joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b440
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x48], rdx
mov qword [rbp + 0x50], r8
mov qword [rbp + 0x90], rcx
mov rcx, qword [rbp + 0x90]
call fcn.00409680
nop
xor eax, eax
mov byte [rbp + 0x5f], al
mov rcx, qword [rbp + 0x90]
call fcn.0040aac0
mov rcx, rax
mov edx, 0x80000000
mov r8d, 1
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
test rbx, rbx
je 0x42b526
mov rcx, rbx
xor edx, edx
call sub.kernel32.dll_GetFileSize
mov esi, eax
test esi, esi
je 0x42b526
mov eax, esi
mov rcx, qword [rbp + 0x48]
cmp rax, rcx
jle 0x42b4cd
mov rsi, qword [rbp + 0x48]
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointer
mov rcx, qword [rbp + 0x50]
mov rdx, qword [0x004030d0]
mov r8d, 1
mov r9d, esi
call fcn.0040d720
mov rcx, rbx
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax]
mov r8d, esi
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x42b51e
mov al, 1
mov byte [rbp + 0x5f], al
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x90]
call fcn.004094b0
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0x70]
pop rbx
pop rsi
pop rbp
ret

Function at 0x42b840
Capabilities:
Compare security identifiers

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x88
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThread
mov rcx, rax
mov edx, 8
or r8d, 0xffffffff
lea r9, [rsp + 0x78]
call sub.advapi32.dll_OpenThreadToken
mov edi, eax
test edi, edi
jne 0x42b895
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x42b895
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
lea r8, [rsp + 0x78]
call sub.advapi32.dll_OpenProcessToken
mov edi, eax
test edi, edi
je 0x42b991
mov ecx, 0x400
call fcn.00405980
mov rsi, rax
mov rcx, qword [rsp + 0x78]
mov edx, 2
mov r8, rsi
mov r9d, 0x400
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_GetTokenInformation
mov edi, eax
mov rcx, qword [rsp + 0x78]
call sub.kernel32.dll_CloseHandle
test edi, edi
je 0x42b989
lea rax, [0x0044396c]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_AllocateAndInitializeSid
xor eax, eax
mov r13d, dword [rsi]
sub r13d, 1
mov edi, eax
cmp edi, r13d
jg 0x42b97e
sub r13d, eax
add r13d, 1
mov rcx, qword [rsp + 0x68]
movsxd rax, edi
add rax, rax
mov rdx, qword [rsi + rax*8 + 8]
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x42b972
mov bl, 1
jmp 0x42b97e
add edi, 1
sub r13d, 1
test r13d, r13d
jne 0x42b955
nop
mov rcx, qword [rsp + 0x68]
call sub.advapi32.dll_FreeSid
mov rcx, rsi
call fcn.004059b0
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x42bfc0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov edx, 0x40
xor r8, r8
call fcn.00406470
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call sub.kernel32_GlobalMemoryStatusEx
test eax, eax
je 0x42c016
mov rax, qword [rsp + 0x28]
cvtsi2sd xmm0, rax
test rax, rax
jge 0x42c006
addsd xmm0, qword [0x0042c020]
divsd xmm0, qword [0x0042c028]
call fcn.00406360
mov rbx, rax
mov eax, ebx
add rsp, 0x60
pop rbx
ret

Function at 0x42c1c0
Capabilities:
Create process on windows

Disassembly:
push rbp
sub rsp, 0xb0
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x28], r9d
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], r8
mov rcx, qword [rbp + 0xc8]
call fcn.00409680
mov rcx, qword [rbp + 0xd0]
call fcn.00409680
nop
lea rcx, [rbp + 0x40]
mov edx, 0x70
xor r8, r8
call fcn.00406470
mov dword [rbp + 0x40], 0x70
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x44], 0x500
lea rax, [0x0042c304]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0xc8]
call fcn.0040ac00
mov rcx, qword [rbp + 0x38]
call fcn.0040a670
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0xd0], 0
je 0x42c280
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0xd0]
call fcn.0040ac00
mov rcx, qword [rbp + 0x30]
call fcn.0040a670
mov qword [rbp + 0x60], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x70], eax
lea rcx, [rbp + 0x40]
call sub.shell32.dll_ShellExecuteExW
test eax, eax
setne al
mov byte [rbp + 0x2f], al
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.00409630
lea rcx, [rbp + 0xc8]
mov edx, 2
call fcn.00409590
movzx rax, byte [rbp + 0x2f]
lea rsp, [rbp + 0xb0]
pop rbp
ret
Function at 0x42c9e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x458
mov rbp, rsp
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x4a0], r8
mov qword [rbp + 0x4a8], r9
mov rcx, qword [rbp + 0x4a0]
call fcn.00409680
mov rcx, qword [rbp + 0x4a8]
call fcn.00409680
nop
xor ebx, ebx
lea rax, [rbp + 0x50]
mov dword [rax], ebx
add ebx, 1
add rax, 4
cmp ebx, 0x100
jne 0x42ca43
nop
xor esi, esi
xor ebx, ebx
lea r8, [rbp + 0x50]
xor ecx, ecx
mov rax, qword [rbp + 0x4a0]
test rax, rax
je 0x42ca6e
mov ecx, dword [rax - 4]
mov r9, qword [rbp + 0x4a0]
mov eax, ebx
cdq
idiv ecx
add edx, 1
movsxd rdx, edx
movzx eax, word [r9 + rdx*2 - 2]
mov ecx, dword [r8]
add esi, ecx
add esi, eax
and esi, 0x800000ff
jns 0x42caa1
sub esi, 1
or esi, 0xffffff00
add esi, 1
movsxd rax, esi
mov edx, dword [rbp + rax*4 + 0x50]
mov dword [r8], edx
mov dword [rbp + rax*4 + 0x50], ecx
add ebx, 1
add r8, 4
cmp ebx, 0x100
jne 0x42ca5d
nop
xor ebx, ebx
xor esi, esi
lea rcx, [rbp + 0x40]
call fcn.004094b0
xor eax, eax
mov rdx, qword [rbp + 0x4a8]
test rdx, rdx
je 0x42cadd
mov eax, dword [rdx - 4]
xor ecx, ecx
test rdx, rdx
je 0x42cae7
mov ecx, dword [rdx - 4]
test eax, 1
sete al
test ecx, ecx
setg cl
test cl, al
je 0x42cbe1
xor eax, eax
xor edi, edi
jmp 0x42cbc8
add ebx, 1
and ebx, 0x800000ff
jns 0x42cb1d
sub ebx, 1
or ebx, 0xffffff00
add ebx, 1
movsxd r13, ebx
mov ecx, dword [rbp + r13*4 + 0x50]
add esi, ecx
and esi, 0x800000ff
jns 0x42cb3b
sub esi, 1
or esi, 0xffffff00
add esi, 1
movsxd r14, esi
mov edx, dword [rbp + r14*4 + 0x50]
mov dword [rbp + r13*4 + 0x50], edx
mov dword [rbp + r14*4 + 0x50], ecx
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x4a8]
mov r8d, eax
mov r9d, 2
call fcn.0040b050
lea rcx, [rbp + 0x38]
lea rdx, [0x0042cc70]
mov r8, qword [rbp + 0x48]
call fcn.0040ae30
mov rcx, qword [rbp + 0x38]
call fcn.0041ef50
mov ecx, dword [rbp + r13*4 + 0x50]
add ecx, dword [rbp + r14*4 + 0x50]
and ecx, 0x800000ff
jns 0x42cba1
sub ecx, 1
or ecx, 0xffffff00
add ecx, 1
movsxd rcx, ecx
xor eax, dword [rbp + rcx*4 + 0x50]
lea rcx, [rbp + 0x30]
mov edx, eax
call fcn.0040aae0
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x30]
call fcn.0040ad60
add edi, 2
mov eax, edi
add eax, 1
xor ecx, ecx
mov rdx, qword [rbp + 0x4a8]
test rdx, rdx
je 0x42cbd9
mov ecx, dword [rdx - 4]
cmp edi, ecx
jl 0x42cb06
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.00409b00
nop
lea rcx, [rbp + 0x30]
mov edx, 4
call fcn.00409590
lea rcx, [rbp + 0x4a0]
mov edx, 2
call fcn.00409590
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x458]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x42e4f0
Capabilities:
Capture webcam image

Disassembly:
push rbp
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x70], rcx
mov rcx, qword [rbp + 0x70]
call fcn.004096a0
nop
cmp byte [0x00450230], 0
jne 0x42e519
call fcn.0042e460
cmp byte [0x00450230], 0
je 0x42e64f
nop
call sub.user32.dll_GetDesktopWindow
lea rcx, [0x0042e708]
mov edx, 0x40000020
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 1
call qword [0x00450228]
mov qword [0x00450220], rax
mov rcx, qword [0x00450220]
xor edx, edx
call sub.user32.dll_SetParent
mov rcx, qword [0x00450220]
mov edx, 0x40a
xor r8, r8
xor r9, r9
call sub.user32.dll_SendMessageW
test rax, rax
je 0x42e5dd
mov rcx, qword [0x00450220]
mov edx, 0x432
mov r8d, 1
xor r9, r9
call sub.user32.dll_SendMessageW
mov rcx, qword [0x00450220]
mov edx, 0x434
mov r8d, 0x18
xor r9, r9
call sub.user32.dll_SendMessageW
mov rcx, qword [0x00450220]
mov edx, 0x435
xor r8, r8
xor r9, r9
call sub.user32.dll_SendMessageW
nop
mov rcx, qword [0x00450220]
mov edx, 0x43c
xor r8, r8
xor r9, r9
call sub.user32.dll_SendMessageW
mov rbx, rax
mov rcx, qword [0x00450220]
mov edx, 0x419
xor r8, r8
mov r9, qword [rbp + 0x70]
call sub.user32.dll_SendMessageW
test rbx, rbx
setne cl
test rax, rax
setne al
test al, cl
je 0x42e64e
mov rcx, qword [0x00450220]
mov edx, 0x40b
xor r8, r8
xor r9, r9
call sub.user32.dll_SendMessageW
mov rcx, qword [0x00450220]
mov edx, 0x10
xor r8, r8
xor r9, r9
call sub.user32.dll_SendMessageW
nop
lea rcx, [rbp + 0x70]
call fcn.00409500
lea rsp, [rbp + 0x58]
pop rbx
pop rbp
ret
Function at 0x42ed80
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov ecx, 7
lea rdx, [rbp + 0x28]
call fcn.0042e750
lea rcx, [rbp + 0x2c]
lea rdx, [rbp + 0x38]
mov r8d, 4
call fcn.00405d40
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x3c]
mov r8d, 4
call fcn.00405d40
mov rax, qword [rbp + 0x38]
test rax, 8
je 0x42eddd
lea rax, [0x00450248]
movabs rcx, 0x800000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x20
je 0x42edfe
lea rax, [0x00450248]
movabs rcx, 0x1000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x100
je 0x42ee1f
lea rax, [0x00450248]
movabs rcx, 0x2000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x200
je 0x42ee40
lea rax, [0x00450248]
movabs rcx, 0x4000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x400
je 0x42ee61
lea rax, [0x00450248]
movabs rcx, 0x8000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x800
je 0x42ee82
lea rax, [0x00450248]
movabs rcx, 0x10000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x4000
je 0x42eea3
lea rax, [0x00450248]
movabs rcx, 0x20000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x10000
je 0x42eec4
lea rax, [0x00450248]
movabs rcx, 0x40000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x20000
je 0x42eee5
lea rax, [0x00450248]
movabs rcx, 0x80000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x40000
je 0x42ef06
lea rax, [0x00450248]
movabs rcx, 0x100000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x80000
je 0x42ef27
lea rax, [0x00450248]
movabs rcx, 0x200000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x400000
je 0x42ef48
lea rax, [0x00450248]
movabs rcx, 0x400000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x800000
je 0x42ef69
lea rax, [0x00450248]
movabs rcx, 0x800000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x1000000
je 0x42ef8a
lea rax, [0x00450248]
movabs rcx, 0x1000000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x4000000
je 0x42efab
lea rax, [0x00450248]
movabs rcx, 0x2000000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x8000000
je 0x42efcc
lea rax, [0x00450248]
movabs rcx, 0x4000000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x10000000
je 0x42efed
lea rax, [0x00450248]
movabs rcx, 0x8000000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x20000000
je 0x42f00e
lea rax, [0x00450248]
movabs rcx, 0x10000000000000
or qword [rax], rcx
mov rax, qword [rbp + 0x38]
test rax, 0x40000000
je 0x42f02f
lea rax, [0x00450248]
movabs rcx, 0x20000000000000
or qword [rax], rcx
mov eax, 0x80000000
mov rcx, qword [rbp + 0x38]
test rax, rcx
je 0x42f051
lea rax, [0x00450248]
movabs rcx, 0x40000000000000
or qword [rax], rcx
movabs rax, 0x100000000
mov rcx, qword [rbp + 0x38]
test rax, rcx
je 0x42f078
lea rax, [0x00450248]
movabs rcx, 0x80000000000000
or qword [rax], rcx
movabs rax, 0x200000000
mov rcx, qword [rbp + 0x38]
test rax, rcx
je 0x42f09f
lea rax, [0x00450248]
movabs rcx, 0x100000000000000
or qword [rax], rcx
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x430150
Capabilities:
Get token membership

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0x88], 0
nop
lea rax, [0x00444238]
mov qword [rbp + 0x78], rax
mov rcx, qword [rbp + 0x78]
mov dl, 2
mov r8d, 0x20
mov r9d, 0x220
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
lea rax, [rbp + 0x88]
mov qword [rsp + 0x50], rax
call sub.advapi32.dll_AllocateAndInitializeSid
mov ecx, eax
call fcn.00426e40
xor ecx, ecx
mov rdx, qword [rbp + 0x88]
lea r8, [rbp + 0x80]
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
je 0x4301fb
cmp dword [rbp + 0x80], 0
setne al
mov byte [rbp + 0x87], al
jmp 0x430202
mov byte [rbp + 0x87], 0
nop
cmp qword [rbp + 0x88], 0
je 0x430219
mov rcx, qword [rbp + 0x88]
call sub.advapi32.dll_FreeSid
movzx rax, byte [rbp + 0x87]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x4333d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push rbp
push rbx
mov byte [rsp - 0x3f8], 0
mov byte [rsp - 0x13f8], 0
sub rsp, 0x13f8
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], rbp
mov qword [rbp + 0x1410], rcx
mov qword [rbp + 0x1418], rdx
mov rcx, qword [rbp + 0x1418]
call fcn.0040f8c0
nop
mov dword [rbp + 0x13b0], 0x18
mov dword [rbp + 0x13c0], 0xffffffff
mov qword [rbp + 0x13b8], 0
lea rcx, [rbp + 0x13d0]
lea rdx, [rbp + 0x13c8]
lea r8, [rbp + 0x13b0]
xor r9, r9
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x433651
nop
lea rcx, [rbp + 0x1348]
mov edx, 0x68
xor r8, r8
call fcn.00406470
mov dword [rbp + 0x1348], 0x68
mov rax, qword [rbp + 0x13d0]
mov qword [rbp + 0x1398], rax
mov rax, qword [rbp + 0x13c8]
mov qword [rbp + 0x13a0], rax
mov rax, qword [rbp + 0x13c8]
mov qword [rbp + 0x13a8], rax
mov dword [rbp + 0x1384], 0x101
mov word [rbp + 0x1388], 0
lea rcx, [rbp + 0x58]
call fcn.00432eb0
lea rcx, [rbp + 0x60]
mov edx, 3
mov r8, qword [rbp + 0x58]
lea r9, [0x0043371c]
mov rax, qword [rbp + 0x1410]
mov qword [rsp + 0x20], rax
call fcn.0040af60
mov rcx, qword [rbp + 0x60]
call fcn.0040aac0
xor ecx, ecx
mov rdx, rax
lea r8, [rbp + 0x13b0]
lea r9, [rbp + 0x13b0]
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x1348]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x13d8]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x433638
nop
mov rcx, qword [rbp + 0x13d8]
mov edx, 0x64
call sub.kernel32.dll_WaitForSingleObject
mov dword [rbp + 0x7c], eax
mov rcx, qword [rbp + 0x13d0]
xor edx, edx
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x78]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call sub.kernel32.dll_PeekNamedPipe
cmp dword [rbp + 0x78], 0
jbe 0x433608
mov dword [rbp + 0x80], 0
mov rcx, qword [rbp + 0x13d0]
lea rdx, [rbp + 0x9e7]
mov r8d, 0x960
lea r9, [rbp + 0x80]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
mov eax, dword [rbp + 0x80]
mov byte [rax + rbp + 0x9e7], 0
lea rcx, [rbp + 0x9e7]
lea rdx, [rbp + 0x86]
call sub.user32.dll_OemToCharA
mov rcx, qword [rbp + 0x1418]
lea rdx, [rbp + 0x86]
mov rax, qword [rbp + 0x1418]
mov rbx, qword [rax]
call qword [rbx + 0x18]
cmp dword [rbp + 0x80], 0x960
jae 0x43358d
mov ecx, 1
call sub.kernel32.dll_Sleep
cmp dword [rbp + 0x7c], 0x102
je 0x43354d
nop
mov rcx, qword [rbp + 0x13d8]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x13e0]
call sub.kernel32.dll_CloseHandle
nop
mov rcx, qword [rbp + 0x13d0]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x13c8]
call sub.kernel32.dll_CloseHandle
nop
lea rcx, [rbp + 0x58]
mov edx, 2
call fcn.00409590
lea rcx, [rbp + 0x1418]
call fcn.0040f7b0
lea rsp, [rbp + 0x13f8]
pop rbx
pop rbp
ret
Function at 0x140003bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140003c24
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140003c10
ret
Function at 0x14000af10
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14000afdc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14000afdc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14000aff5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14000afcc
cmp byte [rax], 0x5c
jne 0x14000afc6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14000afc6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14000afb2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14000afc3
test r8b, 0x10
jne 0x14000afc6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14000afc6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140005b00
test edi, edi
jne 0x14000af30
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140005af0
int3

Function at 0x14000f364
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f3ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f3ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f3ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f3ae
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f3ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000f3b0
xor al, al
add rsp, 0x28
ret
Function at 0x141985058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1419851df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141985089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14198506f
add dl, dl
jne 0x141985096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419850f6
xor eax, eax
add dl, dl
jne 0x1419850a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1419851ad
add dl, dl
jne 0x1419850b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419850c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419850d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1419850dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1419850ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14198507e
mov eax, 1
add dl, dl
jne 0x141985106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141985113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1419850fb
sub eax, ebx
mov ebx, 1
jne 0x14198514c
mov ecx, 1
add dl, dl
jne 0x14198512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14198513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141985123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14198507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141985168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141985175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14198515d
cmp eax, 0x7d00
jae 0x14198519b
cmp eax, 0x500
jb 0x141985196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14198507e
cmp eax, 0x7f
ja 0x14198519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14198507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1419851d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14198507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000c220
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000c248
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000c26e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000c270
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000c2c9
test ecx, ecx
jle 0x14000c2a9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000c2c9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000c2c9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14000c2f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000c321
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14000c33f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000c35b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000c35d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000c399
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000c42e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000c3d4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000c40e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000c42e
cmp rbx, rax
ja 0x14000c3e0
test rbx, rbx
je 0x14000c42e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret