joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001173
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
nop
cpuid
nop
mov eax, 1
nop
cpuid
nop
movabs r9, 0xb2d05e00
nop
cpuid
nop
rdtsc
nop
shl rdx, 0x20
nop
or rax, rdx
nop
mov rcx, rax
nop
fldpi
nop
frndint
nop
rdtsc
nop
shl rdx, 0x20
nop
or rax, rdx
nop
sub rax, rcx
nop
cmp rax, r9
nop
jb 0x1400011a0
nop
nop
push rbp
nop
mov rbp, rsp
nop
sub rsp, 8
nop
mov r10, 0xa
nop
mov rcx, 0xffffffff9f345678
nop
dec rcx
nop
xor r9, r9
nop
mov rax, rcx
nop
jne 0x1400011d9
nop
xor rax, rax
nop
mov rax, rbx
nop
add rax, rdx
nop
dec r10
nop
xor r11, r11
nop
jne 0x1400011d0
nop
xor rax, rax
mov rax, 0xa
nop
dec rax
nop
add rsp, 8
pop rbp
ret

Function at 0x140002b2c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0xa0
xor rcx, rcx
mov rdx, 0xaa97
mov r8, 0x1000
mov r9, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140002c9e
mov rdi, rax
call 0x140002b63
pop rsi
add rsi, 0x15b8d
mov rcx, 0xaa97
rep movsb byte [rdi], byte [rsi]
call rax
pop rbp
pop rbx
ret
add byte [rax - 0x77], cl
and al, 0x50

Function at 0x140003654
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x110
mov rsi, rdx
mov rbp, rcx
lea rdx, [0x140017584]
mov rcx, r8
mov rdi, r9
mov rbx, r8
call fcn.1400057e8
test eax, eax
jne 0x140003693
lea rbx, [0x140017568]
jmp 0x1400036e9
lea rdx, [0x140017798]
mov rcx, rbx
call fcn.1400057e8
test eax, eax
jne 0x1400036af
lea rbx, [0x140017650]
jmp 0x1400036e9
lea rdx, [0x1400177a8]
mov rcx, rbx
call fcn.1400057e8
test eax, eax
jne 0x1400036cb
lea rbx, [0x140017670]
jmp 0x1400036e9
lea rdx, [0x1400177c0]
mov rcx, rbx
call fcn.1400057e8
test eax, eax
jne 0x140003772
lea rbx, [0x140017690]
lea rcx, [rbp + 0x28]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ole32.dll_StringFromIID]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000589c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, [0x140013a6c]
lea rcx, [rsp + 0x40]
call fcn.140005870
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140005870
lea rcx, [rsp + 0x40]
call fcn.140005524
mov rcx, qword [rdi]
mov esi, 1
add eax, eax
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140003772
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140003774
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140130cd0
Capabilities:
Access peb ldr_data

Disassembly:
test ecx, 0xea6d5cfd
call fcn.1401312a4

Function at 0x1401312a4
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x34], 0xf6f6f6f6
jmp 0x1401313e3
mov word [rsp + 0x38], 0xf6f6
mov dword [rsp + 0x3f], 0x6e383c3d
movzx edx, word [rcx + rsi*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
jmp 0x140131368

Function at 0x14013136b
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x3b]
movzx ecx, byte [rsp + rdx + 0x30]
add cl, al
mov byte [rsp + rdx + 0x3b], cl
mov byte [rsp + rdx + 0x30], bl
jmp 0x14013131f
mov rdi, rax
mov esi, ebx
movsxd rcx, dword [rax + 0x3c]
mov r9d, dword [rcx + rax + 0x88]
mov r10d, dword [r9 + rax + 0x20]
nop dword [rax]
jmp 0x1401312f2
nop word [rax + rax]
inc rdx
cmp rdx, 0xa
jb 0x1401312ba
xor edx, edx
jmp 0x140131333
lea rcx, [rsp + 0x3b]
mov r8d, 0x800
call rdi
jmp 0x1401312d3
and al, 0x38
div dh
mov word [rsp + 0x43], 0x7676
mov edi, dword [rcx + rdx*4]
xchg rdx, rbx
jmp 0x140131381
mov rbx, rdx
xchg rdx, rbx
add rdi, r8
xor eax, eax
mov byte [rsp + 0x45], al
jmp 0x1401312b1

Function at 0x1401340be
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
loopne 0x1401340de
wait
int3
mov dword [rbp + 0x44], r8d
jmp fcn.140134651

Function at 0x140135292
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
add byte [rsi - 0x63], ah
xor edi, 0xcb15ba1a
movabs r10, 0x4dbc15000000d0e9
call 0x140135498
Function at 0x14003b0a5
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x14005cbb0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x140184084]
call fcn.14003cedc
nop
mov rax, qword [rbp + 0x100]
mov rcx, rax
call fcn.14003ba5a
nop
mov dword [rbp + 0xc4], 0
mov rax, qword [rbp + 0x100]
add rax, 0x30
mov rcx, qword [rbp + 0x100]
add rcx, 0x20
lea r8, [rbp + 0xc4]
mov rdx, rax
call fcn.14003d1d9
nop
mov rax, qword [rbp + 0x100]
add rax, 0x30
lea rcx, [0x1400b9f00]
add rcx, 0x20
mov r8, rax
mov rdx, rcx
lea rcx, [0x1400b9f00]
call fcn.14003b799
nop
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14003b325
Capabilities:
Write file on windows

Disassembly:
jmp 0x140064500
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140184061]
call fcn.14003cedc
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140064558
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14006466a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140064603
cmp qword [rbp + 0x28], 0
jle 0x140064603
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1400645a1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14003ccc5
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x140064659
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140064659
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14003b7f3
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x140053c90
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14018408b]
call fcn.14003cedc
nop
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x138
jne 0x140053cce
mov rcx, qword [rbp + 0x100]
call fcn.14003b5aa
nop
jmp 0x140053cea
mov rax, qword [rbp + 0x100]
cmp dword [rax], 0x270
jb 0x140053cea
mov rcx, qword [rbp + 0x100]
call fcn.14003bf73
nop
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x100]
mov rax, qword [rcx + rax*8 + 8]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax]
inc eax
mov rcx, qword [rbp + 0x100]
mov dword [rcx], eax
mov rax, qword [rbp + 8]
shr rax, 0x1d
mov rcx, qword [rbp + 0x100]
and rax, qword [rcx + 0x1388]
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shl rax, 0x25
movabs rcx, 0xfff7eee000000000
and rax, rcx
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
shr rax, 0x2b
mov rcx, qword [rbp + 8]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14003bf73
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jmp 0x1400573e0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x14018408b]
call fcn.14003cedc
nop
mov qword [rbp + 8], 0x137
mov qword [rbp + 0x28], 0x9c
mov qword [rbp + 0x48], 0
jmp 0x140057425
mov rax, qword [rbp + 0x48]
inc rax
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0x9c
jae 0x1400574ce
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x48]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
and rax, 1
test rax, rax
je 0x14005748d
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x140057498
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0x68]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
xor rax, qword [rcx + rdx*8 + 0xea8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x48]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005741a
mov qword [rbp + 0x88], 0x9c
jmp 0x1400574ec
mov rax, qword [rbp + 0x88]
inc rax
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0x137
jae 0x1400575ad
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x88]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
and rax, 1
test rax, rax
je 0x140057563
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14005756e
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xa8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x88]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400574db
mov qword [rbp + 0xc8], 0x137
mov eax, 8
imul rax, rax, 0x26f
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rcx + rax + 8]
and rax, 0xffffffff80000000
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x1e0]
mov rcx, qword [rdx + rcx + 8]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
and rax, 1
test rax, rax
je 0x14005761f
movabs rax, 0xb5026f5aa96619e9
mov qword [rbp + 0x1b8], rax
jmp 0x14005762a
mov qword [rbp + 0x1b8], 0
mov rax, qword [rbp + 0xe8]
shr rax, 1
xor rax, qword [rbp + 0x1b8]
mov ecx, 8
imul rcx, rcx, 0x9b
mov rdx, qword [rbp + 0x1e0]
xor rax, qword [rdx + rcx + 8]
mov ecx, 8
imul rcx, rcx, 0x137
mov rdx, qword [rbp + 0x1e0]
mov qword [rdx + rcx + 8], rax
mov rax, qword [rbp + 0x1e0]
mov dword [rax], 0
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x14003c194
Capabilities:
Terminate process

Disassembly:
jmp 0x1400ad5f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14003c536
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400ade40
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400ade60
xor al, al
jmp 0x1400adee1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400ade73
xor al, al
jmp 0x1400adee1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400ade9d
xor al, al
jmp 0x1400adee1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400adeb1
xor al, al
jmp 0x1400adee1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400adec3
xor al, al
jmp 0x1400adee1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400adedf
xor al, al
jmp 0x1400adee1
mov al, 1
add rsp, 0x38
ret
Function at 0x14003ce6e
Capabilities:
Write file on windows

Disassembly:
jmp 0x140055880
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140175040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x140184061]
call fcn.14003cedc
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x1400558e7
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400558ee
mov al, 1
jmp 0x140055a3e
call fcn.14003b8bb
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.14003b8bb
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.14003c82e
movzx eax, al
test eax, eax
je 0x14005593f
xor al, al
jmp 0x140055a3e
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x1400559a4
cmp dword [rbp + 0x154], 1
je 0x1400559af
cmp dword [rbp + 0x154], 3
je 0x140055a2d
jmp 0x140055a3c
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1400559ff
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1400559ff
xor al, al
jmp 0x140055a3e
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140055a1a
mov dword [rbp + 0x154], 1
jmp 0x140055a24
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140055a3e
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140055a3e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400bd1e0]
call fcn.14003c95a
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.14003bebf
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400abc40
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14003d017
movzx eax, al
test eax, eax
jne 0x1400abc60
mov ecx, 7
call fcn.14003c996
nop
mov byte [rsp + 0x20], 0
call fcn.14003ca1d
mov byte [rsp + 0x21], al
cmp dword [0x140175ce0], 1
jne 0x1400abc84
mov ecx, 7
call fcn.14003c996
nop
jmp 0x1400abcdc
cmp dword [0x140175ce0], 0
jne 0x1400abcd7
mov dword [0x140175ce0], 1
lea rdx, [0x1400b9898]
lea rcx, [0x1400b9568]
call fcn.14003be74
test eax, eax
je 0x1400abcb8
mov eax, 0xff
jmp 0x1400abde1
lea rdx, [0x1400b9458]
lea rcx, [section..rdata]
call fcn.14003c9fa
mov dword [0x140175ce0], 2
jmp 0x1400abcdc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14003c92d
call fcn.14003c5f4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400abd39
mov rcx, qword [rsp + 0x30]
call fcn.14003bc03
movzx eax, al
test eax, eax
je 0x1400abd39
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140185020]
nop
call fcn.14003c77a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400abd6d
mov rcx, qword [rsp + 0x38]
call fcn.14003bc03
movzx eax, al
test eax, eax
je 0x1400abd6d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14003cdc9
nop
call fcn.1400abe50
mov dword [rsp + 0x28], eax
call fcn.14003c536
movzx eax, al
test eax, eax
jne 0x1400abd8c
mov ecx, dword [rsp + 0x28]
call fcn.14003b267
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400abd9b
call fcn.14003ce37
nop
xor edx, edx
mov cl, 1
call fcn.14003bb45
mov eax, dword [rsp + 0x28]
jmp 0x1400abde1
add rsp, 0x68
ret
Function at 0x140028d50
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140028e1c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140028e1c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140028e35
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140028e0c
cmp byte [rax], 0x5c
jne 0x140028e06
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140028e06
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140028df2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140028e03
test r8b, 0x10
jne 0x140028e06
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140028e06
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.14002ce50
test edi, edi
jne 0x140028d70
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.14002a340
int3

Function at 0x14002dc50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14002dc84
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14002dc70
ret
Function at 0x140038690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f8480]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400386bd
xor eax, eax
jmp 0x14003880b
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400386f7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400386f7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14003880b
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400387fe
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14003873a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140038749
movsx ecx, dil
jmp 0x14003879d
lea r8, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x41]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x1400387b7
sub eax, 1
je 0x1400387b7
cmp eax, 2
jne 0x1400387fe
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call fcn.14009e8c4
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140038803
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400387e4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.14009f1b0
cmp rsi, rax
jne 0x1400387fe
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140038803
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14008f990
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140038ec0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140038ef1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x140038f6b
mov rdi, r14
mov rcx, rbx
call fcn.14002ae10
test rax, rax
jle 0x140038f43
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400b3b00
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140038f5b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140038f63
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140038f05
sub r14, rdi
jmp 0x14003904f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140038f82
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140038f84
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140038fb6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400b3b00
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14003904c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140038ff1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14003902d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14009ec48
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14003904c
cmp rbp, rax
ja 0x140039000
test rbp, rbp
je 0x14003904c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14009ec48
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret