joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007c1e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14007c20f
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14007c207
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14007c258
mov ecx, dword [0x1401000b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007c248
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14007c248
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x14007c263
inc ecx
inc rax
cmp rax, 2
jl 0x14007c236
mov rcx, rbx
call fcn.1400944d4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14007cc50
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400f7368]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x20], 0
je 0x14007cca1
mov r8, qword [rcx + 0x18]
mov qword [rbp - 0x21], r8
mov rax, qword [rcx + 0x28]
mov qword [rbp - 0x11], rax
mov rax, qword [r8 + 8]
mov rdx, rcx
lea rcx, [rbp - 0x39]
call rax
jmp 0x14007ccb1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x11], 0
mov rax, qword [rbx + 0x30]
mov qword [rbp - 9], rax
lea rdx, [rdi + 8]
lea rcx, [rbp + 0x1f]
call fcn.14007f9f8
nop
cmp qword [rbp - 0x19], 0
je 0x14007cde4
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14007cd01
lea rcx, [0x14007d680]
mov qword [rbp - 0x49], rcx
lea rcx, [rbp + 0x17]
mov qword [rbp - 0x41], rcx
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call rax
jmp 0x14007cda4
mov rdi, qword [rcx + 0x10]
lea rdx, [rbp + 0x1f]
lea rcx, [rbp + 7]
call fcn.14007f9f8
lea rax, [rbp - 1]
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x59]
mov qword [rbp + 0x2f], rax
mov ecx, dword [0x1401000b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007cd39
mov rdx, qword [rax + 8]
jmp 0x14007cd3b
xor edx, edx
mov r8d, 0x28
call fcn.140041c70
mov rbx, rax
mov qword [rbp + 0x3f], 0
lea rcx, [rax + 0x10]
lea rdx, [rbp + 7]
call fcn.14007f9f8
lea rax, [0x14007d790]
mov qword [rbx], rax
mov qword [rbp - 0x51], rbx
mov qword [rbp + 0x37], 0
lea rcx, [rbp + 0x2f]
call fcn.14007d5e0
nop
lea rcx, [rbp + 7]
call fcn.14007fad8
nop
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x39]
call rdi
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14007cda4
mov rax, qword [rcx]
xor edx, edx
call rax
nop
lea rcx, [rbp + 0x1f]
call fcn.14007fad8
nop
cmp qword [rbp - 0x19], 0
je 0x14007cdc3
mov rax, qword [rbp - 0x21]
mov rdx, qword [rax]
lea rcx, [rbp - 0x39]
call rdx
nop
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14008c930
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [rbp + 0x2f]
call fcn.140037d90
nop
lea rcx, [rbp + 0x2f]
call fcn.14003daa0
int3
Function at 0x14007d3f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1400f7368]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
cmp qword [rcx + 0x20], 0
je 0x14007d50c
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14007d463
lea rcx, [0x14007d760]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call rax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14008c930
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rdi, qword [rcx + 0x10]
mov rax, qword [rdx]
xor esi, esi
mov qword [rdx], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov ecx, dword [0x1401000b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007d49f
mov rdx, qword [rax + 8]
jmp 0x14007d4a2
mov rdx, rsi
mov r8d, 0x18
call fcn.140041c70
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rsi
mov qword [rax + 8], rcx
lea rcx, [0x14007d8e0]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x50]
call fcn.14007d6c0
nop
lea rcx, [rsp + 0x28]
call fcn.140040580
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call rdi
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14007d507
mov rax, qword [rcx]
xor edx, edx
call rax
nop
jmp 0x14007d444
lea rcx, [rsp + 0x50]
call fcn.140037d90
nop
lea rcx, [rsp + 0x50]
call fcn.14003daa0
int3

Function at 0x14007d5e0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14007d607
add rcx, 0x10
call fcn.14007fad8
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14007d653
mov ecx, dword [0x1401000b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007d643
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14007d643
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14007d65e
inc ecx
inc rax
cmp rax, 6
jl 0x14007d631
mov rcx, rbx
call fcn.1400944d4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x28]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret
Function at 0x14007d6c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14007d6e7
add rcx, 8
call fcn.140040580
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14007d733
mov ecx, dword [0x1401000b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007d723
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14007d723
mov ecx, 4
mov eax, ecx
cmp qword [rdx + rax*8], 0
je 0x14007d73e
inc ecx
inc rax
cmp rax, 6
jl 0x14007d711
mov rcx, rbx
call fcn.1400944d4
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x18]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 8], 0
add rsp, 0x20
pop rdi
ret

Function at 0x14007ec58
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14007ecdc
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400cc7c0]
cmp byte [rcx + rax], 0
je 0x14007ecdc
dec r8
sub rdx, 1
jne 0x14007ecc2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140084340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x50
mov rax, r8
mov rbx, rcx
test rdx, rdx
jne 0x140084365
mov eax, 0xfffffff7
add rsp, 0x50
pop rbx
ret
test rax, rax
je 0x140084458
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov ecx, dword [rbx + 0x88]
test ecx, ecx
jne 0x140084403
mov eax, dword [rbx + 0x10]
lea edx, [rcx + 1]
mov r14d, dword [rbx + 0x94]
mov rcx, rbx
mov edi, dword [rbx + 0x3c]
mov esi, dword [rbx + 0x8c]
mov ebp, dword [rbx]
mov r13d, dword [rbx + 0x98]
mov r15d, dword [rbx + 0x14]
mov r12d, dword [rbx + 0x90]
mov dword [rsp + 0x78], eax
call fcn.140084460
lea eax, [r14 + rdi]
mov dword [rbx + 0x88], 8
xor eax, esi
mov ecx, 8
xor eax, ebp
bswap eax
mov dword [rbx + 0x80], eax
lea eax, [r15 + r13]
xor eax, r12d
xor eax, dword [rsp + 0x78]
bswap eax
mov dword [rbx + 0x84], eax
mov eax, 8
sub eax, ecx
cdqe
movzx ecx, byte [rax + rbx + 0x80]
mov rax, qword [rsp + 0x68]
xor byte [rax], cl
inc rax
dec dword [rbx + 0x88]
sub qword [rsp + 0x70], 1
mov qword [rsp + 0x68], rax
jne 0x140084391
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140084640
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
movzx eax, dl
lea r10, str.cw
movzx esi, byte [rax + r10]
mov eax, edx
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
lea edi, [rsi + rsi]
movzx r15d, byte [rcx + r10]
movzx ecx, al
mov eax, edx
shr rax, 0x18
lea r9d, [r15 + r15]
movzx r14d, byte [rcx + r10]
mov r8d, r9d
xor r8d, r15d
movzx r10d, byte [rax + r10]
movzx eax, dil
xor al, 0x1b
movzx ebp, al
bt edi, 8
movzx eax, dil
cmovae ebp, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
lea r8d, [r14 + r14]
cmovae ecx, eax
mov edx, r8d
xor bpl, cl
xor edx, r14d
xor bpl, r10b
movzx eax, dl
xor al, 0x1b
xor bpl, r14b
movzx r11d, al
bt edx, 8
movzx eax, dl
cmovae r11d, eax
movzx eax, r9b
xor al, 0x1b
movzx ecx, al
bt r9d, 8
movzx eax, r9b
lea r9d, [r10 + r10]
cmovae ecx, eax
mov edx, r9d
xor edx, r10d
xor r11b, cl
xor r11b, r10b
movzx eax, dl
xor al, 0x1b
xor r11b, sil
movzx r10d, al
bt edx, 8
movzx eax, dl
cmovae r10d, eax
movzx eax, r8b
xor al, 0x1b
movzx ecx, al
bt r8d, 8
movzx eax, r8b
cmovae ecx, eax
xor edi, esi
xor r10b, cl
movzx eax, dil
xor al, 0x1b
xor r10b, r15b
movzx ecx, al
xor r10b, sil
movzx eax, dil
bt edi, 8
cmovae ecx, eax
movzx eax, r9b
xor al, 0x1b
movzx r8d, cl
movzx ecx, al
movzx eax, r9b
mov rbx, qword [rsp + 0x18]
bt r9d, 8
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmovae ecx, eax
movzx eax, cl
xor eax, r8d
movzx ecx, r10b
xor eax, r14d
xor eax, r15d
shl eax, 8
or eax, ecx
movzx ecx, r11b
shl eax, 8
or eax, ecx
movzx ecx, bpl
mov rbp, qword [rsp + 0x20]
shl eax, 8
or eax, ecx
pop r15
pop r14
ret
Function at 0x14008ae10
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x14008b110
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x1400ce9d0]
test edx, edx
je 0x14008b181
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x14008b142
mov r9d, r10d
cmp r10d, esi
jae 0x14008b264
lea r11, [r8 + r10*4]
lea rbx, [0x1400ce9e0]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x14008b1fc
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x14008b248
cmp r10d, 6
jbe 0x14008b248
cmp edx, 4
jne 0x14008b248
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x14008b1a0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x14008ae30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], r9
mov r9, rdx
mov rdx, rcx
mov qword [rsp + 0x20], r8
mov ecx, 0xe
lea r8, [0x1400ce9e0]
call fcn.14008b280
add rsp, 0x38
ret

Function at 0x14008ae60
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14008af90
movups xmm0, xmmword [0x1400ce990]
xor eax, eax
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x1400ce9a0]
mov qword [rbx + 0x20], rax
mov dword [rbx + 0x28], eax
movups xmmword [rbx + 0x10], xmm1
add rsp, 0x20
pop rbx
ret
Function at 0x14008b110
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov r9, rdx
mov r8, rcx
mov edx, 8
lea ecx, [rdx + 6]
jmp 0x14008b110
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
mov r10d, edx
lea esi, [rcx*4 + 4]
mov rdi, r8
lea rbp, [0x1400ce9d0]
test edx, edx
je 0x14008b181
mov rbx, r8
lea eax, [r11*4]
inc r11d
movzx edx, byte [rax + r9 + 3]
lea rbx, [rbx + 4]
shl edx, 8
mov ecx, eax
movzx eax, byte [rax + r9 + 2]
or edx, eax
shl edx, 8
movzx eax, byte [rcx + r9 + 1]
or edx, eax
movzx eax, byte [rcx + r9]
shl edx, 8
or edx, eax
mov dword [rbx - 4], edx
cmp r11d, r10d
jb 0x14008b142
mov r9d, r10d
cmp r10d, esi
jae 0x14008b264
lea r11, [r8 + r10*4]
lea rbx, [0x1400ce9e0]
nop dword [rax + rax]
lea eax, [r9 - 1]
xor edx, edx
mov ecx, dword [rdi + rax*4]
mov eax, r9d
div r10d
test edx, edx
jne 0x14008b1fc
mov r8d, ecx
movzx eax, cl
movzx ecx, byte [rax + rbx]
mov eax, r8d
shr rax, 0x18
shl ecx, 8
movzx eax, byte [rax + rbx]
or ecx, eax
mov eax, r8d
shr rax, 0x10
shl ecx, 8
movzx edx, al
shr r8, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
movzx eax, byte [rbp]
or ecx, edx
xor ecx, eax
inc rbp
jmp 0x14008b248
cmp r10d, 6
jbe 0x14008b248
cmp edx, 4
jne 0x14008b248
mov r8, rcx
mov rax, rcx
shr rax, 0x10
movzx ecx, al
mov rax, r8
shr rax, 0x18
movzx ecx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
shl eax, 8
or ecx, eax
mov rax, r8
shr rax, 8
movzx edx, al
shl ecx, 8
movzx eax, byte [rdx + rbx]
or ecx, eax
movzx eax, r8b
shl ecx, 8
movzx edx, byte [rax + rbx]
or ecx, edx
mov eax, r9d
inc r9d
sub eax, r10d
xor ecx, dword [rdi + rax*4]
mov dword [r11], ecx
add r11, 4
cmp r9d, esi
jb 0x14008b1a0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14008d7bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008d806
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008d806
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008d806
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008d806
cmp dword [rcx + 0x84], 0xe
jbe 0x14008d806
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008d808
xor al, al
add rsp, 0x28
ret

Function at 0x1400a0124
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14009ff50
Function at 0x1400b4dd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400b4df8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400b4df8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140132553
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x30], 0xf6f6f6f6
cmp edx, 0xc
jb 0x1401323f6
je 0x140132585
jne 0x140132585
mul r8
cmp r13, rbp
syscall
add r11d, 0x189c1a4b
jp 0x140132a3f
jmp rax
jmp 0x1401321dd
fst qword [rcx + 0x48]
mov edi, 0xc0e9
add dh, dl
invalid
Function at 0x18000c240
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x18000c3f8
cmp ecx, 0x7c
je 0x18000c3f8
cmp ecx, 0x29
jne 0x18000c288
cmp dword [rbx + 0x1c], 0
jne 0x18000c3f8
test dword [rbx + 0x80], 0x10000000
je 0x18000c411
jmp 0x18000c3c8
cmp ecx, 0x2e
jne 0x18000c29b
lea rcx, [rbx + 0x40]
call fcn.18000bae0
jmp 0x18000c3d5
cmp ecx, 0x5c
jne 0x18000c2ff
mov rcx, rbx
call fcn.18000f980
test byte [rbx + 0x80], 0x80
je 0x18000c2f2
movzx eax, byte [rbx + 0x78]
cmp al, 0x62
jne 0x18000c2cf
lea rcx, [rbx + 0x40]
call fcn.18000c160
mov rcx, rbx
call fcn.18000f980
jmp 0x18000c3e5
cmp al, 0x42
jne 0x18000c2f2
lea rcx, [rbx + 0x40]
call fcn.18000c160
lea rcx, [rbx + 0x40]
call fcn.18000f900
mov rcx, rbx
call fcn.18000f980
jmp 0x18000c3e5
mov rcx, rbx
call fcn.18000c490
jmp 0x18000c3dd
cmp ecx, 0x5b
jne 0x18000c32c
mov rcx, rbx
call fcn.18000f980
mov rcx, rbx
call fcn.18000d0a0
mov edx, 0x5d
mov r8d, 4
mov rcx, rbx
call fcn.18000e720
jmp 0x18000c3dd
cmp ecx, 0x28
jne 0x18000c362
mov rcx, rbx
call fcn.18000f980
mov rcx, rbx
call fcn.1800105f0
mov edx, 0x29
mov r8d, 5
mov rcx, rbx
movzx edi, al
call fcn.18000e720
test dil, dil
je 0x18000c3e5
jmp 0x18000c3dd
cmp ecx, 0x5e
jne 0x18000c37a
lea rcx, [rbx + 0x40]
call fcn.18000b870
mov rcx, rbx
call fcn.18000f980
jmp 0x18000c3e5
cmp ecx, 0x24
jne 0x18000c392
lea rcx, [rbx + 0x40]
call fcn.18000bb90
mov rcx, rbx
call fcn.18000f980
jmp 0x18000c3e5
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x18000c403
cmp ecx, 0x3f
je 0x18000c403
cmp ecx, 0x7b
je 0x18000c403
cmp ecx, 0x7d
jne 0x18000c3b7
test dword [rbx + 0x80], 0x10000000
je 0x18000c41f
jmp 0x18000c3c8
cmp ecx, 0x5d
jne 0x18000c3c8
test dword [rbx + 0x80], 0x10000000
je 0x18000c42d
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.18000b880
mov rcx, rbx
call fcn.18000f980
mov rcx, rbx
call fcn.18000fa30
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
je 0x18000c3f8
cmp ecx, 0x7c
jne 0x18000c264
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.18000e6d0
int3
mov edx, 5
mov rcx, rbx
call fcn.18000e6d0
int3
mov edx, 6
mov rcx, rbx
call fcn.18000e6d0
int3
mov edx, 4
mov rcx, rbx
call fcn.18000e6d0
int3
Function at 0x1800159e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1800159f1
mov ecx, edx
jmp 0x180015a3a
mov ecx, 1
call fcn.180015af0
mov rcx, rax
call fcn.180015a60
mov rcx, rax
mov rdx, rbx
call 0x180015bf0
test rax, rax
jne 0x180015a57
mov ecx, 3
call fcn.180015af0
mov rcx, rax
call fcn.180015a60
mov rcx, rax
mov rdx, rbx
call 0x180015bf0
test rax, rax
jne 0x180015a57
mov ecx, 2
call fcn.180015af0
mov rcx, rax
call fcn.180015a60
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x180015bf0
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r12, rcx
add r13, rcx
cmp rdx, 0xffff
ja 0x180015c4f
sub bp, word [rdi + 0x10]
movzx eax, bp
cmp eax, dword [rdi + 0x14]
jae 0x180015c7a
movzx eax, bp
mov eax, dword [r12 + rax*4]
add rax, rcx
jmp 0x180015c7c
mov r15d, dword [rdi + 0x20]
xor ebx, ebx
add r15, rsi
cmp dword [rdi + 0x18], ebx
jbe 0x180015c7a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, rbp
add rdx, rsi
call 0x180016050
test eax, eax
je 0x180015c99
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x180015c60
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rsi
jmp 0x180015c7c

Function at 0x180015b90
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x180015bae
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x180015bb2
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret
Function at 0x180015bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1800159f1
mov ecx, edx
jmp 0x180015a3a
mov ecx, 1
call fcn.180015af0
mov rcx, rax
call fcn.180015a60
mov rcx, rax
mov rdx, rbx
call 0x180015bf0
test rax, rax
jne 0x180015a57
mov ecx, 3
call fcn.180015af0
mov rcx, rax
call fcn.180015a60
mov rcx, rax
mov rdx, rbx
call 0x180015bf0
test rax, rax
jne 0x180015a57
mov ecx, 2
call fcn.180015af0
mov rcx, rax
call fcn.180015a60
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x180015bf0
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r12, rcx
add r13, rcx
cmp rdx, 0xffff
ja 0x180015c4f
sub bp, word [rdi + 0x10]
movzx eax, bp
cmp eax, dword [rdi + 0x14]
jae 0x180015c7a
movzx eax, bp
mov eax, dword [r12 + rax*4]
add rax, rcx
jmp 0x180015c7c
mov r15d, dword [rdi + 0x20]
xor ebx, ebx
add r15, rsi
cmp dword [rdi + 0x18], ebx
jbe 0x180015c7a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, rbp
add rdx, rsi
call 0x180016050
test eax, eax
je 0x180015c99
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x180015c60
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rsi
jmp 0x180015c7c

Function at 0x180015cb0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x180015cf4
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x180015cdf
mov rax, qword [rax]
test rax, rax
jne 0x180015cd0
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret