joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036020
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.140036fa8
nop
lea rax, [0x14003559c]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
call fcn.1400351d4
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1400360a5
lea rcx, [rsp + 0x30]
call fcn.14004a1f4
jmp 0x1400360bc
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x30]
call fcn.140039404
add rsp, 0x58
ret

Function at 0x140038784
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140038740
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14003aef4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14003af16
mov rcx, qword [rsp + 0x40]
call fcn.140044c40
jmp 0x14003af2d
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14003af2d
mov rcx, qword [rsp + 0x40]
call fcn.140044a4c
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1400420cc
Capabilities:
Get disk information
Get hostname
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x138
mov rax, qword [0x1401ee900]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov dword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x140]
call fcn.14003843c
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400585b4]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x140042190
mov edx, dword [rsp + 0x44]
lea rcx, [rsp + 0xb8]
call fcn.14004ddfc
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x140]
call fcn.14003b028
nop
lea rcx, [rsp + 0xb8]
call fcn.140026338
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0xac]
lea rcx, [rsp + 0xd8]
call fcn.14004ddfc
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x140]
call fcn.14003b028
nop
lea rcx, [rsp + 0xd8]
call fcn.140026338
mov edx, dword [rsp + 0xa8]
lea rcx, [rsp + 0xf8]
call fcn.14004ddfc
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x140]
call fcn.14003b028
nop
lea rcx, [rsp + 0xf8]
call fcn.140026338
mov dword [rsp + 0x48], 0x10
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov rax, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.14004fc50
add rsp, 0x138
ret
Function at 0x1400422ac
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x1401ee900]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x140042305
cmp dword [rsp + 0x90], 0x7c
jge 0x140042305
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, str.Aimbot_Key
call fcn.1400425c0
lea rcx, [rsp + 0x50]
call fcn.14003843c
nop
cmp qword [rsp + 0x30], 0
jne 0x14004232b
lea rdx, [0x140059828]
lea rcx, [rsp + 0x50]
call fcn.1400398d8
jmp 0x14004233a
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400398d8
cmp dword [rsp + 0xa0], 1
jne 0x140042355
lea rdx, [0x140059838]
lea rcx, [rsp + 0x50]
call fcn.1400398d8
movss xmm2, dword [0x140057ed8]
movss xmm1, dword [0x14005a2a4]
lea rcx, [rsp + 0x48]
call fcn.140038a78
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.140045fa4
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140026c28
movzx eax, al
test eax, eax
je 0x1400423ca
cmp dword [rsp + 0xa0], 0
jne 0x1400423ca
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.140026338
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14004fc50
add rsp, 0x88
ret

Function at 0x1400423ec
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x140058668]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140058658]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140042475
lea rcx, [0x140058680]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140042475
lea rcx, [0x140058694]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140042475
xor al, al
jmp 0x140042527
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400586a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400424f7
lea rcx, [0x1400586d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400424f7
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400586e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400424f7
xor al, al
jmp 0x140042527
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x1401efa10]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x1401efa30]
call sub.VCRUNTIME140.dll_memcpy
mov al, 1
add rsp, 0x38
ret
Function at 0x1400430c4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140043100
xor al, al
jmp 0x140043173
mov r8d, 0x1e
lea rdx, [0x1401efa10]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x24], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [rsp + 0x24], 0
jle 0x14004316a
mov byte [rsp + 0x20], 1
jmp 0x14004316f
mov byte [rsp + 0x20], 0
mov al, byte [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140044a4c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140044a7c
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x140044afe
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140044aca
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140044ad2
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140044a71
mov qword [rsp + 8], 0xe3
jmp 0x140044b16
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140044b9d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140044b67
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140044b6f
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140044b09
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140044bf1
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x140044bf9
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140044c40
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140044c61
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140044ce5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140044cb0
mov dword [rsp + 4], 0x9908b0df
jmp 0x140044cb8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140044c54
add rsp, 0x18
ret

Function at 0x140048298
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x1401ee900]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14004832f
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x14004831c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x14004833c
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400482f4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14004fc50
add rsp, 0x170
pop rdi
ret
Function at 0x14004cf00
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret

Function at 0x14004e414
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0x130
mov rax, qword [0x1401ee900]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400437c4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
mov edx, 0x14
lea rcx, [rsp + 0xe0]
call fcn.140049e40
nop
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xc0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xa8], 0
lea rax, [0x140043c8c]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0xe0]
call fcn.140045fa4
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x90], 3
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x14004e554
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x80], rax
lea r8, [rsp + 0xe0]
lea rdx, [0x140058ab0]
lea rcx, [rsp + 0x100]
call fcn.140033d14
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call fcn.1400335f8
nop
lea rcx, [rsp + 0x100]
call fcn.140026338
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
lea rcx, [rsp + 0xe0]
call fcn.140045fa4
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1401efa80], rax
mov edx, 5
mov rcx, qword [0x1401efa80]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140058aa0]
mov rcx, qword [0x1401efa80]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x1401efa80]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x1401efa80]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
lea rcx, [rsp + 0xe0]
call fcn.140026338
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14004fc50
add rsp, 0x130
pop rdi
ret
Function at 0x140050360
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400503aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400503aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400503aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400503aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400503aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400503ac
xor al, al
add rsp, 0x28
ret

Function at 0x1423d00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1423d0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1423d1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1423d05
lea eax, [rcx + 1]
jmp 0x1423d2b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1423d3e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1423d24
sub eax, 3
jb 0x1423d5e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1423dad
sar eax, 1
movsxd rbp, eax
jb 0x1423d94
jmp 0x1423d6c
add ebx, ebx
jne 0x1423d6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1423d94
inc ecx
add ebx, ebx
jne 0x1423d7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1423d94
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1423d8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1423d7c
add ecx, 2
jmp 0x1423d99
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01423cc2
jmp 0x1423d0d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x100f000]
mov eax, dword [rdi]
or eax, eax
je 0x1423e09
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1023000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1423db9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1423e03
mov qword [rbx], rax
add rbx, 8
jmp 0x1423dd9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1423e4d
cmp al, 0xef
ja 0x1423e35
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1423e15
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1423e24
mov eax, dword [rdi]
add rdi, 4
jmp 0x1423e24
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1423ea1
sub rsp, 0xffffffffffffff80
jmp 0x45bb20
Function at 0x1400291d0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor al, al
mov rbx, rcx
cmp dword [rcx + 0x7c], 0xffffffff
je 0x140029437
nop dword [rax]
mov ecx, dword [rbx + 0x7c]
cmp ecx, 0x7c
je 0x140029437
cmp ecx, 0x29
jne 0x14002921b
cmp dword [rbx + 0x1c], 0
jne 0x140029437
test dword [rbx + 0x80], 0x10000000
je 0x140029442
cmp ecx, 0x2e
jne 0x14002927c
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.140029640
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
cmp rcx, rax
je 0x14002926f
cmp byte [rcx], 0x5c
jne 0x14002926c
inc rcx
cmp rcx, rax
je 0x14002926c
mov edx, dword [rbx + 0x80]
test dl, 8
jne 0x14002925b
movzx eax, byte [rcx]
sub al, 0x28
cmp al, 1
jbe 0x140029269
test dl, 0x10
jne 0x14002926c
movzx eax, byte [rcx]
sub al, 0x7b
test al, 0xfd
jne 0x14002926c
mov qword [rbx], rcx
inc qword [rbx]
mov rcx, rbx
call fcn.140028990
jmp 0x140029423
cmp ecx, 0x5c
jne 0x14002933a
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
cmp rcx, rax
je 0x1400292c6
cmp byte [rcx], 0x5c
jne 0x1400292c3
inc rcx
cmp rcx, rax
je 0x1400292c3
mov edx, dword [rbx + 0x80]
test dl, 8
jne 0x1400292b2
movzx eax, byte [rcx]
sub al, 0x28
cmp al, 1
jbe 0x1400292c0
test dl, 0x10
jne 0x1400292c3
movzx eax, byte [rcx]
sub al, 0x7b
test al, 0xfd
jne 0x1400292c3
mov qword [rbx], rcx
inc qword [rbx]
mov rcx, rbx
call fcn.140028990
mov eax, dword [rbx + 0x80]
and eax, 0x80
je 0x1400292fc
cmp byte [rbx + 0x78], 0x62
jne 0x1400292fc
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140029640
mov rcx, rbx
call fcn.140029180
jmp 0x14002942b
test eax, eax
je 0x14002932d
cmp byte [rbx + 0x78], 0x42
jne 0x14002932d
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.140029640
mov rax, qword [rbx + 0x48]
mov rcx, rbx
xor dword [rax + 0xc], 1
add rax, 0xc
call fcn.140029180
jmp 0x14002942b
mov rcx, rbx
call fcn.140029ea0
jmp 0x140029423
cmp ecx, 0x5b
jne 0x140029365
mov rcx, rbx
call fcn.140029180
mov rcx, rbx
call fcn.140029db0
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.140029d50
jmp 0x140029423
cmp ecx, 0x28
jne 0x14002939c
mov rcx, rbx
call fcn.140029180
mov rcx, rbx
call fcn.140029f90
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.140029d50
test dil, dil
je 0x14002942b
jmp 0x140029423
cmp ecx, 0x5e
jne 0x1400293b9
lea rcx, [rbx + 0x40]
mov edx, 2
call fcn.140029640
mov rcx, rbx
call fcn.140029180
jmp 0x14002942b
cmp ecx, 0x24
jne 0x1400293d6
lea rcx, [rbx + 0x40]
mov edx, 3
call fcn.140029640
mov rcx, rbx
call fcn.140029180
jmp 0x14002942b
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140029463
cmp ecx, 0x3f
je 0x140029463
cmp ecx, 0x7b
je 0x140029463
cmp ecx, 0x7d
jne 0x1400293fd
test dword [rbx + 0x80], 0x10000000
je 0x14002944d
cmp ecx, 0x5d
jne 0x14002940e
test dword [rbx + 0x80], 0x10000000
je 0x140029458
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14002a240
mov rcx, rbx
call fcn.140029180
mov rcx, rbx
call fcn.14002a0b0
cmp dword [rbx + 0x7c], 0xffffffff
mov al, 1
jne 0x1400291f0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, 5
call fcn.1400d1e4c
int3
mov ecx, 6
call fcn.1400d1e4c
int3
mov ecx, 4
call fcn.1400d1e4c
int3
mov ecx, 0xa
call fcn.1400d1e4c
int3
Function at 0x140099c90
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x1401bca50]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x1401bca00]
movdqa xmm4, xmmword [0x1401bca70]
movdqa xmm5, xmmword [0x1401bc980]
cmp rcx, r9
jae 0x140099ce4
add rcx, 0x20
nop dword [rax]
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x140099cc0
movdqa xmm0, xmmword [0x1401bc7a0]
movdqa xmm1, xmmword [0x1401bca80]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqa xmmword [r8], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqa xmmword [r8 + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqa xmmword [r8 + 0x20], xmm4
movdqa xmmword [r8 + 0x30], xmm5
ret
Function at 0x14009afa0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
movdqa xmm4, xmmword [0x1401bca20]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x1401bc7b0]
mov r9, rcx
movdqa xmm0, xmmword [rcx]
movdqa xmm1, xmmword [rcx + 0x10]
movdqa xmm2, xmmword [rcx + 0x20]
movdqa xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1401bc7f0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1401bc930]
cmp r8, r10
jae 0x14009b025
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqa xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqa xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqa xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqa xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x14009aff0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqa xmmword [r9], xmm0
movdqa xmmword [r9 + 0x10], xmm1
movdqa xmmword [r9 + 0x20], xmm2
movdqa xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret