joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54da80
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x54db27
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x54dbca
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x54db27
cmp r9, 0
je 0x54dc83
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x54dbe0
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x559e00
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x559e18
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x559e18
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x559e20
xor eax, eax
ret
cmp rbx, 3
je 0x559e2c
cmp rbx, 4
jne 0x559e59
cmp al, 0x2c
ja 0x559e46
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x559e56
cmp al, 0x24
je 0x559e56
nop dword [rax]
cmp al, 0x26
jae 0x559e56
jmp 0x559e59
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x559e56
cmp al, 0x5b
je 0x559e56
cmp al, 0x5d
jne 0x559e59
xor eax, eax
ret
cmp al, 0x2f
ja 0x559e92
nop dword [rax]
cmp al, 0x26
ja 0x559e71
cmp al, 0x24
je 0x559eb1
cmp al, 0x26
je 0x559eb1
jmp 0x559f2b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x559eb1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x559f28
cmp al, 0x2f
je 0x559eb1
jmp 0x559f2b
cmp al, 0x3d
ja 0x559ea9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x559eb1
nop
cmp al, 0x3d
je 0x559eb1
jmp 0x559f2b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x559f20
cmp rbx, 2
jg 0x559ee7
cmp rbx, 1
je 0x559ee1
nop dword [rax]
cmp rbx, 2
jne 0x559f2b
cmp al, 0x2f
je 0x559ed2
cmp al, 0x3b
je 0x559ed2
cmp al, 0x2c
jne 0x559ed9
mov ecx, 1
jmp 0x559ede
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x559f0a
cmp al, 0x40
je 0x559ef9
cmp al, 0x2f
je 0x559ef9
cmp al, 0x3f
jne 0x559f02
mov ecx, 1
nop
jmp 0x559f07
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x559f19
cmp rbx, 7
jne 0x559f2b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x559f28
cmp al, 0x7e
jne 0x559f2b
xor eax, eax
ret
cmp rbx, 7
jne 0x559f41
cmp al, 0x21
je 0x559f3d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x559f41
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x55eec0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f113
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rsi, qword [rax + 0x50]
test rsi, rsi
jle 0x55eff0
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x55f105
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x10]
cmp rbx, rsi
je 0x55ef62
mov rax, rsi
mov rcx, r8
call fcn.00464040
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x50]
add rsi, r8
mov qword [rax + 0x50], rsi
cmp rsi, 0x40
jne 0x55efcc
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0055f400
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x55f0fc
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x55f000
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x55f0a0
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x55f0f4
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.0055f400
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x55f0ef
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
jle 0x55f0de
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x55f0da
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.00464040
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x50], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.004637a0
mov rdx, r9
call fcn.00463760
mov rax, r8
nop
call fcn.004637a0
mov rax, rsi
mov ecx, 0x40
call fcn.004637a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0055eec0
Function at 0x56fee0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x57000e
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x18]
movups xmmword [rdx], xmm15
lea rsi, [rsp + 0x28]
movups xmmword [rsi], xmm15
test byte [rbx], al
cmp rbx, rdx
je 0x56ff38
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x18], xmm0
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x28], xmm0
movzx edx, byte [rsp + 0x18]
and edx, 0xfffffff8
mov byte [rsp + 0x18], dl
movzx edx, byte [rsp + 0x37]
and edx, 0x7f
mov byte [rsp + 0x37], dl
or edx, 0x40
mov byte [rsp + 0x37], dl
mov qword [rsp + 0x60], 0
lea rdx, [rsp + 0x68]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x78]
movups xmmword [rdx], xmm15
mov qword [rsp + 0x38], 0
lea rdx, [rsp + 0x40]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x50]
movups xmmword [rdx], xmm15
lea rax, [rsp + 0x60]
mov rbx, rcx
call fcn.00570040
lea rax, [rsp + 0x60]
lea rbx, [rsp + 0x38]
lea rcx, [rsp + 0x18]
call fcn.0056fca0
lea rax, [rsp + 0x38]
mov rbx, rax
call fcn.00570420
lea rcx, [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rcx
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x10], rdx
call fcn.005724c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x88]
lea rbx, [rsp + 0x60]
call fcn.005701c0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
nop dword [rax]
call fcn.00460fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0056fee0
Function at 0x5b1260
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5b1335
movdqa xmm0, xmmword [0x006ca2d0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5b12a1
movdqa xmm0, xmmword [0x006ca2e0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5b13b7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5b138b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x006c9758]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x006ca650]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5be840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bea4f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2c
call fcn.00402dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
jmp 0x5be900
sub rcx, rdx
dec rcx
mov qword [rsp + 0x28], rcx
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and rcx, rax
mov rax, qword [rsp + 0x40]
add rax, rcx
mov qword [rsp + 0x38], rax
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x2c
call fcn.00402dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
nop
cmp rax, 0xffffffffffffffff
je 0x5be96e
cmp rdx, rax
jb 0x5bea46
mov rbx, rax
mov rsi, rcx
jmp 0x5be9ec
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x40], rsi
jmp 0x5bea0e
mov rbx, rax
mov rdi, qword [rsp + 0x70]
mov rax, rcx
mov rcx, qword [rsp + 0x68]
nop
call fcn.005beaa0
test al, al
jne 0x5bea31
mov rdx, qword [rsp + 0x30]
lea rax, [rdx + 1]
mov rcx, qword [rsp + 0x20]
nop dword [rax + rax]
cmp rcx, rax
jae 0x5be8a4
jmp 0x5bea41
jmp 0x5be987
dec rdx
mov rsi, rdx
neg rdx
sar rdx, 0x3f
and rdx, 1
add rcx, rdx
mov rdx, rsi
test rdx, rdx
jle 0x5be9a0
movzx esi, byte [rcx]
cmp sil, 0x20
je 0x5be970
cmp sil, 9
je 0x5be970
jmp 0x5be9a0
dec rdx
test rdx, rdx
jle 0x5be9b6
movzx esi, byte [rcx + rdx - 1]
cmp sil, 0x20
je 0x5be99d
cmp sil, 9
je 0x5be99d
mov rax, rcx
mov rbx, rdx
mov rcx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
call fcn.005beaa0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
dec rax
mov r8, rax
neg rax
sar rax, 0x3f
and rax, 1
add rcx, rax
mov rax, r8
test rax, rax
jle 0x5be91a
movzx r8d, byte [rcx]
cmp r8b, 0x20
je 0x5be9d5
nop
cmp r8b, 9
je 0x5be9d5
jmp 0x5be91a
dec rax
test rax, rax
jle 0x5be92e
movzx r8d, byte [rax + rcx - 1]
nop dword [rax]
cmp r8b, 0x20
je 0x5bea0b
cmp r8b, 9
je 0x5bea0b
jmp 0x5be92e
mov eax, 1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
call fcn.004637a0
mov rcx, rax
call fcn.00463720
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.005be840
Function at 0x5becc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bee6f
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5bece7
inc rcx
cmp rbx, rcx
jle 0x5bee61
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5bece4
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
call fcn.004d8220
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x00852bf0]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005bac80
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x5bee50
test rdx, rdx
je 0x5bee41
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402dc0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5bee0b
xor eax, eax
lea rbx, [0x00669054]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006690fa]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044d080
jmp 0x5bee32
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x00669049]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044cfa0
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
nop
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460fe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005becc0
Function at 0x1400017e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140001897
movsxd r13, dword [rax + 0x3c]
mov r12d, dword [r13 + rax + 0x88]
mov r15d, dword [r12 + rax + 0x1c]
mov r10d, dword [r12 + rax + 0x20]
add r15, rax
mov r11d, dword [r12 + rax + 0x24]
add r10, rax
add r11, rax
test esi, 0xffff0000
jne 0x14000184e
movzx eax, si
sub eax, dword [r12 + rbx + 0x10]
mov eax, dword [r15 + rax*4]
add rax, rbx
jmp 0x140001899
mov edi, dword [r12 + rax + 0x18]
xor r14d, r14d
mov r9d, r14d
test edi, edi
je 0x140001897
nop dword [rax]
mov eax, dword [r10]
mov r8, rsi
movzx ebp, word [r11]
add rax, rbx
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001883
inc rax
test ecx, ecx
jne 0x140001870
test edx, edx
je 0x1400018b6
inc r9d
add r11, 2
add r10, 4
cmp r9d, edi
jb 0x140001860
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, dword [r15 + rbp*4]
cmp r12, rcx
ja 0x14000196e
mov eax, dword [r13 + rbx + 0x8c]
add eax, r12d
cmp rcx, rax
jae 0x14000196e
lea rbp, [rcx + rbx]
mov rcx, rbp
lea rdx, [0x1400033f0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov rdi, rax
lea rsi, [rax + 1]
mov rax, 0xffffffffffffffff
sub rsi, rbp
mov rcx, rsi
add rcx, 4
lea edx, [rax + 2]
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140001897
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x1400033f4]
mov word [rbx + rsi], cx
movzx ecx, byte [0x1400033f6]
mov byte [rbx + rsi + 2], cl
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000195d
lea rdx, [rdi + 1]
mov rcx, rbx
call fcn.1400017e0
mov r14, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, r14
jmp 0x140001899
lea rax, [rcx + rbx]
jmp 0x140001899

Function at 0x1407812a3
Capabilities:
Encode data using xor

Disassembly:
push 0x3128dd08
mov dword [r8], eax
lea rsp, [rsp + 8]
jmp fcn.1407906e3
lea rsp, [rsp + 0x18]
je 0x14079d885
jmp 0x14079d83a
mov ecx, 0x1b8fb89b
lea r11, [0x14078c3a8]
mov ecx, 0x9eb2d39f
sar rcx, cl
not ecx
movzx ecx, byte [r9]
push 0xfffffffff084d48c
xor ecx, eax
and ecx, 0xff
mov ecx, dword [r11 + rcx*4]
shr eax, 8
xor eax, ecx
inc r9
xor eax, 0x3a1a7591
add byte [rsp + 3], 0x2c
dec rbx
lea rsp, [rsp + 8]
jne 0x14079d846
not eax
jmp 0x14076b1be
Function at 0x14000192c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140002030]
test rax, rax
je 0x140001976
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001976
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001976
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001976
cmp dword [rcx + 0x84], 0xe
jbe 0x140001976
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001978
xor al, al
add rsp, 0x28
ret
Function at 0x1698058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.016981df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1698089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x169806f
add dl, dl
jne 0x1698096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x16980f6
xor eax, eax
add dl, dl
jne 0x16980a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x16981ad
add dl, dl
jne 0x16980b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16980c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16980d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16980dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x16980ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x169807e
mov eax, 1
add dl, dl
jne 0x1698106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1698113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x16980fb
sub eax, ebx
mov ebx, 1
jne 0x169814c
mov ecx, 1
add dl, dl
jne 0x169812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x169813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1698123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x169807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1698168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1698175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x169815d
cmp eax, 0x7d00
jae 0x169819b
cmp eax, 0x500
jb 0x1698196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x169807e
cmp eax, 0x7f
ja 0x169819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x169807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x16981d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x169807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180003510
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180003538
xor eax, eax
lea r8, [0x180003420]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180009e80
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
cmp byte [0x1801af0b8], 0
je 0x18000a0cf
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000a0cf
mov qword [rsp + 0xb0], rbx
movabs rbx, 0xd80958fc74e988a6
mov qword [rsp + 0xa0], rdi
xor edi, edi
mov dword [0x18014c698], edi
mov dword [0x18014c6a8], edi
mov qword [0x1801b1910], rbx
call fcn.18003c7d0
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x997abd671d25ca0b
mov dword [rsp + 0xb8], ecx
mov qword [0x1801b1910], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], rdi
mov qword [0x18014c770], rax
mov dword [rsp + 0xb8], 1
mov rax, qword [rsp + 0xb8]
mov qword [0x18014c778], rax
mov dword [0x18014c6a8], edi
mov dword [0x18014c698], 2
call fcn.18003c7d0
cmp dword [rax], edi
je 0x18000a0bf
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm7
mov dword [0x18014c698], edi
mov dword [0x18014c6a8], edi
mov qword [0x1801b1910], rbx
call fcn.18003c7d0
mov qword [rsp + 0xb8], rdi
mov ecx, dword [rax]
movabs rax, 0x9a9112a0fe9a4713
mov dword [rsp + 0xb8], ecx
mov qword [0x1801b1910], rax
mov rax, qword [rsp + 0xb8]
mov qword [0x18014c770], rax
mov dword [0x18014c6a8], edi
mov qword [0x18014c778], rdi
mov dword [0x18014c698], 2
call fcn.18003c7d0
mov qword [rsp + 0xb8], rdi
mov ebx, dword [rax]
movabs rax, 0x866a4a5fae349510
mov qword [0x1801b1910], rax
mov dword [rsp + 0xb8], ebx
mov rax, qword [rsp + 0xb8]
mov qword [0x18014c770], rax
mov dword [0x18014c6a8], edi
mov dword [0x18014c698], 1
call fcn.18003c7d0
mov qword [rsp + 0xb8], rdi
xorps xmm6, xmm6
mov dword [rsp + 0xb8], ebx
movss xmm7, dword [rax]
movabs rax, 0x8bb4ef4214e0e6d5
mov qword [0x1801b1910], rax
addss xmm7, xmm6
mov rax, qword [rsp + 0xb8]
mov qword [0x18014c770], rax
mov dword [0x18014c6a8], edi
mov dword [0x18014c698], 1
call fcn.18003c7d0
movss xmm0, dword [0x180101f84]
mov edx, ebx
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x68], 1
movss xmm3, dword [rax]
mov dword [rsp + 0x58], 1
addss xmm3, xmm6
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], 1
movss dword [rsp + 0x40], xmm6
movss dword [rsp + 0x38], xmm6
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x20], xmm7
call fcn.18002f370
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov rbx, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
add rsp, 0xa8
ret