joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4140a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41422b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042ff00
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414105
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414114
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414133
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414143
cmp rbx, 0x1000
jae 0x41410b
jmp 0x4141ad
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414155
xor edx, edx
jmp 0x4141a4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042ff00
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414139
jmp 0x414128
call fcn.0045e4e0
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434300
lea rax, [0x004a2192]
mov ebx, 0x18
nop dword [rax]
call fcn.00434b80
mov rax, qword [rsp + 0x38]
call fcn.004348c0
lea rax, [0x004a2499]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434b80
mov rax, qword [rsp + 0x30]
call fcn.004348c0
call fcn.00434540
call fcn.00434360
lea rax, [0x004a4054]
mov ebx, 0x21
call fcn.00432960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ae20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004140a0
Function at 0x414260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414486
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042ff80
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4142d3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4142e2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x414305
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x414315
cmp rbx, 0x1000
jae 0x4142d9
nop
jmp 0x414398
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x41432d
xor esi, esi
jmp 0x41438a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042ff80
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41430b
jmp 0x4142f6
call fcn.0045e4e0
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x414420
nop dword [rax + rax]
call fcn.00434300
lea rax, [0x004a24b2]
mov ebx, 0x19
call fcn.00434b80
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004348c0
lea rax, [0x004a2499]
mov ebx, 0x19
call fcn.00434b80
mov eax, dword [rsp + 0x34]
call fcn.004348c0
nop
call fcn.00434540
call fcn.00434360
lea rax, [0x0049fb99]
mov ebx, 0xd
call fcn.00432960
nop dword [rax + rax]
cmp eax, 0x5af
je 0x4143c0
call fcn.00434300
lea rax, [0x004a24b2]
mov ebx, 0x19
call fcn.00434b80
mov rax, qword [rsp + 0x38]
call fcn.004348c0
lea rax, [0x004a2499]
mov ebx, 0x19
call fcn.00434b80
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004348c0
call fcn.00434540
call fcn.00434360
lea rax, [0x004a3974]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00432960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ae20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00414260
Function at 0x41c200
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x005832f2], 0
jne 0x41c2e7
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x41c2da
lea rbx, [0x005556d8]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x41c2c0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.0045d0c0
lea rax, [0x004a5a52]
mov ebx, 0x2c
call fcn.00432960
nop
int3

Function at 0x41e5c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41e6c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x41e603
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x41e6bb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.0041f3a0
test rax, rax
je 0x41e6bb
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x0041e700]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0045ace0
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x41e6a9
xor eax, eax
jmp 0x41e6b3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x41e5f1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0045ae20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.0041e5c0
Function at 0x441420
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x441587
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x441432
cmp edx, ecx
jne 0x441575
nop word [rax + rax]
test rsi, rsi
jne 0x441575
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x441494
nop
call fcn.0045e900
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00441340
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x441570
mov rdx, qword [0x00530508]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x441565
mov rcx, qword [0x00530500]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00530f70]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00530f70], rax
nop
mov edx, 1
lea rsi, [0x00530f78]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x441553
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004a5297]
mov ebx, 0x28
nop
call fcn.00432960
mov rax, rsi
mov rcx, rdx
call fcn.0045d0a0
call fcn.00431000
lea rax, [0x004a4647]
mov ebx, 0x23
call fcn.00432960
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ae20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00441420
Function at 0x474020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4740ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403100
xorps xmm15, xmm15
mov r14, qword [0x00583508]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4740cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0048baa0]
xor ebx, ebx
mov rcx, rdx
call fcn.004454a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00474600
inc rbx
cmp rcx, rbx
jae 0x4740be
mov edi, 1
lea rsi, [0x0048baa0]
call fcn.00445580
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004bf138]
lea rsi, [0x004beac0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ae20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00474020
Function at 0x7ff6bcaa9190
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r12, rdx
lea rax, [r8 + 1]
mov rdi, rcx
mov rbx, r8
movabs rdx, 0x5851f42d4c957f2d
lea rsi, [rdi + 0x20]
movabs rcx, 0x8126b91cbf22495c
imul rax, rdx
lea rbp, [rdi + 0xc3e0]
movabs rdx, 0x810a978a59f5a1fc
lea r13, [rsp + 0x20]
xor rdx, rax
movq xmm0, rax
xor rcx, rax
movq xmm1, rdx
movq xmm2, rcx
movabs rdx, 0xa77099df38c2d846
movabs rcx, 0x9237efb9ceaaec0c
xor rdx, rax
punpcklqdq xmm0, xmm1
xor rcx, rax
movups xmmword [rsp + 0x20], xmm0
movq xmm0, rdx
movq xmm3, rcx
movabs rdx, 0x494d2597179f8a62
xor rdx, rax
punpcklqdq xmm0, xmm2
movabs rcx, 0x84853bf7b62ce54e
movups xmmword [rsp + 0x30], xmm0
movq xmm0, rdx
movabs rdx, 0x2f2a56746ce62d78
punpcklqdq xmm0, xmm3
xor rdx, rax
xor rax, rcx
movups xmmword [rsp + 0x40], xmm0
movq xmm4, rax
movq xmm0, rdx
punpcklqdq xmm0, xmm4
movups xmmword [rsp + 0x50], xmm0
nop
and ebx, 0x3fffff
mov rdx, rsi
mov rcx, r13
add rsi, 0x1878
shl rbx, 6
add rbx, qword [rdi]
prefetchnta byte [rbx]
call fcn.7ff6bcaab2d0
mov rax, qword [rbx]
xor qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
xor qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
xor qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x18]
xor qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x20]
xor qword [rsp + 0x40], rax
mov rax, qword [rbx + 0x28]
xor qword [rsp + 0x48], rax
mov rax, qword [rbx + 0x30]
xor qword [rsp + 0x50], rax
mov rax, qword [rbx + 0x38]
xor qword [rsp + 0x58], rax
movsxd rax, dword [rsi - 0x64]
mov rbx, qword [rsp + rax*8 + 0x20]
cmp rbp, rsi
jne 0x7ff6bcaa9270
movdqu xmm5, xmmword [r13]
movdqu xmm1, xmmword [r13 + 0x10]
movdqu xmm2, xmmword [r13 + 0x20]
mov rax, qword [r13 + 0x30]
mov rdx, qword [r13 + 0x38]
movups xmmword [r12], xmm5
mov qword [r12 + 0x30], rax
mov qword [r12 + 0x38], rdx
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12 + 0x20], xmm2
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x7ff6bcb84460
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9, rcx
test rcx, rcx
je 0x7ff6bcb844d0
movzx edx, byte [rcx]
xor eax, eax
test dl, dl
je 0x7ff6bcb844c4
xor r8d, r8d
mov r11d, 0x100
mov ebx, 0x20
movsx eax, dl
mov r10d, r8d
add r9, 1
or eax, r11d
add r11d, 0x100
mov edx, eax
shr edx, 2
xor edx, eax
imul eax, eax
and edx, 0xf
mov ecx, edx
shl r10d, cl
mov ecx, ebx
sub ecx, edx
movzx edx, byte [r9]
shr r8, cl
or r10d, r8d
xor eax, r10d
mov r8d, eax
test dl, dl
jne 0x7ff6bcb84480
shr eax, 0x10
xor eax, r8d
pop rbx
ret
xor eax, eax
pop rbx
ret

Function at 0x7ff6bcb84a60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
test rcx, rcx
je 0x7ff6bcb84ad8
movsx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x7ff6bcb84ac9
mov ebp, 0x100
xor ebx, ebx
mov esi, 0x20
nop dword [rax]
call fcn.7ff6bcb3ee60
mov r8d, ebx
add rdi, 1
or eax, ebp
add ebp, 0x100
mov edx, eax
shr edx, 2
xor edx, eax
imul eax, eax
and edx, 0xf
mov ecx, edx
shl r8d, cl
mov ecx, esi
sub ecx, edx
shr rbx, cl
movsx ecx, byte [rdi]
or r8d, ebx
xor eax, r8d
mov ebx, eax
test cl, cl
jne 0x7ff6bcb84a88
shr eax, 0x10
xor eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x7ff6bcc2b8c0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r13, rcx
mov r12, rdx
mov rcx, r8
mov edx, 4
mov rbx, r8
mov rsi, r9
call fcn.7ff6bcb324a0
test eax, eax
jne 0x7ff6bcc2b90a
mov edx, 4
mov rcx, r12
call fcn.7ff6bcb324a0
test eax, eax
je 0x7ff6bcc2b940
mov r9, rsi
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.7ff6bcc2aa50
mov edx, 4
mov rcx, rsi
call fcn.7ff6bcb324a0
test eax, eax
jne 0x7ff6bcc2b90a
mov r9, rsi
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.7ff6bcc2a200
Function at 0x7ff6bcc446b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x7ff6bd171a20]
test eax, eax
je 0x7ff6bcc446e0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [0x7ff6bd1719c0]
mov r8d, 0x30
mov dword [0x7ff6bd171a20], 1
lea rcx, [0x7ff6bd04efb0]
mov rdx, rbx
call qword [0x7ff6bd47e3cc]
sub eax, 1
cmp eax, 0x2e
ja 0x7ff6bcc448c0
movzx ebp, word [0x7ff6bd1719c0]
xor eax, eax
mov esi, 0xa
cmp bp, 0x7e
sete al
lea rbx, [rbx + rax*2]
cmp word [rbx], 0x30
je 0x7ff6bcc44920
xor r13d, r13d
mov edi, esi
jmp 0x7ff6bcc44750
sub r12d, 0x30
cmp esi, r12d
jbe 0x7ff6bcc4477e
imul r13, rdi
add r13, r12
movzx r12d, word [rbx]
mov edx, 4
add rbx, 2
mov ecx, r12d
call fcn.7ff6bcb3ee40
test eax, eax
jne 0x7ff6bcc44740
mov edx, 0x10
mov ecx, r12d
call fcn.7ff6bcb3ee40
test eax, eax
jne 0x7ff6bcc44880
cmp bp, 0x7e
je 0x7ff6bcc448d8
movzx r15d, word [0x7ff6bd1719c0]
mov rbp, qword [0x7ff6bd0d2cc0]
cmp r15w, 0x3a
je 0x7ff6bcc44958
test r15w, r15w
je 0x7ff6bcc448b0
lea rax, [0x7ff6bd1719c0]
jmp 0x7ff6bcc447c6
add rax, 2
test r15w, r15w
je 0x7ff6bcc448b0
mov edx, r15d
movzx r15d, word [rax + 2]
cmp dx, 0x3a
jne 0x7ff6bcc447b8
xor edx, edx
cmp r15w, 0x7e
sete dl
lea rbx, [rax + rdx*2 + 2]
cmp word [rbx], 0x30
je 0x7ff6bcc44990
mov esi, 0xa
xor r14d, r14d
mov edi, esi
jmp 0x7ff6bcc44810
sub r12d, 0x30
cmp esi, r12d
jbe 0x7ff6bcc4483a
imul r14, rdi
add r14, r12
movzx r12d, word [rbx]
mov edx, 4
add rbx, 2
mov ecx, r12d
call fcn.7ff6bcb3ee40
test eax, eax
jne 0x7ff6bcc44800
mov edx, 0x10
mov ecx, r12d
call fcn.7ff6bcb3ee40
test eax, eax
jne 0x7ff6bcc44898
movq xmm0, qword [0x7ff6bd04f138]
movq xmm2, r14
pxor xmm0, xmm2
cmp r15w, 0x7e
je 0x7ff6bcc44940
mov qword [rbp + 8], r14
mov eax, r13d
shr r13, 0x20
or ah, 4
movd xmm3, r13d
movd xmm0, eax
punpckldq xmm0, xmm3
movq qword [rbp], xmm0
jmp 0x7ff6bcc446ca
mov ecx, r12d
call fcn.7ff6bcb3ee60
lea r12d, [rax - 0x57]
jmp 0x7ff6bcc44744
mov ecx, r12d
call fcn.7ff6bcb3ee60
lea r12d, [rax - 0x57]
jmp 0x7ff6bcc44804
mov qword [rbp + 8], 0
jmp 0x7ff6bcc4485a
mov rbp, qword [0x7ff6bd0d2cc0]
mov rcx, rbp
call fcn.7ff6bcc046a0
mov r13, rax
jmp 0x7ff6bcc4485a
mov rbp, qword [0x7ff6bd0d2cc0]
mov rcx, rbp
call fcn.7ff6bcc046a0
mov r8, rax
mov rax, r13
not rax
and rax, r8
test r13d, 0x1000000
je 0x7ff6bcc44970
movabs r13, 0xedfff7fdffffffff
movzx r15d, word [0x7ff6bd1719c0]
and r13, rax
jmp 0x7ff6bcc447a2
movzx ecx, word [rbx + 2]
call fcn.7ff6bcb3ee60
cmp eax, 0x78
je 0x7ff6bcc44980
add rbx, 2
mov esi, 8
jmp 0x7ff6bcc44736
movq xmm1, qword [rbp + 8]
pand xmm1, xmm0
movq qword [rbp + 8], xmm1
jmp 0x7ff6bcc4485a
mov rcx, rbp
call fcn.7ff6bcc046a0
movzx r15d, word [0x7ff6bd1719c0]
mov r13, rax
jmp 0x7ff6bcc447a2
movzx r15d, word [0x7ff6bd1719c0]
mov r13, rax
jmp 0x7ff6bcc447a2
add rbx, 4
mov esi, 0x10
jmp 0x7ff6bcc44736
movzx ecx, word [rbx + 2]
call fcn.7ff6bcb3ee60
cmp eax, 0x78
je 0x7ff6bcc449ac
add rbx, 2
mov esi, 8
jmp 0x7ff6bcc447f2
add rbx, 4
mov esi, 0x10
jmp 0x7ff6bcc447f2
Function at 0x7ff6bcc95060
Capabilities:
Encode data using base64

Disassembly:
push r12
lea r11, [0x7ff6bd05f4e0]
mov r10, rdx
test rcx, rcx
je 0x7ff6bcc95080
test byte [rcx + 0x5c], 2
lea rax, [0x7ff6bd05f480]
cmovne r11, rax
xor r12d, r12d
test r9d, r9d
jg 0x7ff6bcc950e5
jmp 0x7ff6bcc95125
movzx eax, byte [r8 + 1]
add r8, 3
shl eax, 8
or eax, edx
movzx edx, byte [r8 - 1]
mov ecx, eax
shr ecx, 0x12
or edx, eax
shr eax, 0xc
movzx ecx, byte [r11 + rcx]
and eax, 0x3f
mov byte [r10 - 4], cl
movzx eax, byte [r11 + rax]
mov byte [r10 - 3], al
mov eax, edx
and edx, 0x3f
shr eax, 6
and eax, 0x3f
movzx eax, byte [r11 + rax]
mov byte [r10 - 2], al
movzx eax, byte [r11 + rdx]
mov byte [r10 - 1], al
sub r9d, 3
je 0x7ff6bcc95125
movzx edx, byte [r8]
mov rcx, r10
add r12d, 4
add r10, 4
shl edx, 0x10
cmp r9d, 2
jg 0x7ff6bcc95090
je 0x7ff6bcc95130
mov eax, edx
shr edx, 0xc
shr eax, 0x12
and edx, 0x30
movzx eax, byte [r11 + rax]
mov byte [rcx], al
movzx eax, byte [r11 + rdx]
mov byte [rcx + 1], al
mov eax, 0x3d
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
mov eax, r12d
mov byte [r10], 0
pop r12
ret
movzx eax, byte [r8 + 1]
shl eax, 8
or eax, edx
shr edx, 0x12
movzx edx, byte [r11 + rdx]
mov byte [rcx], dl
mov edx, eax
shr eax, 6
shr edx, 0xc
and eax, 0x3c
and edx, 0x3f
movzx edx, byte [r11 + rdx]
mov byte [rcx + 1], dl
movzx eax, byte [r11 + rax]
jmp 0x7ff6bcc9511e
Function at 0x7ff6bcd31140
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x820
mov rbp, rcx
mov rbx, rdx
test rcx, rcx
je 0x7ff6bcd312f3
test rdx, rdx
je 0x7ff6bcd312f3
mov r10, qword [rcx]
test r10, r10
je 0x7ff6bcd312f3
mov eax, dword [rdx + 0x18]
mov r11, qword [rdx]
lea r12, [rsp + 0x20]
mov ecx, pe_nt_image_headers64
mov rdi, r12
mov r9, rax
shl rax, 0xa
lea rsi, [r11 + rax - 0x400]
rep movsq qword [rdi], qword [rsi]
mov esi, dword [rdx + 0x1c]
cmp esi, 1
jbe 0x7ff6bcd31249
cmp esi, 3
jbe 0x7ff6bcd31305
lea eax, [rsi - 4]
lea r13d, [r9 + r9 - 1]
mov edi, 3
and eax, 0xfffffffe
lea r14d, [rax + 5]
mov r8d, r13d
lea ecx, [r13 + r9]
mov rax, r12
xor edx, edx
shl r8, 0xa
mov r13, rcx
shl rcx, 0xa
add r8, r11
add rcx, r11
nop dword [rax]
movdqu xmm0, xmmword [r8 + rdx]
movdqu xmm1, xmmword [r8 + rdx + 0x10]
add rax, 0x20
pxor xmm0, xmmword [rax - 0x20]
pxor xmm1, xmmword [rax - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
movdqu xmm2, xmmword [rcx + rdx + 0x10]
movdqu xmm3, xmmword [rcx + rdx]
add rdx, 0x20
pxor xmm1, xmm2
pxor xmm0, xmm3
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
cmp rdx, 0x400
jne 0x7ff6bcd311e8
lea eax, [rdi + 2]
add r13d, r9d
cmp eax, r14d
je 0x7ff6bcd3130a
mov edi, eax
jmp 0x7ff6bcd311c3
lea r8, [rsp + 0x420]
mov rdi, r8
mov ecx, pe_nt_image_headers64
mov rsi, r12
mov edx, dword [rbp + 8]
rep movsq qword [rdi], qword [rsi]
mov r9d, 0x400
mov rcx, r10
lea r13, [rsp + 0x420]
mov r8, r13
call fcn.7ff6bcd34530
mov r9d, dword [0x7ff6bd3fbd90]
test r9d, r9d
je 0x7ff6bcd312ad
mov edx, 0x400
mov rcx, r12
call fcn.7ff6bcd30d80
mov r8d, dword [0x7ff6bd3fbd90]
test r8d, r8d
je 0x7ff6bcd312ad
mov edx, 0x400
mov rcx, r13
call fcn.7ff6bcd30d80
mov ecx, dword [rbx + 0x28]
test ecx, ecx
jne 0x7ff6bcd31359
mov r12d, dword [rbx + 0x10]
mov edx, dword [0x7ff6bd3fbd90]
mov rcx, qword [rbx]
shl r12d, 0xa
test edx, edx
je 0x7ff6bcd312da
test rcx, rcx
je 0x7ff6bcd312da
mov rdx, r12
call fcn.7ff6bcd30d80
mov eax, dword [rbx + 0x2c]
test eax, eax
jne 0x7ff6bcd312f3
mov rax, qword [rbp + 0x68]
mov rcx, qword [rbx]
test rax, rax
je 0x7ff6bcd3136a
mov rdx, r12
call rax
nop
add rsp, 0x820
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, 1
add edi, 1
lea r8, [rsp + 0x420]
mov ecx, edi
imul ecx, r9d
sub ecx, 1
mov edx, ecx
mov rax, r12
shl rdx, 0xa
add rdx, r11
nop word [rax + rax]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmmword [rax]
add rax, 0x10
add rdx, 0x10
movups xmmword [rax - 0x10], xmm0
cmp r8, rax
jne 0x7ff6bcd31330
add ecx, r9d
cmp esi, edi
jbe 0x7ff6bcd31251
add edi, 1
jmp 0x7ff6bcd3131e
mov edx, dword [rbp + 8]
mov rcx, qword [rbp]
call fcn.7ff6bcd32870
jmp 0x7ff6bcd312b8
call fcn.7ff6bcdbd6e0
jmp 0x7ff6bcd312f3
Function at 0x7ff6bcd34260
Capabilities:
Hash data using sha512

Disassembly:
pxor xmm0, xmm0
movabs r8, 0xbb67ae8584caa73b
movabs r9, 0x3c6ef372fe94f82b
movabs r10, 0xa54ff53a5f1d36f1
movabs rax, 0x6a09e667f3bcc908
movabs r11, 0x510e527fade682d1
or rdx, 0x1010000
mov qword [rcx + 8], r8
movabs r8, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x10], r9
xor rdx, rax
movabs r9, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x18], r10
movabs r10, 0x5be0cd19137e2179
mov qword [rcx + 0x20], r11
mov qword [rcx + 0x28], r8
mov qword [rcx + 0x30], r9
mov qword [rcx + 0x38], r10
mov qword [rcx + 0xd0], 0
mov qword [rcx], rdx
movups xmmword [rcx + 0x40], xmm0
ret
Function at 0x7ff6bcdadd00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x7ff6bd0d4720]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x7ff6bcdadd20
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x7ff6bcdadd28
ret
cmp word [r8 + 0x18], 0x20b
jne 0x7ff6bcdadd20
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x7ff6bcdadd75
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x7ff6bcdadd6c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x7ff6bcdadd20
add rax, 0x28
cmp rax, r9
jne 0x7ff6bcdadd58
xor eax, eax
ret

Function at 0x7ff6bcdadd80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x7ff6bd0d4720]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x7ff6bcdadda0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x7ff6bcdadda8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x7ff6bcdadda0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x7ff6bcdade30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x7ff6bd0d4720]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x7ff6bcdade50
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x7ff6bcdade58
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x7ff6bcf62340
Capabilities:
Parse credit card information

Disassembly:
mov rax, qword [rcx + 0xb8]
cmp qword [rcx + 0xb0], rax
je 0x7ff6bcf62380
mov eax, dword [rcx + 0x88]
test eax, eax
je 0x7ff6bcf62368
cmp eax, 2
je 0x7ff6bcf62370
cmp eax, 1
je 0x7ff6bcf62378
ret
jmp fcn.7ff6bcf624e0
jmp fcn.7ff6bcf63500
jmp fcn.7ff6bcf62900
mov dword [rcx + 0x90], 0x1b
ret