joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54d100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54d25b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x0089fce8]
call fcn.00504580
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x0054d280]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x008f6050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x54d21b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x54d255
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x54d24a
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.004653e0
call fcn.00465360
nop
nop dword [rax + rax]
call fcn.00462cc0
jmp fcn.0054d100
Function at 0x569260
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x5694c1
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x5694a5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x5692ad
xor ebx, ebx
xor ecx, ecx
jmp 0x5692c0
mov rax, rdx
call fcn.0055a020
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x5693d8
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.004832c0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00718058]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e640
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x008f6050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x56939b
xor eax, eax
lea rbx, [0x006a6483]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006a6527]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e720
jmp 0x5693c8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00718118]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e640
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.004832c0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x008f6050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x569468
xor eax, eax
lea rbx, [0x006a6483]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006a6527]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e720
jmp 0x569495
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00718118]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e640
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006a69dd]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00462cc0
mov rax, qword [rsp + 8]
jmp fcn.00569260
Function at 0x56de00
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x56de18
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x56de18
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x56de20
xor eax, eax
ret
cmp rbx, 3
je 0x56de2c
cmp rbx, 4
jne 0x56de59
cmp al, 0x2c
ja 0x56de46
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x56de56
cmp al, 0x24
je 0x56de56
nop dword [rax]
cmp al, 0x26
jae 0x56de56
jmp 0x56de59
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x56de56
cmp al, 0x5b
je 0x56de56
cmp al, 0x5d
jne 0x56de59
xor eax, eax
ret
cmp al, 0x2f
ja 0x56de92
nop dword [rax]
cmp al, 0x26
ja 0x56de71
cmp al, 0x24
je 0x56deb1
cmp al, 0x26
je 0x56deb1
jmp 0x56df2b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x56deb1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x56df28
cmp al, 0x2f
je 0x56deb1
jmp 0x56df2b
cmp al, 0x3d
ja 0x56dea9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x56deb1
nop
cmp al, 0x3d
je 0x56deb1
jmp 0x56df2b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x56df20
cmp rbx, 2
jg 0x56dee7
cmp rbx, 1
je 0x56dee1
nop dword [rax]
cmp rbx, 2
jne 0x56df2b
cmp al, 0x2f
je 0x56ded2
cmp al, 0x3b
je 0x56ded2
cmp al, 0x2c
jne 0x56ded9
mov ecx, 1
jmp 0x56dede
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x56df0a
cmp al, 0x40
je 0x56def9
cmp al, 0x2f
je 0x56def9
cmp al, 0x3f
jne 0x56df02
mov ecx, 1
nop
jmp 0x56df07
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x56df19
cmp rbx, 7
jne 0x56df2b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x56df28
cmp al, 0x7e
jne 0x56df2b
xor eax, eax
ret
cmp rbx, 7
jne 0x56df41
cmp al, 0x21
je 0x56df3d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x56df41
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5740e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5742f7
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x57420e
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x5742e9
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x574182
mov rax, rdx
mov rcx, rsi
call fcn.00465ce0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x5741ea
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00574580
xorps xmm15, xmm15
mov r14, qword [0x008f6050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x5742e1
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x574214
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x574291
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00574580
xorps xmm15, xmm15
mov r14, qword [0x008f6050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x5742cf
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x5742cb
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00465ce0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.004653e0
mov rax, rdx
mov ecx, 0x40
call fcn.004653e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462cc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005740e0
Function at 0x5d7680
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5d7755
movdqa xmm0, xmmword [0x0071a250]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5d76c1
movdqa xmm0, xmmword [0x0071a260]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5d77d7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5d77ab
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00719898]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0071a6c0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5e5000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5e51ab
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5e5027
inc rcx
cmp rbx, rcx
jle 0x5e519d
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5e5024
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0055d300
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x00896058]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005e10c0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5e518d
test rdx, rdx
je 0x5e517e
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x008f6050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5e5149
xor eax, eax
lea rbx, [0x006a6483]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006a6527]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044e720
jmp 0x5e5170
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00718118]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044e640
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462cc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005e5000
Function at 0x14002c1d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14004c2c8], rbx
je 0x14002c21c
cmp rax, rbx
jne 0x14002c20f
mov ebx, 1
mov esi, ebx
jmp 0x14002c221
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002c1f4
mov ebx, 1
mov eax, dword [0x14004c2d0]
cmp eax, ebx
jne 0x14002c237
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14002c29c
mov eax, dword [0x14004c2d0]
test eax, eax
jne 0x14002c296
mov dword [0x14004c2d0], ebx
lea r15, [0x14002f640]
lea rdi, [0x14002f628]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x14002c288
test eax, eax
jne 0x14002c28c
cmp qword [rdi], 0
je 0x14002c27d
mov rax, qword [rdi]
mov rcx, qword [0x14002f5e0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14002c25e
test eax, eax
je 0x14002c29c
mov eax, 0xff
jmp 0x14002c378
mov dword [0x14004b368], ebx
mov eax, dword [0x14004c2d0]
cmp eax, ebx
jne 0x14002c2c3
lea rdx, [0x14002f620]
lea rcx, [0x14002f5e8]
call sub.msvcrt.dll__initterm
mov dword [0x14004c2d0], 2
test esi, esi
jne 0x14002c2d0
xor eax, eax
xchg qword [0x14004c2c8], rax
cmp qword [0x14004c2e8], 0
je 0x14002c304
lea rcx, [0x14004c2e8]
call fcn.14002cdb0
test eax, eax
je 0x14002c304
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14004c2e8]
mov r9, qword [0x14002f5e0]
call r9
mov r8, qword [0x14004b380]
mov rdx, qword [0x14004b378]
mov ecx, dword [0x14004b370]
call fcn.140009c48
mov dword [0x14004b364], eax
cmp dword [0x14004b388], 0
jne 0x14002c334
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14004b368], 0
jne 0x14002c349
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14004b364]
jmp 0x14002c378
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14018c000
add rsp, 0x28
jmp 0x14002c1d0

Function at 0x14002c7b8
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002c7c4
push rbx
sub rsp, 0x540
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002c841
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14002c861
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002c700
add rsp, 0x540
pop rbx
ret
Function at 0x14000a130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x68], 0
je 0x14000a169
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14000a2b3
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
cmp qword [rax], 0
je 0x14000a193
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
jmp 0x14000a19b
mov dword [rsp + 0x20], 0
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x60], 0
jle 0x14000a25b
cmp qword [rsp + 0x28], 0
jle 0x14000a25b
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x60], rax
jge 0x14000a1d3
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
call fcn.140004210
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x58]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x58]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
mov qword [rcx], rax
cmp qword [rsp + 0x60], 0
jle 0x14000a2a3
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x80], 0
je 0x14000a2a3
mov rax, qword [rsp + 0x50]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x60]
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
add rsp, 0x48
ret
Function at 0x14000b570
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14000b59b
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000b5a2
mov al, 1
jmp 0x14000b6fa
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140001020
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140001020
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.140001030
movzx eax, al
test eax, eax
je 0x14000b5f7
xor al, al
jmp 0x14000b6fa
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000b667
cmp dword [rsp + 0x30], 1
je 0x14000b673
cmp dword [rsp + 0x30], 3
je 0x14000b6e8
jmp 0x14000b6f8
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14000b6bf
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14000b6bf
xor al, al
jmp 0x14000b6fa
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14000b6d9
mov dword [rsp + 0x34], 1
jmp 0x14000b6e1
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14000b6fa
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14000b6fa
xor al, al
add rsp, 0xa8
ret
Function at 0x14000ca98
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14000cad2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000cad7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14000cb20
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000f5f0]
cmp byte [rcx + rax], 0
je 0x14000cb20
dec r8
sub rdx, 1
jne 0x14000cb06
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14000dac0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000db0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000db0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000db0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000db0a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000db0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000db0c
xor al, al
add rsp, 0x28
ret