joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14088f780
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14088f78d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14088f79d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14088f785
lea eax, [rcx + 1]
jmp 0x14088f7ab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14088f7be
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14088f7a4
sub eax, 3
jb 0x14088f7de
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14088f82d
sar eax, 1
movsxd rbp, eax
jb 0x14088f814
jmp 0x14088f7ec
add ebx, ebx
jne 0x14088f7ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14088f814
inc ecx
add ebx, ebx
jne 0x14088f7fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14088f814
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14088f80d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14088f7fc
add ecx, 2
jmp 0x14088f819
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14088f742
jmp 0x14088f78d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x889000]
mov eax, dword [rdi]
or eax, eax
je 0x14088f88d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x88f000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14088f83d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14088f887
mov qword [rbx], rax
add rbx, 8
jmp 0x14088f85d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14088f8d1
cmp al, 0xef
ja 0x14088f8b9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14088f899
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14088f8a8
mov eax, dword [rdi]
add rdi, 4
jmp 0x14088f8a8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14088f950], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14088f950
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14088f940
sub rsp, 0xffffffffffffff80
jmp 0x1400014f0
Function at 0x14077f3c8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14077f54f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14077f3f9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077f3df
add dl, dl
jne 0x14077f406
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077f466
xor eax, eax
add dl, dl
jne 0x14077f415
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077f51d
add dl, dl
jne 0x14077f426
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077f433
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077f440
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077f44d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14077f45a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14077f3ee
mov eax, 1
add dl, dl
jne 0x14077f476
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14077f483
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077f46b
sub eax, ebx
mov ebx, 1
jne 0x14077f4bc
mov ecx, 1
add dl, dl
jne 0x14077f49e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077f4ab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077f493
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077f3ee
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14077f4d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077f4e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077f4cd
cmp eax, 0x7d00
jae 0x14077f50b
cmp eax, 0x500
jb 0x14077f506
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077f3ee
cmp eax, 0x7f
ja 0x14077f50e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077f3ee
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14077f542
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14077f3ee
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140007f20
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [rcx]
test edx, edx
jne 0x140007f48
mov dword [rcx + 4], 2
lea rax, [rcx + 4]
cmp edx, 3
jne 0x140007f71
mov dword [rax], 4
cmp edx, 0x22
jne 0x140007f7c
mov dword [rax], 0x4a
ret
cmp edx, 1
jne 0x140007f52
mov dword [rcx + 4], edx
jmp 0x140007f2d
cmp edx, 2
jne 0x140007f2d
lea rax, [rcx + 4]
mov dword [rax], 3
cmp edx, 0x17
jne 0x140008114
mov dword [rax], 0x38
ret
cmp edx, 4
jne 0x140007f88
mov dword [rax], 5
cmp edx, 0x23
jne 0x140007f93
mov dword [rax], 0x4b
ret
cmp edx, 5
jne 0x140007f9f
mov dword [rax], 6
cmp edx, 0x24
jne 0x140007faa
mov dword [rax], 0x4c
ret
cmp edx, 6
jne 0x140007fb6
mov dword [rax], 8
cmp edx, 0x25
jne 0x140007fc1
mov dword [rax], 0x4d
ret
cmp edx, 7
jne 0x140007fcd
mov dword [rax], 9
cmp edx, 0x26
jne 0x140007fd8
mov dword [rax], 0x4e
ret
cmp edx, 8
jne 0x140007fe4
mov dword [rax], 0xc
cmp edx, 0x27
jne 0x140007fef
mov dword [rax], 0x4f
ret
cmp edx, 9
jne 0x140007ffb
mov dword [rax], 0xd
cmp edx, 0x28
jne 0x140008006
mov dword [rax], 0x50
ret
cmp edx, 0xa
jne 0x140008012
mov dword [rax], 0x10
cmp edx, 0x29
jne 0x14000801d
mov dword [rax], 0x51
ret
cmp edx, 0xb
jne 0x140008029
mov dword [rax], 0x11
cmp edx, 0x2a
jne 0x140008034
mov dword [rax], 0x52
ret
cmp edx, 0xc
jne 0x140008040
mov dword [rax], 0x12
cmp edx, 0x2b
jne 0x14000804b
mov dword [rax], 0x53
ret
cmp edx, 0xd
jne 0x140008057
mov dword [rax], 0x13
cmp edx, 0x2c
jne 0x140008062
mov dword [rax], 0x54
ret
cmp edx, 0xe
jne 0x14000806e
mov dword [rax], 0x14
cmp edx, 0x2d
jne 0x140008079
mov dword [rax], 0x55
ret
cmp edx, 0xf
jne 0x140008085
mov dword [rax], 0x30
cmp edx, 0x2e
jne 0x140008090
mov dword [rax], 0x56
ret
cmp edx, 0x10
jne 0x14000809c
mov dword [rax], 0x31
cmp edx, 0x2f
jne 0x1400080a7
mov dword [rax], 0x57
ret
cmp edx, 0x11
jne 0x1400080b3
mov dword [rax], 0x32
cmp edx, 0x30
jne 0x1400080be
mov dword [rax], 0x58
ret
cmp edx, 0x12
jne 0x1400080ca
mov dword [rax], 0x33
cmp edx, 0x31
jne 0x1400080d5
mov dword [rax], 0x59
ret
cmp edx, 0x13
jne 0x1400080e1
mov dword [rax], 0x34
cmp edx, 0x32
jne 0x1400080ec
mov dword [rax], 0x5a
ret
cmp edx, 0x14
jne 0x1400080f8
mov dword [rax], 0x35
cmp edx, 0x33
jne 0x1400080f7
mov dword [rax], 0x18
ret
cmp edx, 0x15
jne 0x140008104
mov dword [rax], 0x36
ret
cmp edx, 0x16
jne 0x140007f61
mov dword [rax], 0x37
ret
cmp edx, 0x18
jne 0x140008120
mov dword [rax], 0x39
ret
cmp edx, 0x19
jne 0x14000812c
mov dword [rax], 0x41
ret
cmp edx, 0x1a
jne 0x140008138
mov dword [rax], 0x42
ret
cmp edx, 0x1b
jne 0x140008144
mov dword [rax], 0x43
ret
cmp edx, 0x1c
jne 0x140008150
mov dword [rax], 0x44
ret
cmp edx, 0x1d
jne 0x14000815c
mov dword [rax], 0x45
ret
cmp edx, 0x1e
jne 0x140008168
mov dword [rax], 0x46
ret
cmp edx, 0x1f
jne 0x140008174
mov dword [rax], 0x47
ret
cmp edx, 0x20
jne 0x140008180
mov dword [rax], 0x48
ret
cmp edx, 0x21
jne 0x140007f3c
mov dword [rax], 0x49
ret
Function at 0x14000a280
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14000a2b5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140009e70
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14000a3f6
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14000a370
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14000a3e5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14000a3ad
mov r10, qword [rdx]
cmp r10, rax
je 0x14000a3a7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14000a3e5
cmp r9, rdx
je 0x14000a3c1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14000a407
cmp r9, rdx
jne 0x14000a3b2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14000a320
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14000a3e5
Function at 0x14000bf80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000bfdd
lea rbx, [0x140044ce0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000bfc4
cmp r10, 2
jb 0x14000bfc4
cmp byte [r9], r8b
jne 0x14000bfc4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000bfa0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000c01f
lea rbx, [0x140044ce0]
cmp r8b, 0x23
jne 0x14000c003
cmp byte [r9], r8b
jne 0x14000c003
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000bff0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000c160
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000c17a
mov qword [r8], 0
lea rdx, [0x14004487c]
call fcn.14000c030
mov rbx, rax
test rax, rax
jne 0x14000c19a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000c271
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000c271
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000c271
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000c271
cmp rdi, 0xffffffffffffffff
je 0x14000c271
mov rax, qword [0x14013ae08]
test rax, rax
je 0x14000c20e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000c271
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000c25e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14013ae08]
test rax, rax
je 0x14000c253
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000c27a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000c26c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000c27c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000f430
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140044ce0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x14013ae08]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x14000f4c6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140021830
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14001b290
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14013ae08]
mov edi, ecx
cmp byte [rbx + 0x4a2d], 0
jne 0x14001b2f1
cmp byte [rbx + 0x4a2e], 0
jne 0x14001b2f1
movsx r9d, word [rbx + 0x5b32]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000be40
test dil, 1
je 0x14001b418
jmp 0x14001b37a
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b32]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140049a44]
mulss xmm1, dword [0x140049a24]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4790], rax
mov dword [rbx + 0x477c], 1
movss dword [rbx + 0x4788], xmm0
movss dword [rbx + 0x478c], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x140049938]
or dword [rbx + 0x4778], 0x41
movss dword [rbx + 0x47d8], xmm0
call fcn.14000be40
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001b3d0
lea r11, [0x140044ce0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x14001b3b3
cmp byte [r8], r9b
jne 0x14001b3b3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001b3a0
not ecx
call fcn.140012fb0
test rax, rax
je 0x14001b418
cmp byte [rax + 0xae], 0
je 0x14001b418
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b32]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b32]
call fcn.14000be40
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400156f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140041360
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400200e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c18], 0
lea rbx, [rcx + 0x5c20]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140020187
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002013a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140022490
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000c5c0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c18]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c28]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14013ae18]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002018f
mov rcx, rbx
call fcn.14000c5c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140020700
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14013ae08]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140020763
mov qword [rsp], rbx
lea rbx, [0x140044ce0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140020743
cmp byte [r8], r9b
jne 0x140020743
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140020730
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b90]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140020797
mov r10, qword [r10 + 0x5b98]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14002079e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140020784
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140040e00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
xor esi, esi
lea r8, [0x14003c8c0]
mov rbx, rcx
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
lea rax, [0x14003c460]
mov qword [rsp + 0x70], 0x50
mov edx, 0x7f00
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
xorps xmm0, xmm0
lea rdi, [0x140049354]
mov edx, 0x7f00
mov qword [rsp + 0x98], rax
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rdi
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rsp + 0x88]
mov r9d, 0x80000000
mov qword [rsp + 0x58], rsi
mov r8, rdi
mov qword [rsp + 0x50], rax
mov rdx, rdi
mov eax, dword [rsp + 0x6c]
xor ecx, ecx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea edx, [rsi - 0x14]
mov r8d, 0x80020
mov rcx, rax
mov qword [rbx + 0x50], rax
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rbx + 0x50]
lea r9d, [rsi + 2]
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x140049b50]
lea rdx, [rsp + 0xc0]
mov rcx, qword [rbx + 0x50]
movdqu xmmword [rsp + 0xc0], xmm0
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [rbx + 0x50]
lea edx, [rsi + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [rbx + 0x50]
mov rcx, rbx
call fcn.14003c4d0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.1400409d0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140041360
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140041fe4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004202e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004202e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004202e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004202e
cmp dword [rcx + 0x84], 0xe
jbe 0x14004202e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140042030
xor al, al
add rsp, 0x28
ret
Function at 0x1400108d4
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [0x140159cc0]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov eax, 0x88
movsxd r13, r9d
mov qword [rsp + 0x20], r8
mov esi, edx
mov r12, rcx
mov ebp, 0x64
sub ebp, r13d
lea rcx, [rsp + 0x30]
lea r8d, [rax + 0x40]
add ebp, ebp
cmp r13d, r8d
cmove ebp, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, ebp
movsxd r14, ebp
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r15, eax
xor edi, edi
jmp 0x14001096e
mov rcx, rdi
test r15, r15
jle 0x14001095a
mov rax, qword [r12 + rcx*8]
xor qword [rsp + rcx*8 + 0x30], rax
inc rcx
cmp rcx, r15
jl 0x140010949
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.140010a14
sub esi, ebp
add r12, r14
cmp esi, ebp
jge 0x140010941
movsxd rbx, esi
lea rcx, [rsp + 0x100]
mov r8, rbx
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
inc esi
mov byte [rsp + rbx + 0x100], 1
movsxd rax, esi
lea rcx, [rsp + 0x100]
sub ebp, esi
add rcx, rax
movsxd r8, ebp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
or byte [rsp + r14 + 0xff], 0x80
test r15, r15
jle 0x1400109cf
mov rax, qword [rsp + rdi*8 + 0x100]
xor qword [rsp + rdi*8 + 0x30], rax
inc rdi
cmp rdi, r15
jl 0x1400109ba
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.140010a14
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14011ae70
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400155b0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
jmp 0x14001561a
cmp ecx, 0x7c
je 0x14001561f
cmp ecx, 0x29
jne 0x14001562a
cmp dword [rdi + 0x1c], 0
jne 0x14001561f
test dword [rdi + 0x80], 0x10000000
je 0x14001575a
cmp ecx, 0x5d
jne 0x1400155f9
test dword [rdi + 0x80], 0x10000000
je 0x140015768
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.140014bbc
mov rcx, rdi
call fcn.140017b30
mov rcx, rdi
call fcn.140017ba4
mov ecx, dword [rdi + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x1400155c4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp ecx, 0x2e
jne 0x14001563a
lea rcx, [rdi + 0x40]
call fcn.140014e44
jmp 0x140015605
cmp ecx, 0x5c
jne 0x14001568c
mov rcx, rdi
call fcn.140017b30
test byte [rdi + 0x80], 0x80
je 0x140015682
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x14001566a
lea rcx, [rdi + 0x40]
call fcn.1400155a4
mov rcx, rdi
call fcn.140017b30
jmp 0x140015615
cmp al, 0x42
jne 0x140015682
lea rcx, [rdi + 0x40]
call fcn.1400155a4
lea rcx, [rdi + 0x40]
call fcn.140017acc
jmp 0x140015660
mov rcx, rdi
call fcn.140015778
jmp 0x14001560d
cmp ecx, 0x5b
jne 0x1400156b7
mov rcx, rdi
call fcn.140017b30
mov rcx, rdi
call fcn.140015de8
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.140017000
jmp 0x14001560d
cmp ecx, 0x28
jne 0x1400156ec
mov rcx, rdi
call fcn.140017b30
mov rcx, rdi
call fcn.1400181d0
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.140017000
test bl, bl
je 0x140015615
jmp 0x14001560d
cmp ecx, 0x5e
jne 0x1400156ff
lea rcx, [rdi + 0x40]
call fcn.140014bb0
jmp 0x140015660
cmp ecx, 0x24
jne 0x140015712
lea rcx, [rdi + 0x40]
call fcn.140014f44
jmp 0x140015660
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14001573e
cmp ecx, 0x3f
je 0x14001573e
cmp ecx, 0x7b
je 0x14001573e
cmp ecx, 0x7d
jne 0x1400155e4
test dword [rdi + 0x80], 0x10000000
je 0x14001574c
jmp 0x1400155f9
mov edx, 0xa
mov rcx, rdi
call fcn.140016ff4
int3
mov edx, 6
mov rcx, rdi
call fcn.140016ff4
int3
mov edx, 5
mov rcx, rdi
call fcn.140016ff4
int3
mov edx, 4
mov rcx, rdi
call fcn.140016ff4
int3