joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r14, rcx
mov edi, 1
mov rbx, qword [0x1401b34f0]
mov edx, 0x81
lea r8d, [rdx + 0x6f]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14001084d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14001084d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14001084d
xor r15d, r15d
mov r13d, 0x403
mov r12d, 0x1234
nop dword [rax]
movzx esi, word [rbx]
cmp r15w, si
je 0x14001084d
movzx eax, word [rbx + 2]
mov ebp, dword [rbx + 4]
add rbx, 8
cmp r13w, ax
jne 0x1400107b1
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140010a90
nop
movzx edx, si
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x143
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r15d
lea rax, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x140010842
call fcn.1400c85cc
jmp 0x140010842
cmp r12w, ax
jne 0x140010842
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0xffffffffffffffff
lea rax, [rsp + 0x188]
mov qword [rsp + 0x180], rax
mov r8d, 3
mov rdx, rbx
lea rcx, [rsp + 0x180]
call fcn.140010a90
nop
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
cmp rcx, rax
je 0x14001081a
call fcn.1400c85cc
movzx edx, si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x40b
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 0xffffffffffffffff
cmove edi, r15d
add rbx, rbp
test edi, edi
jne 0x140010730
mov eax, edi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400c7be0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001a890
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14001a904
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a926
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001a926
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je 0x14001a926
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14001aa40
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x2c0], rbx
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rdx
mov rdi, rcx
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x58], rcx
mov r9d, dword [rdi + 8]
or r9d, 0x2001f
mov rax, qword [rdi]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001aac4
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r9d
mov r8, rsi
mov rdx, rax
call fcn.14001a690
jmp 0x14001aada
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14001abe3
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001aaff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
test ebx, ebx
jne 0x14001abe3
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001aba6
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14001aa40
mov ebx, eax
test eax, eax
jne 0x14001abe3
mov dword [rsp + 0x40], 0x100
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14001ab51
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001abbb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001abd5
mov r8, rsi
mov rdx, qword [rdi]
call fcn.14001a890
jmp 0x14001abe1
mov rdx, rsi
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001ac00
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
jmp 0x14001ac08
mov dword [rsp + 0x50], 0
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400c7be0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001eac0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xorps xmm0, xmm0
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rdi, rcx
cvtsi2sd xmm0, rdx
test rdx, rdx
jns 0x14001eafb
addsd xmm0, qword [0x140144f18]
divsd xmm0, qword [0x140144ee0]
call fcn.1400e7d70
movsd xmm1, qword [0x140144f10]
xor eax, eax
mulsd xmm0, qword [0x140144ee8]
comisd xmm0, xmm1
jb 0x14001eb37
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14001eb37
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si rsi, xmm0
add rsi, rax
test rdi, rdi
je 0x14001ec70
test r14, r14
je 0x14001ec70
cmp rsi, rbp
ja 0x14001ec70
call fcn.14001e940
test al, al
jne 0x14001eb6b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r8d, r8d
lea r11, [0x140000000]
mov edx, r8d
test rbx, rbx
je 0x14001ec22
mov r10, r14
cmp rdx, rbx
jae 0x14001eb92
movzx eax, byte [rdx + rdi]
inc rdx
jmp 0x14001eb95
mov eax, r8d
cmp rdx, rbx
jae 0x14001eba4
movzx r9d, byte [rdx + rdi]
inc rdx
jmp 0x14001eba7
mov r9d, r8d
cmp rdx, rbx
jae 0x14001ebb5
movzx ecx, byte [rdx + rdi]
inc rdx
jmp 0x14001ebb8
mov ecx, r8d
shl eax, 8
add r10, 4
add eax, r9d
shl eax, 8
add eax, ecx
mov ecx, eax
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11 + 0x1afd60]
mov byte [r10 - 4], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11 + 0x1afd60]
mov byte [r10 - 3], al
mov eax, ecx
and ecx, 0x3f
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r11 + 0x1afd60]
mov byte [r10 - 2], al
movzx eax, byte [rcx + r11 + 0x1afd60]
mov byte [r10 - 1], al
cmp rdx, rbx
jb 0x14001eb89
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
cmp dword [r11 + rbx*4 + 0x141000], r8d
jle 0x14001ec64
lea rax, [r14 - 1]
add rax, rsi
nop word [rax + rax]
mov byte [rax], 0x3d
inc r8d
lea rax, [rax - 1]
cmp r8d, dword [r11 + rbx*4 + 0x141000]
jl 0x14001ec50
mov rax, qword [rsp + 0x50]
mov qword [rax], rsi
mov al, 1
jmp 0x14001ec72
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001f4d0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov r9d, dword [0x1401b4d80]
lea r10d, [r9 + 2]
lea eax, [r9 + 1]
imul r10d, eax
imul r10d, r9d
mov eax, 0x88888889
imul r10d
add edx, r10d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r10d, edx
cmp r10d, 0xd
jne 0x14001f547
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x30], 1
mov ecx, dword [0x1401b4d80]
imul ecx, ecx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 3
jne 0x14001f5a4
call fcn.1400c84d4
mov ecx, dword [0x1401b4d80]
cmp ecx, eax
jne 0x14001f5a4
dec ecx
mov dword [0x1401b4d80], ecx
mov r9, qword [rdi]
mov r8, qword [rsi]
lea rdx, [0x140141050]
mov rcx, rbx
call fcn.140011990
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400240d0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.140023570
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
test eax, eax
jne 0x140024106
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x78
ret
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x70], rbx
call fcn.1400c9f1c
lea rcx, [rsp + 0x40]
call fcn.1400c904c
mov ecx, dword [0x1401b4d80]
lea edx, [rcx + 1]
mov rbx, rax
imul edx, ecx
and edx, 0x8000000f
jge 0x140024142
dec edx
or edx, 0xfffffff0
inc edx
cmp edx, 0xd
jne 0x140024160
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
cmp rbx, 0xffffffffffffffff
jne 0x14002416a
xor eax, eax
jmp 0x14002418a
lea rcx, [rsp + 0x30]
call fcn.1400ca7a4
movsxd rcx, dword [rsp + 0x30]
mov rdx, rbx
call fcn.1400ca774
call fcn.1400e7d70
cvttsd2si eax, xmm0
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400c7be0
add rsp, 0x78
ret
Function at 0x140026120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov qword [rbp - 0x29], rcx
xor r15d, r15d
mov dword [rbp - 0x39], r15d
mov dword [rbp - 0x19], 0x5f005f
mov dword [rbp - 0x15], 0x520043
mov dword [rbp - 0x11], 0x40005f
mov dword [rbp - 0xd], 0x410046
mov dword [rbp - 9], 0x4c0049
mov dword [rbp - 5], 0x440045
mov dword [rbp - 1], 0x44005f
mov dword [rbp + 3], 0x57004f
mov dword [rbp + 7], 0x4c004e
mov dword [rbp + 0xb], 0x41004f
mov dword [rbp + 0xf], 0x5f0044
mov dword [rbp + 0x13], 0x450052
mov dword [rbp + 0x17], 0x440041
mov dword [rbp + 0x1b], 0x5f0040
mov dword [rbp + 0x1f], 0x520043
mov dword [rbp + 0x23], 0x5f005f
mov word [rbp + 0x27], r15w
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rcx, [rbp - 0x19]
lea rax, [rbp - 0x19]
test rax, 0xffffffffffff0000
jne 0x14002621f
movzx edi, cx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14002624a
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.1400026c0
jmp 0x14002624a
lea rax, [rbp - 0x19]
or rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140026230
mov r8d, ecx
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.1400023d0
nop
mov dword [rbp - 0x39], 1
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400c7be0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400263c0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401ace90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r9d, dword [0x1401b4d80]
mov edi, edx
mov rbx, rcx
lea eax, [r9 + 1]
lea r8d, [r9 + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, r9d
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub r8d, eax
cmp r8d, 3
jne 0x140026426
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, eax
mov dword [0x1401b4d80], eax
imul r9d, r9d
mov eax, 0x2aaaaaab
xor esi, esi
imul r9d
mov dword [rbx + 0x38], edi
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*2]
shl eax, 2
sub r9d, eax
cmp r9d, 2
jne 0x140026464
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test edi, edi
jns 0x14002648a
mov rcx, qword [rbx + 0x30]
mov qword [rsp + 0x30], rsi
lea r8, [rbx + 0x3c]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rsi
call qword [rax + 0x40]
mov rcx, qword [rbx + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x30], rsi
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c7be0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140027460
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rdi, rdx
mov qword [rax - 0x28], 0
mov dword [rax - 0x30], 0x80
mov dword [rax - 0x38], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400274d4
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, eax
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x1400274cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14002756d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x60], 0
mov rax, qword [rdi]
mov ebx, dword [rax - 0x10]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x14002750c
xor edx, edx
mov rcx, rdi
call fcn.1400024c0
lea r8d, [rbx + rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 1
sete bl
mov rdx, qword [rdi]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14002756a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x140027580
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
xor eax, eax
mov rdi, rdx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400275c7
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov eax, eax
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1400409b0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
movsxd rsi, edx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x60]
call fcn.14001c880
nop
mov dword [rsp + 0x20], 1
mov r8, qword [rax]
mov eax, edi
test r8, r8
setne al
test eax, eax
jne 0x140040a05
mov ecx, 0x80004005
call fcn.140001920
int3
mov rax, qword [rbx + 0xc8]
sub r8, rax
nop
movzx ecx, word [rax]
cmp cx, word [rax + r8]
jne 0x140040a25
add rax, 2
test cx, cx
jne 0x140040a10
jmp 0x140040a2a
sbb edi, edi
or edi, 1
test edi, edi
jne 0x140040a56
call fcn.140022180
test al, al
jne 0x140040a56
call fcn.140022d40
test al, al
jne 0x140040a56
lea rcx, [rsi + rsi*4]
mov rax, qword [rbx + rcx*8 + 0xe8]
cmp dword [rax - 0x10], edi
je 0x140040a56
mov bpl, 1
jmp 0x140040a59
xor bpl, bpl
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x20], eax
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140040a7e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bpl, bpl
jne 0x140040b52
mov edx, esi
mov rcx, rbx
call fcn.140040b80
test al, al
je 0x140040b52
mov edx, esi
mov rcx, rbx
call fcn.140041b00
test al, al
jne 0x140040ae5
mov eax, dword [0x1401b4d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
mov eax, dword [0x1401b5828]
mov edx, 0x41243300
cmp ecx, 9
cmove eax, edx
mov dword [0x1401b5828], eax
jmp 0x140040b52
call fcn.140022180
test al, al
jne 0x140040b2d
call fcn.140022d40
test al, al
jne 0x140040b2d
lea rcx, [rsp + 0x68]
call fcn.14001c880
nop
mov rdx, rax
lea rcx, [rbx + 0xc8]
call fcn.140002340
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140040b46
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140040b46
mov r8d, 1
lea rdx, [0x140140fe0]
lea rcx, [rbx + 0xc8]
call fcn.1400023d0
lea rax, [rsi + rsi*4]
mov byte [rbx + rax*8 + 0xf0], 1
lea rax, [rsi*4 + 0x1a]
add rax, rsi
lea rax, [rbx + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140046090
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
xor ebp, ebp
mov qword [r11 - 0x38], rbp
mov dword [rsp + 0x68], ebp
mov qword [r11 - 0x28], rbp
mov qword [r11 - 0x48], rbp
lea rax, [r11 + 0x18]
mov qword [r11 - 0x58], rax
lea rax, [r11 - 0x48]
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140046116
mov dword [rsp + 0x68], ebp
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rbx
jmp 0x140046140
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001a970
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x140046140
xor dil, dil
jmp 0x1400461b2
mov rcx, qword [rsi]
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x140046154
lea edi, [rax + 0xd]
jmp 0x140046192
or rax, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140046160
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x1400461a8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebp
test edi, edi
sete dil
test rbx, rbx
je 0x1400461c5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rbp
movzx eax, dil
mov dword [rsp + 0x68], ebp
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400461f0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov eax, dword [0x1401b4d80]
lea r10d, [rax + 1]
imul r10d, eax
mov eax, 0x2aaaaaab
imul r10d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r10d, eax
cmp r10d, 0x11
jne 0x14004625d
lea edx, [r10 + 0x77]
lea r8d, [r10 + 0x78]
lea rcx, str._d__d_n
call fcn.1400c8aec
xor ebp, ebp
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x68], ebp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rbp
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400462c4
mov dword [rsp + 0x68], ebp
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rbx
jmp 0x1400462ee
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001a970
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x1400462ee
xor dil, dil
jmp 0x140046343
mov eax, dword [rsi]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x140046339
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebp
test edi, edi
sete dil
test rbx, rbx
je 0x140046356
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rbp
movzx eax, dil
mov dword [rsp + 0x68], ebp
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret