joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034f00
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1400530c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov byte [rsp + 0x20], 0
test rax, rax
je 0x140034f67
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x140034f67
lea rcx, [rsp + 0x20]
call qword [case.0x14000a217.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003ed80
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003ed80
add rsp, 0x148
ret
jmp 0x140034f00

Function at 0x140034f90
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x1400530c0]
xor rax, rsp
mov qword [rsp + 0x130], rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov byte [rsp + 0x20], 0
test rax, rax
je 0x140034f67
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x140034f67
lea rcx, [rsp + 0x20]
call qword [case.0x14000a217.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003ed80
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14003ed80
add rsp, 0x148
ret
jmp 0x140034f00
Function at 0x140038a60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx]
mov rsi, rdx
cmp dword [rcx + 8], 2
jne 0x140038aaa
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x140038a9a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x140038af4
cmp qword [rbx + 0x10], 0
jne 0x140038adf
mov rcx, qword [rcx + 0x10]
lea rdx, [0x140043aec]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x140038adf
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, rax
test rax, rax
jne 0x140038b18
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140038b0f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14003a520
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14003a540
lea rcx, [rbx + rbx]
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x14003a563
lea eax, [rdi + 0x1b]
jmp 0x14003a632
xor ecx, ecx
test rbx, rbx
je 0x14003a584
nop word [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rdi + rcx*2], al
mov byte [rdi + rcx*2 + 1], 0
inc rcx
cmp rcx, rbx
jb 0x14003a570
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14003a61f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14003a612
mov rcx, qword [rsp + 0x30]
lea r8d, [rbx + rbx]
xor r9d, r9d
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbp
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbp + 0x10], eax
mov byte [rbp + 0x14], al
call qword [case.0x14002141b.0]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003b380
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov byte [rcx], 0
mov rdi, rcx
call qword [sym.imp.WS2_32.dll_gethostname]
lea edx, [rbx - 1]
movsxd r8, edx
mov byte [r8 + rdi], 0
test eax, eax
jne 0x14003b3bd
lea edx, [rax + 0x2e]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
je 0x14003b3bb
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003ec30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x14003ec72
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x14003ecb5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x14003ed12
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x14003ecd0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x14003ed53
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14004c60b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14004c60c]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x14003ed20
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x14003f8f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003f942
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003f942
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003f942
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003f942
cmp dword [rcx + 0x84], 0xe
jbe 0x14003f942
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003f944
xor al, al
add rsp, 0x28
ret
Function at 0x14002953c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001cc04
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001cc04
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002968c
cmp rax, 0xffffffffffffffff
je 0x14002968c
xor edi, edi
test rbp, rbp
jle 0x140029637
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f530
mov rbx, rax
test rax, rax
jne 0x1400295c4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002962d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a538
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d8e0
cmp eax, 0xffffffff
je 0x14002960d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400295d4
mov edx, r15d
mov ecx, r14d
call fcn.14001a538
jmp 0x14002962d
cmp byte [rsi + 0x38], dil
je 0x140029624
cmp dword [rsi + 0x34], 5
jne 0x140029624
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002962d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b2cc
jmp 0x1400296a0
jns 0x1400296a0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001cc04
cmp rax, 0xffffffffffffffff
jne 0x140029658
cmp byte [rsi + 0x30], dil
je 0x1400296a0
mov edi, dword [rsi + 0x2c]
jmp 0x1400296a0
mov ecx, r14d
call fcn.1400189f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400296a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400296a0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029699
mov eax, dword [rsi + 0x2c]
jmp 0x14002969e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001cc04
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x403420
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x403460
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x403457
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x403462
add rax, 0x28
cmp rax, r9
jne 0x403444
xor eax, eax
repz ret

Function at 0x403520
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp word [0x00400000], 0x5a4d
lea rbx, [0x00400000]
mov rsi, rcx
je 0x403544
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
call fcn.004033e0
test eax, eax
je 0x40353b
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00403420
Function at 0x533bd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 8]
lea r12d, [rax - 1]
test byte [rcx + 0x14], 4
jne 0x533c20
test eax, eax
je 0x533c07
mov rax, qword [rcx]
movsxd rdx, r12d
shl r12d, 6
mov rcx, qword [rax + rdx*8]
call fcn.00533b00
add eax, r12d
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
not eax
mov edx, dword [rcx + 0xc]
and eax, r12d
sar eax, 0x1f
not eax
mov dword [rsp + 0x2c], eax
test edx, edx
jle 0x533d50
mov r15, qword [rcx]
lea r14d, [rdx - 1]
xor ebp, ebp
xor eax, eax
xor r13d, r13d
nop word [rax + rax]
mov ecx, r12d
mov rsi, qword [r15 + rbp*8]
xor ecx, ebp
mov r8d, ecx
sub ecx, 1
mov rdx, rsi
not r8d
shr rdx, 0x20
and ecx, r8d
sar ecx, 0x1f
or r13d, ecx
mov r8d, ecx
mov rcx, rdx
xor rdx, rsi
neg rcx
sar rcx, 0x3f
and rdx, rcx
xor rdx, rsi
mov r9, rdx
shr r9, 0x10
mov rbx, r9
xor r9, rdx
neg rbx
sar rbx, 0x3f
and r9, rbx
xor rdx, r9
mov r9, rdx
shr r9, 8
mov r11, r9
xor r9, rdx
neg r11
sar r11, 0x3f
and r9, r11
xor rdx, r9
mov r9, rdx
shr r9, 4
mov r10, r9
xor r9, rdx
neg r10
sar r10, 0x3f
and r9, r10
xor rdx, r9
mov r9, rdx
shr r9, 2
mov rdi, r9
neg rdi
sar rdi, 0x3f
xor r9, rdx
and ecx, 0x20
and r9, rdi
test rsi, rsi
setne sil
and ebx, 0x10
and r11d, 8
xor rdx, r9
movzx esi, sil
and r10d, 4
shr rdx, 1
and edi, 2
add ecx, esi
neg rdx
add ecx, ebx
sar rdx, 0x3f
add ecx, r11d
add r10d, ecx
lea ecx, [r10 + rdi]
sub ecx, edx
mov edx, ecx
mov ecx, r13d
not ecx
and edx, r8d
and ecx, 0x40
add eax, ecx
add eax, edx
mov rdx, rbp
add rbp, 1
cmp r14, rdx
jne 0x533c50
and eax, dword [rsp + 0x2c]
jmp 0x533c07
xor eax, eax
jmp 0x533c07
Function at 0x5766f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r13d, dword [rcx + 0x10]
mov esi, dword [rsp + 0xb0]
mov r12, rcx
mov r15, rdx
mov rbx, r8
mov r14, r9
test r13d, r13d
je 0x5768a8
mov edx, 0x2000
call fcn.00578750
mov r8d, eax
mov eax, esi
test r8d, r8d
je 0x576742
mov edx, esi
lea eax, [rsi + 0xe]
add edx, 7
cmovns eax, edx
sar eax, 3
mov r10, qword [r12]
mov r13d, dword [r10 + 4]
test byte [r10 + 0x12], 0x10
je 0x576780
cmp r13d, 1
je 0x576830
movsxd r9, esi
mov r8, r14
mov rdx, r15
mov rcx, r12
call qword [r10 + 0x20]
test eax, eax
js 0x57688c
mov dword [rbx], eax
mov r13d, 1
jmp 0x57688f
test esi, esi
jle 0x576938
movsxd r9, dword [r12 + 0x14]
movsxd r8, eax
mov r11, r8
lea rdx, [r15 + r9]
neg r11
mov rcx, r9
sub rdx, r14
cmp rdx, r11
seta r11b
cmp rdx, r8
setb r8b
or r11b, r8b
je 0x5767c8
test eax, eax
setg r8b
test rdx, rdx
setne al
test r8b, al
jne 0x5769a0
test ecx, ecx
jne 0x5768d0
test dword [r12 + 0x7c], esi
je 0x576950
cmp r13d, 0x20
jg 0x5769db
mov dword [rbx], 0
sub r13d, 1
and r13d, esi
sub esi, r13d
test esi, esi
jle 0x576812
mov rax, qword [r12]
movsxd r9, esi
mov r8, r14
mov rdx, r15
mov rcx, r12
call qword [rax + 0x20]
test eax, eax
je 0x57688c
add dword [rbx], esi
test r13d, r13d
jne 0x5769b0
mov dword [r12 + 0x14], r13d
mov r13d, 1
jmp 0x57688f
movsxd rcx, eax
mov rdx, r15
mov r8, rcx
sub rdx, r14
neg r8
cmp rdx, r8
seta r8b
cmp rdx, rcx
setb cl
or r8b, cl
je 0x57675b
test eax, eax
setg cl
test rdx, rdx
setne al
test cl, al
je 0x57675b
mov dword [rsp + 0x20], 0x137
mov r8d, 0xa2
mov edx, 0xdb
mov ecx, 6
lea r9, [0x0093fc20]
call fcn.00565560
xor r13d, r13d
mov eax, r13d
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 0x94
mov edx, 0xa7
mov ecx, 6
mov dword [rsp + 0x20], 0x17d
lea r9, [0x0093fc20]
call fcn.00565560
jmp 0x57688f
cmp r13d, 0x20
jg 0x5769db
mov edi, r13d
sub edi, ecx
lea rcx, [r12 + r9 + 0x38]
cmp esi, edi
jl 0x576978
movsxd r10, edi
mov rdx, r14
movsxd rbp, r13d
mov r8, r10
mov qword [rsp + 0x38], r10
call fcn.0072ff10
mov rax, qword [r12]
mov r9, rbp
mov rdx, r15
lea r8, [r12 + 0x38]
mov rcx, r12
call qword [rax + 0x20]
test eax, eax
je 0x57688c
mov r10, qword [rsp + 0x38]
mov dword [rbx], r13d
sub esi, edi
add r15, rbp
add r14, r10
jmp 0x5767eb
sete r13b
mov dword [rbx], 0
movzx r13d, r13b
jmp 0x57688f
movsxd r9, esi
mov r8, r14
mov rdx, r15
mov rcx, r12
call qword [r10 + 0x20]
mov r13d, eax
test eax, eax
je 0x5769d0
mov dword [rbx], esi
mov r13d, 1
jmp 0x57688f
movsxd r8, esi
mov rdx, r14
mov r13d, 1
call fcn.0072ff10
add dword [r12 + 0x14], esi
mov dword [rbx], 0
jmp 0x57688f
mov dword [rsp + 0x20], 0x148
jmp 0x576870
movsxd rsi, esi
lea rcx, [r12 + 0x38]
movsxd r8, r13d
lea rdx, [r14 + rsi]
call fcn.0072ff10
jmp 0x57681b
mov dword [rbx], 0
jmp 0x57688f
mov r8d, 0x156
lea rdx, [0x0093fc20]
lea rcx, [0x0093fc38]
call fcn.00620720
nop
nop word cs:[rax + rax]
Function at 0x576b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [rcx + 0x10]
mov r12, rcx
mov r13, rdx
mov rsi, r8
test eax, eax
je 0x576bf8
mov rbx, qword [rcx]
test byte [rbx + 0x12], 0x10
je 0x576ba0
xor r9d, r9d
xor r8d, r8d
call qword [rbx + 0x20]
mov edx, eax
xor eax, eax
test edx, edx
js 0x576b90
mov dword [rsi], edx
mov eax, 1
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov edi, dword [rbx + 4]
cmp edi, 0x20
ja 0x576c7b
cmp edi, 1
je 0x576c34
mov eax, dword [rcx + 0x14]
test byte [rcx + 0x6d], 1
jne 0x576c30
mov edx, edi
sub edx, eax
cmp edi, eax
jbe 0x576bdb
lea r8d, [rdx - 1]
lea rcx, [rcx + rax + 0x38]
movzx edx, dl
add r8, 1
call fcn.0072ff00
mov r9d, edi
lea r8, [r12 + 0x38]
mov rdx, r13
mov rcx, r12
call qword [rbx + 0x20]
test eax, eax
je 0x576b90
mov dword [rsi], edi
jmp 0x576b90
lea r9, [0x0093fc20]
mov r8d, 0x94
mov edx, 0x7f
mov dword [rsp + 0x20], 0x192
mov ecx, 6
mov dword [rsp + 0x3c], eax
call fcn.00565560
mov eax, dword [rsp + 0x3c]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
test eax, eax
jne 0x576c50
mov eax, 1
mov dword [rsi], 0
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8d, 0x8a
mov edx, 0x7f
mov ecx, 6
mov dword [rsp + 0x20], 0x1a8
lea r9, [0x0093fc20]
call fcn.00565560
xor eax, eax
jmp 0x576b90
mov r8d, 0x1a0
lea rdx, [0x0093fc20]
lea rcx, [0x0093fd50]
call fcn.00620720
nop
nop word cs:[rax + rax]

Function at 0x5845e0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
test rcx, rcx
je 0x584638
movzx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x584631
mov r9d, 0x100
nop word [rax + rax]
movsx edx, cl
add r8, 1
or edx, r9d
add r9d, 0x100
mov ecx, edx
shr ecx, 2
xor ecx, edx
imul edx, edx
and ecx, 0xf
rol eax, cl
movzx ecx, byte [r8]
xor eax, edx
test cl, cl
jne 0x584600
mov edx, eax
shr edx, 0x10
xor eax, edx
ret
xor eax, eax
ret

Function at 0x584be0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
je 0x584c40
movsx ecx, byte [rcx]
xor eax, eax
test cl, cl
je 0x584c30
mov edi, 0x100
xor ebx, ebx
nop
call fcn.00542930
add rsi, 1
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol ebx, cl
movsx ecx, byte [rsi]
xor ebx, eax
test cl, cl
jne 0x584c00
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x607c90
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r13, rcx
mov r12, rdx
mov rcx, r8
mov edx, 4
mov rbx, r8
mov rsi, r9
call fcn.005355d0
test eax, eax
jne 0x607cda
mov edx, 4
mov rcx, r12
call fcn.005355d0
test eax, eax
je 0x607d10
mov r9, rsi
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.00606d90
mov edx, 4
mov rcx, rsi
call fcn.005355d0
test eax, eax
jne 0x607cda
mov r9, rsi
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.00606160

Function at 0x66ef50
Capabilities:
Encode data using base64

Disassembly:
push rbx
lea r10, [0x0097e400]
test rcx, rcx
je 0x66ef6c
test byte [rcx + 0x5c], 2
lea rax, [0x0097e3a0]
cmovne r10, rax
xor r11d, r11d
test r9d, r9d
jg 0x66efd1
jmp 0x66f013
movzx eax, byte [r8 + 1]
add r8, 3
shl eax, 8
or eax, ecx
movzx ecx, byte [r8 - 1]
mov ebx, eax
shr ebx, 0x12
or ecx, eax
shr eax, 0xc
movzx ebx, byte [r10 + rbx]
and eax, 0x3f
mov byte [rdx - 4], bl
movzx eax, byte [r10 + rax]
mov byte [rdx - 3], al
mov eax, ecx
and ecx, 0x3f
shr eax, 6
and eax, 0x3f
movzx eax, byte [r10 + rax]
mov byte [rdx - 2], al
movzx eax, byte [r10 + rcx]
mov byte [rdx - 1], al
sub r9d, 3
je 0x66f013
movzx eax, byte [r8]
mov rbx, rdx
add r11d, 4
add rdx, 4
shl eax, 0x10
mov ecx, eax
cmp r9d, 2
jg 0x66ef80
je 0x66f020
shr eax, 0x12
movzx eax, byte [r10 + rax]
mov byte [rbx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x30
movzx eax, byte [r10 + rax]
mov byte [rbx + 1], al
mov eax, 0x3d
mov byte [rbx + 2], al
mov byte [rbx + 3], 0x3d
mov eax, r11d
mov byte [rdx], 0
pop rbx
ret
movzx r8d, byte [r8 + 1]
shl r8d, 8
or r8d, eax
shr eax, 0x12
movzx eax, byte [r10 + rax]
mov byte [rbx], al
mov eax, r8d
shr r8d, 6
shr eax, 0xc
and r8d, 0x3c
and eax, 0x3f
movzx eax, byte [r10 + rax]
mov byte [rbx + 1], al
movzx eax, byte [r10 + r8]
jmp 0x66f00c
Function at 0x723b80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x009abb00]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x723bf2
mov rcx, r10
call fcn.00723a70
test eax, eax
je 0x723bf2
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x723bef
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x723be6
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x723bf2
add r8, 0x28
cmp r8, r9
jne 0x723bd1
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x8a8a50
Capabilities:
Parse credit card information

Disassembly:
mov rax, qword [rcx + 0xb8]
cmp qword [rcx + 0xb0], rax
je 0x8a8a90
mov eax, dword [rcx + 0x88]
test eax, eax
je 0x8a8a78
cmp eax, 2
je 0x8a8a80
cmp eax, 1
je 0x8a8a88
ret
jmp fcn.008a8bf0
jmp fcn.008a99b0
jmp fcn.008a9010
mov dword [rcx + 0x90], 0x1b
ret
Function at 0x1400011c0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140030570
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
xor eax, eax
mov word [rsp + 0xb0], ax
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140030570
mov rcx, qword [rsp + 0xf0]
call fcn.140008e50
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400012b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
lea rdx, str.CreateProcess_failed__
lea rcx, [0x140059dd0]
call fcn.140001770
mov ecx, dword [rsp + 0x50]
mov edx, ecx
mov rcx, rax
call fcn.140005a50
lea rdx, [0x140032404]
mov rcx, rax
call fcn.140001770
lea rdx, [0x140003780]
mov rcx, rax
call fcn.140005c10
xor al, al
jmp 0x1400012da
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xe8
ret