joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f3d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor eax, eax
lea rbx, [rdx + 0x80]
mov qword [rbx + 0x40], rax
lea r14, [rbx + 0x40]
mov qword [r14 + 8], rax
xor ebp, ebp
mov qword [r14 + 0x10], rax
mov rdi, rdx
mov qword [r14 + 0x18], rax
mov rsi, rcx
or dword [rdx + 0x58], 0x40000
lea rax, [0x1401b5f6e]
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
test dword [rdx + 0x58], 0x80000
mov dword [rsp + 0x40], ebp
je 0x14000f444
mov rax, qword [rbx + 0x70]
or rax, 1
mov qword [rbx + 0x58], rax
mov rcx, qword [rdi + 0x110]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rbp
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], r14
lea rdx, [rsp + 0x40]
mov r8d, 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], ebp
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x14000f4cf
mov eax, dword [rdi + 0x58]
bt eax, 0x11
jae 0x14000f537
bts eax, 0x10
mov dword [rdi + 0x58], eax
mov eax, dword [rsp + 0x78]
mov qword [rbx + 0x48], rax
inc dword [rdi + 0x78]
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x14000f4c2
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x14000f5ad
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x14000f5ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14000f537
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jg 0x14000f4ee
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x14000f4fc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [r14], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x14000f52a
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
jmp 0x14000f5ad
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
inc dword [rdi + 0x78]
jmp 0x14000f5ad
or dword [rdi + 0x58], 0x10000
inc dword [rdi + 0x78]
test dword [rdi + 0x58], 0x80000
je 0x14000f5ad
cmp qword [rbx + 0x78], 0xffffffffffffffff
lea rcx, [rbx + 0x78]
jne 0x14000f5ad
mov rdx, qword [rbx + 0x70]
lea r8, [0x14000f060]
mov dword [rsp + 0x28], 4
mov r9, rbx
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x14000f5ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x14000f58f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000f59d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov rdx, rbx
mov rcx, rsi
mov qword [r14], rax
call fcn.14000ea10
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400102f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rdi, r8
mov rcx, qword [r8 + 0x70]
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
jne 0x14001036f
mov eax, dword [rdx + 0x58]
test al, 0x40
je 0x1400103e7
mov edx, eax
and edx, 0xffffffbf
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], edx
jne 0x140010345
test dl, 1
jne 0x140010345
test al, 4
je 0x140010345
and eax, 0xffffffbb
mov dword [rbx + 0x58], eax
test al, 8
je 0x140010345
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov r9, qword [rbx + 0x100]
test r9, r9
je 0x1400103e7
mov ecx, dword [r8 + 0x40]
call fcn.1400174c0
mov ecx, eax
call fcn.140016510
mov edx, eax
mov rcx, rbx
call r9
jmp 0x1400103e7
cmp dword [r8 + 0x40], 0
jl 0x1400103c4
lea r9, [rdx + 0x110]
mov dword [rsp + 0x20], 8
mov edx, 0xffff
mov r8d, 0x700b
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1400103c4
mov rax, qword [rbx + 0x130]
mov qword [rdi + 0x1a8], rax
mov rax, qword [rbx + 0x100]
mov qword [rbx + 0x130], rdi
test rax, rax
je 0x1400103e7
xor edx, edx
mov rcx, rbx
call rax
jmp 0x1400103e7
mov rcx, qword [rdi + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rdi + 0x70], 0xffffffffffffffff
test byte [rbx + 0x58], 0x40
je 0x1400103e7
mov rdx, rdi
mov rcx, rbx
call fcn.14000f0f0
mov ecx, dword [rbx + 0x78]
mov eax, dword [rbx + 0x58]
dec ecx
mov dword [rbx + 0x78], ecx
test al, 1
je 0x140010410
test ecx, ecx
jne 0x140010410
test al, 0x20
jne 0x140010410
or eax, 0x20
mov dword [rbx + 0x58], eax
mov rax, qword [rsi + 0x50]
mov qword [rbx + 0x50], rax
mov qword [rsi + 0x50], rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140010420
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov edi, edx
mov rcx, qword [rcx + 0x110]
cmp rcx, 0xffffffffffffffff
je 0x14001046b
mov dword [rsp + 0x40], edx
lea r9, [rsp + 0x40]
mov edx, 6
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x14001046b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x140010482
mov ecx, dword [rbx + 0x58]
mov eax, ecx
btr eax, 0x18
bts ecx, 0x18
test edi, edi
cmove ecx, eax
xor eax, eax
mov dword [rbx + 0x58], ecx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140014410
Capabilities:
Connect pipe
Create pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x140014505
mov rcx, qword [rdi + 0x120]
mov r9d, 0xff
mov qword [rax - 0x10], rbp
xor r8d, r8d
mov dword [rax - 0x18], ebp
mov edx, 0x40040003
mov dword [rax - 0x20], 0x10000
mov dword [rax - 0x28], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x1400144cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140014484
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140014492
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400144be
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x1400145b1
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x1400145b1
mov r8, rax
mov dword [rsp + 0x20], ebp
mov rdx, rdi
mov rcx, rsi
call fcn.140013c10
test eax, eax
je 0x140014505
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140014484
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140014492
xor eax, eax
mov qword [rsp + 0x50], r14
mov qword [rbx + 0x40], rax
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rax
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1400145ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400145ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x14001454d
mov rax, rbp
jmp 0x140014581
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140014571
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001457f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x1400145a4
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
jmp 0x1400145a8
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
mov r14, qword [rsp + 0x50]
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400149f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test dword [rdx + 0x58], 0x1000000
lea rdi, [rdx + 0x80]
mov rbx, rdx
mov rsi, rcx
je 0x140014a3b
mov qword [rdx + 0x238], 0
lea rcx, [0x1400147b0]
mov rdx, rdi
mov r8d, select
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
jmp 0x140014af5
xor eax, eax
lea rcx, [rdi + 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
test dword [rdx + 0x58], 0x80000
je 0x140014a65
mov rax, qword [rdi + 0x70]
or rax, 1
mov qword [rdi + 0x58], rax
mov qword [rsp + 0x20], rcx
lea rdx, [0x14043f0e8]
mov rcx, qword [rbx + 0x118]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140014a95
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140014af9
test dword [rbx + 0x58], 0x80000
je 0x140014b50
cmp qword [rdi + 0x70], 0
jne 0x140014ac6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x140014b89
cmp qword [rdi + 0x78], 0xffffffffffffffff
lea rcx, [rdi + 0x78]
jne 0x140014b50
mov rdx, qword [rdi + 0x58]
lea r8, [0x14000f060]
mov dword [rsp + 0x28], 4
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x140014b50
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140014b0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140014b19
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140014b46
mov rax, qword [rax + 0x68]
mov qword [rdi + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x140014b6f
mov qword [rdi + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x140014b6f
mov rcx, qword [rbx + 0x128]
test rcx, rcx
je 0x140014b6f
xor r9d, r9d
lea rdx, [0x140015c10]
lea r8d, [r9 + 0x32]
call fcn.1400109b0
or dword [rbx + 0x58], 0x10000
inc dword [rbx + 0x78]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.CreateEvent
call fcn.140016450
int3
Function at 0x140015360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rcx, rbx
movaps xmm0, xmmword [rsp + 0x30]
mov edi, r9d
mov edx, r8d
lea r8, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call qword [rbx + 0x68]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14001541f
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14001541f
mov rcx, qword [rbx + 0x118]
lea r9, [rsp + 0x70]
cmp edi, eax
mov qword [rsp + 0x20], 0
cmova edi, eax
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140015401
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov r8d, eax
call fcn.1400152c0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov edx, dword [rsp + 0x70]
lea r8, [rsp + 0x30]
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_WSASetLastError]
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
lea r8, [rsp + 0x30]
mov rdx, 0xfffffffffffff024
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_WSASetLastError]
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x140017210
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x470
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor eax, eax
mov ebx, 2
mov qword [0x14043f250], rax
xor ecx, ecx
mov word [0x14043f250], bx
mov qword [0x14043f258], rax
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [0x14043f254]
mov word [0x14043f252], ax
lea rcx, str.0.0.0.0
call fcn.140013860
test eax, eax
jne 0x140017404
lea r8, [0x14043f260]
xor edx, edx
lea rcx, [0x140111dd8]
call fcn.140002320
test eax, eax
jne 0x140017404
lea ecx, [rbx + 0x41]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x140017413
mov ecx, 0x202
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14001742c
mov qword [rsp + 0x480], rdi
xor r8d, r8d
mov edi, 1
mov ecx, ebx
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001733d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x14001743b
mov eax, dword [0x14043f280]
mov rcx, rbx
test dword [rsp + 0x40], 0x20000
cmove eax, edi
mov dword [0x14043f280], eax
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x140017450
jmp 0x140017364
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x273d
je 0x1400174a4
cmp eax, 0x273a
jbe 0x1400174a4
cmp eax, 0x2740
jae 0x1400174a4
xor r8d, r8d
mov edx, edi
lea ecx, [r8 + 0x17]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400173db
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x140017465
mov eax, dword [0x14043f27c]
mov rcx, rbx
test dword [rsp + 0x40], 0x20000
cmove eax, edi
mov dword [0x14043f27c], eax
call qword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
je 0x14001747a
jmp 0x14001740b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x273d
je 0x14001748f
cmp eax, 0x273a
jbe 0x14001748f
cmp eax, 0x2740
jae 0x14001748f
jmp 0x14001740b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov rdi, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400f3170
add rsp, 0x470
pop rbx
ret
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.140016450
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.getsockopt
call fcn.140016450
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.closesocket
call fcn.140016450
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.getsockopt
call fcn.140016450
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.closesocket
call fcn.140016450
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.socket
call fcn.140016450
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.socket
call fcn.140016450
int3
Function at 0x14001b4a0
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and qword [rcx + 8], 0
lea rax, vtable.xmrig::ConsoleLog.0
and qword [rcx + 0x10], 0
mov rdi, rcx
mov qword [rcx], rax
call fcn.14001b5e4
test al, al
je 0x14001b55f
mov ecx, 0x158
call fcn.1400f2de0
mov rbx, rax
mov qword [rdi + 8], rax
call fcn.1400025e0
xor r9d, r9d
mov rcx, rax
mov rdx, rbx
lea r8d, [r9 + 1]
call fcn.1400035a0
test eax, eax
js 0x14001b55f
mov rcx, qword [rdi + 8]
xor edx, edx
call fcn.140003b50
mov rax, qword [rdi + 8]
mov ecx, 0xfffffff6
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001b550
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x14001b550
mov edx, dword [rsp + 0x30]
mov rcx, rbx
and edx, 0xffffffbf
mov dword [rsp + 0x30], edx
bts edx, 7
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea rcx, str.XMRig_5.7.0
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x14001b566
mov byte [section..data], 0
mov rbx, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400295ec
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [0x14012c7e0], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14002960b
call fcn.1400286e0
mov rdx, rdi
lea rcx, [0x14012c7d8]
call fcn.14002866c
test rax, rax
je 0x14002963b
mov rdx, rdi
lea rcx, [0x14012c7d8]
call fcn.140028438
mov rdx, rax
mov rcx, rbx
call fcn.140038c30
jmp 0x14002964f
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
mov rcx, rbx
call fcn.140038c80
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140038778
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x1400387cb
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140038790
jmp 0x1400387d8
cmp dword [rcx], 0x4e0
jb 0x1400387d8
call fcn.140038818
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x140038818
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov eax, dword [r10]
mov r11d, 0xe3
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x14003882b
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x140038876
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
ret
Function at 0x14003cb44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rcx, qword [rcx + 8]
call fcn.14001c898
lea rdx, [rax + 0x78]
mov rcx, rbx
call fcn.14003c7c0
mov ecx, 0x40
call fcn.1400f2de0
mov rcx, rax
mov qword [rsp + 0x40], rax
xor eax, eax
test rcx, rcx
je 0x14003cb8e
mov rdx, qword [rbx + 8]
call fcn.14003d248
nop
mov qword [rbx + 0x48], rax
mov rcx, rax
add rsp, 0x30
pop rbx
jmp fcn.14003dce0

Function at 0x14003dce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
call fcn.14001c898
mov rsi, rax
cmp byte [rax + 0x10], 0
je 0x14003de0e
mov ecx, 0x18
call fcn.1400f2de0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14003dd33
lea rdx, [rdi + 0x20]
mov rcx, rax
call fcn.1400426f8
nop
mov qword [rdi + 0x18], rax
mov ecx, 0xa8
call fcn.1400f2de0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14003dd61
lea rdx, [rsi + 0x18]
mov r9, qword [rdi + 0x18]
movzx r8d, word [rsi + 0x38]
mov rcx, rax
call fcn.1400458c8
nop
mov qword [rdi + 0x30], rax
mov rcx, rax
call fcn.140045a00
mov ebx, eax
test eax, eax
jns 0x14003dd7c
mov ecx, eax
call fcn.140001ea0
jmp 0x14003dd83
lea rax, [0x140111994]
test ebx, ebx
jns 0x14003dd8e
movzx r9d, word [rsi + 0x38]
jmp 0x14003dd91
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8, qword [rsi + 0x18]
lea rdx, str.HTTP_API
lea rcx, str.e_1_32m__e_0me_1_37m__13se_0me_1_34m_s:_de_0m_e_1_31m_se_0m
call fcn.14001bf70
test ebx, ebx
jns 0x14003ddbd
mov rcx, rdi
call fcn.14003de20
xor al, al
jmp 0x14003de10
mov word [rdi + 0x38], bx
mov edx, 1
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14003de0e
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14003de0e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x14012dc40], rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [0x14012dc48], rax
mov al, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140056c3c
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rcx, qword [0x14012df90]
lea rdx, [0x14012dfa0]
test rcx, rcx
jne 0x140056cb2
lea rcx, str.nvml.dll
call fcn.140010cd0
test eax, eax
jne 0x140056c7c
mov al, 1
jmp 0x140056cbc
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, str._PROGRAMFILES_NVIDIA_CorporationNVSMI_nvml.dll
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rdx, [0x14012dfa0]
lea rcx, [rsp + 0x20]
call fcn.140010cd0
test eax, eax
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400f3170
add rsp, 0x148
ret
Function at 0x1400607d0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov rax, qword [rdx + 0x28]
cmp byte [rax], 0x22
je 0x14006080f
cmp byte [rax], 0x5b
je 0x14006080a
cmp byte [rax], 0x66
je 0x140060805
cmp byte [rax], 0x6e
je 0x140060800
cmp byte [rax], 0x74
je 0x1400607fb
cmp byte [rax], 0x7b
jne fcn.14005fa64
jmp fcn.1400601cc
jmp fcn.140060718
jmp fcn.14005f9b4
jmp fcn.14005f850
jmp fcn.14005f6ac
xor r9d, r9d
jmp fcn.1400604c8

Function at 0x1400619bc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14012a5e8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140061a66
cmp byte [rcx + 0x71], 0
je 0x140061a66
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140061a27
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140061a2b
sub eax, 1
je 0x140061a2f
sub eax, 2
je 0x140061a66
xor al, al
jmp 0x140061a68
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140061a5d
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140061a27
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140061a68
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f3170
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret