joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ddc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52dffb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
nop
call fcn.005095a0
xorps xmm15, xmm15
mov r14, qword [0x00830e48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x52df0a
nop dword [rax]
cmp rdx, 0x40
ja 0x52dfed
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x52de79
mov rax, rdx
mov rcx, rsi
nop
call fcn.00468840
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x52dee1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0052e440
xorps xmm15, xmm15
mov r14, qword [0x00830e48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x52dfe2
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x52df17
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x52df95
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.0052e440
xorps xmm15, xmm15
mov r14, qword [0x00830e48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x52dfd8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x52dfd4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.00468840
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.00467f20
mov rax, rdx
mov ecx, 0x40
call fcn.00467f20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00465b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0052ddc0
Function at 0x534b60
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x534b78
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x534b78
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x534b80
xor eax, eax
ret
cmp rbx, 3
je 0x534b8c
cmp rbx, 4
jne 0x534bb9
cmp al, 0x2c
ja 0x534ba6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x534bb6
cmp al, 0x24
je 0x534bb6
nop dword [rax]
cmp al, 0x26
jae 0x534bb6
jmp 0x534bb9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x534bb6
cmp al, 0x5b
je 0x534bb6
cmp al, 0x5d
jne 0x534bb9
xor eax, eax
ret
cmp al, 0x2f
ja 0x534bf2
nop dword [rax]
cmp al, 0x26
ja 0x534bd1
cmp al, 0x24
je 0x534c11
cmp al, 0x26
je 0x534c11
jmp 0x534c8b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x534c11
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x534c88
cmp al, 0x2f
je 0x534c11
jmp 0x534c8b
cmp al, 0x3d
ja 0x534c09
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x534c11
nop
cmp al, 0x3d
je 0x534c11
jmp 0x534c8b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x534c80
cmp rbx, 2
jg 0x534c47
cmp rbx, 1
je 0x534c41
nop dword [rax]
cmp rbx, 2
jne 0x534c8b
cmp al, 0x2f
je 0x534c32
cmp al, 0x3b
je 0x534c32
cmp al, 0x2c
jne 0x534c39
mov ecx, 1
jmp 0x534c3e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x534c6a
cmp al, 0x40
je 0x534c59
cmp al, 0x2f
je 0x534c59
cmp al, 0x3f
jne 0x534c62
mov ecx, 1
nop
jmp 0x534c67
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x534c79
cmp rbx, 7
jne 0x534c8b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x534c88
cmp al, 0x7e
jne 0x534c8b
xor eax, eax
ret
cmp rbx, 7
jne 0x534ca1
cmp al, 0x21
je 0x534c9d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x534ca1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x538be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x538deb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x538d04
cmp rdx, 0x40
ja 0x538ddd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x538c74
mov rax, rdx
mov rcx, rsi
call fcn.00468840
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x538ce0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00539040
xorps xmm15, xmm15
mov r14, qword [0x00830e48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x538dd5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x538d07
mov r8, rcx
cmp r8, 0x40
jl 0x538d85
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.00539040
xorps xmm15, xmm15
mov r14, qword [0x00830e48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x538dc8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x538dc4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00468840
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.00467f20
mov rax, rdx
mov ecx, 0x40
call fcn.00467f20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00465b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00538be0
Function at 0x5547a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55493b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5547c1
inc rcx
cmp rbx, rcx
jle 0x554931
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5547be
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.004f4140
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x005eed78]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.00550ec0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x554925
test rdx, rdx
je 0x55491a
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004042e0
xorps xmm15, xmm15
mov r14, qword [0x00830e48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5548e9
xor eax, eax
lea rbx, [0x006b2268]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006550f2]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.00450420
jmp 0x554910
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x006b2270]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.00450360
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005547a0
Function at 0x5613a0
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x561467
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x5613cc
test r15, r15
je 0x5614aa
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x56147c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x5613db
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x562a40
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x562ae7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x562b8a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x562ae7
cmp r9, 0
je 0x562c43
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x562ba0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x587860
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58794d
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
nop dword [rax + rax]
test rcx, rcx
jle 0x587939
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call fcn.00589ba0
xorps xmm15, xmm15
mov r14, qword [0x00830e48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
cmp rbx, rcx
mov rsi, rcx
cmovl rsi, rbx
mov rdi, qword [rsp + 0x58]
cmp rdi, rdx
jne 0x5878f3
cmp rbx, rcx
jmp 0x587925
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
mov rax, rdx
mov rbx, rdi
mov rcx, rsi
call fcn.00468840
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rdx, qword [rsp + 0x28]
mov rbx, rax
mov rax, qword [rsp + 0x20]
jae 0x587931
mov byte [rdx + rbx], 0
add rsp, 0x48
pop rbp
ret
mov rax, rbx
call fcn.00467e60
lea rax, [0x00615260]
lea rbx, [0x006b3960]
call fcn.00437760
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00587860

Function at 0x590200
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5902c5
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rcx
lea rdx, [rax + 0x28]
mov qword [rsp + 0x48], rdx
movzx esi, word [rax + 0x40]
mov word [rsp + 0x3e], si
mov r8, qword [rax + 8]
mov qword [rsp + 0x50], r8
mov r9, qword [rdi + 0x18]
mov qword [rsp + 0x40], r9
lea rax, [0x0060ee40]
xor edi, edi
mov rbx, r8
xor ecx, ecx
call fcn.00405b40
lea rax, [0x0060f040]
mov rbx, qword [rsp + 0x60]
xor ecx, ecx
xor edi, edi
call fcn.00405b40
mov rdx, qword [rsp + 0x50]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x10], rdx
movzx edx, word [rsp + 0x3e]
mov word [rsp + 0x18], dx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x40]
mov word [rsp + 0x28], dx
call fcn.00589a20
xorps xmm15, xmm15
mov r14, qword [0x00830e48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x30]
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00465b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00590200
Function at 0x5c3960
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x008354f8]
lea rdx, [rbp - 4]
mov r8, rdx
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
call rax
test eax, eax
je 0x5c3990
mov eax, dword [rbp - 4]
jmp 0x5c39bf
lea r9, str._go_pkg_mod_github.com_eycorsican_go_tun2socks_v1.16.11_core_c_custom_sys_arch.c
mov r8d, 0x37
lea rdx, str.CryptGenRandom_failed
lea rcx, str.Assertion___s__failed_at_line__d_in__s_n
call sub.msvcrt.dll_printf
mov ecx, 0
call sub.msvcrt.dll_fflush
call sub.msvcrt.dll_abort
add rsp, 0x30
pop rbp
ret

Function at 0x5c39c5
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov dword [rsp + 0x20], 0
mov r9d, 1
mov r8d, 0
mov edx, 0
lea rcx, [0x008354f8]
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
call rax
test eax, eax
jne 0x5c3aaa
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
mov edx, eax
lea rcx, str.CryptAcquireContext_failed_with_error__d__trying_to_create_NEWKEYSET
call fcn.005c3dbe
mov dword [rsp + 0x20], 8
mov r9d, 1
mov r8d, 0
mov edx, 0
lea rcx, [0x008354f8]
mov rax, qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
call rax
test eax, eax
jne 0x5c3aaa
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp - 4], eax
mov edx, dword [rbp - 4]
lea rax, [rbp - 0x90]
mov r9d, edx
lea r8, str.CryptAcquireContext_failed_with_error__d
mov edx, pe_nt_image_headers64
mov rcx, rax
call fcn.005c3916
lea rax, [rbp - 0x90]
lea r9, str._go_pkg_mod_github.com_eycorsican_go_tun2socks_v1.16.11_core_c_custom_sys_arch.c
mov r8d, 0x46
mov rdx, rax
lea rcx, str.Assertion___s__failed_at_line__d_in__s_n
call sub.msvcrt.dll_printf
mov ecx, 0
call sub.msvcrt.dll_fflush
call sub.msvcrt.dll_abort
nop
add rsp, 0xc0
pop rbp
ret

Function at 0x5c3d43
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
call fcn.005c39c5
call fcn.005c3ab4
call fcn.005c3ba1
mov rax, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rax
mov dword [0x008354f0], eax
mov eax, dword [0x008354f0]
cmp eax, 0xffffffff
jne 0x5c3da3
lea r9, str._go_pkg_mod_github.com_eycorsican_go_tun2socks_v1.16.11_core_c_custom_sys_arch.c
mov r8d, 0xb1
lea rdx, str.TlsAlloc_failed
lea rcx, str.Assertion___s__failed_at_line__d_in__s_n
call sub.msvcrt.dll_printf
mov ecx, 0
call sub.msvcrt.dll_fflush
call sub.msvcrt.dll_abort
nop
add rsp, 0x20
pop rbp
ret

Function at 0x5c5070
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov qword [0x00835568], rax
mov rax, qword [0x00835568]
test rax, rax
jne 0x5c50d7
mov ecx, 2
mov rax, qword [fcn.005c6e70]
call rax
mov r9, rax
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea rcx, [0x00835540]
mov rax, qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call rax
nop
add rsp, 0x20
pop rbp
ret
Function at 0x5c53b2
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rdx
mov dword [rbp - 0x54], 0
jmp 0x5c5422
mov rax, qword [rbp - 0x28]
mov r8, rax
mov edx, 0
mov rcx, qword [rbp - 0x30]
mov rax, qword [sym.imp.msvcrt.dll__beginthread]
call rax
mov qword [rbp - 0x60], rax
cmp qword [rbp - 0x60], 0xffffffffffffffff
jne 0x5c5419
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov eax, dword [rax]
cmp eax, 0xd
jne 0x5c5419
mov eax, dword [rbp - 0x54]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
add dword [rbp - 0x54], 1
jmp 0x5c5422
cmp qword [rbp - 0x60], 0xffffffffffffffff
jne 0x5c5458
jmp 0x5c5428
cmp dword [rbp - 0x54], 0x13
jle 0x5c53d1
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov ebx, dword [rax]
mov ecx, 2
mov rax, qword [fcn.005c6e70]
call rax
mov r8d, ebx
lea rdx, str.runtime:_failed_to_create_new_OS_thread___d__n
mov rcx, rax
call sub.msvcrt.dll_fprintf
call sub.msvcrt.dll_abort
nop
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x5c5a90
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.005c6e70
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.005c6e70
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x5c5b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x00835b74]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x5c5ca8
mov rax, qword [0x00835b78]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x5c5b4c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x5c5bd7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x5c5b30
mov rcx, r12
call fcn.005c6860
mov rbp, rax
test rax, rax
je 0x5c5ce2
mov rax, qword [0x00835b78]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.005c6990
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00835b78]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x5c5cf1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x5c5bd0
sub eax, 4
and eax, 0xfffffffb
jne 0x5c5c60
add dword [0x00835b74], 1
cmp ebx, 8
jae 0x5c5c08
test bl, 4
jne 0x5c5cb0
test ebx, ebx
je 0x5c5bf9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x5c5cd0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x5c5bf9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x5c5c3a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x00835b78]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x5c5bd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.005c5a90
nop dword [rax]
xor edi, edi
jmp 0x5c5b57
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x5c5bf9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x5c5bf9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.005c5a90
mov rax, qword [0x00835b78]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.005c5a90
nop
nop dword [rax]
Function at 0x5c64d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00835e60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00835e40]
test rbx, rbx
je 0x5c6524
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x5c651b
test r12, r12
je 0x5c651b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x5c6500
lea rcx, [0x00835e60]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x5c6860
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x007cc990]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x5c68d9
mov rcx, r10
call fcn.005c6730
test eax, eax
je 0x5c68d9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x5c68d6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x5c68cd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x5c68d9
add r8, 0x28
cmp r8, r9
jne 0x5c68b8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret