joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008b94
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x48
mov r9, r8
movsxd rax, dword [rcx + 0x160]
mov r10d, 1
cmp rax, 1
jle 0x140008b94
mov r8, qword [rcx + 0x168]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbp
mov rbp, qword [r8 + r10*8]
cmp byte [rbp], 0x2d
jne 0x140008b7a
xor r11d, r11d
mov r15b, byte [r11 + rdx]
inc r11
test r15b, r15b
je 0x140008bc1
cmp r15b, byte [r11 + rbp]
je 0x140008b68
nop dword [rax + rax]
inc r10
cmp r10, rax
jl 0x140008b5b
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsp
lea r10, [rcx + 0x178]
add rcx, 0x188
xor r8d, r8d
mov qword [rax + 0x28], rcx
mov rcx, r10
mov dword [rax + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add rsp, 0x48
ret
mov rax, rbp
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
cmp byte [r11 + rax], 0x3d
jne 0x140008bdf
inc r11
cmp byte [r11 + rax], 0x3d
je 0x140008bd5
add r11, rax
xor edx, edx
mov al, byte [r11]
test al, al
je 0x140008bfa
mov byte [rdx + r9], al
inc rdx
mov al, byte [rdx + r11]
test al, al
jne 0x140008beb
mov byte [rdx + r9], 0
mov eax, edx
add rsp, 0x48
ret
Function at 0x140009af0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x68
mov eax, dword [rcx + 0x28c]
cmp eax, 1
je 0x140009bbe
cmp eax, 2
jne 0x140009be4
mov rax, r8
test r8, r8
je 0x140009bb6
mov qword [rsp + 0x30], rdi
mov rdi, rcx
mov qword [rsp + 0x38], r12
mov r12, rax
mov qword [rsp + 0x40], r13
mov r13, r8
mov qword [rsp + 0x48], r14
mov r14, rdx
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbp
mov rbp, qword [rdi + 0x48]
cmp rbp, r12
mov rdx, r14
cmovae rbp, r12
mov ebp, ebp
mov r8, rbp
mov rcx, qword [rdi + 0x40]
mov r15, qword [rdi + 0x28]
call fcn.140021e60
mov dword [r15], 2
mov dword [r15 + 4], ebp
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rdi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r15 + 8]
test eax, eax
jl 0x140009bed
add r14, rbp
sub r12, rbp
jne 0x140009b42
mov rdi, qword [rsp + 0x30]
mov r8, r13
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov eax, r8d
add rsp, 0x68
ret
mov rax, rsp
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x298]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x30]
add rsp, 0x68
ret
xor eax, eax
dec eax
add rsp, 0x68
ret
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x68
ret

Function at 0x140009c10
Capabilities:
Read file on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x38
mov eax, dword [rcx + 0x28c]
cmp eax, 1
je 0x140009ce9
cmp eax, 2
jne 0x140009d19
cmp rdx, qword [rcx + 0x30]
je 0x140009cd2
mov rax, r8
test r8, r8
je 0x140009caf
mov r12, rax
mov r14, rdx
mov rdi, rcx
mov r13, r8
mov rbp, qword [rdi + 0x38]
cmp rbp, r12
cmovae rbp, r12
mov ebp, ebp
test rbp, rbp
je 0x140009ca4
mov r15, qword [rdi + 0x28]
mov dword [r15], 1
mov dword [r15 + 4], ebp
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rdi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [r15 + 8]
test eax, eax
jle 0x140009cc1
mov rcx, r14
mov r8, rbp
mov rdx, qword [rdi + 0x30]
call fcn.140021e60
add r14, rbp
sub r12, rbp
jne 0x140009c54
mov r8, r13
mov eax, r8d
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
jge 0x140009ca4
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, r8
call fcn.140009ab0
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsp
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + 0x290]
mov qword [rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x30]
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
dec eax
add rsp, 0x38
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140009d90
Capabilities:
Get system information on windows

Disassembly:
push r14
push r15
sub rsp, 0x68
mov r14, rcx
mov r15, rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, rsp
mov rcx, r14
mov rdx, r15
mov r8d, 1
mov r9d, dword [rsp + 0x50]
mov dword [rax + 0x20], 0
call fcn.140008960
add rsp, 0x68
pop r15
pop r14
ret
Function at 0x14001b320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001b4c6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x14052fd58]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.14003a340
xorps xmm15, xmm15
mov r14, qword [0x140a72a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001b38b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001b3a7
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.1400559a0
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
test rbx, rbx
jbe 0x14001b3cb
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001b3df
cmp rbx, 0x1000
jae 0x14001b395
jmp 0x14001b449
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001b3f1
xor edx, edx
jmp 0x14001b440
mov rcx, qword [0x14052fd58]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.14003a340
xorps xmm15, xmm15
mov r14, qword [0x140a72a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001b3d5
jmp 0x14001b3c0
call fcn.14006d8c0
xorps xmm15, xmm15
mov r14, qword [0x140a72a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003e400
lea rax, [0x1406312f6]
mov ebx, 0x18
call fcn.14003eca0
mov rax, qword [rsp + 0x38]
call fcn.14003e9e0
lea rax, [0x14063148e]
mov ebx, 0x19
call fcn.14003eca0
mov rax, qword [rsp + 0x30]
nop
call fcn.14003e9e0
call fcn.14003e640
call fcn.14003e480
lea rax, [0x1406378ec]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.14003cc20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.14001b320
Function at 0x14001b500
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001b72a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x14052fd50]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003a3e0
xorps xmm15, xmm15
mov r14, qword [0x140a72a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x14001b579
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x14001b5a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov rax, rcx
call fcn.1400559a0
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x14001b5c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x14001b5d9
cmp rbx, 0x1000
jae 0x14001b583
nop dword [rax]
jmp 0x14001b654
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x14001b5ed
xor esi, esi
jmp 0x14001b64a
mov rax, qword [0x14052fd50]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003a3e0
xorps xmm15, xmm15
mov r14, qword [0x140a72a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001b5cf
jmp 0x14001b5b4
call fcn.14006d8c0
xorps xmm15, xmm15
mov r14, qword [0x140a72a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x14001b6cc
call fcn.14003e400
lea rax, [0x140631f1a]
mov ebx, 0x19
call fcn.14003eca0
mov rax, qword [rsp + 0x68]
call fcn.14003e9e0
lea rax, [0x14063148e]
mov ebx, 0x19
call fcn.14003eca0
mov eax, dword [rsp + 0x34]
call fcn.14003e9e0
call fcn.14003e640
call fcn.14003e480
lea rax, [0x1406298b5]
mov ebx, 0xd
call fcn.14003cc20
cmp eax, 0x5af
je 0x14001b677
call fcn.14003e400
lea rax, [0x140631f1a]
mov ebx, 0x19
call fcn.14003eca0
mov rax, qword [rsp + 0x38]
call fcn.14003e9e0
lea rax, [0x14063148e]
mov ebx, 0x19
nop
call fcn.14003eca0
mov eax, dword [rsp + 0x34]
call fcn.14003e9e0
call fcn.14003e640
call fcn.14003e480
lea rax, [0x140636402]
mov ebx, 0x1f
call fcn.14003cc20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001b500
Function at 0x1400269c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140026abe
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x140026a00
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x140026aaf
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.1400274e0
nop dword [rax]
test rax, rax
je 0x140026aaf
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x140026b00]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.140069d40
xorps xmm15, xmm15
mov r14, qword [0x140a72a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x140026a9d
xor eax, eax
jmp 0x140026aa7
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x1400269f2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.140069e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.1400269c0

Function at 0x140060460
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140060519
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x140060560]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140069d40
xorps xmm15, xmm15
mov r14, qword [0x140a72a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140069e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.140060460
Function at 0x14006bf80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14000bc8f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.14000bd20
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x140a72dc0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.14000bcc0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
nop dword [rax]
call fcn.14000bcc0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x14000bc20
cmp byte [0x140a725ea], 0
je 0x14006bfb6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140a73160]
aesenc xmm0, xmmword [0x140a73170]
aesenc xmm0, xmmword [0x140a73180]
movq rax, xmm0
ret
jmp 0x14000bc20

Function at 0x1404ef7d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140a08900]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1404ef7f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1404ef7f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1404ef7f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1404ef845
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1404ef83c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1404ef7f0
add rax, 0x28
cmp rax, r9
jne 0x1404ef828
xor eax, eax
ret

Function at 0x1404ef850
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140a08900]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1404ef870
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1404ef878
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1404ef870
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1404ef900
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140a08900]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1404ef920
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1404ef928
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1400061ef
Capabilities:
Parse credit card information

Disassembly:
jmp 0x140028a30
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rbp - 0x40], 0
call qword [0x1406a7958]
mov dword [rbp - 0x40], 1
lea rcx, [rbp + 0x38]
call qword [0x1406a7880]
nop
lea r8, str._lang.ini
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140009f02
nop
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [0x1406a7708]
nop
lea rcx, [rbp + 0x28]
call qword [0x1406a7950]
nop
lea rcx, [rbp + 0x38]
call qword [0x1406a7950]
mov edx, 8
lea rcx, str.language
call qword [0x1406a7930]
mov qword [rbp + 0x28], rax
lea rcx, [rbp - 0x10]
call qword [0x1406a7720]
nop
mov r9, rax
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call qword [0x1406a76f8]
nop
xor edx, edx
mov rcx, rax
call qword [0x1406a7718]
mov ebx, eax
lea rcx, [rbp - 0x38]
call qword [0x1406a7828]
nop
lea rcx, [rbp - 0x10]
call qword [0x1406a7828]
nop
lea rcx, [rbp + 0x28]
call qword [0x1406a7950]
mov edx, 2
lea rcx, [0x140220ad4]
call qword [0x1406a7930]
mov qword [rbp + 0x30], rax
test ebx, ebx
je 0x140028b7e
cmp ebx, 0x1f
je 0x140028b7e
cmp ebx, 0x2a
jne 0x140028b38
lea rdx, [0x140220ad8]
jmp 0x140028b85
cmp ebx, 0x3b
jne 0x140028b46
lea rdx, [0x140220adc]
jmp 0x140028b85
cmp ebx, 0x25
jne 0x140028b54
lea rdx, [0x140220ae0]
jmp 0x140028b85
cmp ebx, 0x3a
jne 0x140028b62
lea rdx, [0x140220ae4]
jmp 0x140028b85
cmp ebx, 0x42
jne 0x140028b70
lea rdx, [0x140220ae8]
jmp 0x140028b85
cmp ebx, 0x6f
jne 0x140028b8f
lea rdx, [0x140220aec]
jmp 0x140028b85
lea rdx, [0x140220ad4]
lea rcx, [rbp + 0x30]
call qword [0x1406a78e0]
mov edx, 0xa
lea rcx, str.mt_lang_1
call qword [0x1406a7930]
mov qword [rbp + 0x38], rax
mov dl, 0x20
lea rcx, [rbp + 0x28]
call qword [0x1406a7960]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x38]
call qword [0x1406a7940]
nop
mov rdx, rax
mov rcx, rdi
call qword [0x1406a7948]
nop
lea rcx, [rbp - 0x38]
call qword [0x1406a7950]
nop
lea rcx, [rbp + 0x38]
call qword [0x1406a7950]
nop
lea rcx, [rbp + 0x30]
call qword [0x1406a7950]
nop
lea rcx, [rbp - 0x20]
call qword [0x1406a7700]
mov rax, rdi
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
Function at 0x140028a30
Capabilities:
Parse credit card information

Disassembly:
jmp 0x140028a30
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rbp - 0x40], 0
call qword [0x1406a7958]
mov dword [rbp - 0x40], 1
lea rcx, [rbp + 0x38]
call qword [0x1406a7880]
nop
lea r8, str._lang.ini
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140009f02
nop
xor r9d, r9d
lea r8d, [r9 + 1]
mov rdx, rax
lea rcx, [rbp - 0x20]
call qword [0x1406a7708]
nop
lea rcx, [rbp + 0x28]
call qword [0x1406a7950]
nop
lea rcx, [rbp + 0x38]
call qword [0x1406a7950]
mov edx, 8
lea rcx, str.language
call qword [0x1406a7930]
mov qword [rbp + 0x28], rax
lea rcx, [rbp - 0x10]
call qword [0x1406a7720]
nop
mov r9, rax
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call qword [0x1406a76f8]
nop
xor edx, edx
mov rcx, rax
call qword [0x1406a7718]
mov ebx, eax
lea rcx, [rbp - 0x38]
call qword [0x1406a7828]
nop
lea rcx, [rbp - 0x10]
call qword [0x1406a7828]
nop
lea rcx, [rbp + 0x28]
call qword [0x1406a7950]
mov edx, 2
lea rcx, [0x140220ad4]
call qword [0x1406a7930]
mov qword [rbp + 0x30], rax
test ebx, ebx
je 0x140028b7e
cmp ebx, 0x1f
je 0x140028b7e
cmp ebx, 0x2a
jne 0x140028b38
lea rdx, [0x140220ad8]
jmp 0x140028b85
cmp ebx, 0x3b
jne 0x140028b46
lea rdx, [0x140220adc]
jmp 0x140028b85
cmp ebx, 0x25
jne 0x140028b54
lea rdx, [0x140220ae0]
jmp 0x140028b85
cmp ebx, 0x3a
jne 0x140028b62
lea rdx, [0x140220ae4]
jmp 0x140028b85
cmp ebx, 0x42
jne 0x140028b70
lea rdx, [0x140220ae8]
jmp 0x140028b85
cmp ebx, 0x6f
jne 0x140028b8f
lea rdx, [0x140220aec]
jmp 0x140028b85
lea rdx, [0x140220ad4]
lea rcx, [rbp + 0x30]
call qword [0x1406a78e0]
mov edx, 0xa
lea rcx, str.mt_lang_1
call qword [0x1406a7930]
mov qword [rbp + 0x38], rax
mov dl, 0x20
lea rcx, [rbp + 0x28]
call qword [0x1406a7960]
movzx eax, word [rax]
mov word [rsp + 0x20], ax
xor r9d, r9d
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x38]
call qword [0x1406a7940]
nop
mov rdx, rax
mov rcx, rdi
call qword [0x1406a7948]
nop
lea rcx, [rbp - 0x38]
call qword [0x1406a7950]
nop
lea rcx, [rbp + 0x38]
call qword [0x1406a7950]
nop
lea rcx, [rbp + 0x30]
call qword [0x1406a7950]
nop
lea rcx, [rbp - 0x20]
call qword [0x1406a7700]
mov rax, rdi
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
Function at 0x1401665c0
Capabilities:
Decompress data using quicklz
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
test byte [rcx], 2
mov ebp, 1
mov r11, rdx
mov edx, 4
mov eax, ebp
lea r13, [r8 - 1]
cmovne eax, edx
add r13, r11
mov ebx, ebp
lea eax, [rax*2 + 1]
lea r14, [r13 - 0xa]
lea r15, [0x1405ddd40]
movsxd r10, eax
add r10, rcx
xor r12d, r12d
lea rax, [r11 - 1]
nop word [rax + rax]
cmp ebx, ebp
jne 0x14016662b
mov ebx, dword [r10]
add r10, 4
mov edx, dword [r10]
test bpl, bl
je 0x1401666aa
mov ecx, edx
shr ebx, 1
shr rcx, 4
and ecx, 0xfff
mov rsi, qword [r9 + rcx*8]
and edx, 0xf
je 0x140166653
lea edi, [rdx + 2]
add r10, 2
jmp 0x14016665c
movzx edi, byte [r10 + 2]
add r10, 3
mov r8d, r12d
nop
mov edx, r8d
add r8d, 3
mov ecx, dword [rdx + rsi]
mov dword [rdx + r11], ecx
cmp r8d, edi
jb 0x140166660
mov ecx, edi
add r11, rcx
mov r8, r11
sub r8, rcx
cmp rax, r8
jae 0x140166616
mov edx, dword [rax + 1]
inc rax
shr edx, 0xc
xor edx, dword [rax]
and edx, 0xfff
mov qword [r9 + rdx*8], rax
mov byte [rdx + r9 + 0x8000], bpl
cmp rax, r8
jb 0x140166683
jmp 0x140166616
cmp r11, r14
jae 0x1401666f7
mov ecx, ebx
mov dword [r11], edx
and ecx, 0xf
mov ecx, dword [r15 + rcx*4]
add r11, rcx
shr ebx, cl
add r10, rcx
lea r8, [r11 - 3]
cmp rax, r8
jae 0x140166620
mov edx, dword [rax + 1]
inc rax
shr edx, 0xc
xor edx, dword [rax]
and edx, 0xfff
mov qword [r9 + rdx*8], rax
mov byte [rdx + r9 + 0x8000], bpl
cmp rax, r8
jb 0x1401666d0
jmp 0x140166620
mov r15, qword [rsp + 0x40]
mov rdx, r13
sub rdx, r11
inc rdx
cmp r11, r13
cmova rdx, r12
cmp rdx, rbp
jb 0x140166737
cmp ebx, 1
jne 0x14016671f
add r10, 4
mov ebx, 0x80000000
movzx ecx, byte [r10]
inc rbp
inc r11
mov byte [r11 - 1], cl
inc r10
shr ebx, 1
cmp rbp, rdx
jbe 0x140166711
lea r8, [r13 - 3]
cmp rax, r8
jae 0x140166763
mov edx, dword [rax + 1]
inc rax
shr edx, 0xc
xor edx, dword [rax]
and edx, 0xfff
mov qword [r9 + rdx*8], rax
mov byte [rdx + r9 + 0x8000], 1
cmp rax, r8
jb 0x140166740
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, r15
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1406d5584
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0x109f85e6
push r12
pushfq
movabs r12, 0x6cdc38fa2fc93a94
push r13
mov r13, r12
mov r13d, 0x415d3af3
push r15
push rbx
movabs r15, 0x4eaf55a967772dca
mov r12, qword [rsp + 0x20]
bswap r13
test r15, 0x4a4975db
lea r13, [r13 + r15*2 + 0x4ae50af1]
not r15d
setns r13b
mov rbx, r13
mov r15, qword [rsp + 8]
xor bx, 0x695a
cmp bx, 0x26f5
setb bl
jae 0x1406d55a5
pop rbx
add r13, 0x664018f6
mov r13, qword [rsp + 8]
call fcn.1406d5695
seto r11b
cmp r11, 0x58d62d7e
mov r11, qword [rsp + 0x20]
je 0x1406d72d0
add qword [rsp + 0x10], 0xffffffffbf9298c9
call 0x1406d563a
push r8
pushfq
movabs r8, 0x4abb5b6a24dc14b5
xor r8b, 1
push r12
jno 0x1406d7dc3
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.140714006
xchg esi, eax
fiadd dword [rsi]
add dword [rax], eax
add byte [rax], al
push r8
movabs r8, 0x25c2028822a56eaf
mov r8, qword [rsp]
movsx r11, r11w
lea r11, [r11*8 + 0x44690654]
call 0x1406d55fd
mov r8, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0xffffffffdfc91260
movabs r12, 0x21995876509d311f
call fcn.1406d6fbd
Function at 0x140d8e22f
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x18], r8b
test ebp, 0x6032709e
cmp r15d, r10d
clc
push rbp
sar bp, 0x50
push rsi
cmovns bp, bp
rcl bpl, cl
mov sil, bl
sub rsp, 0x158
stc
cmovl rsi, r9
sub esi, r10d
mov rbp, rdx
mov rsi, rcx
jmp 0x140d8e268
test rcx, rcx
je 0x140d8e29a
test rdx, rdx
jmp 0x140d8e279
je 0x140d8e29a
mov eax, 0x5a4d
stc
cmp r11d, 0x70a1109c
cmp word [rcx], ax
jmp 0x140d8e294
je 0x140d8e2bb
sub eax, eax
cmovno esi, ebp
movzx ebp, r11w
add rsp, 0x158
movsx esi, r12w
movsxd rsi, ebp
pop rsi
not ebp
pop rbp
jmp 0x140d8e2ba
ret
movsxd rax, dword [rcx + 0x3c]
jmp 0x140d8e2c5
cmp dword [rax + rcx], 0x4550
jmp 0x140d8e2d1
jne 0x140d8e29a
mov r9d, dword [rax + rcx + 0x88]
test r13d, 0x2102c4c
test cl, r8b
mov dword [rsp + 0x24], r9d
cmc
jmp 0x140d8e2f4
test r9d, r9d
jmp 0x140d8e2fc
je 0x140d8e29a
mov r10d, dword [rax + rcx + 0x8c]
shld dx, r12w, 0xa4
setbe dl
movzx rdx, r15w
lea rdx, [rcx + r9]
test bl, 0xab
mov qword [rsp + 0x178], rbx
cmp r13w, 0x12ed
mov qword [rsp + 0x150], rdi
add dword [rax], eax
add cl, ch
add byte [rax], al
add byte [rax], al