joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e7afc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400e9a1c
nop
cmp dword [0x14014c1f8], 1
je 0x1400e7aa8
mov dword [0x14014c1f4], 1
mov byte [0x14014c1f0], r12b
test ebx, ebx
jne 0x1400e7a94
mov rcx, qword [0x14014e110]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400e7a81
mov rcx, qword [0x14014e108]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400e7a20
call fcn.1400e7df4
cmp qword [rdi], rax
jne 0x1400e7a20
jmp 0x1400e7a06
cmp rdi, rsi
jb 0x1400e7a81
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400e7df4
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14014e110]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14014e108]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400e7a5f
cmp r13, rax
je 0x1400e7a7f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400e7a06
lea rdx, [0x140105e30]
lea rcx, [0x140105e18]
call fcn.1400e7850
lea rdx, [0x140105e40]
lea rcx, [0x140105e38]
call fcn.1400e7850
nop
test r12d, r12d
je 0x1400e7ab7
mov ecx, 8
call fcn.1400e991c
test r12d, r12d
jne 0x1400e7ae2
mov dword [0x14014c1f8], 1
lea ecx, [r12 + 8]
call fcn.1400e991c
mov ecx, r15d
call fcn.1400e77e4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400e7970

Function at 0x1400e7b08
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400e7970
Function at 0x1400ebff7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401423c0]
jne 0x1400e28aa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400e28a6
repz ret
ror rcx, 0x10
jmp 0x1400ebf50
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14014c550]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14014c648]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400ebfd5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14014c550]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400ebff7
mov rax, qword [rsp + 0x88]
mov qword [0x14014c648], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14014c5e8], rax
mov rax, qword [0x14014c648]
mov qword [0x14014c4c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14014c5d0], rax
mov dword [0x14014c4b0], 0xc0000409
mov dword [0x14014c4b4], 1
mov rax, qword [0x1401423c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401423c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14014c548], eax
mov ecx, 1
call fcn.1400f03a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14010ef50]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14014c548], 0
jne 0x1400ec07e
mov ecx, 1
call fcn.1400f03a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400f7ea4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400e7df4
xor ebx, ebx
mov rdi, rax
cmp qword [0x14014cff0], rbx
jne 0x1400f7faa
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400f807f
lea rdx, [0x1401114e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400f807f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14014cff0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1401114b8]
mov rcx, rsi
mov qword [0x14014cff8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14014d000], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14014d010], rax
test rax, rax
je 0x1400f7fa1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14014d008], rax
jmp 0x1400f7fb1
mov rax, qword [0x14014d008]
jmp 0x1400f7fb8
mov rax, qword [0x14014d008]
mov r11, qword [0x14014d010]
cmp rax, rdi
je 0x1400f8020
cmp r11, rdi
je 0x1400f8020
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14014d010]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400f8020
test rax, rax
je 0x1400f8020
call rsi
test rax, rax
je 0x1400f801a
lea rcx, [rsp + 0x88]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400f801a
test byte [rsp + 0x38], 1
jne 0x1400f8020
bts ebp, 0x15
jmp 0x1400f805e
mov rcx, qword [0x14014cff8]
cmp rcx, rdi
je 0x1400f805e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f805e
call rax
mov rbx, rax
test rax, rax
je 0x1400f805e
mov rcx, qword [0x14014d000]
cmp rcx, rdi
je 0x1400f805e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f805e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14014cff0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f807f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400f8081
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18001d1ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor edx, edx
mov rsi, rcx
call fcn.180031e70
mov edx, 0xfa
lea r15, [rsi + 0x18]
mov ecx, 0x20
call fcn.1800403bc
mov edx, eax
xor r8d, r8d
mov rcx, r15
call fcn.1800326f0
mov rcx, r15
call fcn.180032844
mov r14d, eax
lea rdx, [rbp + 0x20]
mov r8d, 1
mov byte [rbp + 0x20], r14b
mov rcx, rsi
call fcn.180031fbc
mov edx, r14d
lea rcx, [rbp - 0x18]
call fcn.180031e70
xor r8d, r8d
lea rcx, [rbp - 0x30]
mov edx, r14d
call fcn.1800326f0
xor edi, edi
test r14d, r14d
jle 0x18001d264
mov edx, edi
mov rcx, r15
call fcn.180031fb0
mov edx, edi
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.180031fb0
mov bl, byte [rbx]
lea rcx, [rbp - 0x18]
mov edx, edi
xor bl, byte [rax]
call fcn.180031fb0
inc edi
mov byte [rax], bl
cmp edi, r14d
jl 0x18001d234
lea rcx, [rbp - 0x18]
call fcn.180032844
xor edx, edx
lea rcx, [rbp - 0x18]
mov ebx, eax
call fcn.180031fb0
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.180031fbc
lea rcx, [rbp - 0x30]
call fcn.180032844
xor edx, edx
lea rcx, [rbp - 0x30]
mov ebx, eax
call fcn.180031fb0
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.180031fbc
lea rcx, [rbp - 0x30]
call fcn.180031efc
lea rcx, [rbp - 0x18]
call fcn.180031efc
lea r11, [rsp + 0x50]
mov rax, rsi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180032374
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
movsxd rcx, dword [rcx + 0x10]
add rcx, qword [rax + 8]
mov edx, dword [rax]
jmp fcn.18003f0c0

Function at 0x180033550
Capabilities:
Hash data with crc32

Disassembly:
xor eax, eax
mov r8, rcx
mov rdx, rcx
test rcx, rcx
je 0x18003357a
mov ecx, eax
mov r9d, 0x7fffffff
cmp byte [rdx], al
je 0x180033578
inc ecx
inc rdx
cmp ecx, r9d
jl 0x180033565
mov eax, r9d
jmp 0x18003357a
mov eax, ecx
mov edx, eax
mov rcx, r8
jmp fcn.18003f0c0

Function at 0x1800385d0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
cmp edx, 0xb28a2f38
je 0x180038672
cmp edx, 0xfab0797
jne 0x18003861e
mov rax, qword gs:[0x30]
xor r8d, r8d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, rbx
mov rdx, qword [rax + 0x10]
mov rdx, qword [rdx + 0x60]
call fcn.18003291c
jmp 0x180038679
xor edi, edi
mov rax, qword [0x180064378]
jmp 0x180038653
xor edx, edx
lea rcx, [rax + 0x10]
xor r8d, r8d
cmp qword [rcx + 8], 0
je 0x18003864c
cmp dword [rcx], esi
je 0x18003868c
inc edx
inc r8
add rcx, 0x20
cmp r8, 0x10
jl 0x180038632
mov rax, qword [rax + 0x200]
test rax, rax
jne 0x180038629
test edi, edi
jne 0x180038668
mov ecx, esi
call fcn.1800382d0
test rax, rax
je 0x18003866f
inc edi
cmp edi, 2
jl 0x180038620
mov rcx, rbx
xor edx, edx
call fcn.1800328fc
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movsxd rdx, edx
mov rcx, rbx
shl rdx, 5
add rdx, rax
call fcn.1800328d4
jmp 0x180038679
Function at 0x180039110
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x180039140
xor eax, eax
jmp 0x1800391f0
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
cmp dword [rbx], 0x4550
jne 0x180039139
movzx eax, word [rbx + 0x14]
lea r15, [rbx + 0x18]
xor edx, edx
lea rcx, [rsp + 0x20]
add r15, rax
call fcn.180032894
movzx r13d, word [rbx + 6]
xor edi, edi
mov esi, edi
mov r12d, edi
test r13, r13
je 0x1800391e3
mov rbx, r15
mov rbp, r15
neg rbx
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x18003918d
mov byte [rax], dil
mov r14, rbp
cmp byte [r14], dil
je 0x1800391af
mov dl, byte [r14]
lea rcx, [rsp + 0x20]
call fcn.180033298
inc r14
lea rax, [rbx + r14]
cmp rax, 8
jl 0x180039190
mov rcx, qword [rsp + 0x20]
call fcn.180033550
xor eax, 0xd2bac0a9
cmp eax, dword [rsp + 0x68]
je 0x1800391d8
inc esi
inc r12
add rbp, 0x28
sub rbx, 0x28
cmp r12, r13
jl 0x180039180
jmp 0x1800391e3
movsxd rax, esi
lea rcx, [rax + rax*4]
lea rdi, [r15 + rcx*8]
lea rcx, [rsp + 0x20]
call fcn.180032a74
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18003f0c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x420
or ebx, 0xffffffff
movsxd rsi, edx
xor edi, edi
mov rbp, rcx
cmp byte [0x180064678], dil
jne 0x18003f1ab
mov edx, 0x736e99dd
mov ecx, 0xfab0797
call fcn.180038c24
test rax, rax
je 0x18003f151
mov ecx, 0x400
call fcn.1800314c8
mov r8, rax
mov qword [0x180064670], rax
mov edx, edi
mov ecx, edx
mov r9d, 8
test cl, 1
je 0x18003f130
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x18003f132
shr ecx, 1
sub r9, 1
jne 0x18003f121
mov dword [rax], ecx
inc edx
add rax, 4
cmp edx, 0xff
jle 0x18003f119
mov byte [0x180064678], 1
jmp 0x18003f1b2
mov ecx, edi
lea rdx, [rsp + 0x20]
mov eax, ecx
mov r8d, 8
test al, 1
je 0x18003f16d
shr eax, 1
xor eax, 0xedb88320
jmp 0x18003f16f
shr eax, 1
sub r8, 1
jne 0x18003f160
mov dword [rdx], eax
inc ecx
add rdx, 4
cmp ecx, 0xff
jle 0x18003f158
test rsi, rsi
jle 0x18003f1d6
movzx ecx, byte [rdi + rbp]
mov eax, ebx
xor rcx, rax
inc rdi
movzx eax, cl
mov ecx, ebx
shr ecx, 8
mov ebx, dword [rsp + rax*4 + 0x20]
xor ebx, ecx
cmp rdi, rsi
jl 0x18003f18a
jmp 0x18003f1d6
mov r8, qword [0x180064670]
test rsi, rsi
jle 0x18003f1d6
movzx ecx, byte [rdi + rbp]
mov eax, ebx
xor rcx, rax
inc rdi
movzx eax, cl
mov ecx, ebx
shr ecx, 8
mov ebx, dword [r8 + rax*4]
xor ebx, ecx
cmp rdi, rsi
jl 0x18003f1b7
lea r11, [rsp + 0x420]
not ebx
mov rbp, qword [r11 + 0x18]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18003f8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x18003fa43
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r15
sub rsp, 0x220
movsxd rbp, r9d
mov r15, r8
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x18003fa22
test r8, r8
je 0x18003fa22
test r9d, r9d
je 0x18003fa22
mov rbx, qword [rax + 0x28]
test rbx, rbx
jne 0x18003f925
cmp qword [rsp + 0x268], rbx
je 0x18003fa22
call fcn.18003f0c0
cmp eax, 0xd2490422
je 0x18003f93d
cmp eax, 0x7598502c
je 0x18003f93d
mov r13b, 1
jmp 0x18003f940
xor r13b, r13b
xor r8d, r8d
mov r10d, 0x100
xor r9d, r9d
mov eax, r8d
mov byte [rsp + r9 + 0x20], r8b
cdq
inc r8d
idiv edi
movsxd rax, edx
mov cl, byte [rax + rsi]
mov byte [rsp + r9 + 0x120], cl
inc r9
cmp r8d, r10d
jl 0x18003f94c
xor r9d, r9d
xor r8d, r8d
movzx edx, byte [rsp + r8 + 0x20]
movzx ecx, byte [rsp + r8 + 0x120]
add ecx, r9d
add ecx, edx
movzx r9d, cl
mov al, byte [rsp + r9 + 0x20]
mov byte [rsp + r8 + 0x20], al
inc r8
mov byte [rsp + r9 + 0x20], dl
sub r10, 1
jne 0x18003f976
xor r12d, r12d
lea edi, [r10 + 1]
test ebp, ebp
jle 0x18003fa22
sub r15, rbx
mov rsi, rbx
neg rsi
mov cl, byte [r15 + rbx]
movzx edi, dil
movzx r8d, byte [rsp + rdi + 0x20]
lea eax, [r12 + r8]
movzx r12d, al
mov al, byte [rsp + r12 + 0x20]
mov byte [rsp + rdi + 0x20], al
mov byte [rsp + r12 + 0x20], r8b
test r13b, r13b
je 0x18003f9f2
movzx edx, byte [rsp + rdi + 0x20]
add rdx, r8
movzx eax, dl
xor cl, byte [rsp + rax + 0x20]
cmp qword [rsp + 0x268], 0
je 0x18003fa12
mov rdx, qword [rsp + 0x270]
call qword [rsp + 0x268]
test al, al
jne 0x18003fa22
jmp 0x18003fa14
mov byte [rbx], cl
inc rbx
inc edi
lea rax, [rsi + rbx]
cmp rax, rbp
jl 0x18003f9ba
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
ret

Function at 0x1800423e0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rsi, rcx
call fcn.180042ed0
xor edx, edx
xor ebx, ebx
mov rcx, rsi
test al, al
je 0x180042443
call fcn.180031fb0
mov rcx, rax
call fcn.180042ea8
movzx ecx, word [rax + 0x14]
lea rdx, [rax + 0x18]
movzx r8d, word [rax + 6]
add rdx, rcx
cmp bx, r8w
jae 0x18004247d
mov ecx, dword [rdx + 0xc]
cmp edi, ecx
jb 0x180042435
add ecx, dword [rdx + 8]
cmp edi, ecx
jb 0x18004243e
inc bx
add rdx, 0x28
jmp 0x180042421
mov rax, rdx
jmp 0x18004247f
call fcn.180031fb0
mov rcx, rax
call fcn.180042ea8
movzx ecx, word [rax + 0x14]
lea rdx, [rax + 0x18]
movzx r8d, word [rax + 6]
add rdx, rcx
cmp bx, r8w
jae 0x18004247d
mov ecx, dword [rdx + 0xc]
cmp edi, ecx
jb 0x180042474
add ecx, dword [rdx + 8]
cmp edi, ecx
jb 0x18004243e
inc bx
add rdx, 0x28
jmp 0x180042460
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180042ea8
Capabilities:
Parse pe header

Disassembly:
mov rax, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x180042eb8
xor eax, eax
ret
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
xor eax, eax
cmp dword [rcx], 0x4550
cmovne rcx, rax
mov rax, rcx
ret
Function at 0x180046084
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 8], ecx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov edi, edx
mov r15d, ecx
mov edx, 0x30
lea rcx, [rax - 0x48]
call fcn.180031e70
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180031fb0
mov ecx, 0xb28a2f38
mov r13, rax
call fcn.1800382d0
xor ebx, ebx
mov r14, rax
mov ebp, ebx
movsxd rdx, dword [rax + 0x3c]
lea rsi, [rax + 0x18]
add rsi, rdx
movzx ecx, word [rdx + rax + 0x14]
movzx r12d, word [rdx + rax + 6]
add rsi, rcx
test r12d, r12d
je 0x180046186
test dword [rsi + 0x24], r15d
je 0x18004614c
mov eax, dword [rsi + 0xc]
mov edx, 0xd14c3325
mov r15d, dword [rsi + 8]
add rax, r14
mov ecx, 0xb28a2f38
add r15, rax
call fcn.180038c24
test rax, rax
je 0x18004613e
mov qword [rsp + 0x28], rbx
mov r9, r13
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
mov rdx, r15
or rcx, 0xffffffffffffffff
call rax
jmp 0x180046140
mov eax, ebx
test eax, eax
jns 0x180046159
mov r15d, dword [rsp + 0x80]
inc ebp
add rsi, 0x28
cmp ebp, r12d
jge 0x180046186
jmp 0x1800460f8
mov eax, dword [r13 + 0x18]
sub eax, dword [rsi + 8]
sub eax, dword [rsi + 0xc]
sub eax, r14d
add eax, dword [r13]
cmp eax, edi
jge 0x180046173
sub edi, eax
lea ebx, [rdi + 0x10]
mov ecx, dword [rsi + 8]
movsxd rax, ebx
mov ebx, dword [rsi + 0xc]
sub rcx, rax
lea rax, [r14 + rcx]
add rbx, rax
lea rcx, [rsp + 0x30]
call fcn.180031efc
lea r11, [rsp + 0x50]
mov rax, rbx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180046ddc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov r9d, 0x40
lea rcx, [rbp - 0x30]
mov r14, r8
mov r15, rdx
call fcn.180048260
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.180031fb0
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180046ee5
movsxd r8, dword [rax + 0x3c]
lea rcx, [rbp - 0x18]
add r8, r14
mov r9d, 0xf8
mov rdx, r15
call fcn.180048260
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.180031f08
lea rcx, [rbp - 0x18]
call fcn.180031efc
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.180031fb0
cmp dword [rax], 0x4550
jne 0x180046ee5
mov esi, dword [rax + 0x78]
xor edi, edi
mov r9d, dword [rax + 0x7c]
test esi, esi
je 0x180046ee5
test r9d, r9d
je 0x180046ee5
lea r8, [r14 + rsi]
mov rdx, r15
lea rcx, [rbp - 0x18]
call fcn.180048260
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.180031f08
lea rcx, [rbp - 0x18]
call fcn.180031efc
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.180031fb0
lea rcx, [rbp - 0x30]
mov r14, rax
sub dword [rax + 0x20], esi
mov edx, dword [rax + 0x20]
sub dword [rax + 0x1c], esi
sub dword [rax + 0x24], esi
call fcn.180031fb0
cmp dword [r14 + 0x18], edi
jbe 0x180046ed7
sub dword [rax], esi
inc edi
lea rax, [rax + 4]
cmp edi, dword [r14 + 0x18]
jb 0x180046ec9
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.180031e24
jmp 0x180046eef
xor edx, edx
mov rcx, rbx
call fcn.180031e70
lea rcx, [rbp - 0x30]
call fcn.180031efc
lea r11, [rsp + 0x50]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180048068
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov esi, r9d
mov r15d, ecx
mov r8d, ecx
mov r9d, 0x40
lea rcx, [rbp - 0x39]
mov r14, rdx
call fcn.180048260
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.180031fb0
mov r9d, 0xf8
lea rcx, [rbp - 0x21]
mov rdx, r14
mov ebx, dword [rax + 0x3c]
lea r8d, [rbx + r15]
call fcn.180048260
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.180031f08
lea rcx, [rbp - 0x21]
call fcn.180031efc
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.180031fb0
xor edi, edi
mov r13d, edi
movzx edx, word [rax + 0x14]
movzx eax, word [rax + 6]
add edx, 0x18
add edx, ebx
mov dword [rbp + 0x67], eax
test eax, eax
je 0x1800481cf
lea r12d, [rdx + r15]
mov r8d, r12d
lea rcx, [rbp - 0x21]
mov r9d, 0x28
mov rdx, r14
call fcn.180048260
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.180031f08
lea rcx, [rbp - 0x21]
call fcn.180031efc
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.180031fb0
mov r14, rax
mov eax, dword [rbp + 0x77]
test dword [r14 + 0x24], eax
je 0x180048192
mov ebx, dword [r14 + 0xc]
mov edx, 0xd14c3325
add ebx, dword [r14 + 8]
mov ecx, 0xb28a2f38
add ebx, r15d
call fcn.180038c24
test rax, rax
je 0x18004818c
mov rcx, qword [rbp + 0x6f]
lea r9, [rbp - 9]
mov edx, ebx
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0x30
call rax
jmp 0x18004818e
mov eax, edi
test eax, eax
jns 0x1800481a8
inc r13d
add r12d, 0x28
cmp r13d, dword [rbp + 0x67]
jge 0x1800481cf
mov r14, qword [rbp + 0x6f]
jmp 0x18004810d
mov eax, dword [rbp + 0xf]
mov ebx, dword [r14 + 8]
sub eax, ebx
sub eax, dword [r14 + 0xc]
sub eax, r15d
add eax, dword [rbp - 9]
cmp eax, esi
jge 0x1800481c4
sub esi, eax
lea edi, [rsi + 4]
sub ebx, edi
add ebx, dword [r14 + 0xc]
add ebx, r15d
jmp 0x1800481d1
mov ebx, edi
lea rcx, [rbp - 0x39]
call fcn.180031efc
mov eax, ebx
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180053024
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rcx]
mov rsi, rdx
lea rdx, [0x180061c20]
mov ebp, r8d
mov edi, 1
movzx r10d, byte [rax + rdx]
add rcx, r10
mov r9d, edi
xor r8d, r8d
xor edx, edx
call fcn.1800537fc
mov rbx, rax
cmp rax, rsi
jae 0x180053139
movzx edx, byte [rax]
lea eax, [rdx - 0x57]
cmp eax, 2
jbe 0x1800531ad
cmp edx, 0x25
ja 0x1800530fb
cmp edx, 0x24
jae 0x1800530bb
cmp edx, 0x1c
ja 0x1800530c5
cmp edx, 0x1b
jae 0x1800530e6
cmp edx, 5
jb 0x180053212
cmp edx, 0xe
jbe 0x1800530e6
cmp edx, 0x10
je 0x1800530e6
cmp edx, 0x15
jbe 0x180053212
cmp edx, 0x18
jbe 0x1800530e6
cmp edx, 0x1a
ja 0x180053212
test ebp, ebp
je 0x180053212
jmp 0x1800530ed
cmp edx, 0x1d
jb 0x180053212
cmp edx, 0x20
jbe 0x1800530bb
cmp edx, 0x21
je 0x1800530e6
cmp edx, 0x22
je 0x1800530bb
cmp edx, 0x23
jne 0x180053212
xor eax, eax
jmp 0x18005313b
add rbx, rdi
mov al, byte [rbx + 2]
and al, 0xc0
cmp al, 0x80
je 0x1800530ea
jmp 0x180053212
cmp edx, 0x3b
ja 0x180053115
movabs rcx, 0x861430000000000
bt rcx, rdx
jb 0x1800530e6
jmp 0x180053212
cmp edx, 0x3d
je 0x1800530e6
cmp edx, 0x47
jbe 0x180053212
cmp edx, 0x49
jbe 0x180053162
cmp edx, 0x4a
je 0x180053150
lea eax, [rdx - 0x4e]
cmp eax, 3
ja 0x180053212
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx r8d, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl r8, 8
or r8, rax
jmp 0x180053168
mov r8d, 0x21
mov al, byte [r8 + rbx]
cmp al, 0x40
jb 0x1800530e6
cmp al, 0x41
jbe 0x180053212
cmp al, 0x43
jbe 0x1800530e6
cmp al, 0x45
jbe 0x180053212
cmp al, 0x47
ja 0x1800530e6
movzx ecx, byte [r8 + rbx + 1]
movzx eax, byte [r8 + rbx + 2]
shl ecx, 8
or ecx, eax
ja 0x1800530e6
jmp 0x180053212
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl ecx, 8
or ecx, eax
je 0x180053139
xor edi, edi
test edi, edi
jne 0x1800531dc
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
call fcn.180053024
test eax, eax
lea eax, [rdi + 1]
cmovne edi, eax
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
add rbx, rcx
cmp byte [rbx], 0x4e
je 0x1800531c2
test edi, edi
je 0x1800530e6
movzx eax, byte [0x180061c20]
xor edx, edx
lea ecx, [rdx + 3]
sub ecx, eax
lea edi, [rdx + 1]
movsxd rax, ecx
add rbx, rax
lea rcx, [0x180061c20]
movzx ecx, byte [rdx + rcx]
add rcx, rbx
jmp 0x180053055