joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400060d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
mov dword [rdx], r8d
mov qword [rax - 0x28], rbx
mov esi, r8d
mov dword [rax + 0x18], ebx
mov rdi, rdx
mov dword [rax + 0x10], 4
lea rax, [rax + 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREBROADCOMUSHUpgradeService
mov qword [rsp + 0x30], rbx
mov rbp, rcx
mov dword [rsp + 0x28], 0x20019
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140006171
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x80]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140006173
mov ecx, dword [rsp + 0x80]
mov dword [rdi], ecx
jmp 0x140006173
mov dword [rdi], esi
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140006190
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rbx
mov rdi, rdx
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREBROADCOMUSHUpgradeService
mov qword [rsp + 0x30], rbx
mov rsi, rcx
mov dword [rsp + 0x28], 0xf003f
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140006209
mov rcx, qword [rsp + 0x70]
lea r9d, [rbx + 4]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140006300
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str.Inside_RunService_...._n
call fcn.1400013e0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000634f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed__error_code___d_n
call fcn.1400013e0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, 0xf01ff
lea rdx, str.hoststoragesvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000638b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.hoststoragesvc
lea rcx, str.OpenService__S_for_running_failed__error_code___d_n
call fcn.1400013e0
jmp 0x1400063d9
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1400063bc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartService_failed__error_code___d_n
call fcn.1400013e0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret

Function at 0x1400063f0
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000643a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed__error_code___d_n
call fcn.1400013e0
jmp 0x1400064c9
mov r8d, 0xf01ff
lea rdx, str.hoststoragesvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140006476
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.hoststoragesvc
lea rcx, str.OpenService__S_for_stopping_failed__error_code___d_n
call fcn.1400013e0
jmp 0x1400064c0
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400064a3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x1400064cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ControlService_failed__error_code___d_n
call fcn.1400013e0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140009d20
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400065c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rdx
mov ebx, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call fcn.14000d200
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140006620
test eax, eax
je 0x140006645
lea ecx, [rax - 1]
movsxd rdx, ecx
movzx r8d, byte [rsp + rdx + 0x30]
cmp r8b, 0x5c
je 0x14000664d
cmp r8b, 0x2f
je 0x14000664d
movsxd rdx, eax
mov byte [rsp + rdx + 0x30], 0x5c
lea r8, [rsp + 0x30]
mov edx, 0xff
mov rcx, rdi
call fcn.140013af4
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140006664
mov eax, ebx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140009d20
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x140006690
Capabilities:
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov qword [rbp - 0x60], 0xf
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov byte [rbp - 0x78], bl
movzx eax, byte [str.USHUpgradeService]
neg al
sbb r8, r8
and r8d, 0x11
lea rcx, [rbp - 0x78]
call fcn.140006e00
nop
lea r8, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140007620
nop
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140006800
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp - 0x50]
call fcn.14000d200
lea rdx, [rbp - 0x50]
lea ecx, [rbx + 0x26]
call fcn.1400065c0
lea r8, str.BroadcomCV_binUSHUpgradeService.exe
mov edx, 0xff
lea rcx, [rbp - 0x50]
call fcn.140013cc0
mov dword [rsp + 0x50], 7
lea rcx, [rbp - 0x50]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140006790
inc eax
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.EventMessageFile
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400067f4
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TypesSupported
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x140006865
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0xffffffffffffffff
jbe 0x14000681e
call fcn.140019824
int3
cmp rax, 0x1000
jb 0x140006860
test byte [rsp + 0x68], 0x1f
je 0x140006833
call fcn.140019824
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140006842
call fcn.140019824
int3
sub rcx, rax
cmp rcx, 8
jae 0x140006851
call fcn.140019824
int3
cmp rcx, 0x27
jbe 0x14000685d
call fcn.140019824
int3
mov rcx, rax
call fcn.14000a01c
mov qword [rbp - 0x80], 0xf
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x68], 0
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x1400068da
inc rax
mov rcx, qword [rbp - 0x78]
cmp rax, 0xffffffffffffffff
jbe 0x140006894
call fcn.140019824
int3
cmp rax, 0x1000
jb 0x1400068d5
test byte [rbp - 0x78], 0x1f
je 0x1400068a8
call fcn.140019824
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400068b7
call fcn.140019824
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400068c6
call fcn.140019824
int3
cmp rcx, 0x27
jbe 0x1400068d2
call fcn.140019824
int3
mov rcx, rax
call fcn.14000a01c
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140009d20
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rbp
ret
Function at 0x140006900
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x50
movzx esi, dx
mov rbp, rcx
mov r8d, esi
sub r8d, 1
je 0x14000693c
sub r8d, 1
je 0x140006935
mov ebx, 0x60000000
jmp 0x140006941
mov ebx, 0xa0000001
jmp 0x140006941
mov ebx, 0xe0000002
lea rdx, str.USHUpgradeService
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov rdi, rax
test rax, rax
je 0x14000699c
xor ecx, ecx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov edx, 1
mov dword [rsp + 0x30], ecx
xor r8d, r8d
mov word [rsp + 0x28], dx
mov r9d, ebx
mov qword [rsp + 0x20], rcx
movzx edx, si
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14000a58c
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14000a61d
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x14000a61d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a61d
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14000a601
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14000a5fb
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000a603
add rdx, 0x28
jmp 0x14000a5e0
xor edx, edx
test rdx, rdx
jne 0x14000a60c
xor al, al
jmp 0x14000a623
test dword [rdx + 0x24], 0x80000000
je 0x14000a619
xor al, al
jmp 0x14000a623
mov al, 1
jmp 0x14000a623
xor al, al
jmp 0x14000a623
add rsp, 0x18
ret
Function at 0x1400238b4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140023754
call fcn.14001c058
mov dword [rax], 0x16
call fcn.140019804
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14002373c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14002373c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140023786
lock or dword [rax + 0x14], 0x10
jmp 0x14002373c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400237a3
mov rcx, qword [rbp + 0x10]
call fcn.140028118
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001c24c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14001fdc4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400237fa
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14002373c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140023866
mov rcx, qword [rbp + 0x10]
call fcn.14001c24c
cmp eax, 0xffffffff
je 0x14002384d
mov rcx, qword [rbp + 0x10]
call fcn.14001c24c
cmp eax, 0xfffffffe
je 0x14002384d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14001c24c
movsxd rdi, eax
lea rsi, [0x140040750]
mov rcx, rbx
sar rdi, 6
call fcn.14001c24c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140023854
lea rax, [0x14003f320]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140023866
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14002389c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140023898
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140023898
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14002373f
jmp 0x14002370c
Function at 0x1400134c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov eax, 1
mov qword [rsp + 0x38], rsi
mov r11, rcx
mov rdi, rdx
movzx ecx, byte [rdx + 0xb]
shl eax, cl
cmp byte [rdx + 0xa], 0
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
jge 0x140013520
mov ecx, dword [rdx + 0xc]
lea eax, [rcx - 1]
test ecx, eax
je 0x140013520
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
jmp 0x140013523
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x14001355e
mov qword [rsp + 0x30], rbx
xor r10d, r10d
mov ebx, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x14001354f
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x14001354f
mov rcx, r11
call fcn.1400130e0
add r10, 0x10
sub rbx, 1
jne 0x140013531
mov rbx, qword [rsp + 0x30]
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x1400135c0
nop word [rax + rax]
movzx eax, byte [r10 + 9]
and al, 0x40
test byte [r10 + 8], 0xf
jne 0x140013589
test al, al
je 0x1400135b7
mov byte [r10 + 9], 0xb
jmp 0x1400135b7
test al, al
je 0x14001359f
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x14001359f
mov rcx, r11
call fcn.1400130e0
test byte [r10 + 8], 0x40
je 0x1400135b7
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x1400135b7
mov rcx, r11
call fcn.1400130e0
add r10, 0x18
cmp r10, rsi
jb 0x140013570
movzx eax, byte [rdi + 9]
mov rsi, qword [rsp + 0x38]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x1400135f7
mov rcx, rdi
call fcn.140013050
mov rcx, qword [r11 + 0x90]
mov qword [rax], rcx
mov qword [r11 + 0x90], rdi
and byte [rdi + 9], 0xc7
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x140013601
xor al, 2
mov byte [rdi + 9], al
add rsp, 0x20
pop rdi
ret
Function at 0x14001e6f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
call qword [sym.imp.ucrtbase.dll_localeconv]
xor esi, esi
lea r11, [0x14011bee0]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x14001e75f
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x14001e750
mov qword [rsp + 0x30], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x14001e776
mov r12d, ebp
jmp 0x14001e77f
cmp al, 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x80]
jne 0x14001e8d9
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x14001e8d9
movsd xmm2, qword [0x14012e4e0]
lea r13, [0x14011bee0]
add rdx, 2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x14001e7db
test edi, edi
jne 0x14001e830
mov edi, ebp
inc rdx
jmp 0x14001e7c0
test byte [r8 + r13 + 1], 0x10
je 0x14001e830
test r10d, r10d
jne 0x14001e7f3
cmp r8b, 0x30
jne 0x14001e7f3
inc r14d
jmp 0x14001e824
inc r10d
cmp r10d, 0x1e
jg 0x14001e821
test byte [rcx + r13 + 1], 2
je 0x14001e809
add ecx, 0xffffffd0
jmp 0x14001e80f
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x14001e824
inc r9d
test edi, edi
je 0x14001e82b
dec r9d
inc rdx
jmp 0x14001e7c0
mov r13, qword [rsp + 0x20]
lea eax, [r14 + r10]
test eax, eax
je 0x14001e8d9
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x14001e8bf
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x14001e867
lea rdx, [r11 + 2]
jmp 0x14001e871
cmp al, 0x2b
jne 0x14001e86f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x14011bee0]
test byte [r8 + r11 + 1], 2
je 0x14001e8d9
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x14001e890
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x14001e8cb
xorps xmm1, xmmword [0x14012ed10]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.ucrtbase.dll_ldexp]
jmp 0x14001e8dc
xorps xmm0, xmm0
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400271c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
cmp r8, 0x28
ja 0x1400271e7
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140027010
movabs rax, 0x7fffffffffffffdf
cmp rbp, rax
jae 0x140027274
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 0x19]
mov qword [rsp + 0x38], rsi
mov r8d, 4
mov qword [rsp + 0x40], rdi
mov rdi, qword [rcx + 0x18]
mov ebx, dword [rdi + 0x60]
call fcn.14001bdf0
movzx ecx, byte [rdi + 0x64]
mov r8, rbp
and cl, 0x18
mov rdx, r14
mov rsi, rax
mov byte [rax + 9], cl
mov byte [rax + 8], 0x14
mov rcx, qword [rdi + 0x70]
mov qword [rax], rcx
lea rcx, [rax + 0x18]
mov qword [rdi + 0x70], rax
mov dword [rax + 0xc], ebx
mov byte [rax + 0xa], 0
mov byte [rax + rbp + 0x18], 0
mov qword [rax + 0x10], rbp
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.14001bcf0
int3
Function at 0x14003c530
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401470c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14003c603
cmp byte [rcx + 0x71], 0
je 0x14003c603
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14003c5ff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003c5c4
sub eax, 1
je 0x14003c5c8
cmp eax, 2
jne 0x14003c5ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140107250
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14003c5f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x14003c5ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003c5ac
xor al, al
jmp 0x14003c5ac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140107250
add rsp, 0x60
pop rbx
ret
Function at 0x140049270
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x1401470c0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.shell32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
test eax, eax
js 0x140049325
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400492d0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14003d570
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea r8, [rdx + rcx*2]
lea rdx, [rsp + 0x40]
cmova rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.14003ca80
nop
lea rcx, [rsp + 0x40]
call fcn.14003c6e0
jmp 0x14004934a
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
xor r8d, r8d
lea rdx, [0x14011bb9a]
mov rcx, rbx
call fcn.140002810
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140107250
add rsp, 0x280
pop rbx
ret
Function at 0x14005d600
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14005d6cc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14005d6cc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14005d6e5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14005d6bc
cmp byte [rax], 0x5c
jne 0x14005d6b6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x14005d6b6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14005d6a2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x14005d6b3
test r8b, 0x10
jne 0x14005d6b6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x14005d6b6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140059860
test edi, edi
jne 0x14005d620
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140059850
int3