joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bc90
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001bede
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140051e30]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001bea6
mov rcx, rbp
call fcn.14001b2c0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001bd61
movsxd rdx, dword [rbp + 0x3268]
mov r8, qword [rbp + 0x3270]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001bd51
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001bd49
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001bd4c
mov rdx, rcx
test rdx, rdx
jne 0x14001bd20
cmp r8, r10
je 0x14001bd61
cmp dword [r8], r9d
jne 0x14001bd61
mov rcx, qword [r8 + 8]
jmp 0x14001bd63
xor ecx, ecx
mov qword [rbx + 0x18], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xbc]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xbc], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test rcx, rcx
je 0x14001bdf7
cmp qword [rcx + 0x20], 0
jne 0x14001bdec
mov qword [rcx + 0x20], rbx
jmp 0x14001bdf7
cmp qword [rcx + 0x28], 0
jne 0x14001bdf7
mov qword [rcx + 0x28], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb4], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 6]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14001be3c
nop word [rax + rax]
mov r9, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14001be30
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140003150
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001be98
cmp r9b, 0x23
jne 0x14001be7b
cmp byte [r8], r9b
jne 0x14001be7b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001be68
not ecx
call fcn.14000b6a0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001bce0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14004e7f0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14004c420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x14004c460
cmp al, 0x25
jne 0x14004c454
cmp byte [r8 + 1], al
jne 0x14004c460
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x14004c447
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14004c5be
cmp byte [r8 + 1], dl
je 0x14004c5be
lea r11, [rsp + 0x28]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14004c49d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14004c4c5
sub dl, 0x61
cmp dl, 0x19
ja 0x14004c4b7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14004c4c5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14004c480
jmp 0x14004c4c8
inc r9
cmp r8, r9
jae 0x14004c4ff
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14004c4f4
bt rdx, rax
jb 0x14004c4fa
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14004c4e0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x28]
mov edx, 0x40
lea rcx, [rsp + 0x50]
movq r9, xmm3
call fcn.140003150
cmp byte [rsp + 0x50], 0x20
lea rcx, [rsp + 0x50]
jne 0x14004c538
nop
inc rcx
cmp byte [rcx], 0x20
je 0x14004c530
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14004c5ac
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x14004c558
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x14004c59a
movss xmm2, dword [0x1400563dc]
cmp al, 0x39
ja 0x14004c59a
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14004c574
cmp r8b, 0x2d
jne 0x14004c5b9
xorps xmm1, xmmword [0x1400568c0]
movaps xmm0, xmm1
jmp 0x14004c5c1
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14004c5c1
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14004e7f0
add rsp, 0xa0
pop rbx
ret
Function at 0x14004c5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x14004c620
cmp al, 0x25
jne 0x14004c614
cmp byte [r8 + 1], al
jne 0x14004c620
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x14004c607
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14004c778
cmp byte [r8 + 1], dl
je 0x14004c778
lea r11, [rsp + 0x28]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14004c65d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14004c685
sub dl, 0x61
cmp dl, 0x19
ja 0x14004c677
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14004c685
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14004c640
jmp 0x14004c688
inc r9
cmp r8, r9
jae 0x14004c6bf
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14004c6b4
bt rdx, rax
jb 0x14004c6ba
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14004c6a0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x28]
mov edx, 0x40
lea rcx, [rsp + 0x50]
call fcn.140003150
cmp byte [rsp + 0x50], 0x20
lea rcx, [rsp + 0x50]
jne 0x14004c6f8
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14004c6f0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14004c76a
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x14004c718
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x14004c758
movsd xmm2, qword [0x140056378]
cmp al, 0x39
ja 0x14004c758
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14004c734
cmp r8b, 0x2d
jne 0x14004c773
xorps xmm1, xmmword [0x1400568b0]
movaps xmm0, xmm1
jmp 0x14004c77b
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14004c77b
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14004e7f0
add rsp, 0xa0
pop rbx
ret

Function at 0x14004ca40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14005f040]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rdi, ecx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [rsp + 0x20]
imul qword [rsp + 0x28]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
mov qword [rsp + 0x20], 0
idiv qword [rsp + 0x28]
add rdi, rax
test rdi, rdi
jle 0x14004cad2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, rdi
jl 0x14004cab1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004e7f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14004f518
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004f562
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004f562
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004f562
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004f562
cmp dword [rcx + 0x84], 0xe
jbe 0x14004f562
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004f564
xor al, al
add rsp, 0x28
ret
Function at 0x180027ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
and r10d, 7
je 0x180027cd1
cmp eax, r10d
jge 0x180027cbf
call fcn.1800217a0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov dword [rbx + 0x14], eax
mov eax, dword [rbx + 0x10]
xor r8d, r8d
mov r9d, eax
test eax, eax
jle 0x180027d12
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r10d, cl
nop word [rax + rax]
shr ecx, 8
lea eax, [r9 - 8]
mov byte [rdx], r10b
lea rdx, [rdx + 1]
inc r8d
mov dword [rbx + 0x14], ecx
mov r9d, eax
movzx r10d, cl
test eax, eax
jg 0x180027cf0
mov dword [rbx + 0x10], eax
jns 0x180027d3f
mov edx, dword [0x1800b4280]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.Corrupt_PNG
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x180027d72
mov r8, qword [rbx + 8]
nop dword [rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x180027d5c
xor dl, dl
jmp 0x180027d65
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x180027d50
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180027d14
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x180027de7
mov edx, dword [0x1800b4280]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.Corrupt_PNG
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x180027e01
mov rcx, rbx
call fcn.18002d0d0
test eax, eax
je 0x180027dda
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.180082150
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180046010
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov rbx, rcx
call fcn.180045fe0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x180046280
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
cmp eax, 0x270
jne 0x180046299
call fcn.180046530
jmp 0x1800462a5
cmp eax, 0x4e0
jb 0x1800462a5
call fcn.180046440
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
jmp 0x180046280
mov rcx, qword [rcx]
jmp 0x1800462f0

Function at 0x180046400
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
cmp eax, 0x270
jne 0x180046299
call fcn.180046530
jmp 0x1800462a5
cmp eax, 0x4e0
jb 0x1800462a5
call fcn.180046440
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
jmp 0x180046280
mov rcx, qword [rcx]
jmp 0x1800462f0

Function at 0x180046440
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
nop word [rax + rax]
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180046460
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1800464b0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
mov dword [r9], ebx
mov rbx, qword [rsp + 8]
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x180046530
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea rax, [rcx + 8]
mov r9d, 0x270
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x180046540
ret

Function at 0x180046580
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11, rcx
test r9, r9
je 0x180046665
cmp r9, 0x40
jb 0x180046643
movsx eax, byte [rcx]
lea rcx, [rdx - 1]
add rcx, r9
movd xmm2, eax
lea rax, [r8 - 1]
punpcklbw xmm2, xmm2
add rax, r9
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
cmp rdx, rax
ja 0x1800465cd
cmp rcx, r8
jae 0x180046643
cmp rdx, r11
ja 0x1800465d7
cmp rcx, r11
jae 0x180046643
mov rcx, r9
mov qword [rsp + 0x10], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rbx, r8
lea rax, [rdx + 0x10]
sub rbx, rdx
movdqu xmm0, xmmword [rbx + rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rbx + rax]
lea rax, [rax + 0x40]
xorps xmm0, xmm2
xorps xmm1, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rbx + rax - 0x30]
movdqu xmmword [rax - 0x40], xmm1
xorps xmm0, xmm2
movdqu xmm1, xmmword [rbx + rax - 0x20]
movdqu xmmword [rax - 0x30], xmm0
xorps xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp r10, rcx
jb 0x1800465f1
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r10, r9
jae 0x180046665
sub r8, rdx
lea rax, [r10 + rdx]
sub r9, r10
nop dword [rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor cl, byte [r11]
mov byte [rax - 1], cl
sub r9, 1
jne 0x180046650
add rsp, 8
ret

Function at 0x180046a00
Capabilities:
Encode data using xor

Disassembly:
mov dword [rcx + 4], edx
lea r10, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r9d, edx
lea r10, [r10 + 4]
shr r9d, 0x1e
xor edx, r9d
imul edx, r8d
add edx, eax
inc rax
mov dword [r10 - 4], edx
cmp rax, 0x270
jb 0x180046a10
mov dword [rcx], 0x270
ret

Function at 0x18004bab0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret
Function at 0x18004ece0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x18004ee98
cmp ecx, 0x7c
je 0x18004ee98
cmp ecx, 0x29
jne 0x18004ed28
cmp dword [rbx + 0x1c], 0
jne 0x18004ee98
test dword [rbx + 0x80], 0x10000000
je 0x18004eeb1
jmp 0x18004ee68
cmp ecx, 0x2e
jne 0x18004ed3b
lea rcx, [rbx + 0x40]
call fcn.18004e600
jmp 0x18004ee75
cmp ecx, 0x5c
jne 0x18004ed9f
mov rcx, rbx
call fcn.180051c80
test byte [rbx + 0x80], 0x80
je 0x18004ed92
movzx eax, byte [rbx + 0x78]
cmp al, 0x62
jne 0x18004ed6f
lea rcx, [rbx + 0x40]
call fcn.18004ec80
mov rcx, rbx
call fcn.180051c80
jmp 0x18004ee85
cmp al, 0x42
jne 0x18004ed92
lea rcx, [rbx + 0x40]
call fcn.18004ec80
lea rcx, [rbx + 0x40]
call fcn.180051c00
mov rcx, rbx
call fcn.180051c80
jmp 0x18004ee85
mov rcx, rbx
call fcn.18004ef30
jmp 0x18004ee7d
cmp ecx, 0x5b
jne 0x18004edcc
mov rcx, rbx
call fcn.180051c80
mov rcx, rbx
call fcn.18004fa70
mov edx, 0x5d
mov r8d, 4
mov rcx, rbx
call fcn.180050f70
jmp 0x18004ee7d
cmp ecx, 0x28
jne 0x18004ee02
mov rcx, rbx
call fcn.180051c80
mov rcx, rbx
call fcn.1800526a0
mov edx, 0x29
mov r8d, 5
mov rcx, rbx
movzx edi, al
call fcn.180050f70
test dil, dil
je 0x18004ee85
jmp 0x18004ee7d
cmp ecx, 0x5e
jne 0x18004ee1a
lea rcx, [rbx + 0x40]
call fcn.18004e390
mov rcx, rbx
call fcn.180051c80
jmp 0x18004ee85
cmp ecx, 0x24
jne 0x18004ee32
lea rcx, [rbx + 0x40]
call fcn.18004e6b0
mov rcx, rbx
call fcn.180051c80
jmp 0x18004ee85
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x18004eea3
cmp ecx, 0x3f
je 0x18004eea3
cmp ecx, 0x7b
je 0x18004eea3
cmp ecx, 0x7d
jne 0x18004ee57
test dword [rbx + 0x80], 0x10000000
je 0x18004eebf
jmp 0x18004ee68
cmp ecx, 0x5d
jne 0x18004ee68
test dword [rbx + 0x80], 0x10000000
je 0x18004eecd
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.18004e3a0
mov rcx, rbx
call fcn.180051c80
mov rcx, rbx
call fcn.180051d30
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
je 0x18004ee98
cmp ecx, 0x7c
jne 0x18004ed04
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.180050f20
int3
mov edx, 5
mov rcx, rbx
call fcn.180050f20
int3
mov edx, 6
mov rcx, rbx
call fcn.180050f20
int3
mov edx, 4
mov rcx, rbx
call fcn.180050f20
int3
Function at 0x180057000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x180057011
mov ecx, edx
jmp 0x18005705a
mov ecx, 1
call fcn.180057110
mov rcx, rax
call fcn.180057080
mov rcx, rax
mov rdx, rbx
call 0x180057210
test rax, rax
jne 0x180057077
mov ecx, 3
call fcn.180057110
mov rcx, rax
call fcn.180057080
mov rcx, rax
mov rdx, rbx
call 0x180057210
test rax, rax
jne 0x180057077
mov ecx, 2
call fcn.180057110
mov rcx, rax
call fcn.180057080
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x180057210
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r12, rcx
add r13, rcx
cmp rdx, 0xffff
ja 0x18005726f
sub bp, word [rdi + 0x10]
movzx eax, bp
cmp eax, dword [rdi + 0x14]
jae 0x18005729a
movzx eax, bp
mov eax, dword [r12 + rax*4]
add rax, rcx
jmp 0x18005729c
mov r15d, dword [rdi + 0x20]
xor ebx, ebx
add r15, rsi
cmp dword [rdi + 0x18], ebx
jbe 0x18005729a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, rbp
add rdx, rsi
call 0x180058f00
test eax, eax
je 0x1800572b9
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x180057280
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rsi
jmp 0x18005729c

Function at 0x1800571b0
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x1800571ce
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x1800571d2
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret
Function at 0x180057210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x180057011
mov ecx, edx
jmp 0x18005705a
mov ecx, 1
call fcn.180057110
mov rcx, rax
call fcn.180057080
mov rcx, rax
mov rdx, rbx
call 0x180057210
test rax, rax
jne 0x180057077
mov ecx, 3
call fcn.180057110
mov rcx, rax
call fcn.180057080
mov rcx, rax
mov rdx, rbx
call 0x180057210
test rax, rax
jne 0x180057077
mov ecx, 2
call fcn.180057110
mov rcx, rax
call fcn.180057080
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x180057210
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r12, rcx
add r13, rcx
cmp rdx, 0xffff
ja 0x18005726f
sub bp, word [rdi + 0x10]
movzx eax, bp
cmp eax, dword [rdi + 0x14]
jae 0x18005729a
movzx eax, bp
mov eax, dword [r12 + rax*4]
add rax, rcx
jmp 0x18005729c
mov r15d, dword [rdi + 0x20]
xor ebx, ebx
add r15, rsi
cmp dword [rdi + 0x18], ebx
jbe 0x18005729a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, rbp
add rdx, rsi
call 0x180058f00
test eax, eax
je 0x1800572b9
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x180057280
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rsi
jmp 0x18005729c

Function at 0x1800572d0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x180057314
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x1800572ff
mov rax, qword [rax]
test rax, rax
jne 0x1800572f0
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret

Function at 0x180058df0
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 8
movzx r11d, byte [rcx]
xor r10d, r10d
mov r8d, r10d
mov r9d, r10d
cmp r11b, 0xcc
je 0x180058e34
mov qword [rsp], rbx
mov ebx, r10d
nop
cmp r11b, byte [rbx + rdx]
lea eax, [r8 + 1]
cmovne eax, r8d
inc r9d
mov r8d, eax
mov ebx, r9d
movzx r11d, byte [r9 + rcx]
cmp r11b, 0xcc
jne 0x180058e10
mov rbx, qword [rsp]
cmp r8d, r9d
sete r10b
mov eax, r10d
add rsp, 8
ret