joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002348
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1400014f4
mov rcx, rbx
call fcn.14000150c
mov edi, eax
test eax, eax
jne 0x14000239c
mov rcx, rbx
call fcn.140001ca4
mov edi, eax
test eax, eax
jne 0x14000239c
mov rcx, rbx
call fcn.1400017d8
mov edi, eax
test eax, eax
jne 0x14000239c
mov rcx, rbx
call fcn.1400018f4
mov edi, eax
test eax, eax
jne 0x14000239c
mov rcx, rbx
call fcn.140001f78
mov edi, eax
cmp dword [0x14000cf20], 0
jne 0x140002414
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbx + 0x110c], 0
lea rcx, [rbx + 0x1224]
je 0x1400023e2
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbx + 0x142c]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbx + 0x1328]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x140002414
xor edx, edx
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
xor edx, edx
lea rcx, [rbx + 0x142c]
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
xor edx, edx
lea rcx, [rbx + 0x1328]
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002808
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140002678

Function at 0x14000438b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000c030]
jne 0x14000299a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002996
repz ret
ror rcx, 0x10
jmp 0x1400042e4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000d8f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000d9e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140004369
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000d8f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000438b
mov rax, qword [rsp + 0x88]
mov qword [0x14000d9e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000d988], rax
mov rax, qword [0x14000d9e8]
mov qword [0x14000d860], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000d970], rax
mov dword [0x14000d850], 0xc0000409
mov dword [0x14000d854], 1
mov rax, qword [0x14000c030]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000c038]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000d8e8], eax
mov ecx, 1
call fcn.140005344
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400092e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000d8e8], 0
jne 0x140004412
mov ecx, 1
call fcn.140005344
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140006098
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000c030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000378c
xor ebx, ebx
cmp qword [0x14000df10], rbx
mov rdi, rax
jne 0x1400061ab
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140006282
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006282
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000df10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000df18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000df20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000df30], rax
test rax, rax
je 0x1400061a2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000df28], rax
jmp 0x1400061b2
mov rax, qword [0x14000df28]
jmp 0x1400061b9
mov rax, qword [0x14000df28]
mov r11, qword [0x14000df30]
cmp rax, rdi
je 0x140006220
cmp r11, rdi
je 0x140006220
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000df30]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140006220
test rax, rax
je 0x140006220
call rsi
test rax, rax
je 0x14000621a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000621a
test byte [rsp + 0x40], 1
jne 0x140006220
bts ebp, 0x15
jmp 0x140006260
mov rcx, qword [0x14000df18]
cmp rcx, rdi
je 0x140006260
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006260
call rax
mov rbx, rax
test rax, rax
je 0x140006260
mov rcx, qword [0x14000df20]
cmp rcx, rdi
je 0x140006260
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006260
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000df10]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006282
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140006284
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002980
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1802cd80e
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [rsp + 0x10]
mov qword [rsp], rdx
mov qword [rsp + 0x10], 0xffffffffa8a51504
add dword [rsp + 2], edx
movsxd rax, eax
mov qword [rsp + 8], 0xffffffff971966aa
lea rsi, [rdx + rdx*4 - 0x18767d64]
shr r9d, 0x38
add r11, rax
or bl, 0xe
push rsi
mov ebx, dword [r10 + r9*2 - 0x120]
mov r9d, dword [r10 + r9*4 - 0x23c]
adc r10, 4
add ebx, r9d
jmp 0x1802e95ce

Function at 0x1802d5221
Capabilities:
Parse pe header

Disassembly:
mov dword [r10 + rdx + 0x5214b760], ecx
mov qword [rsp + rdx + 0x5214b760], rsi
mov rbx, qword [r10 + rdx + 0x5214b760]
sal dl, 0xa5
lea rcx, [rbp + rbp - 0x1ed6cc69]
call fcn.1802d294e
inc esi
movsx r9d, al
and cl, al
jno 0x1802fc1a1
xor r8, rax
neg esi
inc bpl
mov qword [r10 + rdx - 0x633f7ba4], rax
movzx eax, dl
lea r10, [rbp + r10 - 0x7ba5]
bswap ebp
push r9
mov ecx, dword [r9 + rdi - 0x7ba4]
lea rdi, [rdi + rdx - 0x633f7ba0]
setne bpl
sar al, 0x85
xor ecx, r8d
rol dword [rsp + r9*4 - 0x1eeac], 0x86
sbb dl, 0x2d
lea ecx, [rcx + rdx - 0x15ac89dd]
movzx ebx, sil
call fcn.18033fe53
not esi
neg esi
bswap esi
lea rcx, [rdx + 0x48bcb79f]
and edx, edx
push r8
xor dword [rsp + r9*4 - 0x58], esi
add cl, 0x11
bswap rbx
xadd bx, dx
pop r8
movsxd rsi, esi
adc r11, rsi
mov esi, r9d
jmp r11

Function at 0x1802df92b
Capabilities:
Encode data using base64

Disassembly:
shl rbp, 0x92
lea rsi, [rsp + rsi + 0x10]
mov qword [rsp + rcx - 0x2b3], rcx
jp 0x1802ebc42
neg r9w
mov word [rcx + rsi - 0x2b3], bx
sbb dl, 0x99
mov word [rsp + rcx - 0x2a9], cx
mov edx, dword [rdi + rcx - 0x2b1]
dec ecx
add cl, cl
call fcn.180311617

Function at 0x1802e9538
Capabilities:
Parse pe header

Disassembly:
mov rsp, qword [rbx + rbp - 0x2ab8853c]
mov rbp, qword [rbx + rbp - 0x2ab88534]
mov qword [rbx + rbp - 0x2ab8852c], rax
sar bl, 0xe4
js 0x180340d60
mov r10, rbp
lea rbx, [rbx + rbx + 0x4d9402af]
pop r8
movsx ebp, bl
movsx edx, bpl
pop r11
call fcn.180325907
mov eax, esi
inc ebp
ror qword [rsp + rdx - 0xffe4], cl
lea rbx, [rdx + r9*8 + 0x303ce81]
bswap rsi
mov qword [rsp + rdx - 0xffc7], r8
xor dword [rsp + rdx - 0xffc7], ebp
call fcn.1802fc2c4
Function at 0x1802e962c
Capabilities:
Parse pe header

Disassembly:
neg edx
movsx esi, bl
bswap edx
not edx
rol edx, cl
lea r9, [r9*8 - 0x1e5b3f76]
not r9d
add bl, 0x12
inc edx
lea rax, [rsi + rbp*4 - 0x2ac78550]
neg cl
setl r9b
push r8
call fcn.180334d9f
not bpl
movsx esi, ax
adc r11, rbx
xchg rcx, rdx
movsx ebx, bpl
jmp fcn.18031647c
movsxd rcx, ecx
mov qword [rsp + rbp - 0x7c863e13], 0xffffffff8aa11a19
xor word [rsp + rbx - 0x7c863e1b], 0x7894
adc r11, rcx
mov qword [rsp + rbp - 0x7c863e23], rbp
mov ax, word [r10 + rbx - 0x7c863e23]
and bx, word [rsp + rbx - 0x7c863e1a]
mov bx, word [r10 + rbp - 0x7c863e21]
jne 0x1802ec563
mov ecx, 0x8191f436
movsx ebp, cl
movsx ebx, bp
mov edx, dword [rbp + rdi - 0x36]
xor edx, r8d
movzx r9d, bp
jmp 0x18032fb1b
lea rsi, [r9 + r9*4 - 0x25c9fd5e]
rol r9, 0x57
mov cl, byte [r10 + rbp - 0x7c863e1f]
mov word [rsp + rbp - 0x7c863e1a], 0x2c18
movsx edx, sil
pop rsi
lea r10, [rsi + r10 - 0x7c863e1f]
call fcn.18031864a
mov ebx, 0xa82ec29c
mov rdx, qword [r10]
mov rbx, qword [r10 + 8]
call fcn.180301447
rol edx, 2
shl bp, 0xa5
neg edx
rol edx, 1
shl r9w, 0xe9
setns cl
dec edx
jmp 0x1802e4485

Function at 0x1802f5885
Capabilities:
Authenticate hmac

Disassembly:
mov ebp, edx
lea rax, [rsp + rax + 0x28]
call fcn.18030d057

Function at 0x18030f5e7
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rbx*8 - 0x4c35a4e0], rbx
lea rbx, [0x1802f0f90]
lea rsp, [rsp + 8]
movzx r10d, byte [rsi]
xor r10d, eax
push 0x16270dae
and r10d, 0xff
mov r10d, dword [rbx + r10*4]
ror dword [rsp + 2], 0x14
shr eax, 8
xor eax, r10d
inc dword [rsp + 3]
inc rsi
xor eax, 0x191680e
dec rcx
not word [rsp]
lea rsp, [rsp + 8]
jne 0x18030f5fb
mov r9d, 0x1b0ccc02
pop r10
mov ecx, 0xa62c0732
push rcx
movzx r9d, cx
not eax
pop rbp
lea rsi, [r9 + r9 - 0x4f7aeec5]
mov edx, 0x77300e28
mov dword [r10 + rdx - 0x77300e28], eax
push rbp
jmp 0x1803393da
mov ecx, dword [r9 + rdi - 0x732]
xchg word [rsp + r9*8 - 0x3990], bp
and qword [rsp + r9*2 - 0xe64], rdx
lea rdi, [rdi + r9*8 - 0x398c]
xor ecx, r8d
or r9, rdx
push rdx
lea ecx, [rcx + r9 + 0x1d87e3f0]
and byte [rsp + rdx - 0x77300e19], r9b
rol byte [rsp + rsi + 0x4f7ae066], 0x67
not ecx
setns byte [rsp + r9 - 0x77300f31]
neg ecx
shr dword [rsp + rsi + 0x4f7ae069], 0xe1
bswap ecx
call fcn.180330845
Function at 0x18031703c
Capabilities:
Authenticate hmac

Disassembly:
movzx ebx, byte [rdi + rbp*2 + 0x7b]
sar eax, 0xb9
dec dword [rsp + rbp + 0x4d]
push rdx
lea rdi, [rdi + rbp + 0x41]
pop rax
mov qword [rsp + rbp*2 + 0x76], 0xffffffffa5a137a2
ror qword [rsp + rbp + 0x3f], 0x36
xor bl, r8b
and byte [rsp + rbp*2 + 0x87], cl
xor bl, 0x2c
sar dx, 0x2b
ror bl, 1
lea rax, [rcx + rdx*4 - 0x17629949]
add dword [rsp + rbp + 0x3b], 0xaeb6d419
jle 0x180340abf
not bl
movsx ebp, r9b
mov word [r10 + rbp - 0x2b], bx
movsx eax, bpl
lea rdx, [r9 + rbp*2 - 0xaddf8f6]
xchg qword [rsp + 8], rax
add rax, 0xfffffffffffd6305
jmp rax
sub bl, 0x9a
shl rsi, cl
neg bl
and ebp, eax
dec bl
sub dword [rsp + rbp - 0x74513ab8], edx
xor r8b, bl
or eax, 0xc6008f95
shr cl, 0xe7
lea rbx, [rsp + rbx + 0x18]
call fcn.1802de504
movzx ebx, byte [rdi + 4]
ror edx, 0x63
lea rdi, [rdi + rdx - 0x17f3fffb]
mov esi, 0x913e71f
jae 0x1802de46f
mov rdx, qword [r10]
mov eax, 0xd43bb082
add r10, 8

Function at 0x18034771d
Capabilities:
Parse pe header

Disassembly:
shr sil, 0xc1
mov qword [rsp + rcx - 0x5b8a], rcx
bswap edx
call fcn.1802d603c
Function at 0x423380
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00fb7311], 0
jne 0x4234e5
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x42348e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x4234da
lea rbx, [0x00fae8c0]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x42344f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x4234aa
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x4233b5
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x4233b5
mov ecx, 0x40
nop
call fcn.00472240
lea rax, [0x00b3c368]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0043b220
nop
int3
Function at 0x461a00
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x461ae1
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00469bc0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046ffc0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.00470120
jmp fcn.00461a00
Function at 0x471cc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00fb79a0]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x00fb7310], 0
je 0x471cfd
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00fb7c40]
aesenc xmm0, xmmword [0x00fb7c50]
aesenc xmm0, xmmword [0x00fb7c60]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40ac40

Function at 0x4a1860
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x4a1939
lea rsi, [rdx + rdx*2]
lea rdi, [0x00f21d40]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x4a18e2
inc rdx
nop
jmp 0x4a18b8
cmp r9, 0xffffffffffffffe0
jle 0x4a18ed
dec rdx
jmp 0x4a18b8
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.00472220
nop
int3
Function at 0x4af120
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x4af141
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rbx, rcx
jl 0x4af132
mov dword [rsp + 0x28], edx
ret

Function at 0x5ec6c0
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x5ec6d3
mov byte [rsp + 0x18], 0
ret
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x5ec6cd
lea ecx, [rax - 0x30]
nop
cmp cl, 9
jbe 0x5ec6cd
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x5ec860
cmp al, 0x2c
ja 0x5ec836
lea edx, [rax - 0x21]
nop
cmp dl, 1
ja 0x5ec70b
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x5ec705
cmp al, 0x26
jae 0x5ec705
cmp al, 0x2f
ja 0x5ec7f8
nop dword [rax + rax]
cmp al, 0x26
ja 0x5ec7d1
cmp al, 0x24
jne 0x5ec7c7
cmp rcx, 2
jg 0x5ec789
cmp rcx, 1
je 0x5ec781
nop dword [rax]
cmp rcx, 2
jne 0x5ec763
cmp al, 0x2f
jne 0x5ec754
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
je 0x5ec74a
cmp al, 0x2c
je 0x5ec74a
cmp al, 0x3f
sete al
jmp 0x5ec74f
cmp rcx, 7
jne 0x5ec77a
cmp al, 0x21
jne 0x5ec773
mov byte [rsp + 0x18], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x5ec76d
mov byte [rsp + 0x18], 1
nop
ret
cmp al, 0x3f
sete byte [rsp + 0x18]
ret
cmp rcx, 5
jne 0x5ec7af
cmp al, 0x40
jne 0x5ec7a0
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
je 0x5ec793
cmp al, 0x3f
je 0x5ec793
cmp al, 0x3a
sete al
jmp 0x5ec798
cmp rcx, 6
je 0x5ec7c1
cmp rcx, 7
jne 0x5ec763
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x5ec730
jmp 0x5ec763
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x5ec730
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x5ec7eb
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x5ec730
jmp 0x5ec763
cmp al, 0x3d
ja 0x5ec816
lea edx, [rax - 0x3a]
nop
cmp dl, 1
jbe 0x5ec730
cmp al, 0x3d
je 0x5ec730
jmp 0x5ec763
lea edx, [rax - 0x3f]
nop dword [rax]
cmp dl, 1
jbe 0x5ec730
cmp al, 0x5f
je 0x5ec7e5
cmp al, 0x7e
je 0x5ec7e5
jmp 0x5ec763
lea edx, [rax - 0x3a]
nop dword [rax]
cmp dl, 4
jbe 0x5ec705
cmp al, 0x5b
je 0x5ec705
cmp al, 0x5d
je 0x5ec705
jmp 0x5ec713
cmp rcx, 4
je 0x5ec6f4
jmp 0x5ec713
Function at 0x819ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x819de6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
xor eax, eax
xor ecx, ecx
jmp 0x819cef
add rax, 2
lea ecx, [r9 + 1]
cmp rax, rdx
jge 0x819d73
lea r9, [rax + 1]
nop dword [rax + rax]
cmp r9, rdx
jae 0x819dd5
mov r9d, dword [rbx + rax*4 + 4]
cmp rax, rdx
jae 0x819dcd
mov r10d, dword [rbx + rax*4]
dec r10d
nop
cmp r10d, ecx
jl 0x819ce7
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r9d
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r10d
call fcn.00819660
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x3c]
jmp 0x819ce7
cmp ecx, 0x10ffff
jle 0x819d9d
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], r8
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call fcn.00819660
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp 0x819d7b
mov rcx, rdx
call fcn.00472220
mov rax, r9
mov rcx, rdx
nop dword [rax + rax]
call fcn.00472220
nop
call fcn.00470120
jmp fcn.00819ca0
Function at 0x819e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x81a079
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
nop word [rax + rax]
test rcx, rcx
jle 0x81a05c
mov qword [rsp + 0x58], rcx
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
xor r8d, r8d
jmp 0x819ed6
mov dword [rsp + 0x3c], r11d
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r11d
call fcn.00819660
mov eax, dword [rsp + 0x3c]
mov r10d, dword [rsp + 0x48]
lea r11d, [r10 + rax]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x4c]
cmp r9d, r11d
jge 0x819e6b
inc r8
cmp r8, rcx
jge 0x819f04
add rdx, 6
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x50], r8
movzx r9d, word [rdx + 2]
movzx r10d, word [rdx + 4]
movzx r11d, word [rdx]
cmp r10d, 1
je 0x81a014
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x48], r10d
jmp 0x819ec5
mov rcx, qword [rax + 0x20]
mov rax, qword [rax + 0x18]
test rcx, rcx
jle 0x819fb2
mov qword [rsp + 0x58], rcx
xor edx, edx
jmp 0x819f89
mov dword [rsp + 0x38], r10d
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r10d
nop dword [rax + rax]
call fcn.00819660
mov eax, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x44]
lea r10d, [r9 + rax]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x40]
cmp r10d, r8d
jle 0x819f1e
inc rdx
nop dword [rax]
cmp rdx, rcx
jge 0x819fb2
add rax, 0xc
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rdx
mov r8d, dword [rax + 4]
mov r9d, dword [rax + 8]
mov r10d, dword [rax]
nop
cmp r9d, 1
je 0x819fd4
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], r8d
jmp 0x819f75
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r8d
call fcn.00819660
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
jmp 0x819f7a
mov qword [rsp], rbx
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r9d
call fcn.00819660
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
jmp 0x819eca
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
jmp 0x819f04
call fcn.00470120
nop
jmp fcn.00819e00