joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053640
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [0x140106000]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140106488]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140106080]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov dword [rsp + 0x20], 0xeb3feb3d
mov word [rsp + 0x34], ax
mov edx, 0x14b2
mov dword [rsp + 0x24], 0xeb34eb35
mov dword [rsp + 0x28], 0xeb2aeb36
mov dword [rsp + 0x2c], 0xeb30eb36
mov dword [rsp + 0x30], 0xeb36eb22
mov byte [rsp + 0x36], 1
nop dword [rax]
nop word [rax + rax]
movzx ecx, ax
sub cx, dx
xor word [rsp + rax*2 + 0x20], cx
inc rax
cmp rax, 0xa
jb 0x1400536c0
xor edx, edx
mov byte [rsp + 0x36], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005ca30
add rsp, 0x48
ret
Function at 0x140058990
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea ecx, [rbx + 8]
call fcn.14005d038
lea rcx, [0x14003b3c0]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14005c820]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140058b5d
lea ecx, [rbx + 8]
call fcn.14005d038
lea rcx, [0x14003da20]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14005c820]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140058b4d
lea rdx, str.Turkish
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rcx, str.bgsHmN1bsM
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginMutation]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x140054960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rsp + 0x58]
call fcn.140054b40
nop
lea rcx, [rsp + 0x58]
call fcn.1400567f0
call fcn.140040950
call fcn.140058270
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140058b06
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058b01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058b01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005ce44
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
cmp dword [rsp + 0x40], 0
je 0x140058b27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rsp + 0x50], 0
je 0x140058b35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14005ca30
add rsp, 0x80
pop rbx
ret
mov dword [rsp + 0x40], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x50], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14005acf0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov dword [rsp + 0x40], 0
mov rcx, qword [0x1401060c0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005ad31
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov edx, 0xb664a0
mov eax, dword [0x140105ff8]
lea r9d, [rcx + 0x40]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x50], eax
mov eax, 0x999fcf6c
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x71], ecx
mov word [rsp + 0x75], cx
mov byte [rsp + 0x77], cl
mov byte [rsp + 0x70], cl
mov rcx, qword [0x140105ff0]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x68], 4
mov qword [rsp + 0x78], 0x85cfe4c
mov qword [rsp + 0x80], 0x85ece6c
call qword [0x1401063e8]
movss xmm0, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14005ca30
add rsp, 0xa0
pop rbx
ret

Function at 0x14005ade0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1401060c0]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005ae24
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140105ff0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x50]
mov eax, dword [0x140105ff8]
mov r9d, 0x40
mov qword [rsp + 0x38], rdi
mov edx, 0xb664a0
mov dword [rsp + 0x50], eax
mov eax, 0x999fcf6c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 8
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x85cfe4c
mov qword [rsp + 0x80], 0x85ece6c
mov qword [rsp + 0x20], rdi
call qword [0x1401063e8]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14005ca30
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x14005aee0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xorps xmm0, xmm0
mov rbx, rcx
mov rcx, qword [0x1401060c0]
xorps xmm1, xmm1
movups xmmword [r11 - 0x48], xmm0
mov rdi, rdx
movups xmmword [r11 - 0x38], xmm1
movups xmmword [r11 - 0x28], xmm0
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005af37
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov edx, 0xb664a0
mov eax, dword [0x140105ff8]
lea r9d, [rcx + 0x40]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x40], eax
mov eax, 0x999fcf6c
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov byte [rsp + 0x60], cl
mov rcx, qword [0x140105ff0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], 0x30
mov qword [rsp + 0x68], 0x85cfe4c
mov qword [rsp + 0x70], 0x85ece6c
call qword [0x1401063e8]
movups xmm0, xmmword [rsp + 0x80]
mov rax, rbx
movups xmm1, xmmword [rsp + 0x90]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14005ca30
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret

Function at 0x14005b010
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov rdi, r8
mov rcx, qword [0x1401060c0]
mov rsi, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005b051
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x140105ff8]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
mov eax, 0x999fcf6c
mov qword [rsp + 0x30], rcx
mov edx, 0xb664a0
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
lea r9d, [rcx + 0x40]
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov rcx, qword [0x140105ff0]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xc
mov byte [rsp + 0x60], 1
mov qword [rsp + 0x68], 0x85cfe4c
mov qword [rsp + 0x70], 0x85ece6c
mov qword [rsp + 0x78], rax
call qword [0x1401063e8]
movsd xmm0, qword [rdi]
mov rax, rbx
movsd qword [rbx], xmm0
mov ecx, dword [rdi + 8]
mov dword [rbx + 8], ecx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005ca30
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005b100
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1401060c0]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005b144
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140105ff0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x50]
mov eax, dword [0x140105ff8]
mov r9d, 0x40
mov qword [rsp + 0x38], rdi
mov edx, 0xb664a0
mov dword [rsp + 0x50], eax
mov eax, 0x999fcf6c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 8
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x85cfe4c
mov qword [rsp + 0x80], 0x85ece6c
mov qword [rsp + 0x20], rdi
call qword [0x1401063e8]
mov r8, qword [rsp + 0x40]
movabs rax, 0xffffffff00000000
mov rcx, r8
movabs rdx, 0xffffff8000000000
and rcx, rax
movabs r9, 0xffffff7fffffffff
lea rax, [rcx + rdx]
test r9, rax
jne 0x14005b21b
add rdx, rcx
mov rcx, r8
and ecx, 0xffffff
add rcx, qword [0x140105fe0]
test r9, rdx
cmove r8, rcx
mov rax, r8
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14005ca30
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret

Function at 0x14005b240
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1401060c0]
mov dword [rsp + 0x40], edi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005b283
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140105ff0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x50]
mov eax, dword [0x140105ff8]
mov r9d, 0x40
mov qword [rsp + 0x38], rdi
mov edx, 0xb664a0
mov dword [rsp + 0x50], eax
mov eax, 0x999fcf6c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 4
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x85cfe4c
mov qword [rsp + 0x80], 0x85ece6c
mov qword [rsp + 0x20], rdi
call qword [0x1401063e8]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14005ca30
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x14005b340
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400e1040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1401060c0]
mov dword [rsp + 0x40], edi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14005b383
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140105ff0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x50]
mov eax, dword [0x140105ff8]
mov r9d, 0x40
mov qword [rsp + 0x38], rdi
mov edx, 0xb664a0
mov dword [rsp + 0x50], eax
mov eax, 0x999fcf6c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 4
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x85cfe4c
mov qword [rsp + 0x80], 0x85ece6c
mov qword [rsp + 0x20], rdi
call qword [0x1401063e8]
movsxd rcx, dword [rsp + 0x40]
movabs rax, 0xffffffff00000000
mov r8, rcx
movabs r9, 0xffffff8000000000
and r8, rax
movabs r10, 0xffffff7fffffffff
mov rdx, rcx
lea rax, [r8 + r9]
test r10, rax
jne 0x14005b460
mov rax, rdx
lea rcx, [r8 + r9]
and eax, 0xffffff
add rax, qword [0x140105fe0]
test r10, rcx
cmove rdx, rax
mov rcx, rdx
mov eax, ecx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14005ca30
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret

Function at 0x14005d638
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005d682
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005d682
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005d682
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005d682
cmp dword [rcx + 0x84], 0xe
jbe 0x14005d682
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005d684
xor al, al
add rsp, 0x28
ret
Function at 0x1407ae8c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1407ae8cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1407ae8dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1407ae8c5
lea eax, [rcx + 1]
jmp 0x1407ae8eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1407ae8fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1407ae8e4
sub eax, 3
jb 0x1407ae91e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1407ae96d
sar eax, 1
movsxd rbp, eax
jb 0x1407ae954
jmp 0x1407ae92c
add ebx, ebx
jne 0x1407ae92a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1407ae954
inc ecx
add ebx, ebx
jne 0x1407ae93a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1407ae954
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1407ae94d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1407ae93c
add ecx, 2
jmp 0x1407ae959
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1407ae882
jmp 0x1407ae8cd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x7a8000]
mov eax, dword [rdi]
or eax, eax
je 0x1407ae9cd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7ae000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1407ae97d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1407ae9c7
mov qword [rbx], rax
add rbx, 8
jmp 0x1407ae99d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1407aea11
cmp al, 0xef
ja 0x1407ae9f9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1407ae9d9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1407ae9e8
mov eax, dword [rdi]
add rdi, 4
jmp 0x1407ae9e8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1407aea90], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1407aea90
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1407aea80
sub rsp, 0xffffffffffffff80
jmp 0x1400014f0
Function at 0x140796058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407961df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140796089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079606f
add dl, dl
jne 0x140796096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407960f6
xor eax, eax
add dl, dl
jne 0x1407960a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407961ad
add dl, dl
jne 0x1407960b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407960c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407960d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407960dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407960ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14079607e
mov eax, 1
add dl, dl
jne 0x140796106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140796113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407960fb
sub eax, ebx
mov ebx, 1
jne 0x14079614c
mov ecx, 1
add dl, dl
jne 0x14079612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14079613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140796123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140796168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140796175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079615d
cmp eax, 0x7d00
jae 0x14079619b
cmp eax, 0x500
jb 0x140796196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079607e
cmp eax, 0x7f
ja 0x14079619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407961d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14079607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001d60
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx + 8]
mov byte [rsp + 0x20], 0
test r9, r9
je 0x140001daa
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.14002367c
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140016e60
add rsp, 0x38
ret
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140016e60
add rsp, 0x38
ret

Function at 0x140001dc0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx + 8]
xor eax, eax
mov word [rsp + 0x20], ax
test r9, r9
je 0x140001df9
lea edx, [rax + 1]
lea r8d, [rax + 2]
lea rcx, [rsp + 0x20]
call fcn.14002367c
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140016e60
add rsp, 0x38
ret

Function at 0x140007320
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor edi, edi
mov byte [rsp + 0x20], 0
mov rbx, rcx
cmp byte [rcx + 0x40], dil
jne 0x1400073c5
cmp dword [rcx + 0x48], 0x100
jl 0x140007366
inc dword [rcx + 0x44]
call fcn.140007030
mov rcx, rbx
call fcn.140007240
test al, al
je 0x1400073c1
mov r9, qword [rbx + 8]
test r9, r9
je 0x14000739c
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.14002367c
cmp rax, 1
jne 0x1400073c1
inc dword [rbx + 0x48]
movzx edx, byte [rsp + 0x20]
cmp dl, 0x1a
jne 0x1400073b7
mov byte [rbx + 0x40], al
mov edi, 0x1a
movzx eax, di
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140016e60
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.140002590
movzx edi, ax
jmp 0x14000739c
mov byte [rbx + 0x40], 1
mov eax, 0x1a
jmp 0x14000739f

Function at 0x140007d10
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx + 8]
mov byte [rsp + 0x20], 0
test r9, r9
je 0x140007d5f
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.14002367c
movzx edx, byte [rsp + 0x20]
call fcn.140002590
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140016e60
add rsp, 0x38
ret
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140016e60
add rsp, 0x38
ret

Function at 0x14000c120
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x14000c930
lea r9, [rdx + rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x14000c964
movabs r10, 0x100000001b3
movzx edx, byte [rcx + r8]
inc r8
xor rax, rdx
imul rax, r10
cmp r8, r9
jb 0x14000c950
ret
Function at 0x14000df40
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x14000e0f8
nop dword [rax + rax]
cmp ecx, 0x7c
je 0x14000e0f8
cmp ecx, 0x29
jne 0x14000df8d
cmp dword [rbx + 0x1c], 0
jne 0x14000e0f8
test dword [rbx + 0x80], 0x10000000
je 0x14000e10e
jmp 0x14000e0cd
cmp ecx, 0x2e
jne 0x14000dfa0
lea rcx, [rbx + 0x40]
call fcn.14000f970
jmp 0x14000e0da
cmp ecx, 0x5c
jne 0x14000e008
mov rcx, rbx
call fcn.14000df00
test byte [rbx + 0x80], 0x80
je 0x14000dffb
movzx eax, word [rbx + 0x78]
cmp ax, 0x62
jne 0x14000dfd6
lea rcx, [rbx + 0x40]
call fcn.14000f960
mov rcx, rbx
call fcn.14000df00
jmp 0x14000e0ea
cmp ax, 0x42
jne 0x14000dffb
lea rcx, [rbx + 0x40]
call fcn.14000f960
lea rcx, [rbx + 0x40]
call fcn.14000fa40
mov rcx, rbx
call fcn.14000df00
jmp 0x14000e0ea
mov rcx, rbx
call fcn.14000f620
jmp 0x14000e0e2
cmp ecx, 0x5b
jne 0x14000e033
mov rcx, rbx
call fcn.14000df00
mov rcx, rbx
call fcn.14000f5b0
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.14000f590
jmp 0x14000e0e2
cmp ecx, 0x28
jne 0x14000e067
mov rcx, rbx
call fcn.14000df00
mov rcx, rbx
call fcn.14000f730
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.14000f590
test dil, dil
je 0x14000e0ea
jmp 0x14000e0e2
cmp ecx, 0x5e
jne 0x14000e07f
lea rcx, [rbx + 0x40]
call fcn.14000f940
mov rcx, rbx
call fcn.14000df00
jmp 0x14000e0ea
cmp ecx, 0x24
jne 0x14000e097
lea rcx, [rbx + 0x40]
call fcn.14000f950
mov rcx, rbx
call fcn.14000df00
jmp 0x14000e0ea
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14000e103
cmp ecx, 0x3f
je 0x14000e103
cmp ecx, 0x7b
je 0x14000e103
cmp ecx, 0x7d
jne 0x14000e0bc
test dword [rbx + 0x80], 0x10000000
je 0x14000e119
jmp 0x14000e0cd
cmp ecx, 0x5d
jne 0x14000e0cd
test dword [rbx + 0x80], 0x10000000
je 0x14000e124
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14000f980
mov rcx, rbx
call fcn.14000df00
mov rcx, rbx
call fcn.14000f800
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x14000df60
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
call fcn.14000d0a0
int3
mov edx, 5
call fcn.14000d0a0
int3
mov edx, 6
call fcn.14000d0a0
int3
mov edx, 4
call fcn.14000d0a0
int3