joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
movsxd rax, dword [rcx + 0x3c]
mov rdi, rcx
mov r11, rdx
mov ecx, dword [rax + rcx + 0x88]
mov eax, dword [rax + rdi + 0x8c]
mov qword [rsp + 0x128], rcx
add rcx, rdi
mov dword [rsp + 0x120], eax
mov esi, dword [rcx + 0x1c]
mov r10d, dword [rcx + 0x20]
mov ebp, dword [rcx + 0x24]
mov ebx, dword [rcx + 0x18]
mov edx, dword [rcx + 0x10]
add rsi, rdi
add r10, rdi
add rbp, rdi
test r11, 0xffffffffffff0000
jne 0x1800044fb
cmp r11, rdx
jb 0x180004543
mov eax, dword [rcx + 0x14]
lea rcx, [rdx - 1]
add rcx, rax
cmp r11, rcx
ja 0x180004543
sub r11, rdx
mov eax, dword [rsi + r11*4]
add rax, rdi
jmp 0x180004545
xor r9d, r9d
test ebx, ebx
jle 0x180004543
nop word [rax + rax]
mov eax, dword [r10]
mov r8, r11
add rax, rdi
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180004533
inc rax
test ecx, ecx
jne 0x180004520
test edx, edx
je 0x180004558
inc r9d
add r10, 4
cmp r9d, ebx
jl 0x180004510
xor eax, eax
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
movsxd rax, r9d
movzx ecx, word [rbp + rax*2]
mov ebx, dword [rsi + rcx*4]
mov ecx, dword [rsp + 0x128]
lea rax, [rcx + rdi]
add rbx, rdi
cmp rbx, rax
jb 0x180004643
mov eax, dword [rsp + 0x120]
add rax, rcx
add rax, rdi
cmp rbx, rax
ja 0x180004643
xor edx, edx
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x20], 0
lea r8d, [rdx + 0x63]
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rsp + 0x91]
lea r8d, [rdx + 0x63]
mov byte [rsp + 0x90], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rsp + 0x20]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x180004643
lea rdx, [rax + 1]
lea rcx, [rsp + 0x90]
mov byte [rax], 0
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x120], 0x6c6c642e
mov byte [rsp + 0x124], 0
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180004643
lea rdx, [rsp + 0x90]
mov rcx, rax
call fcn.180004480
jmp 0x180004545
mov rax, rbx
jmp 0x180004545
Function at 0x1800049a0
Capabilities:
Enumerate pe sections

Disassembly:
push r14
push r15
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
mov r15, rdx
mov r14, rcx
cmp dword [rdx + 0x94], esi
jbe 0x180004aa3
mov ebx, dword [rdx + 0x90]
lea edx, [rsi + 0x14]
add rbx, rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x180004a8b
lea rdi, [rbx + 0xc]
movabs rbp, 0x8000000000000000
nop dword [rax + rax]
mov eax, dword [rdi]
test eax, eax
je 0x180004a8b
lea rcx, [r14 + rax]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], sil
jne 0x180004a12
xor edx, edx
call sub.msvcrt.dll_memset
mov eax, dword [rdi - 0xc]
test eax, eax
je 0x180004a2f
lea rbx, [r14 + rax]
jmp 0x180004a35
mov ebx, dword [rdi + 4]
add rbx, r14
cmp qword [rbx], rsi
je 0x180004a70
nop word [rax + rax]
mov rax, qword [rbx]
mov qword [rbx], rsi
test rbp, rax
jne 0x180004a67
lea rcx, [rax + r14]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8 + 2], sil
jne 0x180004a53
inc r8
xor edx, edx
call sub.msvcrt.dll_memset
add rbx, 8
cmp qword [rbx], rsi
jne 0x180004a40
add rdi, 0x14
mov edx, 0x14
lea rcx, [rdi - 0xc]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x180004a00
mov ecx, dword [r15 + 0x90]
mov r8d, dword [r15 + 0x94]
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
cmp dword [r15 + 0x8c], esi
jbe 0x180004b2f
mov edi, dword [r15 + 0x88]
add rdi, r14
mov eax, dword [rdi + 0x18]
test eax, eax
je 0x180004afb
mov ebx, dword [rdi + 0x20]
mov ebp, esi
add rbx, r14
test eax, eax
je 0x180004afb
nop dword [rax]
mov ecx, dword [rbx]
add rcx, r14
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rcx + r8], sil
jne 0x180004ae0
xor edx, edx
call sub.msvcrt.dll_memset
inc ebp
add rbx, 4
cmp ebp, dword [rdi + 0x18]
jb 0x180004ad0
mov eax, dword [rdi + 0x14]
test eax, eax
je 0x180004b17
mov ecx, dword [rdi + 0x1c]
lea r8d, [rax*8]
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
mov ecx, dword [r15 + 0x88]
mov r8d, dword [r15 + 0x8c]
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
mov eax, dword [r15 + 0xb4]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x180004b5d
mov ecx, dword [r15 + 0xb0]
mov r8d, eax
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
movzx eax, word [r15 + 0x14]
movzx r10d, word [r15 + 6]
lea r9, [r15 + 0x18]
add r9, rax
test r10d, r10d
je 0x180004bd6
nop word [rax + rax]
lea rax, [rsp + 0x20]
mov r8, r9
mov dword [rsp + 0x20], 0x6c65722e
mov word [rsp + 0x24], 0x636f
mov byte [rsp + 0x26], 0
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180004bb3
inc rax
test ecx, ecx
jne 0x180004ba0
test edx, edx
je 0x180004bc4
inc esi
add r9, 0x28
cmp esi, r10d
jb 0x180004b80
jmp 0x180004bd6
mov ecx, dword [r9 + 0xc]
mov r8d, dword [r9 + 0x10]
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
mov eax, dword [r15 + 0x9c]
mov rsi, qword [rsp + 0x70]
test eax, eax
je 0x180004bfa
mov ecx, dword [r15 + 0x98]
mov r8d, eax
xor edx, edx
add rcx, r14
call sub.msvcrt.dll_memset
add rsp, 0x48
pop r15
pop r14
ret
Function at 0x180004c10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
movsxd rdi, dword [rcx + 0x3c]
mov rsi, rcx
mov r14, r8
add rdi, rcx
mov rcx, qword [0x1800071e8]
mov r15, rdx
test rcx, rcx
je 0x180004c56
mov eax, dword [0x1800071f0]
cmp eax, dword [rdi + 0x50]
jne 0x180004c56
mov rbx, rcx
jmp 0x180004c81
mov edx, dword [rdi + 0x50]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rcx, rax
mov qword [0x1800071e8], rax
mov eax, dword [rdi + 0x50]
mov dword [0x1800071f0], eax
test rbx, rbx
je 0x180004d78
mov r8d, eax
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, dword [rdi + 0x54]
mov rdx, rsi
add r8d, dword [rsi + 0x3c]
mov rcx, rbx
call sub.msvcrt.dll_memcpy
movsxd rdi, dword [rsi + 0x3c]
mov rdx, rsi
add rdi, rbx
mov rcx, rbx
mov r8, rdi
call fcn.180004650
mov r8, rbx
sub r8, qword [rdi + 0x30]
je 0x180004cd0
mov rdx, rdi
mov rcx, rbx
call fcn.1800046e0
mov rdx, rdi
mov rcx, rbx
call fcn.180004790
test eax, eax
je 0x180004d67
test r15, r15
jne 0x180004ced
test r14, r14
je 0x180004d1f
cmp dword [rdi + 0x8c], 0
je 0x180004d67
mov edx, dword [rdi + 0x88]
cmp dword [rdx + rbx + 0x14], 3
jne 0x180004d67
mov eax, dword [rdx + rbx + 0x1c]
mov ecx, dword [rax + rbx + 4]
add rcx, rbx
mov qword [r15], rcx
mov eax, dword [rdx + rbx + 0x1c]
mov ecx, dword [rax + rbx + 8]
add rcx, rbx
mov qword [r14], rcx
mov esi, dword [rdi + 0x28]
mov rdx, rdi
mov rcx, rbx
call fcn.1800049a0
mov rdx, rdi
mov rcx, rbx
call fcn.1800048d0
mov r8d, dword [rdi + 0x54]
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
test esi, esi
je 0x180004d62
mov eax, esi
add rax, rbx
je 0x180004d67
mov edx, 1
mov rcx, rbx
mov r8d, edx
call rax
test eax, eax
je 0x180004d67
mov rax, rbx
jmp 0x180004d7a
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x180004da0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x20
mov rdx, rcx
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x40]
xor edi, edi
mov dword [rsp + 0x38], 0x6272
mov qword [rsp + 0x40], rdi
call qword [sym.imp.msvcrt.dll_fopen_s]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004e79
lea r8d, [rdi + 2]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rsi
call qword [sym.imp.msvcrt.dll_fseek]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_ftell]
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
xor edx, edx
movsxd rbx, eax
call qword [sym.imp.msvcrt.dll_fseek]
lea r9d, [rdi + 4]
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
mov rsi, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x180004e64
mov r9, qword [rsp + 0x40]
lea edx, [rdi + 1]
mov r8, rsi
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fread]
xor eax, eax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov word [rbx], ax
call fcn.180004c10
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x180004e90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov edx, dword [0x1800071f0]
mov rcx, qword [0x1800071e8]
lea r9, [rsp + 0x30]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x28
ret
Function at 0x140024a90
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140024b5c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140024b5c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140024b75
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140024b4c
cmp byte [rax], 0x5c
jne 0x140024b46
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140024b46
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140024b32
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140024b43
test r8b, 0x10
jne 0x140024b46
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140024b46
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140027d40
test edi, edi
jne 0x140024ab0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140025c60
int3

Function at 0x140028a50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140028a84
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140028a70
ret
Function at 0x140030890
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rcx
xor esi, esi
add rcx, 0x10
call fcn.140047a00
mov ecx, dword [rbx + 0x308]
test al, al
je 0x1400309d4
cmp ecx, 1
je 0x1400309bc
mov dword [rbx + 0x308], 1
xor edx, edx
mov rcx, rbx
call fcn.140033f40
mov rcx, rbx
call fcn.140033790
lea rcx, [0x1400d46a0]
call fcn.140034f70
test al, al
je 0x140030a29
lea rcx, [rbx + 0x10]
call fcn.1400478f0
test al, al
je 0x140030a29
lea rcx, [rbx + 0x10]
call fcn.140048530
lea rdi, [rbx + 0x528]
cmp byte [rdi + 8], sil
jne 0x1400309a3
cmp qword [rdi + 0x18], rsi
je 0x1400309a3
mov word [rdi + 8], 0x101
mov dword [rdi + 0x20], 0x32
lea ecx, [rsi + 8]
call fcn.140073318
test rax, rax
je 0x140030944
mov qword [rax], rdi
jmp 0x140030947
mov rax, rsi
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002cab0]
xor edx, edx
xor ecx, ecx
call fcn.140082788
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140030a3c
cmp dword [rsp + 0x38], 0
je 0x140030a31
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140072258
test eax, eax
jne 0x140030a31
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.140033f40
lea rcx, [rbx + 0x10]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp fcn.140026cc0
test ecx, ecx
je 0x140030a19
mov dword [rbx + 0x308], esi
mov rcx, rbx
call fcn.140033790
mov byte [rbx + 0x530], sil
mov edi, 0x1388
cmp byte [rbx + 0x531], sil
je 0x140030a19
nop dword [rax + rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0x32
js 0x140030a19
cmp byte [rbx + 0x531], sil
jne 0x140030a00
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call fcn.140082604
nop
mov ecx, 1
call fcn.1400715e4
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call fcn.1400715e4
int3
Function at 0x1400335b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1400d2718]
xor rax, rsp
mov qword [rsp + 0x88], rax
movzx esi, r8b
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x50], rdx
xor r14d, r14d
lea rcx, [rsp + 0x58]
call fcn.140006c60
mov byte [rsp + 0x78], sil
mov qword [rsp + 0x80], rbp
lea ecx, [r14 + 0x30]
call fcn.140073318
mov rdi, rax
test rax, rax
je 0x14003363f
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x14009ba40]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], r14b
mov byte [rax + 0x20], sil
mov qword [rax + 0x28], rbp
jmp 0x140033642
mov rdi, r14
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.14002ee60
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x14002c920]
xor edx, edx
xor ecx, ecx
call fcn.140082788
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140033768
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400336c3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400336be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140033778
call fcn.140073354
cmp dword [rsp + 0x48], 0
je 0x14003375d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.140072258
test eax, eax
jne 0x14003375d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140033726
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140033721
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003377e
mov rcx, r8
call fcn.140073354
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], 0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400737e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov ecx, 1
call fcn.1400715e4
nop
mov dword [rsp + 0x48], r14d
mov ecx, 6
call fcn.1400715e4
nop
call fcn.140079cfc
nop
call fcn.140079cfc
int3

Function at 0x140033790
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x1400d4c70]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call fcn.14007148c
test eax, eax
jne 0x140033821
cmp dword [0x1400d4cbc], 0x7fffffff
je 0x14003380c
lea edx, [rax + 2]
mov rcx, rbx
call fcn.14003c0f0
mov eax, dword [rbx + 0xc0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x50]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140071494
mov dword [0x1400d4cbc], 0x7ffffffe
mov ecx, 6
call fcn.1400715e4
int3
mov ecx, 5
call fcn.1400715e4
int3
Function at 0x140033d50
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rdx
xor ebp, ebp
mov dword [rsp + 0x38], ebp
lea r14, [0x1400d4c70]
mov qword [rsp + 0x50], r14
mov rcx, r14
call fcn.14007148c
test eax, eax
jne 0x140033e78
cmp dword [0x1400d4cbc], 0x7fffffff
je 0x140033e63
lea edx, [rbp + 8]
mov rcx, rdi
call fcn.14003c0f0
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140006c60
mov rdx, rax
mov rcx, rdi
call fcn.140037240
nop
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x34]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rsi, dword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rbx], bpl
mov dword [rsp + 0x38], 2
mov rdx, rsi
cmp rsi, 0xf
jbe 0x140033e25
xor r8d, r8d
mov rcx, rbx
call fcn.14002d670
mov qword [rbx + 0x10], rbp
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140033e32
mov rdx, qword [rbx]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rcx, r14
call fcn.140071494
mov rax, rbx
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [0x1400d4cbc], 0x7ffffffe
mov ecx, 6
call fcn.1400715e4
int3
mov ecx, 5
call fcn.1400715e4
int3

Function at 0x140033f40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
movzx edi, dl
mov rbx, rcx
lea rsi, [0x1400d4c70]
mov qword [rsp + 0x80], rsi
mov rcx, rsi
call fcn.14007148c
test eax, eax
jne 0x140034084
cmp dword [0x1400d4cbc], 0x7fffffff
je 0x14003406f
lea edx, [rax + 0xa]
mov rcx, rbx
call fcn.14003c0f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], reloc.OLEAUT32.dll_SafeArrayDestroy
lea edx, [rbp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400281a0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], SafeArrayUnaccessData
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.TRAINER_INITIALIZE]
movups xmmword [rax], xmm0
movzx ecx, word [0x14009f408]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], bpl
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140037240
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x88], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x88]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x80]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x80], 1
jne 0x14003405b
mov dword [rsp + 0x88], edi
mov dword [rsp + 0x80], ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x80]
lea r8d, [rbp + 4]
lea rdx, [rsp + 0x88]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rcx, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp fcn.140071494
mov dword [0x1400d4cbc], 0x7ffffffe
mov ecx, 6
call fcn.1400715e4
int3
mov ecx, 5
call fcn.1400715e4
int3
Function at 0x140037240
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], rdx
lea r9, [rsp + 0x30]
mov eax, dword [rdx + 0x10]
xor esi, esi
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov dword [rsp + 0x38], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
lea r8d, [rsi + 4]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140037291
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400372df
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400372da
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400372fe
mov rcx, r8
call fcn.140073354
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140079cfc
int3

Function at 0x140037310
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], rdx
lea r9, [rsp + 0x30]
mov eax, dword [rdx + 0x10]
mov rbx, rdx
add eax, eax
mov dword [rsp + 0x30], 0
mov rdi, rcx
mov dword [rsp + 0x38], eax
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
mov r8d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jb 0x14003736a
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.140027cd0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140039140
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x140039223
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140039223
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140039241
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140039213
cmp word [rax], 0x5c
jne 0x14003920c
lea rdx, [rax + 2]
cmp rdx, rcx
je 0x14003920c
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1400391f7
movzx ecx, word [rdx]
sub cx, 0x28
cmp cx, 1
jbe 0x140039209
test r8b, 0x10
jne 0x14003920c
movzx ecx, word [rdx]
sub cx, 0x7b
test bp, cx
jne 0x14003920c
mov rax, rdx
add rax, 2
mov qword [rbx], rax
mov rcx, rbx
call fcn.14003b260
test edi, edi
jne 0x140039170
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140025c60
int3

Function at 0x14003b660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x14003b6a4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14003b690
ret