joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ce70
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14004ced1
mov rdi, rax
lea rdx, [0x1400554e6]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004ced1
mov rsi, rax
lea rdx, [0x1400554f4]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004ced1
mov rdi, rax
xor ebx, ebx
jmp 0x14004cf57
lea rcx, [0x140055480]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14004cfcf
mov rsi, rax
lea rdx, [0x14005548a]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004cfcf
mov rdi, rax
lea rdx, [0x14005549d]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004cfcf
mov rbx, rax
lea rdx, [0x1400554b1]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14004cfcf
mov rsi, rax
lea rcx, [rbp - 0x40]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x14004cfcf
mov rdi, qword [rbp - 0x40]
movzx eax, byte [0x14006e181]
mov ecx, 0x18
mov edx, 8
call fcn.14000bc10
test rax, rax
je 0x14004d004
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x14006e198], rcx
je 0x14004cfc3
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x14004cfac
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.14000bc20
mov rcx, rsi
mov rax, rcx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rax, [0x140055480]
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rdx, str.C:Usersklns.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.10_src_thread_parkerwindowsmod.rs
lea rcx, [rbp - 0x40]
call fcn.14004dfb0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.14004ddc0
ud2
Function at 0x1400201d0
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x30]
lea r8, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x18], rsi
mov rsi, qword [rbp + 0x60]
mov qword [rbp + 0x10], rdi
mov rax, qword [0x140050bc0]
xor rax, rbp
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rsi], r8
cmp qword [rsi + 0x80], 0
je 0x140020228
mov rdi, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp rax, qword [rdi]
je 0x1400203c0
cmp byte [rsi + 0x7c], 0
je 0x140020350
cmp qword [rsi + 0x80], 0
je 0x1400202f2
mov rdi, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp rax, qword [rdi]
je 0x140020393
cmp qword [rsi + 0x68], 0
je 0x1400202e1
cmp byte [rsi + 0x71], 0
je 0x1400202e1
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
mov rsi, qword [rbp + 0x60]
cmp eax, 0xffffffff
je 0x1400202e1
mov rdi, rsp
lea r8, [rbp + 0x20]
mov rcx, qword [rsi + 0x68]
add rsi, 0x74
mov rdx, rsi
lea r9, [rbp + 0x40]
lea rax, [rbp]
mov r10, qword [rcx]
mov qword [rdi + 0x20], rax
call qword [r10 + 0x40]
mov rsi, qword [rbp + 0x60]
test eax, eax
je 0x1400202b6
cmp eax, 1
je 0x1400202ba
cmp eax, 3
jne 0x1400202e1
mov byte [rsi + 0x71], 0
jmp 0x1400202e1
mov byte [rsi + 0x71], 0
mov r8, qword [rbp]
lea rax, [rbp + 0x20]
sub r8, rax
je 0x1400202e1
mov r9, qword [rsi + 0x80]
lea rcx, [rbp + 0x20]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rsi, qword [rbp + 0x60]
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rbp + 0x60]
xor edx, edx
lea r10, [rsi + 8]
mov byte [rsi + 0x7c], dl
lea rdi, [rsi + 0x10]
mov byte [rsi + 0x71], dl
lea r11, [rsi + 0x28]
mov qword [rsi + 0x18], r10
lea r8, [rsi + 0x30]
mov qword [rsi + 0x20], rdi
lea rcx, [rsi + 0x48]
mov qword [rsi + 0x38], r11
lea r9, [rsi + 0x4c]
mov qword [rsi + 0x40], r8
xor eax, eax
mov qword [rdi], rax
mov qword [r8], rax
mov dword [r9], edx
mov qword [r10], rax
mov qword [r11], rax
mov dword [rcx], edx
mov rdi, qword [0x140056cc0]
mov qword [rsi + 0x50], rcx
mov qword [rsi + 0x58], r9
mov qword [rcx + 0x38], rax
mov qword [rsi + 0x74], rdi
mov qword [rsi + 0x68], rax
mov rax, qword [sym.imp.MSVCP140.dll_const_std::basic_streambuf_char__struct_std::char_traits_char__::vftable]
mov rcx, qword [rsi + 0x60]
mov qword [rsi], rax
test rcx, rcx
je 0x14002036d
mov edx, 1
call fcn.140024610
mov rcx, qword [rbp + 0x40]
mov qword [rbp + 0x40], 0
xor rcx, rbp
cmp rcx, qword [0x140050bc0]
jne 0x1400203ba
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x10]
lea rsp, [rbp + 0x50]
pop rbp
ret
mov rax, qword [rsi + 0x88]
mov r8, qword [rsi + 0x90]
mov qword [rdi], rax
sub r8, rax
mov rdi, qword [rsi + 0x38]
mov qword [rdi], rax
mov r9, qword [rsi + 0x50]
mov dword [r9], r8d
jmp 0x140020251
call fcn.140039fc0
nop
mov rax, qword [rsi + 0x88]
mov r8, qword [rsi + 0x90]
mov qword [rdi], rax
sub r8, rax
mov rdi, qword [rsi + 0x38]
mov qword [rdi], rax
mov r9, qword [rsi + 0x50]
mov dword [r9], r8d
jmp 0x140020228
Function at 0x1400221b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rbp
sub rsp, 0x60
lea r9, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov rbx, rcx
mov rbp, rdx
mov r8, qword [0x140050bc0]
xor r8, rsp
mov qword [rsp + 0x58], r8
mov qword [rbx], r9
cmp qword [rbx + 0x80], 0
je 0x1400221f1
mov rsi, qword [rbx + 0x18]
lea rdx, [rbx + 0x70]
cmp rdx, qword [rsi]
je 0x14002238b
cmp byte [rbx + 0x7c], 0
je 0x140022307
cmp qword [rbx + 0x80], 0
je 0x1400222a9
mov rsi, qword [rbx + 0x18]
lea rdx, [rbx + 0x70]
cmp rdx, qword [rsi]
je 0x14002235f
cmp qword [rbx + 0x68], 0
je 0x14002229c
cmp byte [rbx + 0x71], 0
je 0x14002229c
mov rsi, qword [rbx]
mov rcx, rbx
mov edx, 0xffffffff
call qword [rsi + 0x18]
cmp eax, 0xffffffff
je 0x14002229c
mov rcx, qword [rbx + 0x68]
mov r11, rsp
lea rdx, [rbx + 0x74]
lea r8, [rsp + 0x38]
mov rsi, qword [rcx]
lea r9, [rsp + 0x58]
lea r10, [rsp + 0x30]
mov qword [r11 + 0x20], r10
call qword [rsi + 0x40]
test eax, eax
je 0x140022272
cmp eax, 1
je 0x140022276
cmp eax, 3
jne 0x14002229c
mov byte [rbx + 0x71], 0
jmp 0x14002229c
mov byte [rbx + 0x71], 0
mov r8, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
sub r8, rdx
je 0x14002229c
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
lea r10, [rbx + 8]
mov byte [rbx + 0x7c], al
lea rsi, [rbx + 0x10]
mov byte [rbx + 0x71], al
lea r11, [rbx + 0x28]
mov qword [rbx + 0x18], r10
lea r8, [rbx + 0x30]
mov qword [rbx + 0x20], rsi
lea rcx, [rbx + 0x48]
mov qword [rbx + 0x38], r11
lea r9, [rbx + 0x4c]
mov qword [rbx + 0x40], r8
xor edx, edx
mov qword [rsi], rdx
mov qword [r8], rdx
mov dword [r9], eax
mov qword [r10], rdx
mov qword [r11], rdx
mov dword [rcx], eax
mov rsi, qword [0x140056cc0]
mov qword [rbx + 0x50], rcx
mov qword [rbx + 0x58], r9
mov qword [rcx + 0x38], rdx
mov qword [rbx + 0x74], rsi
mov qword [rbx + 0x68], rdx
mov rdx, qword [sym.imp.MSVCP140.dll_const_std::basic_streambuf_char__struct_std::char_traits_char__::vftable]
mov rcx, qword [rbx + 0x60]
mov qword [rbx], rdx
test rcx, rcx
je 0x140022324
mov edx, 1
call fcn.140024610
test rbp, 1
je 0x14002233a
mov rcx, rbx
mov edx, 0x98
call fcn.140039fe0
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], 0
xor rcx, rsp
cmp rcx, qword [0x140050bc0]
jne 0x140022386
mov rax, rbx
add rsp, 0x60
pop rbp
pop rsi
pop rbx
ret
mov rdx, qword [rbx + 0x88]
mov r8, qword [rbx + 0x90]
mov qword [rsi], rdx
sub r8, rdx
mov rsi, qword [rbx + 0x38]
mov qword [rsi], rdx
mov r9, qword [rbx + 0x50]
mov dword [r9], r8d
jmp 0x14002221a
call fcn.140039fc0
mov rdx, qword [rbx + 0x88]
mov r8, qword [rbx + 0x90]
mov qword [rsi], rdx
sub r8, rdx
mov rsi, qword [rbx + 0x38]
mov qword [rsi], rdx
mov r9, qword [rbx + 0x50]
mov dword [r9], r8d
jmp 0x1400221f1
Function at 0x140023380
Capabilities:
Read file on windows

Disassembly:
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x20
mov r12, r8
mov rbp, rdx
mov r13, rcx
test r12, r12
jle 0x14002352c
cmp qword [r13 + 0x68], 0
jne 0x140023458
mov rdx, qword [r13 + 0x38]
mov r15, r12
mov rdx, qword [rdx]
test rdx, rdx
je 0x1400233c2
mov r9, qword [r13 + 0x50]
movsxd r14, dword [r9]
jmp 0x1400233c5
xor r14d, r14d
test r14, r14
ja 0x1400234fb
cmp qword [r13 + 0x80], 0
je 0x140023444
mov r9, qword [r13 + 0x18]
lea rdx, [r13 + 0x70]
cmp rdx, qword [r9]
je 0x1400234d4
cmp r15, 0xfff
jbe 0x140023424
mov r9, qword [r13 + 0x80]
mov rcx, rbp
mov edx, 1
mov r8d, 0xfff
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add rbp, rax
sub r15, rax
cmp rax, 0xfff
jne 0x140023444
cmp r15, 0xfff
ja 0x1400233f2
test r15, r15
jbe 0x140023444
mov r9, qword [r13 + 0x80]
mov rcx, rbp
mov edx, 1
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r15, rax
sub r12, r15
mov rax, r12
add rsp, 0x20
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov r15, r12
mov rdx, qword [r13 + 0x38]
mov rdx, qword [rdx]
test rdx, rdx
je 0x140023470
mov r8, qword [r13 + 0x50]
movsxd r14, dword [r8]
jmp 0x140023473
xor r14d, r14d
test r14, r14
jle 0x1400234a3
cmp r15, r14
mov rcx, rbp
cmovl r14, r15
mov r8, r14
call fcn.140034140
mov rdx, qword [r13 + 0x50]
add rbp, r14
sub r15, r14
movsxd r8, r14d
sub dword [rdx], r14d
mov r9, qword [r13 + 0x38]
add qword [r9], r8
jmp 0x1400234bb
mov rdx, qword [r13]
mov rcx, r13
call qword [rdx + 0x38]
cmp eax, 0xffffffff
je 0x1400234c0
mov byte [rbp], al
inc rbp
dec r15
test r15, r15
jg 0x14002345b
sub r12, r15
mov rax, r12
add rsp, 0x20
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov rdx, qword [r13 + 0x88]
mov r10, qword [r13 + 0x90]
mov qword [r9], rdx
sub r10, rdx
mov r9, qword [r13 + 0x38]
mov qword [r9], rdx
mov r11, qword [r13 + 0x50]
mov dword [r11], r10d
jmp 0x1400233e9
cmp r14, r12
mov rcx, rbp
cmovae r14, r12
mov r8, r14
call fcn.140034140
mov rdx, qword [r13 + 0x50]
mov r15, r12
add rbp, r14
sub r15, r14
movsxd r9, r14d
sub dword [rdx], r14d
mov r10, qword [r13 + 0x38]
add qword [r10], r9
jmp 0x1400233ce
xor eax, eax
add rsp, 0x20
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140023540
Capabilities:
Write file on windows

Disassembly:
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x20
mov r13, rcx
mov rbp, r8
mov r12, rdx
cmp qword [r13 + 0x68], 0
je 0x1400235e5
mov r15, rbp
test rbp, rbp
jle 0x1400235d1
mov r9, qword [r13 + 0x40]
mov rcx, qword [r9]
test rcx, rcx
je 0x14002357e
mov r9, qword [r13 + 0x58]
movsxd r14, dword [r9]
jmp 0x140023581
xor r14d, r14d
test r14, r14
jle 0x1400235b1
cmp r15, r14
mov rdx, r12
cmovl r14, r15
mov r8, r14
call fcn.140034140
mov r9, qword [r13 + 0x58]
add r12, r14
sub r15, r14
movsxd r10, r14d
sub dword [r9], r14d
mov r11, qword [r13 + 0x40]
add qword [r11], r10
jmp 0x1400235cc
mov r9, qword [r13]
mov rcx, r13
movzx edx, byte [r12]
call qword [r9 + 0x18]
cmp eax, 0xffffffff
je 0x1400235d1
inc r12
dec r15
test r15, r15
jg 0x140023569
sub rbp, r15
mov rax, rbp
add rsp, 0x20
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
mov r9, qword [r13 + 0x40]
mov r15, rbp
mov rcx, qword [r9]
test rcx, rcx
je 0x1400235fd
mov r9, qword [r13 + 0x58]
movsxd r14, dword [r9]
jmp 0x140023600
xor r14d, r14d
test rbp, rbp
jle 0x140023658
test r14, r14
jle 0x140023638
cmp rbp, r14
mov rdx, r12
cmovl r14, rbp
mov r8, r14
call fcn.140034140
mov r9, qword [r13 + 0x58]
add r12, r14
movsxd r10, r14d
sub rbp, r14
sub dword [r9], r14d
mov r11, qword [r13 + 0x40]
add qword [r11], r10
test rbp, rbp
jle 0x140023658
mov r9, qword [r13 + 0x80]
test r9, r9
je 0x140023658
mov rcx, r12
mov edx, 1
mov r8, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbp, rax
sub r15, rbp
mov rax, r15
add rsp, 0x20
pop rbp
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x140023670
Capabilities:
Write file on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x68
mov rdi, rcx
mov r10, qword [0x140050bc0]
mov r14d, r9d
xor r10, rsp
mov r13, r8
mov qword [rsp + 0x60], r10
mov r12, rdx
mov r11, qword [rdi + 0x38]
lea rbp, [rdi + 0x70]
cmp rbp, qword [r11]
je 0x140023838
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x140023797
cmp qword [rdi + 0x68], 0
je 0x140023766
cmp byte [rdi + 0x71], 0
je 0x140023766
mov r9, qword [rdi]
mov rcx, rdi
mov edx, 0xffffffff
call qword [r9 + 0x18]
cmp eax, 0xffffffff
je 0x140023797
mov rcx, qword [rdi + 0x68]
mov r15, rsp
lea rdx, [rdi + 0x74]
lea r8, [rsp + 0x40]
mov r10, qword [rcx]
lea r9, [rsp + 0x60]
lea r11, [rsp + 0x30]
mov qword [r15 + 0x20], r11
call qword [r10 + 0x40]
test eax, eax
je 0x140023727
cmp eax, 1
je 0x14002372b
cmp eax, 3
jne 0x140023797
mov byte [rdi + 0x71], 0
mov rcx, qword [rdi + 0x80]
jmp 0x140023766
mov byte [rdi + 0x71], 0
mov r15, qword [rsp + 0x30]
lea r9, [rsp + 0x40]
sub r15, r9
je 0x140023759
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x40]
mov edx, 1
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x140023797
cmp byte [rdi + 0x71], 0
jne 0x140023797
mov rcx, qword [rdi + 0x80]
test r13, r13
jne 0x140023771
cmp r14d, 1
je 0x140023788
mov rdx, r13
mov r8d, r14d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x140023797
mov rcx, qword [rdi + 0x80]
lea rdx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetpos]
test eax, eax
je 0x1400237d7
xor edx, edx
mov qword [r12], 0xffffffffffffffff
mov qword [r12 + 8], rdx
mov qword [r12 + 0x10], rdx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
xor rcx, rsp
cmp rcx, qword [0x140050bc0]
jne 0x14002380f
mov rax, r12
add rsp, 0x68
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, qword [rdi + 0x18]
cmp rbp, qword [rdx]
je 0x140023814
mov rcx, qword [rdi + 0x74]
xor ebp, ebp
mov rdx, qword [rsp + 0x38]
mov qword [r12], rdx
mov qword [r12 + 8], rbp
mov qword [r12 + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rbp
xor rcx, rsp
cmp rcx, qword [0x140050bc0]
je 0x1400237c5
call fcn.140039fc0
mov rbp, qword [rdi + 0x88]
mov r8, qword [rdi + 0x90]
mov qword [rdx], rbp
sub r8, rbp
mov rdx, qword [rdi + 0x38]
mov qword [rdx], rbp
mov r9, qword [rdi + 0x50]
mov dword [r9], r8d
jmp 0x1400237e0
cmp r14d, 1
jne 0x1400236aa
cmp qword [rdi + 0x68], 1
sbb r13, 0
jmp 0x1400236aa
Function at 0x140023850
Capabilities:
Write file on windows

Disassembly:
push rbx
push r14
push r15
push rbp
sub rsp, 0x68
mov r14, r8
mov rbx, rcx
mov rbp, rdx
mov r10, qword [0x140050bc0]
xor r10, rsp
mov r11, qword [r14]
add r11, qword [r14 + 8]
mov qword [rsp + 0x60], r10
mov rcx, qword [rbx + 0x80]
mov qword [rsp + 0x38], r11
test rcx, rcx
je 0x140023949
cmp qword [rbx + 0x68], 0
je 0x14002393a
cmp byte [rbx + 0x71], 0
je 0x14002393a
mov r8, qword [rbx]
mov rcx, rbx
mov edx, 0xffffffff
call qword [r8 + 0x18]
cmp eax, 0xffffffff
je 0x140023949
mov rcx, qword [rbx + 0x68]
mov r15, rsp
lea rdx, [rbx + 0x74]
lea r8, [rsp + 0x40]
mov r10, qword [rcx]
lea r9, [rsp + 0x60]
lea r11, [rsp + 0x30]
mov qword [r15 + 0x20], r11
call qword [r10 + 0x40]
test eax, eax
je 0x1400238fb
cmp eax, 1
je 0x1400238ff
cmp eax, 3
jne 0x140023949
mov byte [rbx + 0x71], 0
mov rcx, qword [rbx + 0x80]
jmp 0x14002393a
mov byte [rbx + 0x71], 0
mov r15, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
sub r15, rdx
je 0x14002392d
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x40]
mov edx, 1
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x140023949
cmp byte [rbx + 0x71], 0
jne 0x140023949
mov rcx, qword [rbx + 0x80]
lea rdx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fsetpos]
test eax, eax
je 0x140023988
xor edx, edx
mov qword [rbp], 0xffffffffffffffff
mov qword [rbp + 8], rdx
mov qword [rbp + 0x10], rdx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], 0
xor rcx, rsp
cmp rcx, qword [0x140050bc0]
jne 0x140023983
mov rax, rbp
add rsp, 0x68
pop rbp
pop r15
pop r14
pop rbx
ret
call fcn.140039fc0
mov rdx, qword [r14 + 0x10]
lea r8, [rbx + 0x70]
mov qword [rbx + 0x74], rdx
mov rdx, qword [rbx + 0x18]
cmp r8, qword [rdx]
je 0x1400239cc
mov rcx, qword [rbx + 0x74]
xor ebx, ebx
mov rdx, qword [rsp + 0x38]
mov qword [rbp], rdx
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rbx
xor rcx, rsp
cmp rcx, qword [0x140050bc0]
jne 0x140023983
jmp 0x140023975
mov r8, qword [rbx + 0x88]
mov r9, qword [rbx + 0x90]
mov qword [rdx], r8
sub r9, r8
mov rdx, qword [rbx + 0x38]
mov qword [rdx], r8
mov r10, qword [rbx + 0x50]
mov dword [r10], r9d
jmp 0x14002399d
Function at 0x14003ace0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003ad2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003ad2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003ad2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003ad2a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003ad2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003ad2c
xor al, al
add rsp, 0x28
ret
Function at 0x1400034bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003506
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003506
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003506
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003506
cmp dword [rcx + 0x84], 0xe
jbe 0x140003506
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003508
xor al, al
add rsp, 0x28
ret
Function at 0x140002e5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002ea6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002ea6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002ea6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002ea6
cmp dword [rcx + 0x84], 0xe
jbe 0x140002ea6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002ea8
xor al, al
add rsp, 0x28
ret
Function at 0x1400031c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000320a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000320a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000320a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000320a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000320a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000320c
xor al, al
add rsp, 0x28
ret
Function at 0x140001030
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [section..xvlk_2]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x250], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x14000e308]
lea rcx, [rsp + 0x30]
mov r8d, eax
call entry0
xor edx, edx
lea r8, [rsp + 0x30]
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rdi, rax
test rax, rax
je 0x1400010cb
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x1400010c2
lea rcx, [0x1400165e0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [0x1400165e0], 0
mov rdi, qword [rsp + 0x250]
jne 0x1400010e7
call sub.ntdll.dll_RtlGetLastNtStatus
jmp 0x140001168
lea rcx, [0x1400165e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x140001138
call sub.ntdll.dll_RtlGetLastNtStatus
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14000e338]
lea rcx, [rsp + 0x30]
mov r8d, eax
call entry0
lea r8, [rsp + 0x30]
lea rdx, [0x1400165e0]
mov r9d, 0x1010
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, ebx
jmp 0x140001168
lea rdx, [0x14000e360]
lea rcx, [rsp + 0x30]
mov r8, rax
call entry0
lea r8, [rsp + 0x30]
lea rdx, [0x1400165e0]
mov r9d, 0x1040
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400016f0
add rsp, 0x240
pop rbx
ret

Function at 0x14000366c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400034d4
Function at 0x180f15bd3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rax
jmp 0x180fabe08
push r12
jmp 0x180f99f78
add r8, 4
test spl, r8b
xor r10d, ebx
cmp ebx, 0x4bb3371f
test r13b, 0x9a
jmp 0x180fd1ebe
dec r8d
btr r10, r13
ror r8d, 3
cdq
setp r9b
movzx ebx, r15w
inc r8d
bts si, r14w
shrd si, r10w, 0x35
cqo
lea r8, [r8 + rax]
setae bl
cmc
test r8w, r11w
movabs rdx, 0x100000000
lea r8, [r8 + rdx]
shrd r10d, edx, 0x2a
dec ebp
sub sil, r10b
mov rbp, rsp
sub rsp, 0x180
adc bl, spl
add bl, bpl
and rsp, 0xfffffffffffffff0
sbb r9, 0x1d215e66
mov rbx, r8
shl si, cl
movabs r9, 0
bt r10w, 0xf9
btr esi, r10d
cmp r11b, 0xfe
sub rbx, r9
sar r10b, cl
shl esi, cl
lea rsi, [0x180f814dc]
shrd r10w, dx, 0x22
xadd r10b, r10b
cmp rdx, 0x7d8a3403
mov r10d, dword [r8]
jmp 0x180f3399f
push rbx
movzx bx, r12b
movzx rbx, r14w
push r14
push r15
jmp 0x180ed995b
jmp rsi
push rdx
push rcx
movsxd rdx, edi
cmovge eax, r12d
mov al, r9b
push rbp
push r9
cbw
rdtsc
push r8
mov bpl, 0xf5
movsxd rdx, r10d
pushfq
xchg r9b, r8b
cmovne bx, r10w
movzx dx, r11b
push r13
cqo
cbw
push r10
push r11
dec r9b
cdq
push rdi
movsx ebx, bx
push rsi
rdtsc
movabs rax, 0
movsxd r10, esp
xchg r10b, bpl
push rax
movzx esi, r12w
movsx ebp, dx
mov r8, qword [rsp + 0x90]
cmovno si, si
movsx bx, r12b
mov bh, 0x6c
not r8d
mov ebx, ecx
setnp sil
movzx ebp, dx
dec r8d
xor r8d, 0x1ae37486
xchg esi, ebp
sal bh, 0xad
bswap r8d
mov rbp, 0x7b7f6e7c
xor r8d, 0x71a865b7
jmp 0x180f81450
xor r10d, 0x3b6864bb
test rdi, 0x1782042
sub r10d, 0x307d5bf6
cmc
rol r10d, 3
cmp cl, r8b
clc
bswap r10d
push rbx
cmp r8b, 0x7f
adc bl, r14b
xor dword [rsp], r10d
pop rbx
cmc
cmp ax, r13w
movsxd r10, r10d
cmp bl, 0xfd
add rsi, r10
jmp 0x180f9c5f1
Function at 0x1400213e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140021414
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140021400
ret
Function at 0x140027fb0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002807c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002807c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140028095
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14002806c
cmp byte [rax], 0x5c
jne 0x140028066
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140028066
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140028052
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140028063
test r8b, 0x10
jne 0x140028066
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140028066
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400239d0
test edi, edi
jne 0x140027fd0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400239c0
int3