joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e030
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x14001e120
lea rdi, [0x140022498]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14001e120
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001e120
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001e120
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400224a8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001e230
movzx edx, byte [rbx + 0x40]
cmp rsi, qword [rax + 0x1d8]
je 0x14001e138
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
je 0x14001e190
test dl, 3
jne 0x14001e110
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x14002ce28], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001e101
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
jmp 0x14001e125
mov rcx, rbp
call sym.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x14001e109
nop
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
ret
test dl, 3
jne 0x14001e110
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x14002ce28], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001e15d
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x14001e101
and eax, 0xfffffffe
mov rcx, rbp
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call sym.pthread_mutex_unlock
call sym._pthread_invoke_cancel
nop word [rax + rax]
test dl, 0xc
jne 0x14001e110
and edx, 0xf
jne 0x14001e120
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001e101
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [sym._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, rdi
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x14002ce28], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001e218
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbp
call sym.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14001e101
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14001e0c0
movzx edx, byte [rbx + 0x40]
jmp 0x14001e0cd
Function at 0x14001e250
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140022498]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_mutex_lock
mov rcx, rbx
call sym.__pthread_get_pointer
test rax, rax
je 0x14001e2c8
cmp qword [rax + 0x1d8], rbx
jne 0x14001e2c8
test byte [rax + 0x40], 0xc
jne 0x14001e2c8
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x14001e2c8
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x14001e2c8
mov rcx, rdi
call sym.pthread_mutex_unlock
test esi, esi
je 0x14001e2e0
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x14001e2e8
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov rcx, rdi
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x14001e2d5
mov eax, 0x16
jmp 0x14001e2d5

Function at 0x14001e480
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400224a8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001e4f0
cmp esi, 1
ja 0x14001e4fd
lea rbp, [rbx + 0x38]
mov rcx, rbp
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14001e4c4
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffe
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14001e4a6
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14001e510
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
mov rdi, rdx
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400224a8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14001e588
mov ebp, esi
and ebp, 0xfffffffd
jne 0x14001e595
lea r12, [rbx + 0x38]
mov rcx, r12
call sym.pthread_mutex_lock
test rdi, rdi
je 0x14001e558
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov eax, dword [rbx + 0x44]
mov rcx, qword [rbx + 0x1d8]
and eax, 0xfffffffd
or eax, esi
mov dword [rbx + 0x44], eax
call sym.test_cancel_locked
mov rcx, r12
call sym.pthread_mutex_unlock
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x14001e538
mov ebp, 0x16
mov eax, ebp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14001e840
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbp, rdx
test rcx, rcx
je 0x14001e960
lea rdi, [0x140022498]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x14001e960
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14001e960
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001e960
test byte [rbx + 0x44], 4
jne 0x14001e970
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400224a8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001e990
cmp rsi, qword [rax + 0x1d8]
je 0x14001e9b8
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x14001e8eb
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14001e8fa
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001e90e
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x14001e9a8
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001e9bf
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001e980
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x14001e956
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x14001e8c6
jmp 0x14001e8d3
call sym.pthread_mutex_destroy
jmp 0x14001e930
mov eax, 0x24
jmp 0x14001e965
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x14001e9d0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x140022498]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rbx, rax
test rax, rax
je 0x14001eaf0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14001eaf0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x14001eaf0
test byte [rbx + 0x44], 4
jne 0x14001eb10
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x1400224a8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001eb50
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x14001eb88
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x14001ea77
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001eb30
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001ea8b
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x14001eb68
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001eb9a
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14001eb78
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x14001ea73
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14001eade
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x14001ea45
jmp 0x14001ea4c
call sym.pthread_mutex_destroy
jmp 0x14001eaac
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x14001ead4
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14001eade
call sym.replace_spin_keys.part.0
nop
Function at 0x1400224c0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002258c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002258c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400225a5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14002257c
cmp byte [rax], 0x5c
jne 0x140022576
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140022576
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140022562
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140022573
test r8b, 0x10
jne 0x140022576
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140022576
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400258b0
test edi, edi
jne 0x1400224e0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140023680
int3

Function at 0x1400265c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400265f4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400265e0
ret
Function at 0x140035e20
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor esi, esi
add rcx, 0x10
call fcn.14004e3f0
mov ecx, dword [rbx + 0x318]
test al, al
je 0x140035f64
cmp ecx, 1
je 0x140035f4c
mov dword [rbx + 0x318], 1
xor edx, edx
mov rcx, rbx
call fcn.140039510
mov rcx, rbx
call fcn.140038d50
lea rcx, [0x1400de480]
call fcn.14003a540
test al, al
je 0x140035fb9
lea rcx, [rbx + 0x10]
call fcn.14004e2f0
test al, al
je 0x140035fb9
lea rcx, [rbx + 0x10]
call fcn.14004e8e0
lea rdi, [rbx + 0x608]
cmp byte [rdi + 8], sil
jne 0x140035f33
cmp qword [rdi + 0x18], rsi
je 0x140035f33
mov word [rdi + 8], 0x101
mov dword [rdi + 0x20], 0x32
lea ecx, [rsi + 8]
call fcn.1400800f8
test rax, rax
je 0x140035ed4
mov qword [rax], rdi
jmp 0x140035ed7
mov rax, rsi
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140032120]
xor edx, edx
xor ecx, ecx
call fcn.14008f61c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140035fcc
cmp dword [rsp + 0x38], 0
je 0x140035fc1
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14007f038
test eax, eax
jne 0x140035fc1
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.140039510
lea rcx, [rbx + 0x10]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.1400246e0
test ecx, ecx
je 0x140035fa9
mov dword [rbx + 0x318], esi
mov rcx, rbx
call fcn.140038d50
mov byte [rbx + 0x610], sil
mov edi, 0x1388
cmp byte [rbx + 0x611], sil
je 0x140035fa9
nop dword [rax + rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x32
js 0x140035fa9
cmp byte [rbx + 0x611], sil
jne 0x140035f90
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.14008f498
nop
mov ecx, 1
call fcn.14007e3c4
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call fcn.14007e3c4
int3
Function at 0x140038b80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400dc438]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx edi, r8b
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rdx
xor ebp, ebp
lea rcx, [rsp + 0x58]
call fcn.140005710
mov byte [rsp + 0x78], dil
mov qword [rsp + 0x80], rsi
lea ecx, [rbp + 0x30]
call fcn.1400800f8
test rax, rax
je 0x140038c0c
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x1400a7970]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], bpl
mov byte [rax + 0x20], dil
mov qword [rax + 0x28], rsi
jmp 0x140038c0f
mov rax, rbp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140031f90]
xor edx, edx
xor ecx, ecx
call fcn.14008f61c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140038d26
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140038c80
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038c7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038d35
call fcn.140080134
cmp dword [rsp + 0x38], 0
je 0x140038d1b
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14007f038
test eax, eax
jne 0x140038d1b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140038ce3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140038cde
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038d3b
mov rcx, r8
call fcn.140080134
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400805c0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, 1
call fcn.14007e3c4
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.14007e3c4
nop
call fcn.140086adc
nop
call fcn.140086adc
int3

Function at 0x140038d50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x1400dea50]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call fcn.14007e26c
test eax, eax
jne 0x140038de1
cmp dword [0x1400dea9c], 0x7fffffff
je 0x140038dcc
lea edx, [rax + 2]
mov rcx, rbx
call fcn.1400418d0
mov eax, dword [rbx + 0xc0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14007e274
mov dword [0x1400dea9c], 0x7ffffffe
mov ecx, 6
call fcn.14007e3c4
int3
mov ecx, 5
call fcn.14007e3c4
int3
Function at 0x140039320
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rdx
xor ebp, ebp
mov dword [rsp + 0x3c], ebp
lea r14, [0x1400dea50]
mov qword [rsp + 0x50], r14
mov rcx, r14
call fcn.14007e26c
test eax, eax
jne 0x14003944a
cmp dword [0x1400dea9c], 0x7fffffff
je 0x140039435
lea edx, [rbp + 8]
mov rcx, rdi
call fcn.1400418d0
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140005710
mov rdx, rax
mov rcx, rdi
call fcn.14003c8f0
nop
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x38]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x34]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x34]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x3c], 2
mov rdx, rsi
cmp esi, 0xf
jbe 0x1400393f7
movzx r8d, byte [rsp + 0x30]
mov rcx, rbx
call fcn.140032cb0
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140039404
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.14007e274
mov rax, rbx
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [0x1400dea9c], 0x7ffffffe
mov ecx, 6
call fcn.14007e3c4
int3
mov ecx, 5
call fcn.14007e3c4
int3

Function at 0x140039510
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
movzx edi, dl
mov rbx, rcx
lea rsi, [0x1400dea50]
mov qword [rsp + 0x80], rsi
mov rcx, rsi
call fcn.14007e26c
test eax, eax
jne 0x140039654
cmp dword [0x1400dea9c], 0x7fffffff
je 0x14003963f
lea edx, [rax + 0xa]
mov rcx, rbx
call fcn.1400418d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], reloc.OLEAUT32.dll_SafeArrayDestroy
lea edx, [rbp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140025d10
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], SafeArrayUnaccessData
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.TRAINER_INITIALIZE]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400ab298]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], bpl
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14003c8f0
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x88], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x88]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x80]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x80], 1
jne 0x14003962b
mov dword [rsp + 0x88], edi
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x80]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x88]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp fcn.14007e274
mov dword [0x1400dea9c], 0x7ffffffe
mov ecx, 6
call fcn.14007e3c4
int3
mov ecx, 5
call fcn.14007e3c4
int3
Function at 0x14003c8f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], rdx
lea r9, [rsp + 0x30]
mov eax, dword [rdx + 0x10]
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov dword [rsp + 0x38], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
lea r8d, [rsi + 4]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14003c941
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14003c98f
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14003c98a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003c9ae
mov rcx, r8
call fcn.140080134
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140086adc
int3

Function at 0x14003c9c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], rdx
lea r9, [rsp + 0x30]
mov eax, dword [rdx + 0x10]
mov rbx, rdx
add eax, eax
mov dword [rsp + 0x30], 0
mov rdi, rcx
mov dword [rsp + 0x38], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, dword [rbx + 0x10]
mov rdx, rbx
add r8d, r8d
cmp qword [rbx + 0x18], 8
jb 0x14003ca1d
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.140025840
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003e7f0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x14003e8d3
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14003e8d3
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14003e8f1
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14003e8c3
cmp word [rax], 0x5c
jne 0x14003e8bc
lea rdx, [rax + 2]
cmp rdx, rcx
je 0x14003e8bc
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14003e8a7
movzx ecx, word [rdx]
sub cx, 0x28
cmp cx, 1
jbe 0x14003e8b9
test r8b, 0x10
jne 0x14003e8bc
movzx ecx, word [rdx]
sub cx, 0x7b
test bp, cx
jne 0x14003e8bc
mov rax, rdx
add rax, 2
mov qword [rbx], rax
mov rcx, rbx
call fcn.140040920
test edi, edi
jne 0x14003e820
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140023680
int3

Function at 0x140040d20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140040d64
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140040d50
ret