joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5237f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x138
mov r12, rcx
call sub.msvcrt.dll__errno
mov dword [rax], 0
test r12, r12
je 0x5239c9
cmp byte [r12], 0
je 0x5239ab
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x5239d9
test al, 0x10
je 0x5239ab
lea rsi, [rsp + 0x20]
mov r8d, 0x104
mov rdx, r12
mov rcx, rsi
mov rbx, rsi
call sub.msvcrt.dll__fullpath
mov edx, dword [rbx]
add rbx, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x523851
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
cmove rbx, rdx
mov edi, eax
add dil, al
sbb rbx, 3
sub rbx, rsi
lea rcx, [rbx + 0x24b]
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x523a01
lea rdx, [rax + 0x244]
lea rax, [rbx + 1]
cmp eax, 8
jb 0x523954
mov rcx, qword [rsp + 0x20]
lea rdi, [r12 + 0x24c]
and rdi, 0xfffffffffffffff8
mov qword [r12 + 0x244], rcx
mov ecx, eax
mov r8, qword [rsi + rcx - 8]
mov qword [rdx + rcx - 8], r8
mov rcx, rdx
sub rcx, rdi
sub rsi, rcx
add ecx, eax
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
cmp byte [r12 + 0x244], 0
jne 0x52397c
add rbx, rdx
mov eax, 0x2a
lea rdx, [r12 + 0x130]
mov ecx, 0x20
mov word [rbx], ax
mov rdi, rdx
xor eax, eax
mov qword [r12 + 0x238], 0xffffffffffffffff
mov dword [r12 + 0x240], 0
mov qword [r12 + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, r12
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop r12
ret
test al, 4
jne 0x5239ec
test eax, eax
je 0x5238eb
movzx ecx, byte [rsi]
mov byte [rdx], cl
test al, 2
je 0x5238eb
mov ecx, eax
movzx r8d, word [rsi + rcx - 2]
mov word [rdx + rcx - 2], r8w
jmp 0x5238eb
movzx ecx, byte [r12 + rbx + 0x243]
add rbx, rdx
cmp cl, 0x5c
je 0x5238fd
cmp cl, 0x2f
je 0x5238fd
mov ecx, 0x5c
mov word [rbx], cx
lea rbx, [rdx + rax]
jmp 0x5238fd
call sub.msvcrt.dll__errno
xor r12d, r12d
mov dword [rax], 0x14
mov rax, r12
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop r12
ret
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x523944
call sub.msvcrt.dll__errno
xor r12d, r12d
mov dword [rax], 2
jmp 0x523944
mov ecx, dword [rsi]
mov dword [rdx], ecx
mov ecx, eax
mov r8d, dword [rsi + rcx - 4]
mov dword [rdx + rcx - 4], r8d
jmp 0x5238eb
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x523944
Function at 0x530b30
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00701b98], eax
cmp eax, 0xffffffff
je 0x6c8a30
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x531110
Capabilities:
Print debug messages

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rbx, rcx
test rcx, rcx
je 0x531135
call fcn.00530a00
cmp eax, 1
je 0x531142
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
ret
lea r12, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
mov rdi, r12
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x5311c5
mov eax, 0x28
jmp 0x531197
add rax, 1
cmp rax, 0x6b
je 0x5311b7
cmp byte [r12 + rax], 0
mov edx, eax
jne 0x53118d
cmp eax, 0x6a
je 0x5311b7
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
jmp 0x5311a5

Function at 0x5311d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x00a8b5c0], 1
je 0x5311e7
call fcn.00531080
mov ecx, dword [0x00701b98]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x531208
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call fcn.00530fc0
cmp qword [0x00a90050], 0
mov rbx, rax
je 0x5311fb
test rax, rax
je 0x5311fb
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.00531110
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rdi
mov dword [rsp + 0x30], 2
mov r8, rsi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x6c8a36
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ecx, dword [0x00701b98]
mov rdx, rbx
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x6c8a36
mov r12, rbx
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r12
ret
call sub.msvcrt.dll_abort
nop
mov rax, qword [pe_dos_header]
ud2
Function at 0x5327f0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call fcn.00530fc0
mov r12, rax
test rax, rax
je 0x532a47
test rdi, rdi
je 0x53282a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x53289b
test ebx, ebx
je 0x532894
mov ecx, 0x14
call r14
cmp ebx, 4
je 0x53289b
add ebx, 1
jmp 0x532865
xor ecx, ecx
call r13
jmp 0x53288f
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call fcn.00531110
cmp qword [r12 + 0x30], 0
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x5329ff
xor edx, edx
test rsi, rsi
je 0x532901
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x532a27
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [0x00531650]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x5329cb
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x5329a7
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x53298a
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x532971
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x532947
mov edx, 0xf
cmp eax, 0xe
jg 0x532947
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x532947
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x5329db
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call fcn.005308a0
mov rcx, r14
call fcn.00531110
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x532a0b
mov qword [rdi], 0
mov rcx, r12
call fcn.00530d50
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call fcn.005311d0
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x532901
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x534a70
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
mov rax, qword [0x0072afd0]
movdqa xmm11, xmmword [rcx]
movdqa xmm7, xmmword [rax + 0xe0]
movdqa xmm9, xmmword [rax + 0xc0]
movdqa xmm6, xmmword [rax + 0xf0]
movdqa xmm8, xmmword [rax + 0xd0]
movdqa xmm5, xmmword [rax + 0x100]
movdqa xmm4, xmmword [rax + 0x110]
movdqa xmm3, xmmword [rax + 0x120]
add rdx, r8
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm1, xmmword [rcx + 0x20]
movdqa xmm2, xmmword [rax + 0x130]
movdqa xmm0, xmmword [rcx + 0x30]
cmp r8, rdx
jae 0x534b75
nop dword [rax + rax]
aesdec xmm11, xmm9
aesenc xmm10, xmm9
aesdec xmm1, xmm5
add r8, 0x40
aesenc xmm0, xmm5
aesdec xmm11, xmm8
aesenc xmm10, xmm8
aesdec xmm1, xmm4
aesenc xmm0, xmm4
aesdec xmm11, xmm7
aesenc xmm10, xmm7
aesdec xmm1, xmm3
aesenc xmm0, xmm3
aesdec xmm11, xmm6
aesenc xmm10, xmm6
aesdec xmm1, xmm2
aesenc xmm0, xmm2
movaps xmmword [r8 - 0x40], xmm11
movaps xmmword [r8 - 0x30], xmm10
movaps xmmword [r8 - 0x20], xmm1
movaps xmmword [r8 - 0x10], xmm0
cmp rdx, r8
ja 0x534b00
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x68
ret
mov rax, qword [0x0072afd0]
mov eax, dword [rax + 0x34]
mov r8, rcx
mov rcx, rdx
lea edx, [rax*8 + 0x80]
add r8, 0x40
jmp 0x534a70

Function at 0x535d20
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm0, xmmword [str._f__nc]
movdqa xmm1, xmmword [0x00716db0]
movdqa xmm2, xmmword [0x00716dc0]
movdqa xmm3, xmmword [0x00716dd0]
add rdx, rcx
cmp rcx, rdx
jae 0x535d70
nop dword [rax + rax]
aesenc xmm3, xmmword [rcx]
aesdec xmm2, xmmword [rcx + 0x10]
aesenc xmm1, xmmword [rcx + 0x20]
add rcx, 0x40
aesdec xmm0, xmmword [rcx - 0x10]
cmp rdx, rcx
ja 0x535d50
movdqa xmm4, xmmword [0x00716de0]
aesenc xmm3, xmm4
aesdec xmm2, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm4
movdqa xmm4, xmmword [0x00716df0]
aesenc xmm3, xmm4
aesdec xmm2, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm4
movaps xmmword [r8], xmm3
movaps xmmword [r8 + 0x10], xmm2
movaps xmmword [r8 + 0x20], xmm1
movaps xmmword [r8 + 0x30], xmm0
ret
Function at 0x53ec00
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
movdqa xmm4, xmmword [str._f__nc]
movdqa xmm5, xmmword [0x00716db0]
movdqa xmm6, xmmword [0x00716dc0]
movdqa xmm7, xmmword [0x00716dd0]
movdqa xmm3, xmmword [r9]
movdqa xmm2, xmmword [r9 + 0x10]
movdqa xmm1, xmmword [r9 + 0x20]
movdqa xmm0, xmmword [r9 + 0x30]
movdqa xmm11, xmmword [0x00716e00]
movdqa xmm10, xmmword [0x00716e10]
movdqa xmm9, xmmword [0x00716e20]
movdqa xmm8, xmmword [0x00716e30]
mov r10, rdx
mov r11, rcx
lea rdx, [rcx + 0x1000]
lea r10, [rcx + r10 - 0x1000]
lea rbx, [r10 + 0x2000]
cmp r11, r10
jae 0x53ed0a
mov rax, r11
nop dword [rax]
aesdec xmm3, xmm11
aesenc xmm2, xmm10
aesenc xmm7, xmmword [rax]
add rax, 0x40
aesdec xmm1, xmm9
aesenc xmm0, xmm8
prefetcht0 byte [rdx]
aesdec xmm6, xmmword [rax - 0x30]
aesenc xmm5, xmmword [rax - 0x20]
aesdec xmm4, xmmword [rax - 0x10]
movaps xmmword [rax - 0x40], xmm3
add rdx, 0x40
movaps xmmword [rax - 0x30], xmm2
movaps xmmword [rax - 0x20], xmm1
movaps xmmword [rax - 0x10], xmm0
cmp rax, r10
jb 0x53eca8
mov rax, r10
sub rax, r11
sub rax, 1
and rax, 0xffffffffffffffc0
lea r11, [r11 + rax + 0x40]
add r10, 0x1000
cmp r10, rbx
jne 0x53eda0
movaps xmmword [r9], xmm3
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmmword [r9 + 0x30], xmm0
movdqa xmm0, xmmword [0x00716de0]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmmword [r9 + 0x10], xmm2
movaps xmm11, xmmword [rsp + 0x50]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
movaps xmmword [r9 + 0x20], xmm1
aesdec xmm4, xmm0
movdqa xmm0, xmmword [0x00716df0]
aesenc xmm7, xmm0
aesdec xmm6, xmm0
aesenc xmm5, xmm0
movaps xmmword [r8], xmm7
movaps xmm7, xmmword [rsp + 0x10]
aesdec xmm4, xmm0
movaps xmmword [r8 + 0x10], xmm6
movaps xmm6, xmmword [rsp]
movaps xmmword [r8 + 0x20], xmm5
movaps xmmword [r8 + 0x30], xmm4
add rsp, 0x60
pop rbx
ret
mov rdx, rcx
jmp 0x53ec9d
Function at 0x5dabe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx edx, byte [rcx + 0x3a0]
mov r8d, dword [rcx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov rbx, rcx
lea r13, [rcx + 0x80]
mov edx, r8d
lea rcx, [rcx + rax*8 + 0x180]
call fcn.004a9a30
mov r12, rax
test rax, rax
jne 0x5daca5
mov rbp, qword [0x0072b390]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
lea rsi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0xbebc200
jmp 0x5dac5f
call rdi
cmp dword [rax], 4
jne 0x5dac6f
mov rdx, rsi
mov rcx, rsi
call fcn.00533710
cmp eax, 0xffffffff
je 0x5dac58
mov rax, qword [rbp]
test rax, rax
je 0x5dacaf
movzx edx, byte [rbx + 0x3a0]
mov r8d, dword [rbx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov edx, r8d
lea rcx, [r13 + rax*8 + 0x100]
call fcn.004a9a30
mov r12, rax
test rax, rax
je 0x5dac40
cmp qword [rbx + 0x3b0], 0
je 0x5dacbc
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rbx + 0x78]
mov edi, dword [rbx + 0x3c]
mov ecx, 0x10
mov rsi, qword [rax + 0x10]
call fcn.006c5c70
movzx r9d, byte [rbx + 0x40]
mov dword [rsp + 0x20], edi
mov rdx, r12
mov r8, rsi
mov rcx, rax
mov r13, rax
xor r9d, 1
movzx r9d, r9b
call fcn.004ae290
mov qword [rbx + 0x3b0], r13
jmp 0x5dacaf

Function at 0x5dc4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx edx, byte [rcx + 0x4d0]
mov r8d, dword [rcx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov rbx, rcx
lea r13, [rcx + 0xb0]
mov edx, r8d
lea rcx, [rcx + rax*8 + 0x2b0]
call fcn.004a9a30
mov r12, rax
test rax, rax
jne 0x5dc565
mov rbp, qword [0x0072b390]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
lea rsi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0xbebc200
jmp 0x5dc51f
call rdi
cmp dword [rax], 4
jne 0x5dc52f
mov rdx, rsi
mov rcx, rsi
call fcn.00533710
cmp eax, 0xffffffff
je 0x5dc518
mov rax, qword [rbp]
test rax, rax
je 0x5dc56f
movzx edx, byte [rbx + 0x4d0]
mov r8d, dword [rbx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov edx, r8d
lea rcx, [r13 + rax*8 + 0x200]
call fcn.004a9a30
mov r12, rax
test rax, rax
je 0x5dc500
cmp qword [rbx + 0x4e0], 0
je 0x5dc57c
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rbx + 0xa0]
mov edi, dword [rbx + 0x3c]
mov ecx, 0x10
mov rsi, qword [rax + 0x10]
call fcn.006c5c70
movzx r9d, byte [rbx + 0x40]
mov dword [rsp + 0x20], edi
mov rdx, r12
mov r8, rsi
mov rcx, rax
mov r13, rax
xor r9d, 1
movzx r9d, r9b
call fcn.004ae290
mov qword [rbx + 0x4e0], r13
jmp 0x5dc56f
Function at 0x5de430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx edx, byte [rcx + 0x5f0]
mov r8d, dword [rcx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov rbx, rcx
lea r13, [rcx + 0xd0]
mov edx, r8d
lea rcx, [rcx + rax*8 + 0x3d0]
call fcn.004a9a30
mov r12, rax
test rax, rax
jne 0x5de4f5
mov rbp, qword [0x0072b390]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
lea rsi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0xbebc200
jmp 0x5de4af
call rdi
cmp dword [rax], 4
jne 0x5de4bf
mov rdx, rsi
mov rcx, rsi
call fcn.00533710
cmp eax, 0xffffffff
je 0x5de4a8
mov rax, qword [rbp]
test rax, rax
je 0x5de4ff
movzx edx, byte [rbx + 0x5f0]
mov r8d, dword [rbx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov edx, r8d
lea rcx, [r13 + rax*8 + 0x300]
call fcn.004a9a30
mov r12, rax
test rax, rax
je 0x5de490
cmp qword [rbx + 0x600], 0
je 0x5de50c
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rbx + 0xc8]
mov edi, dword [rbx + 0x3c]
mov ecx, 0x10
mov rsi, qword [rax + 0x10]
call fcn.006c5c70
movzx r9d, byte [rbx + 0x40]
mov dword [rsp + 0x20], edi
mov rdx, r12
mov r8, rsi
mov rcx, rax
mov r13, rax
xor r9d, 1
movzx r9d, r9b
call fcn.004ae290
mov qword [rbx + 0x600], r13
jmp 0x5de4ff

Function at 0x5dfd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx edx, byte [rcx + 0x720]
mov r8d, dword [rcx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov rbx, rcx
lea r13, [rcx + 0x100]
mov edx, r8d
lea rcx, [rcx + rax*8 + 0x500]
call fcn.004a9a30
mov r12, rax
test rax, rax
jne 0x5dfde5
mov rbp, qword [0x0072b390]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
lea rsi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0xbebc200
jmp 0x5dfd9f
call rdi
cmp dword [rax], 4
jne 0x5dfdaf
mov rdx, rsi
mov rcx, rsi
call fcn.00533710
cmp eax, 0xffffffff
je 0x5dfd98
mov rax, qword [rbp]
test rax, rax
je 0x5dfdef
movzx edx, byte [rbx + 0x720]
mov r8d, dword [rbx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov edx, r8d
lea rcx, [r13 + rax*8 + 0x400]
call fcn.004a9a30
mov r12, rax
test rax, rax
je 0x5dfd80
cmp qword [rbx + 0x730], 0
je 0x5dfdfc
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rbx + 0xf0]
mov edi, dword [rbx + 0x3c]
mov ecx, 0x10
mov rsi, qword [rax + 0x10]
call fcn.006c5c70
movzx r9d, byte [rbx + 0x40]
mov dword [rsp + 0x20], edi
mov rdx, r12
mov r8, rsi
mov rcx, rax
mov r13, rax
xor r9d, 1
movzx r9d, r9b
call fcn.004ae290
mov qword [rbx + 0x730], r13
jmp 0x5dfdef
Function at 0x5e16f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movzx edx, byte [rcx + 0x840]
mov r8d, dword [rcx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov rbx, rcx
lea r13, [rcx + 0x120]
mov edx, r8d
lea rcx, [rcx + rax*8 + 0x620]
call fcn.004a9a30
mov r12, rax
test rax, rax
jne 0x5e17b5
mov rbp, qword [0x0072b390]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
lea rsi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0xbebc200
jmp 0x5e176f
call rdi
cmp dword [rax], 4
jne 0x5e177f
mov rdx, rsi
mov rcx, rsi
call fcn.00533710
cmp eax, 0xffffffff
je 0x5e1768
mov rax, qword [rbp]
test rax, rax
je 0x5e17bf
movzx edx, byte [rbx + 0x840]
mov r8d, dword [rbx + 0x28]
mov rax, rdx
shl rax, 5
add rax, rdx
mov edx, r8d
lea rcx, [r13 + rax*8 + 0x500]
call fcn.004a9a30
mov r12, rax
test rax, rax
je 0x5e1750
cmp qword [rbx + 0x850], 0
je 0x5e17cc
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, qword [rbx + 0x118]
mov edi, dword [rbx + 0x3c]
mov ecx, 0x10
mov rsi, qword [rax + 0x10]
call fcn.006c5c70
movzx r9d, byte [rbx + 0x40]
mov dword [rsp + 0x20], edi
mov rdx, r12
mov r8, rsi
mov rcx, rax
mov r13, rax
xor r9d, 1
movzx r9d, r9b
call fcn.004ae290
mov qword [rbx + 0x850], r13
jmp 0x5e17bf

Function at 0x5e54d0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
mov rax, qword [0x0072afd0]
movdqa xmm11, xmmword [rcx]
movdqa xmm7, xmmword [rax + 0xe0]
movdqa xmm9, xmmword [rax + 0xc0]
movdqa xmm6, xmmword [rax + 0xf0]
movdqa xmm8, xmmword [rax + 0xd0]
movdqa xmm5, xmmword [rax + 0x100]
movdqa xmm4, xmmword [rax + 0x110]
movdqa xmm3, xmmword [rax + 0x120]
add rdx, r8
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm1, xmmword [rcx + 0x20]
movdqa xmm2, xmmword [rax + 0x130]
movdqa xmm0, xmmword [rcx + 0x30]
cmp r8, rdx
jae 0x534b75
nop dword [rax + rax]
aesdec xmm11, xmm9
aesenc xmm10, xmm9
aesdec xmm1, xmm5
add r8, 0x40
aesenc xmm0, xmm5
aesdec xmm11, xmm8
aesenc xmm10, xmm8
aesdec xmm1, xmm4
aesenc xmm0, xmm4
aesdec xmm11, xmm7
aesenc xmm10, xmm7
aesdec xmm1, xmm3
aesenc xmm0, xmm3
aesdec xmm11, xmm6
aesenc xmm10, xmm6
aesdec xmm1, xmm2
aesenc xmm0, xmm2
movaps xmmword [r8 - 0x40], xmm11
movaps xmmword [r8 - 0x30], xmm10
movaps xmmword [r8 - 0x20], xmm1
movaps xmmword [r8 - 0x10], xmm0
cmp rdx, r8
ja 0x534b00
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x68
ret
mov rax, qword [0x0072afd0]
mov eax, dword [rax + 0x34]
mov r8, rcx
mov rcx, rdx
lea edx, [rax*8 + 0x80]
add r8, 0x40
jmp 0x534a70
Function at 0x663740
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x663767
call rbp
cmp dword [rax], 4
jne 0x663784
mov rcx, rdi
call fcn.00663540
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x663760
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x6ad3e0
Capabilities:
Parse credit card information

Disassembly:
mov rax, qword [rcx + 0xb8]
cmp qword [rcx + 0xb0], rax
je 0x6ad420
mov eax, dword [rcx + 0x88]
test eax, eax
je 0x6ad408
cmp eax, 2
je 0x6ad410
cmp eax, 1
je 0x6ad418
ret
jmp fcn.006ad580
jmp fcn.006ae340
jmp fcn.006ad9a0
mov dword [rcx + 0x90], 0x1b
ret
Function at 0x6bc390
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0xc6a4a7935bd1e995
mov rax, rdx
mov r11, rdx
imul rax, r9
and r11, 0xfffffffffffffff8
add r11, rcx
xor rax, r8
cmp rcx, r11
je 0x6bc3e0
nop dword [rax + rax]
mov r10, qword [rcx]
add rcx, 8
imul r10, r9
mov r8, r10
shr r8, 0x2f
xor r8, r10
imul r8, r9
xor r8, rax
mov rax, r8
imul rax, r9
cmp r11, rcx
jne 0x6bc3b8
and edx, 7
je 0x6bc415
sub edx, 1
xor r8d, r8d
movsxd rdx, edx
nop
movzx ecx, byte [r11 + rdx]
shl r8, 8
sub rdx, 1
add r8, rcx
test edx, edx
jns 0x6bc3f0
xor r8, rax
movabs rax, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
movabs r8, 0xc6a4a7935bd1e995
imul rax, r8
mov r8, rax
shr r8, 0x2f
xor rax, r8
ret