joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a53e0
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x5a566e
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x288], rbx
nop
nop
call fcn.00557780
xorps xmm15, xmm15
mov r14, qword [0x00a78d08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x280]
mov rcx, qword [rax]
mov rax, rcx
call fcn.00585460
test rbx, rbx
jne 0x5a55e2
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x130]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046c874
mov rbp, qword [rbp]
mov qword [rsp + 0x258], 0
movups xmmword [rsp + 0x260], xmm15
mov qword [rsp + 0x260], 0
mov qword [rsp + 0x268], 0x20
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x258], rdx
mov rbx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
mov rsi, rax
lea rax, [rsp + 0x258]
call fcn.00584c40
nop dword [rax + rax]
test rbx, rbx
jne 0x5a55cc
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rdx + 8]
lea rdi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046c874
mov rbp, qword [rbp]
mov qword [rsp + 0x240], 0
movups xmmword [rsp + 0x248], xmm15
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 0x20
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x240], rdx
mov rbx, rax
mov rdi, qword [rsp + 0x238]
lea rax, [rsp + 0x240]
call fcn.00587700
mov qword [rsp + 0x230], rax
mov rdx, qword [rsp + 0x238]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 8]
shl rsi, 6
sub rsi, qword [rdx + 8]
lea rdx, [rsi + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rcx, [rdx + rsi]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x28], rcx
nop
mov rbx, rcx
lea rax, [0x0069e040]
call fcn.0044f400
mov rdx, qword [rsp + 0x230]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
mov r8, qword [rsp + 0x28]
mov rcx, r8
xor ebx, ebx
jmp 0x5a5600
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
inc rbx
mov r8, r10
nop
cmp rbx, rdx
jge 0x5a5619
mov r9, qword [rsi + rbx*8]
xor edi, edi
jmp 0x5a5638
test r9, r9
je 0x5a55f8
jmp 0x5a564e
mov r10, r8
jmp 0x5a55f8
mov rbx, rcx
xor edi, edi
xor esi, esi
add rsp, 0x270
pop rbp
ret
mov byte [r8 + rax - 1], r9b
inc rdi
shr r9, 8
mov r8, r10
cmp rdi, 8
jge 0x5a5614
lea r10, [r8 - 1]
test r10, r10
jl 0x5a560d
cmp rcx, r10
ja 0x5a5629
jmp 0x5a5665
lea rax, [0x0069dfc0]
lea rbx, [0x00782ca0]
nop dword [rax]
call fcn.00438720
mov rax, r10
call fcn.0046c5a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.005a53e0
Function at 0x5a5d40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a5f7b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call fcn.00557780
xorps xmm15, xmm15
mov r14, qword [0x00a78d08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x5a5e8a
nop dword [rax]
cmp rdx, 0x40
ja 0x5a5f6d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x5a5df9
mov rax, rdx
mov rcx, rsi
nop
call fcn.0046cf80
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x5a5e61
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005a64c0
xorps xmm15, xmm15
mov r14, qword [0x00a78d08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x5a5f62
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x5a5e97
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x5a5f15
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.005a64c0
xorps xmm15, xmm15
mov r14, qword [0x00a78d08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x5a5f58
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x5a5f54
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.0046cf80
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.0046c660
mov rax, rdx
mov ecx, 0x40
call fcn.0046c660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005a5d40
Function at 0x5ac2e0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x5ac2f8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5ac2f8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5ac300
xor eax, eax
ret
cmp rbx, 3
je 0x5ac30c
cmp rbx, 4
jne 0x5ac339
cmp al, 0x2c
ja 0x5ac326
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5ac336
cmp al, 0x24
je 0x5ac336
nop dword [rax]
cmp al, 0x26
jae 0x5ac336
jmp 0x5ac339
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5ac336
cmp al, 0x5b
je 0x5ac336
cmp al, 0x5d
jne 0x5ac339
xor eax, eax
ret
cmp al, 0x2f
ja 0x5ac372
nop dword [rax]
cmp al, 0x26
ja 0x5ac351
cmp al, 0x24
je 0x5ac391
cmp al, 0x26
je 0x5ac391
jmp 0x5ac40b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5ac391
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5ac408
cmp al, 0x2f
je 0x5ac391
jmp 0x5ac40b
cmp al, 0x3d
ja 0x5ac389
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5ac391
nop
cmp al, 0x3d
je 0x5ac391
jmp 0x5ac40b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5ac400
cmp rbx, 2
jg 0x5ac3c7
cmp rbx, 1
je 0x5ac3c1
nop dword [rax]
cmp rbx, 2
jne 0x5ac40b
cmp al, 0x2f
je 0x5ac3b2
cmp al, 0x3b
je 0x5ac3b2
cmp al, 0x2c
jne 0x5ac3b9
mov ecx, 1
jmp 0x5ac3be
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x5ac3ea
cmp al, 0x40
je 0x5ac3d9
cmp al, 0x2f
je 0x5ac3d9
cmp al, 0x3f
jne 0x5ac3e2
mov ecx, 1
nop
jmp 0x5ac3e7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x5ac3f9
cmp rbx, 7
jne 0x5ac40b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5ac408
cmp al, 0x7e
jne 0x5ac40b
xor eax, eax
ret
cmp rbx, 7
jne 0x5ac421
cmp al, 0x21
je 0x5ac41d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5ac421
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5b27c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5b29cb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x5b28e4
cmp rdx, 0x40
ja 0x5b29bd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x5b2854
mov rax, rdx
mov rcx, rsi
call fcn.0046cf80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x5b28c0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005b2c40
xorps xmm15, xmm15
mov r14, qword [0x00a78d08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x5b29b5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x5b28e7
mov r8, rcx
cmp r8, 0x40
jl 0x5b2965
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.005b2c40
xorps xmm15, xmm15
mov r14, qword [0x00a78d08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x5b29a8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x5b29a4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046cf80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046c660
mov rax, rdx
mov ecx, 0x40
call fcn.0046c660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046a2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005b27c0
Function at 0x5cc3e0
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x5cc4a7
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5cc40c
test r15, r15
je 0x5cc4ea
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x5cc4bc
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5cc41b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5cd960
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5cda07
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x5cdaaa
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5cda07
cmp r9, 0
je 0x5cdb63
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x5cdac0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x61a680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x61a81b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x61a6a1
inc rcx
cmp rbx, rcx
jle 0x61a811
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x61a69e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0052c720
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x009dc448]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.00616a60
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x61a805
test rdx, rdx
je 0x61a7fa
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403b00
xorps xmm15, xmm15
mov r14, qword [0x00a78d08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x61a7c9
xor eax, eax
lea rbx, [0x007819c0]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006fefd3]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.00453420
jmp 0x61a7f0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00780228]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.00453360
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0061a680
Function at 0x65cb60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x65cc62
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.005b07a0
test rdi, rdi
jne 0x65cbb3
mov rbx, qword [0x009f11a0]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x006ae1e0]
call fcn.00413780
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call fcn.0065cb00
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403b00
xorps xmm15, xmm15
mov r14, qword [0x00a78d08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x65cc35
xor eax, eax
lea rbx, [0x007819c0]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006fefd3]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.00453420
jmp 0x65cc5c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00780228]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.00453360
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0046a2c0
mov rax, qword [rsp + 8]
jmp fcn.0065cb60
Function at 0x140004220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400042b0
cmp r11, r10
ja 0x140004326
cmp r10, rdx
ja 0x140004338
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x1400042b2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140004290
jmp 0x140004314
ja 0x1400042ba
mov r11, r10
cmp rax, r8
jne 0x140004254
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400042f0
mov rdi, r8
sub ecx, edx
jns 0x14000430b
jmp 0x140004316
cmp r8, rsi
je 0x140004347
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140004316
xor al, 1
cmp rdi, rsi
jne 0x1400042d0
jmp 0x140004316
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140022880
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140022680
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140022990
int3

Function at 0x140008540
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140001ac0
cmp rax, rcx
je 0x140008565
cmp rdx, 4
jae 0x140008568
xor eax, eax
xor r8d, r8d
jmp 0x140008600
xor eax, eax
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400243e0]
movdqa xmm3, xmmword [0x1400243f0]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140008590
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140008617
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140008600
ret
Function at 0x14000fa10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
movzx r9d, byte [rdx + 0x38]
cmp byte [rcx - 0x80], al
stc
add dword [rdi + 0x6a], esi
xor r8d, r8d
xor eax, eax

Function at 0x140014624
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001466e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001466e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001466e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001466e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001466e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140014670
xor al, al
add rsp, 0x28
ret

Function at 0x140017ce8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140017d57
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140017d57
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140017d57
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140017d57
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140017d57
cmp dword [rcx + 0x84], 0xe
jbe 0x140017d57
cmp dword [rcx + 0xf8], 0
je 0x140017d57
mov ecx, ebx
call fcn.140017e08
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140017be4
nop
cmp dword [rbp + 0x20], 0
je 0x140017da5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140017db0
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140017ce8

Function at 0x140017eec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140017ce8
Function at 0x14001afac
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14001afdc
xor eax, eax
jmp 0x14001b09f
mov rbp, rbx
cmp word [rax], si
je 0x14001b001
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14001afe8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14001afe4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14001aecc
movsxd r14, eax
test eax, eax
jne 0x14001b03f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14001afd5
mov rcx, r14
call fcn.14001be88
mov rdi, rax
test rax, rax
jne 0x14001b058
xor ecx, ecx
call fcn.14001952c
jmp 0x14001b034
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14001aecc
test eax, eax
jne 0x14001b089
mov rcx, rdi
call fcn.14001952c
jmp 0x14001b093
xor ecx, ecx
call fcn.14001952c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret