joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140288505
Capabilities:
Encode data using xor

Disassembly:
mov r11, r15
push rbp
xor r11w, 0x1b43
lea rax, [rax + r11*2 - 0x3685]
push rdx
jg 0x140167a77
mov r14, qword [rsp + 0x40]
or qword [rsp + r10 - 0x79e31702], 0x11a94358
shr byte [rsp + r10 - 0x79e31702], 0x4d
and qword [rsp + r10 - 0x79e316d2], 0x21f504f9
call fcn.14017d6e5
neg word [rsp + r10 - 0x79e316d2]
mov dword [rsp + 8], 0x19db5464
mov r11, qword [rsp + 0x18]
and r10w, r10w
and dword [rsp + r10 - 0x79e316d2], 0x4c81962
shr byte [rsp + 0x38], 0xe8
jns 0x14015546e
jg 0x140279221
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.14034fe01
or r11d, 0x423d427a
mov rdx, qword [rsp + r10 - 0x53fffff8]
mov rdx, qword [rdx + r10 - 0x54000000]
lea r11, [r10 + r11*4 + 0x1de35f6f]
shr r11b, 0x7f
shr r10b, 0x5d
lea r11, [r10 + r11 + 0x73140e40]
lea rdx, [rdx + r10*2 - 0x4e22b352]
shr r11d, 0xee
jb 0x1400de6d2
mov qword [rsp + r10 - 0x53fffff8], r10
call fcn.14001af69

Function at 0x140293d2f
Capabilities:
Encode data using xor

Disassembly:
xchg dword [rsp + 0x20], ebx
mov qword [rsp + 8], 0x28d4e81f
lea rsp, [rsp + 8]
call fcn.1403bfab7
add sil, byte [rbp - 5]
shl byte [rsp + rsi - 0x38], 1
mov bh, 0x3c
clc
jns 0x140293db4
or dword [rbx + 0x66fef986], edx
or eax, 0x92e797a1
jle 0x140293d9f
or ebp, dword [rsi + 0x5fb3478c]
mov al, 0xb0
invalid
xor dword [rsi], ebp
loopne 0x140293d9c
pop rax
or bl, ch
mov dl, 0xbf
test byte [rcx - 0x69a66a07], bl
ficom word [rdx + 0x55]
cmp cl, byte [rax - 5]
xchg esi, eax
sbb byte [rdi - 0x6727a20a], dl
or al, 0x99
adc dword [rdi], 0xfffffff6
adc eax, 0x6afd586d
pop rsp
jae 0x140293d1f
xchg ebp, eax
cmp r14d, r12d
cmp esi, esp
leave
movabs eax, dword [0x533a6fc5e9b24306]
ror byte [rdx], cl
or eax, 0x20f6b3af
hlt
test byte [rsi + 0x1df9d786], 0x72
fbstp tbyte [rsi + 0x68]
xlatb
stc
sbb eax, 0x6876df72
push rax
fisubr dword [rcx]
lahf
xchg esi, eax
not cl
jrcxz 0x140293e06
jbe 0x140293e43
je 0x140293db7
jmp 0x140293d6b
outsb dx, byte [rsi]
in al, dx
sub dl, byte [rbx + 0x16]
in eax, dx
pop rcx
rcl bh, cl
pop rcx
add dh, bh
loop 0x140293e8e
xor al, 0x71
test al, 0xc5
xchg ebx, eax
stosd dword [rdi], eax
mov esp, 0x64685fe9
mov edi, 0x6ae3bf3a
in eax, 0x28
or ebp, 0x17d46bb
insd dword [rdi], dx
adc bl, byte [rdi - 0x2520713]
push 0x3d0cd4b4
mov ah, 0xd4
or al, 0x3d
jae 0x140293ea9
add eax, 0x34c88d58
mov ecx, 0xde60ede6
or eax, dword [rbp + rbx - 0x59de7d62]
sbb dword [rsi + 0x1361b663], esi
push rsp
int 6
movabs eax, dword [0x36157591b397d843]
jg 0x140293e39
xor al, 0xb9
out 0xed, al
invalid
mov word [rbx], gs
leave
cdq
mov al, ch
cdq
sal byte [rax + rsi*4 + 0x448396a], 1
fucompi st(4)
add dword [rdx*8 + 0x3a60a658], edx
sar byte [rsi], cl
adc byte [rsi + 0x52], al
invalid
invalid
invalid
Function at 0x1402ae5a7
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rax, qword [rsp + 0x18]
mov rax, qword [rax]
mov qword [rsp + 0x18], r13
shl r13, 0x56
and si, si
xor sil, 4
test dword [rsp + 0x1c], esi
lea rsi, [r13 + riz + 0x1e704c25]
lea rax, [rax + 0x768d0402]
movabs rbx, 0x144f1111524b508f
sets r13b
cmovns r13, qword [rsp + 0x18]
sub ebx, dword [rsp + 0x1b]
push r8
call fcn.14025c7ba
push rbx
pushfq
movabs rbx, 0x4f091965591840da
test rbx, 0x506b455a

Function at 0x1402b226b
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x84c49ab2
sub ecx, dword [rbp - 0x2e817ba8]
or byte [rcx - 0x4eb41ba5], ch
push rcx
sbb ecx, dword [rax - 0x3f]
jmp 0xc07d4b20
shr rcx, 0x62
call fcn.14002e328
jne 0x140146307
pop rsp
out 0xed, eax
xor dword [rbp - 0x1580d681], ebp
jae 0x1401462a4
push rcx
sar dword [rbp - 0x6d], 0xd6
push 0x2963edd6
jg 0x140146358
sbb esp, dword [rbp - 0x2a]
add edx, dword [rbp - 0x10]
test esi, edx
adc eax, 0x299341a9
invalid
jrcxz 0x14014636e
sub dword [0x116a9d611], esp
retf
rol byte [rbx + 0xab6fb5b], cl
xor byte [rsi - 1], ch
movsd dword [rdi], dword [rsi]
cmc
push 0xffffffffffffffda
outsb dx, byte [rsi]
push rsp
add al, 0x95
pop rcx
invalid
jae 0x140146393
jrcxz 0x140146307
xchg ebp, eax
sbb ch, bh
jl 0x140146371
invalid
invalid
movabs rcx, 0x5b7568a259ca4fb8
jl 0x1401462b7
loop 0x1402b22ae
invalid
invalid

Function at 0x1402cb4b0
Capabilities:
Encode data using xor

Disassembly:
neg r14b
test dword [rsp + r14*2 + 0x82], edi
mov r14, qword [rsp + r14*8 + 0x50]
jl 0x1402ae604
setno byte [rsp + 0x60]
ja 0x14022f717
call fcn.140187493
xchg qword [rsp + 0x18], rsi
push rbx
call fcn.1401ca6ed
xchg byte [rcx], dl
invalid
jno 0x14001ef43
call fcn.1402486d6

Function at 0x1402d0c22
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 0x30]
neg dword [rsp + 0x20]
or qword [rsp + 0x20], 0x50565ce8
jne 0x14024e60f
add qword [rsp], 0xffffffffbfeb92d8
mov r8, qword [rsp + 0x40]
cmp word [rsp + 0x38], 0x5da9
jne 0x14001f7cd

Function at 0x1402d8e3f
Capabilities:
Encode data using xor

Disassembly:
test byte [rsp + 0x38], 0x80
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x58]
ret 8
add word [rsp + 0x40], 0x3826
jno 0x140022a36

Function at 0x1402de689
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xb3c352b2
sub byte [rdi + 0x10c0f618], al
mov edi, 0x65ec9b28
retf 0x76cf
mov r14w, 0x12c
xchg qword [rsp + r14 - 0x114], rax
call fcn.1400f59cb
test dword [rsi], esi
jnp 0x1402de6fb
jle 0x1402de6fe
xchg byte [rdi + 0x76], bl
sar dword [rcx], 0xe0
loope 0x1402de62a
mov edi, 0x822d29a0
push rsp
sub dword [rdx - 0x42], eax
in eax, 0x56
invalid
sub dword [rdi + 0x295745f7], edi
xor ebx, eax
movabs byte [0x1bcdd16d04dad6a8], al
cli
push r15
sub dword [rbx], esi
fsub dword [rdx + 0x4dad6a8]
insd dword [rdi], dx
ror ebp, 1
sbb edi, edx
scasd eax, dword [rdi]
rcl dword [rbp - 0x69b58268]
invalid
Function at 0x1402df771
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 0x10]
lea rbx, [rbx + 1]
jne 0x1400e36ce
xor eax, dword [rcx + rbx*4 + 0x63]
cdq
pop rsi
and dword [rdi - 0x737022dd], ebx
jb 0x1402df7aa
sub esi, dword [rcx + 0x7ba38e8c]
invalid
mov eax, dword [rbx]
xchg edx, eax
xor byte [rdx - 0x7c], bh
add esp, ebx
sbb sp, word [rdi - 0x64]
loopne 0x1402df7ad
sbb dword [rbx + rax*8 - 0x7a64abce], ebx
and ecx, dword [rdi - 0x33]
push 0x366bc01c
xchg esp, eax
movabs dword [0x804e59a3944535b0], eax
and dword [rbx + 0x23], 0xe
invalid

Function at 0x1402e81ba
Capabilities:
Authenticate hmac

Disassembly:
mov r11d, dword [rsp + 0x3c]
shr r11, 0x81
mov rbp, qword [rsp + r11 - 0x7fffffdf]
mov rbp, qword [rbp + r11 - 0x7fffffff]
mov r13, qword [rsp + r11 - 0x7fffffc7]

Function at 0x1402e91df
Capabilities:
Encode data using xor

Disassembly:
not word [rsp + 0x48]
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x80]
ret
add word [rsp + 0x48], r12w
jle 0x14016e730
sub r12b, 0x72
test byte [rsp + 0x48], r12b
mov r12, qword [rsp + 0x28]
ja 0x1400f0a60
lodsb al, byte [rsi]
invalid

Function at 0x1402eebbf
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1401242f9
mov rbx, qword [rsp + 0x30]
call fcn.1401709e5
jne 0x1402b00d2
test r10d, 0x3a6a77c6
setge r13b
js 0x1402cbd57
jne 0x1402b1f88
Function at 0x140018a30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140018a7c
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140018aca
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140018ac5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140018ae9
mov rcx, r8
call fcn.14003cb60
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.14004378c
int3

Function at 0x140018af0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jb 0x140018b42
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140018b94
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140018b8f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140018bb3
mov rcx, r8
call fcn.14003cb60
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.14004378c
int3
Function at 0x14001ab20
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140085048]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rdi, qword [rsp + 0xe0]
xor ebx, ebx
cmp qword [rcx + 0x18], 8
jb 0x14001ab6a
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001ab9e
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
mov r8d, 0x19
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, rbp
call fcn.140007d80
jmp 0x14001ad0d
mov ebp, 1
mov ecx, 0x208
call fcn.14003ce20
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov rbx, 0xffffffffffffffff
mov r15d, 0x104
nop dword [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14001abed
mov rax, qword [r14]
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001abfa
mov r8, qword [rdi]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x14001ac09
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x14001ac17
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [r15 - 1]
cmp eax, ecx
jb 0x14001ac98
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001ac3f
mov r8, qword [rdi]
mov rax, rsi
sub r8, rsi
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001ac64
add rax, 2
test ecx, ecx
jne 0x14001ac50
test edx, edx
je 0x14001ac98
mov rcx, rsi
call fcn.14003cb60
inc ebp
imul r15d, ebp, 0x104
mov ecx, r15d
mov eax, 2
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.14003ce20
mov rsi, rax
jmp 0x14001abe0
mov rbp, qword [rsp + 0x38]
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14001aca0
mov rax, qword [rsp + 0x60]
cmp rbx, rax
ja 0x14001ace3
lea rdi, [rsp + 0x48]
cmp rax, 8
cmovae rdi, qword [rsp + 0x48]
mov qword [rsp + 0x58], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14003f090
xor r14d, r14d
mov word [rbx + rdi], r14w
jmp 0x14001acf3
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400083d0
mov rcx, rsi
call fcn.14003cb60
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm1
mov rax, rbp
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003cb40
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001bd20
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140085048]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebp, ebp
mov dword [rsp + 0x24], ebp
lea rdx, [0x140088890]
lea rcx, [0x1400884d0]
call fcn.140018c30
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
xor r8d, r8d
lea rdx, [0x140070e7c]
lea rcx, [rsp + 0x40]
call fcn.140007d80
mov dword [rsp + 0x24], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14003ecd0
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001be57
cmp eax, 0x104
je 0x14001be57
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x14001be57
mov ecx, esi
call fcn.14003ce20
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.14003ecd0
mov dword [rsp + 0x28], ebp
mov r9, rdi
mov r8d, esi
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x60]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14001be4f
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, str.StringFileInfo000004b0ProductVersion
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14001be4f
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140007490
nop
mov rcx, rdi
call fcn.14003cb60
lea rdx, [rsp + 0x40]
lea rcx, [0x1400887f0]
call fcn.140007580
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001bea7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bea2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bed0
call fcn.14003cb60
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14003cb40
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14004378c
int3
Function at 0x14001d140
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x140088920]
call fcn.14003c3d8
test eax, eax
jne 0x14001d1ef
cmp dword [0x14008896c], 0x7fffffff
je 0x14001d1da
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rax + 4]
xor edi, edi
mov dword [rsp + 0x50], 2
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rbx + 0xc0]
lea r9, [rsp + 0x48]
mov rcx, qword [rbx + 8]
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [0x140088920]
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
jmp fcn.14003c3e0
mov ecx, 6
mov dword [0x14008896c], 0x7ffffffe
call fcn.14003c0a0
int3
mov ecx, 5
call fcn.14003c0a0
int3
Function at 0x14001e810
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
mov dword [rsp + 0x40], ebp
mov rdi, qword [0x140088390]
lea r14, [0x140088920]
mov qword [rsp + 0x58], r14
mov rcx, r14
call fcn.14003c3d8
test eax, eax
jne 0x14001e968
cmp dword [0x14008896c], 0x7fffffff
je 0x14001e953
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140007660
mov rdx, rax
mov rcx, rdi
call fcn.140018a30
nop
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x40], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x14001e90b
mov rcx, rbx
call fcn.140011590
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001e918
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x48]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.14003c3e0
mov rax, rbx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [0x14008896c], 0x7ffffffe
mov ecx, 6
call fcn.14003c0a0
int3
mov ecx, 5
call fcn.14003c0a0
int3
Function at 0x14001f670
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140085048]
xor rax, rsp
mov qword [rbp - 8], rax
mov ebx, ecx
mov rsi, r8
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14001f79c
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, rdi
mov rcx, r14
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test rbx, rbx
je 0x14001f79c
test eax, eax
je 0x14001f79c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14001f79c
mov rcx, qword [rsi]
mov dword [rbp - 0x28], 0xf4366324
mov dword [rbp - 0x24], 0xe009ef36
mov dword [rbp - 0x20], 0xf9febbee
mov dword [rbp - 0x1c], 0x3c9ab01c
mov dword [rbp - 0x18], 0xbd3102c3
mov dword [rbp - 0x14], 0x530cf69d
mov dword [rbp - 0x10], 0x61bb98e6
mov dword [rbp - 0xc], 0xe6baac0d
cmp rcx, qword [rsi + 8]
je 0x14001f742
mov qword [rsi + 8], rcx
mov rax, qword [rsi + 0x10]
sub rax, rcx
cmp rdi, rax
jbe 0x14001f759
mov rdx, rdi
mov rcx, rsi
call fcn.14001f7c0
xor ebx, ebx
test rdi, rdi
je 0x14001f798
mov rdx, qword [rsi + 8]
mov rax, rbx
and eax, 0x1f
movzx ecx, byte [rbp + rax - 0x28]
xor cl, byte [rbx + r14]
mov byte [rbp - 0x30], cl
cmp rdx, qword [rsi + 0x10]
je 0x14001f784
mov byte [rdx], cl
inc qword [rsi + 8]
jmp 0x14001f790
lea r8, [rbp - 0x30]
mov rcx, rsi
call fcn.14001f8b0
inc rbx
cmp rbx, rdi
jb 0x14001f760
mov al, 1
jmp 0x14001f79e
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003cb40
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001ffa0
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400883a8], 0
jne 0x140020092
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x140074bd8]
mov qword [rsp + 0x48], rbx
lea rcx, [0x140074bc8]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea rdi, [0x1400883a8]
test eax, eax
js 0x140020055
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x140074bb8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x140020046
mov rcx, qword [rsp + 0x40]
lea r8, [0x140070e28]
mov r9, rdi
lea rdx, [0x140070e38]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14002003b
mov rcx, qword [0x1400883a8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x140020092
cmp qword [0x1400883a8], 0
jne 0x140020092
lea r9, [0x140070e28]
mov qword [rsp + 0x20], rdi
lea r8, [0x140070e38]
xor edx, edx
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x14002009f
mov rcx, qword [0x1400883a8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x140074500]
lea rdx, [0x140074520]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x1400223f0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x140085048]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140022460
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140007d80
mov dword [rsp + 0x30], 1
mov r8d, SafeArrayDestroy
lea rdx, [0x140075d90]
mov rcx, rbx
call fcn.1400079c0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14003cb40
add rsp, 0x260
pop rbx
ret
Function at 0x1400259c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140025a04
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400259f0
ret
Function at 0x14002a860
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x14002a943
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002a943
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14002a961
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14002a933
cmp word [rax], 0x5c
jne 0x14002a92c
lea rdx, [rax + 2]
cmp rdx, rcx
je 0x14002a92c
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14002a917
movzx ecx, word [rdx]
sub cx, 0x28
cmp cx, 1
jbe 0x14002a929
test r8b, 0x10
jne 0x14002a92c
movzx ecx, word [rdx]
sub cx, 0x7b
test bp, cx
jne 0x14002a92c
mov rax, rdx
add rax, 2
mov qword [rbx], rax
mov rcx, rbx
call fcn.140026ad0
test edi, edi
jne 0x14002a890
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140026ac0
int3