joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400041e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x5f
mov byte [rsp + 0x28], 0x55
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x66
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x5a
mov byte [rsp + 0x30], 0x65
mov byte [rsp + 0x31], 0x6a
mov byte [rsp + 0x32], 0x1f
mov byte [rsp + 0x33], 0x54
mov byte [rsp + 0x34], 0x60
mov byte [rsp + 0x35], 0x5e
mov byte [rsp + 0x36], 0xf1
cmp byte [0x14059a3a0], 0
jne 0x14000429e
mov byte [0x14059a3c7], 1
mov eax, 0
lea rcx, [0x14059a3b0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x140004279
mov byte [0x14059a3a0], 1
lea rcx, [0x140001955]
call fcn.1400014f0
lea rax, [0x14059a3b0]
add rsp, 0x48
ret

Function at 0x1400042aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x66
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x1f
mov byte [rsp + 0x29], 0x5c
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x64
mov byte [rsp + 0x2c], 0x61
mov byte [rsp + 0x2d], 0x56
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x64
mov byte [rsp + 0x30], 0x5c
mov byte [rsp + 0x31], 0x6a
mov byte [rsp + 0x32], 0x1f
mov byte [rsp + 0x33], 0x54
mov byte [rsp + 0x34], 0x60
mov byte [rsp + 0x35], 0x5e
mov byte [rsp + 0x36], 0xf1
cmp byte [0x14059a200], 0
jne 0x140004362
mov byte [0x14059a227], 1
mov eax, 0
lea rcx, [0x14059a210]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x14000433d
mov byte [0x14059a200], 1
lea rcx, [0x140001aa5]
call fcn.1400014f0
lea rax, [0x14059a210]
add rsp, 0x48
ret

Function at 0x14000436e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x61
mov byte [rsp + 0x26], 0x52
mov byte [rsp + 0x27], 0x5f
mov byte [rsp + 0x28], 0x55
mov byte [rsp + 0x29], 0x52
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2b], 0x56
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x66
mov byte [rsp + 0x2e], 0x63
mov byte [rsp + 0x2f], 0x5a
mov byte [rsp + 0x30], 0x65
mov byte [rsp + 0x31], 0x6a
mov byte [rsp + 0x32], 0x1f
mov byte [rsp + 0x33], 0x54
mov byte [rsp + 0x34], 0x60
mov byte [rsp + 0x35], 0x5e
mov byte [rsp + 0x36], 0xf1
cmp byte [0x140599f48], 0
jne 0x140004426
mov byte [0x140599f67], 1
mov eax, 0
lea rcx, [0x140599f50]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x17
jne 0x140004401
mov byte [0x140599f48], 1
lea rcx, [0x140001ccd]
call fcn.1400014f0
lea rax, [0x140599f50]
add rsp, 0x48
ret
Function at 0x140004432
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 0x11
mov byte [rsp + 0x23], 0x56
mov byte [rsp + 0x24], 0x5e
mov byte [rsp + 0x25], 0x64
mov byte [rsp + 0x26], 0x5a
mov byte [rsp + 0x27], 0x64
mov byte [rsp + 0x28], 0x60
mov byte [rsp + 0x29], 0x57
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x140599fc8], 0
jne 0x1400044bd
mov byte [0x140599fde], 1
mov eax, 0
lea rcx, [0x140599fd0]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x140004498
mov byte [0x140599fc8], 1
lea rcx, [0x140001c6d]
call fcn.1400014f0
lea rax, [0x140599fd0]
add rsp, 0x38
ret

Function at 0x1400044ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
mov byte [rsp + 0x22], 0x11
mov byte [rsp + 0x23], 0x54
mov byte [rsp + 0x24], 0x54
mov byte [rsp + 0x25], 0x5d
mov byte [rsp + 0x26], 0x56
mov byte [rsp + 0x27], 0x52
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x56
mov byte [rsp + 0x2a], 0x63
mov byte [rsp + 0x2b], 0x1f
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x60
mov byte [rsp + 0x2e], 0x5e
mov byte [rsp + 0x2f], 0xf1
cmp byte [0x140599e68], 0
jne 0x140004555
mov byte [0x140599e7e], 1
mov eax, 0
lea rcx, [0x140599e70]
movzx edx, byte [rsp + rax + 0x22]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0xe
jne 0x140004530
mov byte [0x140599e68], 1
lea rcx, [0x140001d75]
call fcn.1400014f0
lea rax, [0x140599e70]
add rsp, 0x38
ret

Function at 0x140004562
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x65
mov byte [rsp + 0x26], 0x63
mov byte [rsp + 0x27], 0x56
mov byte [rsp + 0x28], 0x5f
mov byte [rsp + 0x29], 0x55
mov byte [rsp + 0x2a], 0x5e
mov byte [rsp + 0x2b], 0x5a
mov byte [rsp + 0x2c], 0x54
mov byte [rsp + 0x2d], 0x63
mov byte [rsp + 0x2e], 0x60
mov byte [rsp + 0x2f], 0x1f
mov byte [rsp + 0x30], 0x54
mov byte [rsp + 0x31], 0x60
mov byte [rsp + 0x32], 0x5e
mov byte [rsp + 0x33], 0xf1
cmp byte [0x140599ec8], 0
jne 0x14000460b
mov byte [0x140599ee4], 1
mov eax, 0
lea rcx, [0x140599ed0]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x1400045e6
mov byte [0x140599ec8], 1
lea rcx, [0x140001d2d]
call fcn.1400014f0
lea rax, [0x140599ed0]
add rsp, 0x48
ret
Function at 0x140004618
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov byte [rsp + 0x20], 0x11
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x68
mov byte [rsp + 0x23], 0x68
mov byte [rsp + 0x24], 0x1f
mov byte [rsp + 0x25], 0x67
mov byte [rsp + 0x26], 0x5a
mov byte [rsp + 0x27], 0x63
mov byte [rsp + 0x28], 0x66
mov byte [rsp + 0x29], 0x64
mov byte [rsp + 0x2a], 0x65
mov byte [rsp + 0x2b], 0x60
mov byte [rsp + 0x2c], 0x65
mov byte [rsp + 0x2d], 0x52
mov byte [rsp + 0x2e], 0x5d
mov byte [rsp + 0x2f], 0x1f
mov byte [rsp + 0x30], 0x54
mov byte [rsp + 0x31], 0x60
mov byte [rsp + 0x32], 0x5e
mov byte [rsp + 0x33], 0xf1
cmp byte [0x140599e48], 0
jne 0x1400046c1
mov byte [0x140599e64], 1
mov eax, 0
lea rcx, [0x140599e50]
movzx edx, byte [rsp + rax + 0x20]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x14000469c
mov byte [0x140599e48], 1
lea rcx, [0x140001d8d]
call fcn.1400014f0
lea rax, [0x140599e50]
add rsp, 0x48
ret

Function at 0x1400048ec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov word [rsp + 0x20], 0x3d
mov word [rsp + 0x22], 0x46
mov word [rsp + 0x24], 0x59
mov word [rsp + 0x26], 0x51
mov word [rsp + 0x28], 0x4d
mov word [rsp + 0x2a], 0x50
mov word [rsp + 0x2c], 0x53
mov word [rsp + 0x2e], 0x46
mov word [rsp + 0x30], 0x53
mov word [rsp + 0x32], 0xf
mov word [rsp + 0x34], 0x46
mov word [rsp + 0x36], 0x59
mov word [rsp + 0x38], 0x46
mov word [rsp + 0x3a], 0xe1
cmp byte [0x140599048], 0
jne 0x140004994
mov byte [0x14059906c], 1
mov eax, 0
lea rcx, [0x140599050]
movzx edx, word [rsp + rax*2 + 0x20]
mov word [rcx + rax*2], dx
add rax, 1
cmp rax, 0xe
jne 0x14000496e
mov byte [0x140599048], 1
lea rcx, [0x140001f4d]
call fcn.1400014f0
lea rax, [0x140599050]
add rsp, 0x48
ret
Function at 0x14000a490
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x14000a4c0
mov eax, 0
cmp word [rcx], 0x5a4d
jne 0x14000a4bf
mov eax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x14000a4c5
cdqe
add rax, rcx
cmp dword [rax], 0x4550
mov edx, 0
cmovne rax, rdx
ret
mov rax, rcx
jmp 0x14000a4bf
mov eax, 0
jmp 0x14000a4bf

Function at 0x14000ab40
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.14000aaf0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140014d20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1405945d0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x140014d8f
mov rcx, r9
call fcn.140014bf0
test eax, eax
je 0x140014d8f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x140014d8d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140014d84
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140014d8f
add rdx, 0x28
cmp rdx, r9
jne 0x140014d70
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret
Function at 0xdc8bb0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xdc8bbd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xdc8bcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xdc8bb5
lea eax, [rcx + 1]
jmp 0xdc8bdb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xdc8bee
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xdc8bd4
sub eax, 3
jb 0xdc8c0e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xdc8c5d
sar eax, 1
movsxd rbp, eax
jb 0xdc8c44
jmp 0xdc8c1c
add ebx, ebx
jne 0xdc8c1a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xdc8c44
inc ecx
add ebx, ebx
jne 0xdc8c2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xdc8c44
call r11
adc ecx, ecx
add ebx, ebx
jne 0xdc8c3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xdc8c2c
add ecx, 2
jmp 0xdc8c49
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00dc8b72
jmp 0xdc8bbd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x4bd400
mov dl, 0x5e
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xdc8ca9
cmp rsi, rcx
jae 0xdc8cb1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xdc8c90
cmp al, 0x8f
ja 0xdc8c90
cmp byte [rsi - 2], 0xf
je 0xdc8c96
sub al, 0xe8
cmp al, 1
ja 0xdc8c7a
cmp rsi, rcx
jae 0xdc8cb1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xdc8c80
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xdc8cb1
lodsb al, byte [rsi]
jmp 0xdc8c90
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9b0000]
mov eax, dword [rdi]
or eax, eax
je 0xdc8d0e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x9c8000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xdc8cbe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xdc8d08
mov qword [rbx], rax
add rbx, 8
jmp 0xdc8cde
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xdc8d52
cmp al, 0xef
ja 0xdc8d3a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xdc8d1a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xdc8d29
mov eax, dword [rdi]
add rdi, 4
jmp 0xdc8d29
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xdc8da6
sub rsp, 0xffffffffffffff80
jmp 0x475500
Function at 0x180001178
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rsi, rdx
xor ebx, ebx
mov edx, ecx
lea ecx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800011e4
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1800011e4
mov rdx, rsi
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1800011df
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32Next]
jmp 0x1800011b9
mov rbx, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140004180
Capabilities:
Prepare http request

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rbp, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x88], rcx
lea rdx, [r9 + 0x20]
lea rcx, [rsp + 0x68]
call fcn.140006210
lea r8, [rsp + 0x68]
mov r9, qword [rsp + 0x68]
mov r10, qword [rsp + 0x80]
cmp r10, 8
cmovae r8, r9
mov rdx, qword [rsp + 0x78]
cmp rdx, 5
jne 0x1400041ff
lea rcx, str.https
test rdx, rdx
je 0x1400041f8
sub r8, rcx
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400041ff
add rcx, 2
sub rdx, 1
jne 0x1400041e4
mov edi, 0x800000
jmp 0x140004201
xor edi, edi
cmp r10, 8
jb 0x14000423c
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140004234
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004332
mov rcx, r9
call fcn.140038024
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.140006210
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
cmp qword [rbx + 0x18], 8
jb 0x140004268
mov rbx, qword [rbx]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
mov rcx, qword [r14]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test rax, rax
sete dil
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400042d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004338
call fcn.140038024
test dil, dil
jne 0x1400042ee
mov qword [rsi], rbx
mov rax, rsi
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Error__WinHttpOpenRequest_
lea rcx, [rsp + 0x48]
call fcn.1400061d0
nop
mov r8d, ebx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x90]
call fcn.140002b70
lea rdx, [0x1400827a8]
lea rcx, [rsp + 0x90]
call fcn.140039ee4
nop
call fcn.14003fc24
int3
call fcn.14003fc24
int3
Function at 0x140004340
Capabilities:
Receive http response

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x140084060]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov dword [r11 - 0x18], esi
test r8, r8
jne 0x140004398
mov dword [r11 - 0x14], esi
lea rdx, [r11 - 0x14]
mov rcx, qword [rdi]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x14000449e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov dword [rsp + 0x20], 1
mov edx, 0x2000
mov rcx, rbx
call fcn.140008960
lea r9, [rsp + 0x110]
mov r8d, 0x2000
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x14000445a
mov edi, dword [rsp + 0x110]
mov rsi, qword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, rsi
sub rcx, rdx
cmp rdi, rcx
jae 0x1400043ff
lea rax, [rdx + rdi]
mov qword [rbx + 8], rax
jmp 0x140004432
jbe 0x140004432
mov rax, qword [rbx + 0x10]
sub rax, rdx
cmp rdi, rax
jbe 0x14000441a
mov rdx, rdi
mov rcx, rbx
call fcn.140008960
jmp 0x140004432
sub rdi, rcx
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.14003a680
lea rcx, [rdi + rsi]
mov qword [rbx + 8], rcx
mov rax, rbx
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.140037fc0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Error__WinHttpReadData_
lea rcx, [rsp + 0x30]
call fcn.1400061d0
nop
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.140002b70
lea rdx, [0x1400827a8]
lea rcx, [rsp + 0xb0]
call fcn.140039ee4
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Error__WinHttpQueryDataAvailable_
lea rcx, [rsp + 0x30]
call fcn.1400061d0
nop
mov r8d, ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140002b70
lea rdx, [0x1400827a8]
lea rcx, [rsp + 0x50]
call fcn.140039ee4
int3
Function at 0x14000dd50
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
mov ebp, 0xfffd
nop word [rax + rax]
movzx ecx, word [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x14000de33
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14000de33
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14000de51
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14000de23
cmp word [rax], 0x5c
jne 0x14000de1c
lea rdx, [rax + 2]
cmp rdx, rcx
je 0x14000de1c
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14000de07
movzx ecx, word [rdx]
sub cx, 0x28
cmp cx, 1
jbe 0x14000de19
test r8b, 0x10
jne 0x14000de1c
movzx ecx, word [rdx]
sub cx, 0x7b
test bp, cx
jne 0x14000de1c
mov rax, rdx
add rax, 2
mov qword [rbx], rax
mov rcx, rbx
call fcn.140009aa0
test edi, edi
jne 0x14000dd80
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140009a90
int3
Function at 0x140013680
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x140084060]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
test rcx, rcx
je 0x140013818
mov r9, qword [rcx + 0x58]
test r9, r9
je 0x140013818
cmp edx, dword [rcx + 0x10]
jae 0x140013818
cmp dword [rcx + 0x14], 1
jne 0x140013818
mov eax, edx
lea r8, [rax*4]
mov rax, qword [r9 + 0x20]
mov edi, dword [rax + r8]
add rdi, qword [r9]
je 0x140013818
test rsi, rsi
je 0x140013818
mov dword [rsi], edx
mov rax, qword [rcx + 0x58]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0xffffffff
mov rcx, qword [rax + 0x20]
mov eax, dword [r8 + rcx]
mov dword [rsi + 4], eax
movzx eax, word [rdi + 4]
mov word [rsi + 8], ax
movzx eax, word [rdi + 6]
mov word [rsi + 0xa], ax
movzx eax, word [rdi + 8]
mov word [rsi + 0xc], ax
movzx eax, word [rdi + 0xa]
mov word [rsi + 0xe], ax
movzx ecx, word [rdi + 0xe]
movzx edx, word [rdi + 0xc]
mov eax, ecx
shr eax, 9
add eax, 0x50
mov dword [rsp + 0x34], eax
mov eax, ecx
shr eax, 5
and ecx, 0x1f
and eax, 0xf
mov dword [rsp + 0x2c], ecx
dec eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov eax, edx
shr eax, 0xb
mov dword [rsp + 0x28], eax
mov eax, edx
shr eax, 5
and edx, 0x1f
and eax, 0x3f
add edx, edx
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], edx
call fcn.14004481c
mov qword [rsi + 0x10], rax
lea rdx, [rdi + 0x2e]
mov eax, dword [rdi + 0x10]
mov ecx, 0x103
mov dword [rsi + 0x18], eax
mov eax, dword [rdi + 0x14]
mov qword [rsi + 0x20], rax
mov eax, dword [rdi + 0x18]
mov qword [rsi + 0x28], rax
movzx eax, word [rdi + 0x24]
mov word [rsi + 0x30], ax
mov eax, dword [rdi + 0x26]
mov dword [rsi + 0x34], eax
mov eax, dword [rdi + 0x2a]
mov qword [rsi + 0x38], rax
movzx eax, word [rdi + 0x1c]
cmp eax, ecx
cmovb ecx, eax
mov ebx, ecx
lea rcx, [rsi + 0x44]
mov r8d, ebx
call fcn.140039fd0
mov byte [rbx + rsi + 0x44], 0
mov ecx, 0xff
movzx eax, word [rdi + 0x20]
cmp eax, ecx
cmovb ecx, eax
mov dword [rsi + 0x40], ecx
movzx edx, word [rdi + 0x1e]
mov ebx, ecx
add rdx, rdi
movzx ecx, word [rdi + 0x1c]
mov r8d, ebx
add rcx, 0x2e
add rdx, rcx
lea rcx, [rsi + 0x148]
call fcn.140039fd0
mov byte [rbx + rsi + 0x148], 0
mov eax, 1
mov rbx, qword [rsp + 0x50]
jmp 0x14001381a
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140037fc0
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14001f0b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14001f0d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001f14c
mov rdi, r14
mov rcx, rbx
call fcn.1400068b0
test rax, rax
jle 0x14001f124
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140039fd0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001f13c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14001f144
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14001f0e6
sub r14, rdi
jmp 0x14001f22f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001f163
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001f165
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001f197
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140039fd0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001f22c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001f1d2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14001f20d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140048760
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14001f22c
cmp rbp, rax
ja 0x14001f1e0
test rbp, rbp
je 0x14001f22c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140048760
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x140036fd0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140037054
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140066d50]
cmp byte [rcx + rax], 0
je 0x140037054
dec r8
sub rdx, 1
jne 0x14003703a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret