joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5366e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5368c0
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x005edd80]
call fcn.0040d920
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x53674b
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x536879
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x5368a0
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x53673d
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x53673d
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x53673d
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x53673d
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x536808
cmp r9, r10
jle 0x536808
ja 0x536883
mov rax, r10
mov rcx, r9
call fcn.00464860
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00462200
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.005366e0
Function at 0x5379a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x537bdc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.004cc520
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x537aea
nop
cmp rdx, 0x40
ja 0x537bce
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x537a59
mov rax, rdx
mov rcx, rsi
nop
call fcn.00465200
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x537ac1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00538120
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x537bc3
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x537af7
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x537b77
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.00538120
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x537bb2
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x537bae
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00465200
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00464920
mov rax, rdx
mov ecx, 0x40
call fcn.00464920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462200
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.005379a0
Function at 0x54c6c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54c81b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x007b4d30]
call fcn.004ffe80
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x0054c840]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403240
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x54c7db
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x54c815
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x54c80a
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00464920
call fcn.004648a0
nop
nop dword [rax + rax]
call fcn.00462200
jmp fcn.0054c6c0
Function at 0x5686a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x568901
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x5688e5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x5686ed
xor ebx, ebx
xor ecx, ecx
jmp 0x568700
mov rax, rdx
call fcn.005594e0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x568818
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0046f900
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00685108]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e080
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403240
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5687db
xor eax, eax
lea rbx, [0x00625085]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00625108]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e160
jmp 0x568808
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00685190]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e080
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.0046f900
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403240
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5688a8
xor eax, eax
lea rbx, [0x00625085]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00625108]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e160
jmp 0x5688d5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00685190]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e080
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x006254ad]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00462200
mov rax, qword [rsp + 8]
jmp fcn.005686a0
Function at 0x56d420
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x56d438
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x56d438
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x56d440
xor eax, eax
ret
cmp rbx, 3
je 0x56d44c
cmp rbx, 4
jne 0x56d479
cmp al, 0x2c
ja 0x56d466
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x56d476
cmp al, 0x24
je 0x56d476
nop dword [rax]
cmp al, 0x26
jae 0x56d476
jmp 0x56d479
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x56d476
cmp al, 0x5b
je 0x56d476
cmp al, 0x5d
jne 0x56d479
xor eax, eax
ret
cmp al, 0x2f
ja 0x56d4b2
nop dword [rax]
cmp al, 0x26
ja 0x56d491
cmp al, 0x24
je 0x56d4d1
cmp al, 0x26
je 0x56d4d1
jmp 0x56d54b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x56d4d1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x56d548
cmp al, 0x2f
je 0x56d4d1
jmp 0x56d54b
cmp al, 0x3d
ja 0x56d4c9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x56d4d1
nop
cmp al, 0x3d
je 0x56d4d1
jmp 0x56d54b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x56d540
cmp rbx, 2
jg 0x56d507
cmp rbx, 1
je 0x56d501
nop dword [rax]
cmp rbx, 2
jne 0x56d54b
cmp al, 0x2f
je 0x56d4f2
cmp al, 0x3b
je 0x56d4f2
cmp al, 0x2c
jne 0x56d4f9
mov ecx, 1
jmp 0x56d4fe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x56d52a
cmp al, 0x40
je 0x56d519
cmp al, 0x2f
je 0x56d519
cmp al, 0x3f
jne 0x56d522
mov ecx, 1
nop
jmp 0x56d527
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x56d539
cmp rbx, 7
jne 0x56d54b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x56d548
cmp al, 0x7e
jne 0x56d54b
xor eax, eax
ret
cmp rbx, 7
jne 0x56d561
cmp al, 0x21
je 0x56d55d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x56d561
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x572880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x572a97
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x5729ae
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x572a89
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x572922
mov rax, rdx
mov rcx, rsi
call fcn.00465200
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x57298a
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00572d20
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x572a81
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x5729b4
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x572a31
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.00572d20
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x572a6f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x572a6b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00465200
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.00464920
mov rax, rdx
mov ecx, 0x40
call fcn.00464920
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462200
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00572880
Function at 0x5cb3e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5cb5f5
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0xc0], r8
test rdi, rdi
je 0x5cb526
mov rax, rcx
mov rbx, rdi
mov rcx, rsi
call fcn.005594e0
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0xc0]
mov rax, rdx
mov ebx, 0xa
call fcn.004958e0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x80]
mov qword [rsp], rdx
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 8], rsi
mov byte [rsp + 0x10], 0x3a
call fcn.00403240
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5cb4ec
xor eax, eax
lea rbx, [0x00625085]
mov ecx, 1
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00625108]
mov r9d, 2
mov r10, qword [rsp + 0x70]
mov r11, qword [rsp + 0x50]
call fcn.0044e160
jmp 0x5cb516
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00685190]
mov esi, 1
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x50]
call fcn.0044e080
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rax, r8
mov ebx, 0xa
call fcn.004958e0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x78], rcx
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x58], rdx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403240
xorps xmm15, xmm15
mov r14, qword [0x00809ec8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5cb5ba
xor eax, eax
lea rbx, [0x00625085]
mov ecx, 1
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x58]
lea r8, [0x00625108]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x48]
call fcn.0044e160
jmp 0x5cb5e5
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
lea rdi, [0x00685190]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
nop dword [rax]
call fcn.0044e080
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00462200
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.005cb3e0
Function at 0x1400e7e90
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400e7e9d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400e7ead
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400e7e95
lea eax, [rcx + 1]
jmp 0x1400e7ebb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400e7ece
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400e7eb4
sub eax, 3
jb 0x1400e7eee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400e7f3d
sar eax, 1
movsxd rbp, eax
jb 0x1400e7f24
jmp 0x1400e7efc
add ebx, ebx
jne 0x1400e7efa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400e7f24
inc ecx
add ebx, ebx
jne 0x1400e7f0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400e7f24
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400e7f1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400e7f0c
add ecx, 2
jmp 0x1400e7f29
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400e7e52
jmp 0x1400e7e9d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x33400
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400e7f89
cmp rsi, rcx
jae 0x1400e7f91
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400e7f70
cmp al, 0x8f
ja 0x1400e7f70
cmp byte [rsi - 2], 0xf
je 0x1400e7f76
sub al, 0xe8
cmp al, 1
ja 0x1400e7f5a
cmp rsi, rcx
jae 0x1400e7f91
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400e7f60
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400e7f91
lodsb al, byte [rsi]
jmp 0x1400e7f70
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xe4000]
mov eax, dword [rdi]
or eax, eax
je 0x1400e7fee
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x15ec58]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400e7f9e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400e7fe8
mov qword [rbx], rax
add rbx, 8
jmp 0x1400e7fbe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400e8028
cmp al, 0xef
ja 0x1400e801a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400e7ffa
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400e8009
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400e807c
sub rsp, 0xffffffffffffff80
jmp 0x1400229ec
Function at 0x1400016ab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov dword [rbp - 0xc], 0
jmp 0x1400017a6
mov eax, dword [rbp - 4]
add eax, 1
mov ecx, 0x100
cdq
idiv ecx
mov dword [rbp - 4], edx
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, byte [rax]
movzx edx, al
mov eax, dword [rbp - 8]
add eax, edx
mov ecx, 0x100
cdq
idiv ecx
mov dword [rbp - 8], edx
mov eax, dword [rbp - 8]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rdx, rax
mov eax, dword [rbp - 4]
movsxd rcx, eax
mov rax, qword [rbp + 0x10]
add rax, rcx
mov rcx, rax
call fcn.1400015a8
mov eax, dword [rbp - 4]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, byte [rax]
movzx edx, al
mov eax, dword [rbp - 8]
movsxd rcx, eax
mov rax, qword [rbp + 0x10]
add rax, rcx
movzx eax, byte [rax]
movzx eax, al
add eax, edx
mov ecx, 0x100
cdq
idiv ecx
mov eax, edx
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
movzx eax, byte [rax]
movzx eax, al
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rax, qword [rbp + 0x18]
add rax, rdx
movzx eax, byte [rax]
mov edx, eax
mov eax, dword [rbp - 0x10]
mov ecx, edx
xor ecx, eax
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rax, qword [rbp + 0x20]
add rax, rdx
mov edx, ecx
mov byte [rax], dl
add dword [rbp - 0xc], 1
mov eax, dword [rbp - 0xc]
cmp eax, dword [rbp + 0x28]
jl 0x1400016dd
mov eax, 0
add rsp, 0x30
pop rbp
ret

Function at 0x140001f40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002d80
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002d80
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]