joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800028c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x1800028e2
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x1800028fe
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x180002915
cmp byte [rcx + 1], 0x25
jne 0x180002959
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x180002921
cmp al, 0xe9
jne 0x180002959
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, rbx
cmp rcx, rbx
jae 0x180002944
cmp rcx, 0xffffffff80000000
jae 0x18000293b
lea rsi, [rcx + 0x7ff80000]
jmp 0x180002959
mov rsi, 0xfffffffffff80000
jmp 0x180002959
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180002959
mov edi, 0x80000
mov rdx, qword [0x180008158]
mov rax, qword [0x180008150]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x180002980
test rax, rax
je 0x180002997
mov rdx, rax
mov qword [0x180008158], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x180002997
cmp rcx, rdi
jb 0x180002997
cmp rcx, rsi
jbe 0x180002aea
mov qword [0x180008158], rax
mov rdx, rax
test rax, rax
je 0x1800029e2
mov rcx, rax
nop dword [rax]
test rax, rax
je 0x1800029cc
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1800029cc
cmp rax, rdi
jb 0x1800029cc
cmp rax, rsi
jbe 0x180002aea
mov rdx, qword [rdx + 8]
mov qword [0x180008158], rdx
mov rcx, rdx
mov rax, rdx
test rdx, rdx
jne 0x1800029b0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x180002a0c
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.1800026e0
mov rdx, rax
test rax, rax
jne 0x180002a98
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x180002a32
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.1800027d0
mov rdx, rax
test rax, rax
jne 0x180002a98
cmp rbx, 0x40000000
jbe 0x180002a52
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.1800027d0
mov rdx, rax
test rax, rax
jne 0x180002a98
cmp rbx, rbp
jae 0x180002a6e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.1800026e0
mov rdx, rax
test rax, rax
jne 0x180002a98
mov rdx, rbx
mov rcx, rdi
call fcn.1800026e0
mov rdx, rax
test rax, rax
jne 0x180002a98
mov rdx, rsi
mov rcx, rbx
call fcn.1800027d0
mov rdx, rax
test rax, rax
je 0x180002b21
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x180008158], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x180008150]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x180008150], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x180002ad2
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x180002b21
cmp rax, rsi
ja 0x180002b21
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x1800062c0]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x180002b23
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002d80
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x180002dae
xor al, al
jmp 0x180002df0
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x180002dbf
xor al, al
jmp 0x180002df0
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x180002de6
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x180002de6
mov al, 1
jmp 0x180002df0
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x1800032d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x180008168], 0
jne 0x180003377
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x180008168], ecx
jne 0x180003377
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x180008150]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x180008180], rdi
mov qword [0x180008178], rdi
mov qword [0x180008170], rdi
test rbx, rbx
je 0x180003360
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180003358
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180003330
jmp 0x180003360
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x18000816c], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x180003990
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x18000816c]
mov rdi, rcx
test eax, eax
jne 0x180003a33
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x1800039ba
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.1800041b0
mov rbx, rax
test rax, rax
jne 0x1800039d6
lea edi, [rax + 8]
jmp 0x1800039f9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180003a17
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.180004564
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x18000816c], edi
mov qword [0x180008170], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180008178]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x180008178], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x415f40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4160eb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430540
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x415fae
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415fc1
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415fe5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415ff9
cmp rbx, 0x1000
jae 0x415fb8
nop
jmp 0x416069
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41600d
xor edx, edx
jmp 0x416060
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00430540
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x415fef
jmp 0x415fd5
call fcn.0045f780
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00435500
lea rax, [0x004bffa2]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00435e00
mov rax, qword [rsp + 0x38]
call fcn.00435b00
lea rax, [0x004c0032]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00435e00
mov rax, qword [rsp + 0x30]
call fcn.00435b00
call fcn.00435760
call fcn.00435580
lea rax, [0x004c2159]
mov ebx, 0x21
call fcn.00433d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bc00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415f40
Function at 0x416120
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41634a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004305c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41619b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4161ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x4161d0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4161e4
cmp rbx, 0x1000
jae 0x4161a5
jmp 0x41626e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4161f6
xor esi, esi
jmp 0x416260
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004305c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x4161da
jmp 0x4161c2
call fcn.0045f780
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4162e9
call fcn.00435500
lea rax, [0x004c03e8]
mov ebx, 0x19
call fcn.00435e00
mov rax, qword [rsp + 0x68]
call fcn.00435b00
lea rax, [0x004c0032]
mov ebx, 0x19
nop
call fcn.00435e00
mov eax, dword [rsp + 0x34]
call fcn.00435b00
call fcn.00435760
call fcn.00435580
lea rax, [0x004bcf29]
mov ebx, 0xd
call fcn.00433d80
cmp eax, 0x5af
je 0x416293
call fcn.00435500
lea rax, [0x004c03e8]
mov ebx, 0x19
call fcn.00435e00
mov rax, qword [rsp + 0x38]
call fcn.00435b00
lea rax, [0x004c0032]
mov ebx, 0x19
nop dword [rax]
call fcn.00435e00
mov eax, dword [rsp + 0x34]
call fcn.00435b00
call fcn.00435760
call fcn.00435580
lea rax, [0x004c1aaa]
mov ebx, 0x1f
call fcn.00433d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bc00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416120
Function at 0x41d800
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005bb654], 0
jne 0x41d8f9
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and rbx, 7
mov rsi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41d8ef
lea rbx, [0x0058dab8]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and rdx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and rax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
test al, bl
jne 0x41d8ca
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x16a8], rsi
add qword [rax + 0x16b0], rdi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.0045e320
lea rax, [0x004c3a22]
mov ebx, 0x2c
call fcn.00433d80
nop
int3
Function at 0x42c980
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42cc26
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x16d0]
mov rcx, qword [rax + 0x16c0]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42cc1a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x16c0], 0
cmp byte [0x005bb654], 0
jne 0x42c9e2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42ca2b
xor edx, edx
jmp 0x42ca0e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x16d0]
mov rax, rcx
call fcn.0041d020
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42c9e6
add rax, 0x16c0
call fcn.0042c840
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x42cbb2
mov rsi, qword [rax + rdx*8 + 0x16d0]
nop dword [rax]
cmp rsi, 0x1000
jb 0x42ca28
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00411f80
test rax, rax
jne 0x42ca82
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42ca28
nop
mov rsi, rcx
shr rcx, 3
and rsi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x42cac5
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x42ca28
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42cc0d
lea r10, [0x0058dab8]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and rcx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42cb4c
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x42cb85
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x16a8]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x16a8], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42ca28
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42cc05
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x16d0], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x42ca28
cmp rbx, 0x200
ja 0x42cbf7
lea rdx, [rax + 0x16d0]
lea rsi, [rax + 0x1698]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004226e0
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x16c0]
call fcn.0042c840
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.0045e380
mov rax, r8
call fcn.0045e300
mov rax, r8
mov ecx, 0x40
call fcn.0045e320
mov edx, 0x200
nop
call fcn.0045e360
nop
mov qword [rsp + 8], rax
call fcn.004602e0
mov rax, qword [rsp + 8]
jmp fcn.0042c980
Function at 0x44c9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44cb38
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44c9fc
test r8b, r8b
jne 0x44c9fc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44ca0f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44caf8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44cae6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44cadc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44ca63
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44caa6
mov eax, 1
cmp rax, rbx
ja 0x44ca95
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045e3c0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44cad4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44ca9d
mov r8d, eax
mov eax, r10d
jmp 0x44ca68
mov rcx, rbx
call fcn.0045e300
xor eax, eax
mov rcx, rbx
call fcn.0045e300
mov eax, r8d
mov rcx, rbx
call fcn.0045e3c0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44cb2e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44caf1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44ca15
mov eax, edx
mov rcx, rbx
call fcn.0045e300
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.0045e300
nop
int3
Function at 0x453f80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45404a
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
lea rdx, [rsp + 0x18]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x28]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x38]
movups xmmword [rdx], xmm15
lea rdx, [rsp + 0x48]
movups xmmword [rdx], xmm15
lea rdx, [0x00454080]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045bac0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0045bc00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00453f80

Function at 0x45a800
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov r13, 0
mov qword [rsp + 0x20], r13
mov byte [rsp + 0x17], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rsi, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rsi + 0x30]
mov qword [rsi + 0xe8], rcx
lea rcx, fcn.0043f3a0
mov qword [rsp + 0x20], rcx
mov byte [rsp + 0x17], 1
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
mov qword [rsp + 0x18], rcx
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 0x2e0], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rcx + 0x2e8], rdx
lea rdx, [rsp + 0x48]
mov qword [rcx + 0x2f0], rdx
lea rbx, [rcx + 0x2e0]
mov rax, qword [0x00566e10]
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.004039e0
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rcx + 0x2f8]
mov rsi, qword [rcx + 0x300]
mov rcx, qword [rcx + 0x308]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], 0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
call fcn.0043f3a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
Function at 0x45dd40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402bef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409260
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045bc00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402bc0
cmp byte [0x005bb653], 0
je 0x45dd55
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45ad20
jmp 0x402bc0

Function at 0x45dd60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005bb900]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005bb653], 0
je 0x45dd95
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005bbb80]
aesenc xmm0, xmmword [0x005bbb90]
aesenc xmm0, xmmword [0x005bbba0]
movq rax, xmm0
ret
jmp 0x409460

Function at 0x45dda0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005bb900]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005bb653], 0
je 0x45ddd6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005bbb80]
aesenc xmm0, xmmword [0x005bbb90]
aesenc xmm0, xmmword [0x005bbba0]
movq rax, xmm0
ret
jmp 0x4094c0

Function at 0x45f700
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005bbb00]
mov qword [rsp + 8], rdx
lea r8d, [0x005bb668]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045dca0
add rsp, 0x30
ret

Function at 0x4605c0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
call fcn.0045aae0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x4740a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x4740b8
movzx esi, byte [rbx + rdx]
inc rdx
imul eax, eax, 0x1000193
xor eax, esi
cmp rcx, rdx
jg 0x4740a9
ret
Function at 0x14013002d
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x58], 0xf6f6f6f6
xchg r11, r13
mov rdx, r11
xchg r13, r11
je 0x140130079
jne 0x140130079
call rax
cmp rsi, rdx
sub r10d, 0xe21c400
lea r15d, [rbx - 0xbb1]
call rcx
jns 0x14012f45b
rcr r15d, 0xb7
test ecx, 0xc36feaf6
jmp 0x1401302de
mov dword [rsp + 0x68], 0x7371784f
mov dword [rsp + 0x5c], 0xf6f6f6f6
Function at 0x140024a80
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140024b4c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140024b4c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140024b65
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140024b3c
cmp byte [rax], 0x5c
jne 0x140024b36
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140024b36
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140024b22
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140024b33
test r8b, 0x10
jne 0x140024b36
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140024b36
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140028700
test edi, edi
jne 0x140024aa0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140026070
int3

Function at 0x140029170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400291a4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140029190
ret