joyce8/EMBER2024-capa huggingface dataset:
Function at 0x563160
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x563178
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x563178
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x563180
xor eax, eax
ret
cmp rbx, 3
je 0x56318c
cmp rbx, 4
jne 0x5631b9
cmp al, 0x2c
ja 0x5631a6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5631b6
cmp al, 0x24
je 0x5631b6
nop dword [rax]
cmp al, 0x26
jae 0x5631b6
jmp 0x5631b9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5631b6
cmp al, 0x5b
je 0x5631b6
cmp al, 0x5d
jne 0x5631b9
xor eax, eax
ret
cmp al, 0x2f
ja 0x5631f2
nop dword [rax]
cmp al, 0x26
ja 0x5631d1
cmp al, 0x24
je 0x563211
cmp al, 0x26
je 0x563211
jmp 0x56328b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x563211
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x563288
cmp al, 0x2f
je 0x563211
jmp 0x56328b
cmp al, 0x3d
ja 0x563209
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x563211
nop
cmp al, 0x3d
je 0x563211
jmp 0x56328b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x563280
cmp rbx, 2
jg 0x563247
cmp rbx, 1
je 0x563241
nop dword [rax]
cmp rbx, 2
jne 0x56328b
cmp al, 0x2f
je 0x563232
cmp al, 0x3b
je 0x563232
cmp al, 0x2c
jne 0x563239
mov ecx, 1
jmp 0x56323e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x56326a
cmp al, 0x40
je 0x563259
cmp al, 0x2f
je 0x563259
cmp al, 0x3f
jne 0x563262
mov ecx, 1
nop
jmp 0x563267
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x563279
cmp rbx, 7
jne 0x56328b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x563288
cmp al, 0x7e
jne 0x56328b
xor eax, eax
ret
cmp rbx, 7
jne 0x5632a1
cmp al, 0x21
je 0x56329d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5632a1
xor eax, eax
nop
ret
mov eax, 1
ret

Function at 0x566d80
Capabilities:
Encrypt data using des

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
xor eax, eax
jmp 0x566d8f
inc rax
cmp rax, 8
jge 0x566d99
xor ecx, ecx
jmp 0x566da2
add rsp, 0x10
pop rbp
ret
inc rcx
cmp rcx, 4
jge 0x566d8c
xor edx, edx
jmp 0x566dc0
mov dword [rbx + rax*4], ecx
lea rbx, [rdi + 1]
mov rax, r10
mov rcx, r9
mov rdx, rbx
nop dword [rax]
cmp rdx, 0x10
jge 0x566d9f
mov rbx, rax
shl rax, 6
lea rsi, [0x007c0020]
lea rdi, [rsi + rax]
mov r8, rcx
shl rcx, 4
add rdi, rcx
movzx edi, byte [rdi + rdx]
lea rcx, [rbx - 7]
neg rcx
shl rcx, 2
shl rdi, cl
cmp rcx, 0x40
sbb r9, r9
and rdi, r9
xor eax, eax
xor ecx, ecx
jmp 0x566e96
mov rdi, r8
and r8d, 2
shl r8, 4
mov r9, rdi
and edi, 1
or r8, rdi
mov rdi, rdx
shl rdx, 1
or r8d, edx
mov rdx, rcx
shl rcx, 1
shr rdx, 0x1f
mov r10, rbx
shl rbx, 8
movzx eax, r8b
or rcx, rdx
lea rdx, [0x008292a0]
add rbx, rdx
cmp rax, 0x40
jb 0x566dac
jmp 0x566ea5
lea r9, [0x007bdbc0]
movzx r10d, byte [r9 + rax]
mov r11, rcx
mov ecx, r10d
mov r12, rdi
shr r12, cl
lea r13, [rax - 0x1f]
neg r13
inc rax
cmp cl, 0x40
sbb rcx, rcx
and rcx, r12
and ecx, 1
mov r10, rcx
mov rcx, r13
shl r10, cl
cmp rcx, 0x40
sbb rcx, rcx
and rcx, r10
or rcx, r11
cmp rax, 0x20
jl 0x566e52
nop dword [rax]
jmp 0x566e07
mov ecx, 0x40
call sym.runtime.panicIndex
nop
int3
Function at 0x57bb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57bc3e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x57bbc2
cmp r8, rdi
ja 0x57bc32
cmp rsi, rbx
je 0x57bba5
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x57bba2
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x57bc1f
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x57bba5
mov rbx, rdx
test byte [rax], al
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x57bc17
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
jmp 0x57bc00
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x57bbc8
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call sym.runtime.panicIndex
lea rax, [0x005eedc0]
lea rbx, [0x00695750]
call sym.runtime.gopanic
mov rcx, r8
mov rdx, rdi
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.crypto_rc4._Cipher_.XORKeyStream
Function at 0x57e8e0
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x57e9a7
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x57e90c
test r15, r15
je 0x57e9ea
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x57e9bc
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x57e91b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x57fea0
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x57ff47
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x57ffea
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x57ff47
cmp r9, 0
je 0x5800a3
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x580000
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5c28a0
Capabilities:
Parse credit card information

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c2a8f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x88], rsi
mov byte [rsp + 0x27], al
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x80], rdi
mov rax, rcx
mov rbx, rdi
lea rcx, [0x0062f60c]
mov edi, 5
call sym.strings.EqualFold
test al, al
je 0x5c2909
mov rcx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
xor eax, eax
xor edx, edx
jmp 0x5c2980
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
nop
call sym.mime.writeQString
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], rdx
mov rcx, rdi
neg rdi
sar rdi, 0x3f
and rdi, rax
lea rbx, [rdi + rsi]
mov rax, qword [rsp + 0x50]
call sym.mime.writeQString
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rdx, rsi
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x48]
mov rcx, rsi
mov rsi, rdi
mov rax, r8
nop dword [rax + rax]
cmp rcx, rax
jle 0x5c2a70
jbe 0x5c2a89
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdx
movzx r8d, byte [rsi + rax]
lea r9d, [r8 - 0x20]
cmp r9b, 0x5e
ja 0x5c29c6
cmp r8b, 0x3d
je 0x5c29c6
cmp r8b, 0x3f
je 0x5c29c6
cmp r8b, 0x5f
je 0x5c29c6
mov ebx, 1
mov edi, 1
jmp 0x5c2a09
mov rbx, rcx
sub rbx, rax
mov rdx, rbx
neg rdx
sar rdx, 0x3f
and rdx, rax
add rdx, rsi
mov rax, rdx
nop
call sym.unicode_utf8.DecodeRuneInString
lea rcx, [rbx + rbx*2]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x88]
mov rdi, rbx
mov rbx, rcx
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x38], rbx
lea r8, [rbx + rdx]
cmp r8, 0x3f
jle 0x5c2a5a
mov qword [rsp + 0x28], rdi
movzx eax, byte [rsp + 0x27]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
call sym.mime.WordEncoder.splitWord
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x28]
xor edx, edx
lea r8, [rdi + rax]
nop
cmp rcx, r8
jb 0x5c2a7e
cmp rax, r8
jbe 0x5c292b
jmp 0x5c2a76
add rsp, 0x58
pop rbp
ret
mov rcx, r8
call sym.runtime.panicSliceB
mov rdx, rcx
mov rcx, r8
call sym.runtime.panicSliceAlen
call sym.runtime.panicIndex
nop
mov byte [rsp + 8], al
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call sym.runtime.morestack_noctxt.abi0
movzx eax, byte [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp sym.mime.WordEncoder.qEncode
Function at 0x1400013c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
movzx ebp, r8b
mov rbx, rcx
cmp edx, 0x10
jae 0x140001452
test rcx, rcx
je 0x140001452
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x140001452
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140001452
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140001452
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x140001452
cmp dword [rdi], 0x4550
jne 0x140001452
test rdi, rdi
je 0x140001452
mov rcx, rbx
call fcn.140001990
movzx ecx, al
lea rax, [rsi + 0xf]
lea rax, [rax + rcx*2]
lea rax, [rdi + rax*8]
test bpl, bpl
jne 0x140001454
xor ecx, ecx
cmp dword [rax], ecx
cmove rax, rcx
jmp 0x140001454
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001470
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400014dd
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x1400014dd
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400014dd
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400014dd
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x1400014dd
cmp dword [rdi], 0x4550
jne 0x1400014dd
test rdi, rdi
je 0x1400014dd
mov rcx, rbx
call fcn.140001990
mov eax, dword [rdi + 0x28]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400014f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 0x5a4d
test rcx, rcx
je 0x140001567
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x140001567
cmp word [rbx], di
jne 0x140001567
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140001567
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140007170
test al, al
jne 0x140001567
cmp dword [rsi], 0x4550
jne 0x140001567
test rsi, rsi
je 0x140001567
mov edx, 0xf8
mov rcx, rsi
call fcn.140007170
test al, al
je 0x140001561
xor esi, esi
jmp 0x14000156e
movzx esi, word [rsi + 0x18]
jmp 0x14000156e
xor esi, esi
test rbx, rbx
je 0x1400015e2
mov edx, 0x40
mov rcx, rbx
call fcn.140007170
test al, al
jne 0x1400015e2
cmp word [rbx], di
jne 0x1400015e2
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400015e2
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x1400015e2
cmp dword [rdi], 0x4550
jne 0x1400015e2
test rdi, rdi
je 0x1400015e2
mov eax, 0x20b
cmp si, ax
jne 0x1400015cf
mov rax, qword [rdi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 0x34]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001600
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140001687
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x140001687
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140001687
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140001687
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x140001687
cmp dword [rdi], 0x4550
jne 0x140001687
mov rcx, rbx
call fcn.140001990
mov rcx, rbx
test al, al
je 0x140001674
call fcn.140001730
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1400016a0
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400016a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140001715
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x140001715
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140001715
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140001715
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x140001715
cmp dword [rdi], 0x4550
jne 0x140001715
test rdi, rdi
je 0x140001715
mov rcx, rbx
call fcn.140001990
xor ecx, ecx
test al, al
cmove rcx, rdi
mov rax, rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140001730
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400017a5
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x1400017a5
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400017a5
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400017a5
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x1400017a5
cmp dword [rdi], 0x4550
jne 0x1400017a5
test rdi, rdi
je 0x1400017a5
mov rcx, rbx
call fcn.140001990
xor ecx, ecx
test al, al
cmovne rcx, rdi
mov rax, rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400017c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400017f1
test rdx, rdx
je 0x140001803
mov r9d, 0x40
mov r8, rcx
call fcn.140007140
test al, al
jne 0x140001811
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x1400017f1
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1400017f1
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1400017f1
lea rbx, [rdi + rax]
test rsi, rsi
je 0x140001849
mov r9d, 0xf8
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140007140
test al, al
je 0x1400017f1
jmp 0x14000185a
mov edx, 0xf8
mov rcx, rbx
call fcn.140007170
test al, al
jne 0x1400017f1
mov rsi, qword [rsp + 0x38]
xor eax, eax
cmp dword [rbx], 0x4550
cmovne rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001900
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140001983
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x140001983
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140001983
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140001983
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x140001983
cmp dword [rdi], 0x4550
jne 0x140001983
test rdi, rdi
je 0x140001983
mov rcx, rbx
call fcn.140001990
movzx ecx, al
add rcx, 0xa
shl rcx, 4
add rcx, rdi
cmp dword [rcx], 0
je 0x140001983
test rcx, rcx
setne al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x140001990
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140001a0f
mov edx, 0x40
call fcn.140007170
test al, al
jne 0x140001a0f
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140001a0f
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140001a0f
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x140001a0f
cmp dword [rdi], 0x4550
jne 0x140001a0f
test rdi, rdi
je 0x140001a0f
mov edx, 0xf8
mov rcx, rdi
call fcn.140007170
test al, al
jne 0x140001a0f
mov eax, 0x20b
cmp word [rdi + 0x18], ax
sete al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140005dd0
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r14, rdx
mov r15, rcx
xor r12d, r12d
mov qword [rax - 0x38], r12
mov dword [rax - 0x40], 0x80
mov dword [rax - 0x48], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005f61
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
mov r8d, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x140005f58
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
je 0x140005f4f
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov rax, qword [r14]
test rax, rax
je 0x140005e94
cmp rax, rbx
cmovbe rbx, rax
mov rdx, rbx
mov rcx, rbp
call fcn.140007170
test al, al
je 0x140005f65
lea rdx, str.____Mapping_of
lea rcx, [0x140020110]
call fcn.140001a20
mov rcx, rax
mov rdx, r15
call fcn.140003920
mov rcx, rax
lea rdx, str._is_invalid_
call fcn.140001a20
mov r14, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rbx, qword [rcx + 8]
mov qword [rsp + 0x48], rbx
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
nop
lea rcx, [rsp + 0x40]
call fcn.140002b00
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx r15d, al
test rbx, rbx
je 0x140005f32
mov r8, qword [rbx]
mov rcx, rbx
call qword [r8 + 0x10]
test rax, rax
je 0x140005f32
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, r15b
mov rcx, r14
call fcn.1400060c0
mov rcx, r14
call fcn.140005ca0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140005fa9
mov rcx, rbx
call fcn.1400070f0
mov r15, rax
test rax, rax
je 0x140005f85
mov r8, rbx
mov rdx, rbp
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x140005f88
mov rbx, r12
mov qword [r14], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r15
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140006ec0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
push r13
lea rbp, [r11 - 0x5f]
sub rsp, 0xa8
mov rax, qword [0x14001f040]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov dword [rbp + 0xf], 0x74726956
xor r13d, r13d
mov dword [rbp + 0x13], 0x416c6175
mov dword [rbp + 0x17], 0x636f6c6c
mov byte [rbp + 0x1b], 0
mov rax, qword gs:[0x30]
mov qword [rbp - 1], rcx
mov qword [r11 - 0x28], r12
mov r12d, r13d
mov qword [r11 - 0x30], r14
mov rcx, qword [rax + 0x60]
mov qword [r11 - 0x38], r15
mov r11d, r13d
mov dword [rbp - 0x25], edx
mov qword [rbp + 7], r8
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x30]
movsxd rax, dword [r14 + 0x3c]
mov ecx, dword [rax + r14 + 0x88]
add rcx, r14
mov r8d, dword [rcx + 0x14]
mov r15d, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x20]
add r15, r14
mov eax, dword [rcx + 0x24]
add rdx, r14
mov r9d, dword [rcx + 0x18]
add rax, r14
mov dword [rbp - 0x29], r9d
mov qword [rbp - 0x11], rdx
mov qword [rbp - 0x21], rax
mov qword [rbp - 9], r8
test r8, r8
je 0x140007094
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rdi
cmp dword [r15 + r12*4], r13d
je 0x14000705e
mov ecx, r9d
mov rsi, r13
mov qword [rbp - 0x19], rcx
test r9d, r9d
je 0x14000705e
nop
movzx edi, word [rax + rsi*2]
cmp rdi, r12
jne 0x14000704a
mov ebx, dword [rdx + rsi*4]
lea r8, [rbp - 0x39]
add rbx, r14
mov dword [rbp - 0x39], 0x50746547
mov dword [rbp - 0x35], 0x41636f72
mov rax, 0xffffffffffffffff
mov dword [rbp - 0x31], 0x65726464
mov word [rbp - 0x2d], 0x7373
mov byte [rbp - 0x2b], r13b
nop dword [rax]
inc rax
cmp byte [r8 + rax], r13b
jne 0x140006ff0
mov r10d, r13d
mov r9, r13
test rax, rax
je 0x140007046
lea rcx, [rbp - 0x39]
sub rbx, rcx
nop dword [rax + rax]
mov r8d, r10d
lea rcx, [rbp - 0x39]
add rcx, r9
inc r10d
movzx edx, byte [rcx + rbx]
cmp dl, byte [rcx]
cmovne r10d, r8d
movsxd rcx, r10d
cmp rcx, rax
jne 0x140007036
mov r11d, dword [r15 + rdi*4]
add r11, r14
inc r9
cmp r9, rax
jb 0x140007010
mov rcx, qword [rbp - 0x19]
mov rdx, qword [rbp - 0x11]
mov rax, qword [rbp - 0x21]
inc rsi
cmp rsi, rcx
jb 0x140006fb0
mov r8, qword [rbp - 9]
mov r9d, dword [rbp - 0x29]
inc r12
cmp r12, r8
jb 0x140006f92
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xd8]
test r11, r11
je 0x140007094
lea rdx, [rbp + 0xf]
mov rcx, r14
call r11
mov r13, rax
mov rax, qword [rbp - 1]
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
test rax, rax
je 0x1400070c9
mov r9d, dword [rbp - 0x25]
mov r8d, 0x3000
mov rcx, qword [rbp + 7]
mov rdx, rax
call r13
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140008cd0
add rsp, 0xa8
pop r13
pop rbp
ret
jmp 0x140006ec0