e]
jmp 0x18058d68e
jmp 0x180578a4b
mov dword [rdi], eax
call fcn.180566670
mov rax, qword [rdi]
jmp 0x180588d77
not ecx
push 0x5e8021b2
push 0x71934eb0
mov dword [rdi], ecx
lea rsp, [rsp + 0x10]
jmp fcn.1805671ce
mov r11d, 0x87abad2c
jmp 0x18054f916
mov ecx, 0xbd30c1af
mov ecx, dword [rdi + 4]
add rdi, 4
push 0xffffffffc60cb124
add eax, ecx
jmp 0x1805784f5
Function at 0x180001200
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001228
xor eax, eax
lea r8, [0x180001120]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
add rsp, 0x38
ret
Function at 0x180006990
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180006a14
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180008630]
cmp byte [rcx + rax], 0
je 0x180006a14
dec r8
sub rdx, 1
jne 0x1800069fa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret