joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402c8000
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1403f2cc0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1402c8095
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.1400f8d6a
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1402c80f6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.1400fb137
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400f8d42
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1402c81b1
sub ecx, 1
je 0x1402c8224
sub ecx, 1
je 0x1402c8160
cmp ecx, 1
je 0x1402c8143
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x140308bb4]
call fcn.1400fb137
jmp 0x1402c8224
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1402c7c10
test eax, eax
je 0x1402c8224
jmp 0x1402c80ca
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call fcn.1400f989b
test rax, rax
je 0x1402c8224
sub rax, rsi
cmp rax, rbp
jae 0x1402c8224
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.1400fa75f
jmp 0x1402c8224
cmp r8d, 4
jle 0x1402c8224
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1402c8224
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.1400f8f9f
mov esi, eax
test eax, eax
je 0x1402c8203
mov edx, 5
mov rcx, rbx
call fcn.1402c9010
mov eax, esi
jmp 0x1402c80ca
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1400f9a7b
mov rcx, r14
call fcn.1400fa6e2
test eax, eax
je 0x1402c80c8
mov edx, 5
mov rcx, rbx
call fcn.1402c9010
mov eax, Ordinal_45
jmp 0x1402c80ca
Function at 0x1402e0a00
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1403f2cc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov dword [rbp - 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1402e0b37
movzx edx, byte [rdi + 1]
movzx ecx, byte [rdi]
movzx eax, dl
movzx r8d, byte [rdi + 5]
shr al, 1
mov byte [rbp - 0x1c], cl
shl cl, 7
or al, cl
shl dl, 6
movzx ecx, byte [rdi + 2]
mov byte [rbp - 0x1b], al
movzx eax, cl
shr al, 2
or al, dl
shl cl, 5
movzx edx, byte [rdi + 3]
mov byte [rbp - 0x1a], al
movzx eax, dl
shr al, 3
or al, cl
shl dl, 4
movzx ecx, byte [rdi + 4]
mov byte [rbp - 0x19], al
movzx eax, cl
shr al, 4
or al, dl
shl cl, 3
mov byte [rbp - 0x18], al
movzx eax, r8b
shr al, 5
or al, cl
shl r8b, 2
movzx ecx, byte [rdi + 6]
mov byte [rbp - 0x17], al
movzx eax, cl
add cl, cl
shr al, 6
or al, r8b
mov byte [rbp - 0x15], cl
mov qword [rsp + 0xa0], r14
lea rcx, [rbp - 0x1c]
xor r14d, r14d
mov byte [rbp - 0x16], al
mov dword [rbp - 0x28], 0x208
mov dword [rbp - 0x24], 0x6601
mov dword [rbp - 0x20], 8
lea edx, [r14 + 8]
call fcn.1400f9e59
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r8d, [r14 + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
lea rdx, [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14, qword [rsp + 0xa0]
test eax, eax
jne 0x1402e0b3b
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x1402e0b80
mov rax, qword [rsi]
xor r9d, r9d
mov rcx, qword [rbp - 0x30]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400f8d42
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov dl, byte [rcx + 0x91]
mov rbp, rcx
mov r15b, byte [rcx + 0x92]
mov al, dl
and al, 0xc
mov r8d, 4
neg al
mov al, dl
sbb sil, sil
sar al, 7
and al, 0x44
lea r11d, [r8 - 3]
and sil, r8b
or sil, al
mov eax, dword [rcx + 0x3c4]
neg eax
mov al, byte [rbp + 0x380]
sbb cl, cl
and al, r11b
and cl, 0x25
shl al, 4
or sil, cl
and dl, 3
or sil, al
or sil, dl
cmp r15b, sil
je 0x14000d79c
mov al, sil
mov byte [rbp + 0x92], sil
and al, 0x30
lea rbx, [rbp + 0xf80]
lea r14, section..text
cmp al, 0x10
jne 0x14000d5d2
movzx eax, word [0x1400a059e]
movzx ecx, word [0x1400a05a4]
add rax, r14
movzx edx, word [0x1400a058c]
add rcx, r14
movzx edi, word [0x1400a05aa]
add rdx, r14
movzx r9d, word [0x1400a05b2]
add rdi, r14
movzx r10d, word [0x1400a05b8]
jmp 0x14000d5fe
mov rax, qword [rbx + 0x750]
lea rdx, [0x140002529]
mov rcx, qword [rbx + 0x768]
mov rdi, qword [rbx + 0x780]
movzx r9d, word [0x1400a05b4]
movzx r10d, word [0x1400a05ba]
lea r13, [r9 + r14]
mov qword [rbx + 0x748], rax
lea r12, [r10 + r14]
mov qword [rbx + 0x760], rcx
mov r14b, sil
mov qword [rbx + 0x700], rdx
mov r9b, sil
mov qword [rbx + 0x778], rdi
xor r14b, r15b
and r9b, r8b
test r14b, 0x64
je 0x14000d6be
test r9b, r9b
jne 0x14000d68a
lea rdx, [rbx + 0x4d0]
mov r8d, 0x2c8
mov rcx, rbx
call fcn.14005ce90
mov r11d, 1
test sil, 2
je 0x14000d717
lea rax, [0x1400049f4]
mov qword [rbx + 0x248], rax
mov qword [rbx + 0x250], rax
mov qword [rbx + 0x258], rax
mov qword [rbx + 0x260], rax
jmp 0x14000d717
test sil, 0x20
lea rdx, [0x1400049d9]
mov cl, sil
lea rax, [0x140004a01]
cmovne rax, rdx
mov rdi, rbx
and cl, 0x40
lea rdx, [0x140004b95]
mov ecx, 0x59
cmovne rax, rdx
rep stosq qword [rdi], rax
jmp 0x14000d717
test r9b, r9b
jne 0x14000d717
mov qword [rbx + 0x290], rcx
lea rcx, [rbx + 0x248]
mov qword [rbx + 0x278], rax
mov qword [rbx + 0x230], rdx
mov qword [rbx + 0x2a8], rdi
test sil, 2
je 0x14000d704
lea rax, [0x1400049f4]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
jmp 0x14000d717
mov rax, qword [rcx + 0x4d0]
mov qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, r11
jne 0x14000d704
test r11b, r14b
je 0x14000d75d
lea rdi, [rbx + 0x2c8]
mov ecx, 0x41
test r11b, sil
jne 0x14000d753
lea rdx, [0x1400a05b2]
lea r8, section..text
movzx eax, word [rdx]
lea rdx, [rdx + 2]
add rax, r8
mov qword [rdi], rax
lea rdi, [rdi + 8]
sub rcx, r11
jne 0x14000d73b
jmp 0x14000d75d
lea rax, [0x140004a97]
rep stosq qword [rdi], rax
test r11b, sil
jne 0x14000d770
mov qword [rbx + 0x2c8], r13
mov qword [rbx + 0x2e0], r12
test sil, 0x10
je 0x14000d79c
test r15b, 0x10
jne 0x14000d79c
movzx eax, word [rbp + 0x950]
lea rdi, [rbp + 0xf00]
add ax, ax
mov ecx, 0x40
sub ax, r11w
movzx eax, ax
rep stosw word [rdi], ax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000f5c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r14, r9
sub rdx, rcx
mov esi, r8d
sub rdx, 0x68
mov rdi, rcx
sar rdx, 2
call fcn.14000e9ac
test rax, rax
jne 0x14000f687
lea rbp, [rdi + 0x68]
lea r15d, [rax + 1]
sub rbx, 4
cmp rbx, rbp
jbe 0x14000f64f
mov r8d, dword [rbx]
mov eax, r8d
movzx ecx, r8b
shr eax, 8
movzx r9d, al
lea rax, [0x1400a03c0]
movzx eax, word [rax + rcx*2]
and ax, 7
cmp ax, 2
jne 0x14000f653
cmp esi, r9d
jb 0x14000f60d
cmp ecx, 0x2c
jne 0x14000f64f
shr r8d, 0x10
cmp esi, r8d
ja 0x14000f60d
xor eax, eax
jmp 0x14000f691
cmp ax, r15w
jne 0x14000f60d
cmp r9d, esi
jne 0x14000f60d
cmp ecx, 0x12
jne 0x14000f6aa
mov esi, r8d
mov rdx, rbx
sub rdx, rdi
shr esi, 0x10
sub rdx, 0x68
mov r8d, esi
sar rdx, 2
mov rcx, rdi
call fcn.14000e9ac
test rax, rax
je 0x14000f60d
mov qword [r14], rax
lea rax, str.local
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
cmp ecx, 0x2d
je 0x14000f740
cmp ecx, 0x36
je 0x14000f71b
cmp ecx, 0x39
jne 0x14000f64f
mov eax, r8d
shr rax, 0x10
movzx ecx, al
mov rax, qword [rdi + 0x20]
not rcx
mov rdx, qword [rax + rcx*8]
add rdx, 0x18
mov qword [r14], rdx
cmp rbx, rbp
jbe 0x14000f70f
cmp byte [rbx - 4], 0x12
jne 0x14000f70f
mov eax, dword [rbx - 4]
shr eax, 8
movzx ecx, al
lea eax, [r9 + 2]
cmp ecx, eax
jne 0x14000f70f
shr r8d, 8
xor r8d, dword [rbx - 4]
test r8d, 0xffff0000
jne 0x14000f70f
lea rax, str.method
jmp 0x14000f691
lea rax, str.field
jmp 0x14000f691
mov rax, qword [rdi + 0x20]
mov rcx, r8
shr rcx, 0x10
not rcx
mov rcx, qword [rax + rcx*8]
lea rax, str.global
add rcx, 0x18
mov qword [r14], rcx
jmp 0x14000f691
mov rcx, qword [rdi + 0x58]
shr r8d, 0x10
test rcx, rcx
jne 0x14000f756
lea rcx, [0x14009f7d6]
jmp 0x14000f76a
test r8d, r8d
je 0x14000f76a
mov al, byte [rcx]
add rcx, r15
test al, al
jne 0x14000f75b
add r8d, 0xffffffff
jne 0x14000f75b
mov qword [r14], rcx
lea rax, str.upvalue
jmp 0x14000f691

Function at 0x1400111fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov ebp, r9d
shr rcx, 0x20
mov rsi, r8
xor ecx, edx
mov edi, edx
rol ecx, 4
call fcn.14007a4c8
mov r10d, eax
cmp ebp, 0xc
jbe 0x140011290
lea r8, [rsi - 0xc]
add r8, rbp
mov rdx, r8
add r10d, dword [rdx + 4]
add edi, dword [rdx + 8]
mov ecx, r10d
add ebx, dword [rdx]
xor edi, r10d
rol ecx, 0xe
mov rdx, rsi
sub edi, ecx
add rsi, 0xc
xor ebx, edi
mov eax, edi
rol eax, 0xb
sub ebx, eax
xor r10d, ebx
mov ecx, ebx
ror ecx, 7
sub r10d, ecx
cmp rdx, r8
jb 0x14001123b
mov eax, r10d
mov ecx, r10d
rol eax, 0x10
xor ecx, edi
sub ecx, eax
xor ebx, ecx
mov eax, ecx
rol eax, 4
sub ebx, eax
mov eax, ebx
xor r10d, ebx
rol eax, 0xe
sub r10d, eax
mov rbx, qword [rsp + 0x30]
mov eax, r10d
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016870
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1400bad58]
mov rbx, rcx
test rax, rax
jne 0x1400168bc
xor r8d, r8d
lea rcx, str.advapi32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
je 0x140016927
lea rdx, str.SystemFunction036
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400bad58], rax
test rax, rax
je 0x140016927
mov edx, 0x20
mov rcx, rbx
call rax
test al, al
je 0x140016927
mov rax, qword [rbx]
cmp rax, 2
jae 0x1400168da
add rax, 2
mov qword [rbx], rax
mov rax, qword [rbx + 8]
cmp rax, 0x40
jae 0x1400168ec
add rax, 0x40
mov qword [rbx + 8], rax
mov rax, qword [rbx + 0x10]
cmp rax, 0x200
jae 0x140016902
add rax, 0x200
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x18]
cmp rax, 0x20000
jae 0x140016918
add rax, 0x20000
mov qword [rbx + 0x18], rax
mov rcx, rbx
call fcn.140016930
mov eax, 1
jmp 0x140016929
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14001a0bc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x48], 0
mov rbx, rcx
jne 0x14001a123
xor r8d, r8d
lea rcx, str.winmm.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x14001a123
lea rdx, str.timeBeginPeriod
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x48]
lea rdx, str.timeEndPeriod
mov qword [rbx + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx + 0x50], 0
mov qword [rbx + 0x58], rax
je 0x14001a11c
test rax, rax
jne 0x14001a123
and qword [rbx + 0x48], 0
jmp 0x14001a15a
lea rcx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
and qword [rsp + 0x28], 0
lea r8, [0x140019ff4]
and dword [rsp + 0x20], 0
mov r9, rbx
and dword [rbx + 0x90], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x88], rax
add rsp, 0x30
pop rbx
ret

Function at 0x140026584
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov ebx, 0x200
mov edx, ebx
mov rdi, rcx
call fcn.140022588
mov r9, r14
mov r8d, ebx
mov edx, 1
mov rcx, rax
mov rbp, rax
call fcn.140079ffc
mov rsi, rax
cmp eax, ebx
jne 0x1400265fc
lea ecx, [rbx + rbx]
mov ebx, ecx
mov edx, ecx
mov rcx, rdi
call fcn.140022588
mov r8d, ebx
mov ecx, esi
sub r8d, esi
add rcx, rax
mov r9, r14
mov edx, 1
mov rbp, rax
call fcn.140079ffc
add esi, eax
cmp esi, ebx
je 0x1400265cc
mov rbx, qword [rdi + 0x28]
mov rdx, rbp
mov r8d, esi
mov rcx, rdi
lea rax, [rbx + 8]
mov qword [rdi + 0x28], rax
call fcn.140011658
movabs rcx, 0xfffd800000000000
or rax, rcx
mov qword [rbx], rax
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 0x10], rax
jb 0x14002663c
mov rcx, rdi
call fcn.140010e08
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140026658
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor esi, esi
mov ebx, r8d
mov r14, rdx
mov rbp, rcx
test r8d, r8d
je 0x1400266e4
mov edx, ebx
call fcn.140022588
mov r8d, ebx
lea edx, [rsi + 1]
mov r9, r14
mov rcx, rax
mov rdi, rax
call fcn.140079ffc
mov rbx, qword [rbp + 0x28]
mov rdx, rdi
mov r8d, eax
mov r14, rax
lea rcx, [rbx + 8]
mov qword [rbp + 0x28], rcx
mov rcx, rbp
call fcn.140011658
movabs r8, 0xfffd800000000000
or rax, r8
mov qword [rbx], rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 0x10], rax
jb 0x1400266df
mov rcx, rbp
call fcn.140010e08
test r14d, r14d
jmp 0x14002671f
mov rcx, r14
call fcn.140081f94
mov rdx, r14
mov ecx, eax
mov ebx, eax
call fcn.140083070
mov rdx, qword [rbp + 0x28]
movabs r8, 0xfffd800000000000
lea rcx, [rdx + 8]
mov qword [rbp + 0x28], rcx
mov rcx, qword [rbp + 0x10]
add rcx, 0x78
or rcx, r8
mov qword [rdx], rcx
cmp ebx, 0xffffffff
mov rbx, qword [rsp + 0x30]
setne sil
mov rbp, qword [rsp + 0x38]
mov eax, esi
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002e808
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
or r14d, 0xffffffff
mov r11d, edx
mov ebx, r8d
xor r10d, r10d
or r8d, r14d
mov rdi, rcx
test edx, edx
jne 0x14002e856
mov eax, dword [rcx]
test eax, eax
jne 0x14002e841
xor eax, eax
jmp 0x14002e9ce
bsf ecx, eax
cmp ecx, ebx
jb 0x14002e850
mov ecx, ebx
shr eax, cl
mov dword [rdi], eax
jmp 0x14002e83a
shr eax, cl
mov dword [rdi], eax
sub ebx, ecx
cmp ebx, 0x12
jbe 0x14002e8e2
mov edx, r9d
and r9b, 0x30
shr edx, 0x18
lea esi, [rdx - 1]
cmp r9b, 0x20
jne 0x14002e88d
mov eax, 0x38e38e39
mov r14d, 0x3f
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r14d, edx
jmp 0x14002e8e2
bsr ecx, dword [rdi + r11*4]
imul eax, r11d, 0x1d
mov r8d, r11d
sub eax, ebx
add eax, ecx
mov ecx, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x1400a2400]
cvttsd2si eax, xmm0
sub ecx, eax
mov eax, 0x38e38e39
sub ecx, edx
imul ecx
mov eax, esi
sar edx, 1
mov r14d, edx
add edx, 0x3e
shr r14d, 0x1f
add r14d, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
sub r8d, eax
add r8d, 0x3d
cmp ebx, 9
jb 0x14002e973
mov ecx, dword [rdi + r11*4]
mov r9d, r11d
mov eax, ecx
and ecx, 0x1ff
shr eax, 9
imul ebp, ecx, 0x1dcd65
mov dword [rdi + r11*4], eax
cmp r11d, r10d
je 0x14002e933
dec r9d
and r9d, 0x3f
mov edx, dword [rdi + r9*4]
mov eax, edx
shr eax, 9
and edx, 0x1ff
add eax, ebp
imul ebp, edx, 0x1dcd65
mov dword [rdi + r9*4], eax
cmp r9d, r10d
jne 0x14002e90c
cmp r10d, r14d
je 0x14002e955
cmp r10d, r8d
je 0x14002e955
test ebp, ebp
je 0x14002e94c
dec r10d
and r10d, 0x3f
mov dword [rdi + r10*4], ebp
cmp dword [rdi + r11*4], 0
jne 0x14002e96b
jmp 0x14002e961
cmp dword [rdi + r11*4], 0
jne 0x14002e96b
cmp r11d, r10d
je 0x14002e9cb
dec r11d
and r11d, 0x3f
dec r8d
add ebx, 0xfffffff7
jmp 0x14002e8e2
test ebx, ebx
je 0x14002e9cb
mov r9d, dword [rdi + r11*4]
mov ecx, ebx
mov esi, 1
mov ebp, 0x3b9aca00
shl esi, cl
mov eax, r9d
dec esi
sar ebp, cl
shr eax, cl
jmp 0x14002e9ab
dec r11d
mov ecx, ebx
and r11d, 0x3f
mov edx, dword [rdi + r11*4]
mov eax, edx
shr eax, cl
add eax, r9d
mov r9d, edx
and r9d, esi
mov dword [rdi + r11*4], eax
imul r9d, ebp
cmp r11d, r10d
jne 0x14002e994
test r9d, r9d
je 0x14002e9cb
dec r10d
and r10d, 0x3f
mov dword [rdi + r10*4], r9d
mov eax, r10d
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x140030a8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xa8]
mov rbx, rcx
mov ecx, 0x10f0000
and eax, ecx
cmp eax, ecx
jne 0x140030bbd
xor esi, esi
cmp word [rbx + 0x234], si
jne 0x140030add
cmp word [rbx + 0x236], si
jne 0x140030add
cmp word [rbx + 0x238], si
jne 0x140030add
cmp word [rbx + 0x23a], si
je 0x140030bbd
cmp dword [rbx + 0x158], esi
jne 0x140030b2a
movzx eax, word [rbx + 0xa]
mov rdx, qword [rbx + 0x30]
lea r8, [rax + rax*2]
mov rax, qword [rbx + 0x38]
mov ecx, dword [rdx + r8*4 - 0xc]
lea r9, [rax + rcx*4]
mov al, byte [rdx + r8*4 - 2]
test al, al
je 0x140030b2a
movzx edx, al
movzx eax, word [r9]
cmp eax, 0x8000
jb 0x140030b20
mov ecx, eax
mov rax, qword [rbx + 0x20]
or byte [rax + rcx*8 + 4], 0x20
add r9, 4
sub rdx, 1
jne 0x140030b0a
mov rcx, rbx
call fcn.140030cac
cmp dword [rbx + 0x158], esi
je 0x140030bb5
mov ecx, dword [rbx + 0xc]
mov r9d, esi
mov rax, qword [rbx + 0x20]
dec ecx
lea rdx, [rax + rcx*8]
cmp byte [rdx + 5], 0x13
jne 0x140030bb5
mov r8, qword [rbx + 0x20]
movzx r11d, word [rdx]
movzx ecx, word [rdx + 2]
mov r10b, byte [r8 + r11*8 + 4]
mov dil, byte [r8 + rcx*8 + 4]
mov al, r10b
xor al, dil
test al, 0x20
jne 0x140030b7e
movzx eax, word [r8 + rcx*8 + 6]
cmp word [r8 + r11*8 + 6], ax
je 0x140030ba6
movzx ecx, r10b
or r10b, 0x20
mov byte [r8 + r11*8 + 4], r10b
movzx eax, dil
and ecx, eax
mov rax, qword [rbx + 0x20]
not ecx
and ecx, 0x20
or r9d, ecx
movzx ecx, word [rdx + 2]
or byte [rax + rcx*8 + 4], 0x20
sub rdx, 8
cmp byte [rdx + 5], 0x13
je 0x140030b50
test r9d, r9d
jne 0x140030b3a
mov rcx, rbx
call fcn.140030ed0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140041678
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rdx
mov rdi, rcx
test r8d, r8d
je 0x14003118a
cmp qword [rcx + 0xbe8], rdx
jne 0x14003116a
mov edx, 0x20
call fcn.140031388
jmp 0x140031186
mov rdx, qword [rdx + 8]
lea r9, [rsp + 0x40]
mov r8d, 0x20
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400311ea
xor eax, eax
jmp 0x1400311b2
mov rbx, qword [rcx + 0xbe8]
cmp r10, rbx
jb 0x1400311bd
mov rdx, qword [rcx + 0xc00]
add rdx, rbx
cmp r10, rdx
jae 0x1400311bd
mov edx, 4
call fcn.140031388
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rbx]
cmp r10, rbx
jb 0x1400311bd
mov rdx, qword [rbx + 8]
lea rax, [rdx + rbx]
cmp r10, rax
jae 0x1400311bd
lea r9, [rsp + 0x40]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400311af
mov rcx, rdi
call fcn.1400313dc
int3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rdx + 0x58]
mov rbp, rdx
mov ebx, r8d
mov rdx, rdi
xor r8d, r8d
mov r14, r9
mov r12, rcx
call 0x140031140
mov r8d, dword [rbp + 0x54]
mov ecx, ebx
and ebx, 0x1f
shr rcx, 5
shl ebx, 2
xor esi, esi
mov r15d, ebx
mov r13, rax
add r15, 0xfffffffffffffffa
lea rbx, [rdi - 6]
mov rcx, qword [r12 + rcx*8 + 0x6a0]
add rbx, r8
add r15, rcx
cmp r8d, 5
jbe 0x14004170e
lea eax, [r8 - 5]
cmp byte [rax + rdi], 0xe9
jne 0x14004170e
movsxd rax, dword [r8 + rdi - 4]
add rax, 0xfffffffffffffffa
add rax, r8
add rax, rdi
cmp rax, r15
jne 0x14004170e
mov eax, r14d
sub eax, edi
sub eax, r8d
mov dword [r8 + rdi - 4], eax
cmp rdi, rbx
jae 0x1400417ac
mov al, byte [rdi]
mov rcx, rsi
and al, 0xf0
cmp al, 0x40
sete cl
cmp dword [rcx + rdi + 2], 0xfffff138
jne 0x140041733
cmp byte [rcx + rdi], 0xc7
je 0x1400417a7
mov rcx, rdi
call fcn.140040758
mov eax, eax
add rdi, rax
cmp rdi, rbx
jb 0x140041717
jmp 0x1400417a7
movzx eax, word [rdi]
mov ecx, 0xf0ff
and ax, cx
mov ecx, 0x800f
cmp ax, cx
jne 0x14004177a
movsxd rax, dword [rdi + 2]
add rax, rdi
cmp rax, r15
jne 0x14004177a
cmp rdi, rsi
je 0x14004177a
mov eax, r14d
sub eax, edi
sub eax, 6
mov dword [rdi + 2], eax
jmp 0x14004179a
cmp byte [rdi], 0xe8
jne 0x14004179a
movsxd rcx, dword [rdi + 1]
lea rax, [0x140010f2c]
add rcx, 5
add rcx, rdi
cmp rcx, rax
jne 0x14004179a
lea rsi, [rdi + 7]
mov rcx, rdi
call fcn.140040758
mov eax, eax
add rdi, rax
cmp rdi, rbx
jb 0x140041747
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x54]
add rdx, rcx
call fcn.14000d9e8
mov r8d, 1
mov rdx, r13
mov rcx, r12
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp 0x140031140
Function at 0x1400461e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x4500
shr r8, 2
or dx, ax
mov word [rcx + 0xba], r8w
mov eax, 0x7fff
mov word [rcx + 0xbc], dx
mov word [rcx + 0xb8], ax
jmp fcn.14004e53c
Function at 0x140049514
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.140049550
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140048960