joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400941f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400bc040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140094302
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140094302
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x140094269
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14009430d
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x1400942f0
mov edx, dword [rbx + 4]
test edx, edx
je 0x1400942f0
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x1400942c9
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x1400942e5
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140094bd0
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x140094281
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14009430d
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009f630
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140095a70
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x1400bc040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140095afe
test rbx, rbx
je 0x140095ac6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140095ab0
test eax, eax
jns 0x140095b1f
test rbx, rbx
je 0x140095b24
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140095c22
test rbx, rbx
jne 0x140095b2b
xor eax, eax
jmp 0x140095c22
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x140095c02
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x140095b80
lea rcx, [rsp + 0x28]
call fcn.140092c30
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140095ba0
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140095c38
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140095bf8
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140095bf3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140095c81
call fcn.14009f9bc
inc edi
cmp edi, dword [rbx]
jb 0x140095b44
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009f630
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140095c8d
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140095c88
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140095c88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14009f9bc
mov rax, rdi
jmp 0x140095c15
Function at 0x1400a03dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a0426
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a0426
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a0426
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a0426
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a0426
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a0428
xor al, al
add rsp, 0x28
ret
Function at 0x14105f108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14105f28f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14105f139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14105f11f
add dl, dl
jne 0x14105f146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14105f1a6
xor eax, eax
add dl, dl
jne 0x14105f155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14105f25d
add dl, dl
jne 0x14105f166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14105f173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14105f180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14105f18d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14105f19a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14105f12e
mov eax, 1
add dl, dl
jne 0x14105f1b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14105f1c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14105f1ab
sub eax, ebx
mov ebx, 1
jne 0x14105f1fc
mov ecx, 1
add dl, dl
jne 0x14105f1de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14105f1eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14105f1d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105f12e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14105f218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14105f225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14105f20d
cmp eax, 0x7d00
jae 0x14105f24b
cmp eax, 0x500
jb 0x14105f246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105f12e
cmp eax, 0x7f
ja 0x14105f24e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14105f12e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14105f282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14105f12e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x100001798
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000017e5
cmp rcx, 0xffffffffffffffff
je 0x1000017e5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1000017dd
cmp dword [rcx + 0x3c], edx
jl 0x1000017dd
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1000017dd
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000017e5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400120b0
Capabilities:
Accept command line arguments

Disassembly:
push rdi
push r15
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1400120e5
lea rax, [rdi - 1]
add rsp, 0x78
pop r15
pop rdi
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x90], rbx
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.140012250
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
xor ebx, ebx
test eax, eax
jle 0x1400121e9
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x70], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140012250
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jl 0x140012160
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x98]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14000f770
mov esi, eax
cmp dword [rsp + 0x40], ebx
jle 0x140012229
mov rdi, r14
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x140012229
call fcn.140010dfc
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jl 0x140012210
mov rcx, r14
call fcn.140010dfc
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
add rsp, 0x78
pop r15
pop rdi
ret
Function at 0x140011005
Capabilities:
Create thread

Disassembly:
jmp 0x140015910
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14002e1bb]
call fcn.1400115a5
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x120]
lea r8, [0x14001163b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400159b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateThread___failed._Error:__d_n
call fcn.14001104b
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400232a0]
call fcn.1400114c9
mov rax, rdi
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400112a3
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400111a4
Capabilities:
Connect pipe

Disassembly:
jmp 0x140014870
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x14002e1bb]
call fcn.1400115a5
mov qword [rbp + 8], 0xffffffffffffffff
lea rax, [rbp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140014907
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateEvent___failed._Error:__d_n
call fcn.14001104b
xor eax, eax
jmp 0x14001495e
mov r8d, 0x20
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.14001143d
mov rax, qword [rbp + 8]
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x14001495a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14001495a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ConnectNamedPipe___failed._Error:__d_n
call fcn.14001104b
xor eax, eax
jmp 0x14001495e
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140023220]
call fcn.1400114c9
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400112a3
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140011217
Capabilities:
Create pipe

Disassembly:
jmp 0x1400149e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x14002e1bb]
call fcn.1400115a5
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
lea rax, [rbp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
lea rax, [rbp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov ecx, 0x208
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140014a79
xor eax, eax
jmp 0x140014b85
mov r9, qword [rbp + 0x190]
lea r8, str..pipe_wspipe_spoolss
mov edx, 0x104
mov rcx, qword [rbp + 0x28]
call fcn.1400113c0
mov edx, 1
lea rcx, [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x140014acd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeSecurityDescriptor___failed._Error:__d_n
call fcn.14001104b
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_free]
xor eax, eax
jmp 0x140014b85
xor r9d, r9d
lea r8, [rbp + 0x90]
mov edx, 1
lea rcx, str.D:_A_OICI_GA___WD_
call fcn.14001159b
test eax, eax
jne 0x140014b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ConvertStringSecurityDescriptorToSecurityDescriptor___failed._Error:__d_n
call fcn.14001104b
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_free]
xor eax, eax
jmp 0x140014b85
lea rax, [rbp + 0x88]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x800
mov dword [rsp + 0x20], 0x800
mov r9d, 0xa
xor r8d, r8d
mov edx, 0x40000003
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140014b77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateNamedPipe___failed._Error:__d_n
call fcn.14001104b
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_free]
xor eax, eax
jmp 0x140014b85
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_free]
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x1400231a0]
call fcn.1400114c9
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400112a3
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret

Function at 0x140011325
Capabilities:
Terminate process

Disassembly:
jmp 0x140017b90
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400113ed
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018f20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018f40
xor al, al
jmp 0x140018fc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018f53
xor al, al
jmp 0x140018fc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140018f7d
xor al, al
jmp 0x140018fc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018f91
xor al, al
jmp 0x140018fc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018fa3
xor al, al
jmp 0x140018fc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140018fbf
xor al, al
jmp 0x140018fc1
mov al, 1
add rsp, 0x38
ret
Function at 0x422960
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x00933f82], 0
jne 0x422ac5
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
sub rdx, qword [rbx + 0x18]
nop
test rdx, rdx
jne 0x422a6e
xor eax, eax
nop
nop
nop
mov rcx, rax
shr rax, 3
and rcx, 7
mov edx, 1
shl edx, cl
nop
add rax, qword [rbx + 0x50]
lock or byte [rax], dl
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x422aba
lea rbx, [0x0092b540]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov esi, 1
shl esi, cl
test sil, bl
jne 0x422a2f
lock or byte [rdx], sil
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
mov rcx, qword [rsp + 0x30]
add qword [rax + 0x16a8], rcx
mov rcx, qword [rsp + 0x38]
add qword [rax + 0x16b0], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
cmp word [rbx + 0x5e], 0
je 0x422a8a
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
shr rdx, cl
and rax, rdx
jmp 0x422995
movzx ecx, byte [rbx + 0x65]
cmp cl, 0x40
sbb rax, rax
movzx esi, byte [rbx + 0x66]
cmp sil, 0x40
sbb rdi, rdi
shr rdx, cl
and rax, rdx
movzx edx, word [rbx + 0x5c]
imul rax, rdx
mov ecx, esi
shr rax, cl
and rax, rdi
jmp 0x422995
mov ecx, 0x40
nop
call fcn.0046ae80
lea rax, [0x0070d960]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.004389a0
nop
int3
Function at 0x45b520
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45b601
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00463360]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00468c00
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.00468d60
jmp fcn.0045b520
Function at 0x46a900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x00934400]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x00933f81], 0
je 0x46a93d
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x009346a0]
aesenc xmm0, xmmword [0x009346b0]
aesenc xmm0, xmmword [0x009346c0]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a460

Function at 0x47a3c0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rdx, 5
sar rsi, 0x3f
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x47a499
lea rsi, [rdx + rdx*2]
lea rdi, [0x008d2ac0]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x47a442
inc rdx
nop
jmp 0x47a418
cmp r9, 0xffffffffffffffe0
jle 0x47a44d
dec rdx
jmp 0x47a418
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.0046ae60
nop
int3
Function at 0x490c00
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x490c21
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rbx, rcx
jl 0x490c12
mov dword [rsp + 0x28], edx
ret
Function at 0x586540
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x586553
mov byte [rsp + 0x18], 0
ret
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x58654d
lea ecx, [rax - 0x30]
nop
cmp cl, 9
jbe 0x58654d
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x5866e0
cmp al, 0x2c
ja 0x5866b6
lea edx, [rax - 0x21]
nop
cmp dl, 1
ja 0x58658b
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x586585
cmp al, 0x26
jae 0x586585
cmp al, 0x2f
ja 0x586678
nop dword [rax + rax]
cmp al, 0x26
ja 0x586651
cmp al, 0x24
jne 0x586647
cmp rcx, 2
jg 0x586609
cmp rcx, 1
je 0x586601
nop dword [rax]
cmp rcx, 2
jne 0x5865e3
cmp al, 0x2f
jne 0x5865d4
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
je 0x5865ca
cmp al, 0x2c
je 0x5865ca
cmp al, 0x3f
sete al
jmp 0x5865cf
cmp rcx, 7
jne 0x5865fa
cmp al, 0x21
jne 0x5865f3
mov byte [rsp + 0x18], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x5865ed
mov byte [rsp + 0x18], 1
nop
ret
cmp al, 0x3f
sete byte [rsp + 0x18]
ret
cmp rcx, 5
jne 0x58662f
cmp al, 0x40
jne 0x586620
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
je 0x586613
cmp al, 0x3f
je 0x586613
cmp al, 0x3a
sete al
jmp 0x586618
cmp rcx, 6
je 0x586641
cmp rcx, 7
jne 0x5865e3
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x5865b0
jmp 0x5865e3
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x5865b0
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x58666b
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x5865b0
jmp 0x5865e3
cmp al, 0x3d
ja 0x586696
lea edx, [rax - 0x3a]
nop
cmp dl, 1
jbe 0x5865b0
cmp al, 0x3d
je 0x5865b0
jmp 0x5865e3
lea edx, [rax - 0x3f]
nop dword [rax]
cmp dl, 1
jbe 0x5865b0
cmp al, 0x5f
je 0x586665
cmp al, 0x7e
je 0x586665
jmp 0x5865e3
lea edx, [rax - 0x3a]
nop dword [rax]
cmp dl, 4
jbe 0x586585
cmp al, 0x5b
je 0x586585
cmp al, 0x5d
je 0x586585
jmp 0x586593
cmp rcx, 4
je 0x586574
jmp 0x586593