joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010b7e
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140073138]
mov rsi, rcx
mov rcx, rdi
mov ebx, edx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
je 0x140010bcb
cmp qword [rax + 0x1d8], rsi
jne 0x140010bcb
test byte [rax + 0x40], 0xc
jne 0x140010bcb
cmp dword [rax + 0xbc], 0
jne 0x140010bcb
mov rax, qword [rax + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x140010bda
mov rcx, rdi
mov ebx, 3
call sym.pthread_mutex_unlock
jmp 0x140010c02
mov rcx, rdi
call sym.pthread_mutex_unlock
test ebx, ebx
je 0x140010c02
sub ebx, 2
cmp ebx, 0x15
ja 0x140010bfd
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp sym.pthread_cancel
mov ebx, 0x16
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140010dcb
Capabilities:
Create thread
Resume thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rsi, rdx
mov rbp, r8
mov r12, r9
call sym.pop_pthread_mem
mov rbx, rax
test rax, rax
je 0x140010e9f
test rdi, rdi
je 0x140010e01
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
xor r11d, r11d
mov dword [rbx + 0x44], 1
mov dword [rbx + 0xbc], r11d
mov qword [rbx + 0x28], 0xffffffffffffffff
mov qword [rbx + 8], r12
mov r12, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rbp
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call r12
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x140010e5a
mov eax, ebp
neg eax
sbb ecx, ecx
inc ebp
and ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 5
jne 0x140010e2b
mov qword [rbx + 0x38], 0xffffffffffffffff
lea r12, [rbx + 0x68]
mov rcx, r12
call sym.replace_spin_keys.constprop.0
xor r10d, r10d
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], r10d
mov dword [rbx + 0xb8], r10d
jne 0x140010ea9
test rdi, rdi
je 0x140010e97
xor r9d, r9d
mov qword [rdi], r9
mov rcx, rbx
call sym.push_pthread_mem
mov eax, 0xb
jmp 0x140010fac
xor ebp, ebp
test rsi, rsi
je 0x140010ed5
mov eax, dword [rsi]
mov rbp, qword [rsi + 0x10]
mov dword [rbx + 0x44], eax
test al, 8
je 0x140010ed0
call sym.__pthread_self_lite
mov eax, dword [rax + 0xc0]
mov dword [rbx + 0xc0], eax
jmp 0x140010ed5
mov eax, dword [rsi + 0x18]
jmp 0x140010ec8
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov r9, rbx
mov edx, ebp
mov qword [rsp + 0x28], r8
xor ecx, ecx
lea r8, [sym.pthread_create_wrapper]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x140010f35
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140010f15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call sym.pthread_mutex_destroy
mov rcx, r12
call sym.replace_spin_keys.constprop.0
xor ecx, ecx
mov qword [rbx + 0x30], rcx
mov qword [rbx + 0x28], rcx
jmp 0x140010e8c
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x140010f63
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x140010f63
mov edx, 0xf
cmp eax, 0xe
jg 0x140010f63
mov edx, 2
cmp eax, edx
cmovle edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
je 0x140010f99
xor edx, edx
mov rcx, rsi
mov qword [rbx + 0x28], rdx
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140010fa2
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140015bf0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
or edx, 0xffffffff
test rax, rax
jle 0x140015c1a
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x14004eaf0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov rcx, rbx
call method.std::__basic_file_char_.fd__
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd rbp, eax
inc eax
jne 0x14004eb28
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 4
je 0x14004eb01
mov rax, rbp
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x14005a740
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rcx
test rax, rax
je 0x14005a760
mov rcx, qword [rcx]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp rax
mov esi, 4
lea rdi, [rsp + 0x2c]
mov ecx, dword [rbx + 0x10]
mov r8d, esi
mov rdx, rdi
call sym.read
test eax, eax
jle 0x14005a792
cdqe
add rdi, rax
sub rsi, rax
jne 0x14005a76a
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
inc eax
je 0x14005a7a2
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 4
je 0x14005a76a
jmp 0x14005a796
Function at 0x14005f0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx]
mov rbx, rdx
mov eax, ecx
not eax
test ax, 0x101
jne 0x14005f0e0
add dword [rdx + 8], 0xc
mov r9b, byte [rsi]
test r9b, r9b
jns 0x14005f10b
xor edx, edx
test byte [rsi + 1], 2
je 0x14005f0fd
mov eax, dword [rbx + 0x14]
mov r8d, 0x64
cdq
idiv r8d
mov eax, dword [rsi + 4]
sub eax, 0x13
imul eax, eax, 0x64
add eax, edx
mov dword [rbx + 0x14], eax
and cx, 0x402
cmp cx, 0x400
jne 0x14005f1b6
mov eax, r9d
not eax
test al, 0x18
je 0x14005f19a
test r9d, 4
je 0x14005f19a
mov eax, dword [rbx + 0x14]
lea r11, [0x14007b6e0]
xor r10d, r10d
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
mov r8, rax
neg r8
and r8d, 0x1a
add r8, r11
movzx edi, word [r8 + r10*2]
mov rdx, r10
lea r10, [r10 + 1]
cmp edi, ecx
jle 0x14005f155
test r9d, 8
jne 0x14005f176
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and r9d, 0x10
jne 0x14005f197
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r11 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
or byte [rsi], 0x18
mov edx, dword [rbx + 0x10]
test byte [rsi], 8
jne 0x14005f1a7
cmp edx, 0xb
ja 0x14005f1b6
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0xc]
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
mov dword [rbx + 0x18], eax
mov eax, dword [rsi]
mov dil, byte [rsi]
and ax, 0x404
cmp ax, 0x400
jne 0x14005f204
movsxd r9, dword [rbx + 0x10]
test edi, 8
jne 0x14005f1d7
cmp r9d, 0xb
ja 0x14005f204
mov eax, dword [rbx + 0x14]
lea ecx, [rax + 0x76c]
call method.std._anonymous_namespace_::is_leap_int_
lea rcx, [0x14007b6e0]
mov edx, dword [rbx + 0xc]
movzx eax, al
imul rax, rax, 0xd
add rax, r9
movzx eax, word [rcx + rax*2]
lea eax, [rdx + rax - 1]
mov dword [rbx + 0x1c], eax
test edi, 0x60
je 0x14005f2e7
test edi, 2
je 0x14005f2e7
mov ebp, dword [rbx + 0x14]
test edi, 4
jne 0x14005f279
mov r12d, edi
mov r8d, 1
xor edx, edx
mov ecx, ebp
call method.std._anonymous_namespace_::day_of_the_week_int__int__int_
shr r12b, 5
mov r8d, 7
xor r12d, 1
and r12d, 1
sub eax, r12d
mov edx, eax
mov eax, r8d
sub eax, edx
cdq
idiv r8d
mov al, byte [rsi + 2]
and eax, 0x3f
dec eax
imul eax, eax, 7
lea ecx, [rdx + rax]
mov eax, dword [rbx + 0x18]
sub eax, r12d
add eax, 7
cdq
idiv r8d
add ecx, edx
mov dword [rbx + 0x1c], ecx
mov eax, edi
not eax
test al, 0x18
je 0x14005f2e7
lea ecx, [rbp + 0x76c]
lea r10, [0x14007b6e0]
xor r9d, r9d
call method.std._anonymous_namespace_::is_leap_int_
mov ecx, dword [rbx + 0x1c]
mov r8, rax
neg r8
and r8d, 0x1a
add r8, r10
movzx r11d, word [r8 + r9*2]
mov rdx, r9
lea r9, [r9 + 1]
cmp r11d, ecx
jle 0x14005f2a6
test edi, 8
jne 0x14005f2c7
lea r8d, [rdx - 1]
mov dword [rbx + 0x10], r8d
and edi, 0x10
jne 0x14005f2e7
movzx eax, al
dec edx
imul rax, rax, 0xd
movsxd rdx, edx
add rax, rdx
movzx eax, word [r10 + rax*2]
sub ecx, eax
inc ecx
mov dword [rbx + 0xc], ecx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140071b40
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor edx, edx
lea rcx, [0x140073760]
call sym.pthread_mutex_init
xor r8d, r8d
lea rbp, [rsp + 0x40]
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x140073768], r8
mov qword [0x140073770], r8
mov qword [0x140073778], r8
call sym.getenv
xor r9d, r9d
mov dword [rsp + 0x78], 0x100
mov rbx, rax
lea rax, str.glibcxx.eh_pool
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x48], rax
lea rax, str.obj_size
mov qword [rsp + 0x58], rax
lea rax, str.obj_count
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x50], 8
mov qword [rsp + 0x68], 9
mov qword [rsp + 0x70], rax
test rbx, rbx
je 0x140071c87
cmp byte [rbx], 0x3a
jne 0x140071be5
inc rbx
xor edx, edx
mov r9, rbx
mov r8d, 0xf
mov rcx, rbp
mov qword [rsp + 0x20], 0xf
call method.std::basic_string_view_char__std::char_traits_char___.compare_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long__const
test eax, eax
jne 0x140071c72
cmp byte [rbx + 0xf], 0x2e
jne 0x140071c72
add rbx, 0x10
lea rsi, [rsp + 0x50]
mov rdi, qword [rsi]
xor edx, edx
mov r9, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rdi
mov r8, rdi
call method.std::basic_string_view_char__std::char_traits_char___.compare_unsigned_long_long__unsigned_long_long__char_const__unsigned_long_long__const
test eax, eax
jne 0x140071c36
cmp byte [rbx + rdi], 0x3d
je 0x140071c49
add rsi, 0x18
lea rax, [rsp + 0x80]
cmp rsi, rax
je 0x140071c72
jmp 0x140071c14
lea rdx, [rsp + 0x38]
lea rcx, [rbx + rdi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x38]
mov dl, byte [rbx]
cmp dl, 0x3a
je 0x140071c6b
test dl, dl
jne 0x140071c72
test eax, eax
js 0x140071c72
mov dword [rsi + 0x10], eax
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
jmp 0x140071bd4
mov eax, dword [rsp + 0x78]
mov edx, 0x1000
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x60]
test eax, eax
jne 0x140071ca2
mov eax, 6
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x140073778], rbx
je 0x140071cec
mov rcx, rbx
call sym.malloc
mov qword [0x140073770], rax
test rax, rax
jne 0x140071cdc
xor ecx, ecx
mov qword [0x140073778], rcx
jmp 0x140071cec
xor edx, edx
mov qword [0x140073768], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
lea rcx, [sym.__tcf_0_1]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.atexit
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14004f300]
mov dword [rax], 1
mov rax, qword [0x14004f310]
mov dword [rax], 1
mov rax, qword [0x14004f320]
mov dword [rax], 1
mov rax, qword [0x14004f2b0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140019ab0
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x10078
push rbx
call fcn.140032690
sub rsp, rax
xor eax, eax
mov rdx, rcx
lea rbx, [rsp + 0x20]
xor ecx, ecx
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], cx
lea rsi, [rsp + 0x70]
mov rcx, rbx
call fcn.140029800
mov rdx, rsi
mov r8d, 0x10000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x140019b09
mov rcx, rsi
call sub.msvcrt.dll__wcsdup
add rsp, 0x10078
pop rbx
pop rsi
ret
Function at 0x140031370
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140042af0
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140042af0
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140032042
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400582c8]
test eax, eax
je 0x1400320da
lea rax, [0x1400582a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400582d0]
mov qword [rbp - 8], rax
jmp 0x1400320be
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400320b2
cmp qword [rbp - 0x10], 0
je 0x1400320b2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140032078
lea rax, [0x1400582a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400320db
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400321e0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140032208
mov eax, 0
jmp 0x140032256
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140032231
mov eax, 0
jmp 0x140032256
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140032251
mov eax, 0
jmp 0x140032256
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14003225c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1400322da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1400322d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1400322d1
mov rax, qword [rbp - 8]
jmp 0x1400322ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400322a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14002ac40
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [str.___t_]
lea r14, str.___t_
cmp rcx, r14
je 0x14002ac87
test byte [rcx + 0x1c], 4
je 0x14002ac87
cmp byte [rcx + 0x19], 5
jb 0x14002ac87
mov rcx, qword [rcx + 0x10]
lea r8, [0x140081b70]
mov edx, 0x14
call fcn.140001010
lea rcx, [0x140098110]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx + 8]
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rcx + 8], rax
and qword [rbx], 0
and qword [rbx + 8], 0
mov eax, dword [rbx + 0x18]
test eax, eax
jne 0x14002acc8
cmp dword [rbx + 0x2c], eax
jne 0x14002acc8
lea rcx, [0x140098028]
call fcn.14003363c
jmp case.default.0x14002ae49
cmp eax, 2
jne 0x14002ad37
mov rcx, qword [rbx + 0x38]
cmp rcx, 0xffffffffffffffff
je case.default.0x14002ae49
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne case.default.0x14002ae49
mov rax, qword [str.___t_]
cmp rax, r14
je case.default.0x14002ae49
test byte [rax + 0x1c], 4
je case.default.0x14002ae49
cmp byte [rax + 0x19], 2
jb case.default.0x14002ae49
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140081b70]
mov r9d, eax
mov edx, 0x15
mov rcx, qword [rcx + 0x10]
call fcn.140001030
jmp case.default.0x14002ae49
cmp eax, 3
jne case.default.0x14002ae49
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14002ad8b
mov rax, qword [str.___t_]
cmp rax, r14
je 0x14002ad8b
test byte [rax + 0x1c], 4
je 0x14002ad8b
cmp byte [rax + 0x19], 2
jb 0x14002ad8b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
lea r8, [0x140081b70]
mov r9d, eax
mov edx, 0x16
mov rcx, qword [rcx + 0x10]
call fcn.140001030
cmp dword [rbx + 0x660], 0
je 0x14002ade6
cmp dword [rbx + 0x65c], 0
je 0x14002adef
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002ade6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.___t_]
cmp rcx, r14
je 0x14002ade6
test byte [rcx + 0x1c], 4
je 0x14002ade6
cmp byte [rcx + 0x19], 2
jb 0x14002ade6
mov rcx, qword [rcx + 0x10]
lea r9, [rbx + 0x40]
mov edx, 0x17
mov dword [rsp + 0x20], eax
lea r8, [0x140081b70]
call fcn.140001250
cmp dword [rbx + 0x65c], 0
jne case.default.0x14002ae49
cmp qword [rbx + 0x668], 0
je case.default.0x14002ae49
lea rcx, [0x1400981a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x668]
mov edx, 1
mov r9d, edx
mov r8d, edx
call fcn.14003b3ec
lea rcx, [0x1400981a0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rbx
call fcn.140062654
lea rcx, [0x140098110]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x30
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dl, 0xb4
ret
in al, dx
add ax, 0xf553
iretd
mov esi, 0x8c355daa
div byte [rdi + 0x54137cff]
cmc
invalid
lodsd eax, dword [rsi]
lodsb al, byte [rsi]
push 0xffffffffffffff94
mov dl, 0xd4
add esi, dword [rdx + 0x12e48c14]
je 0x140112a51
mov bl, 0x74
adc eax, 0x359517ff
sahf
invalid
Function at 0x140021cd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140021d04
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140021cf0
ret
Function at 0x1400288a0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002896c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002896c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140028985
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14002895c
cmp byte [rax], 0x5c
jne 0x140028956
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140028956
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140028942
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140028953
test r8b, 0x10
jne 0x140028956
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140028956
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400242c0
test edi, edi
jne 0x1400288c0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400242b0
int3
Function at 0x14002b220
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14002b251
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14002b2cb
mov rdi, r14
mov rcx, rbx
call fcn.14001f1f0
test rax, rax
jle 0x14002b2a3
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400a0430
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14002b2bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002b2c3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14002b265
sub r14, rdi
jmp 0x14002b3af
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14002b2e2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002b2e4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002b316
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400a0430
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14002b3ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002b351
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14002b38d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14008adec
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14002b3ac
cmp rbp, rax
ja 0x14002b360
test rbp, rbp
je 0x14002b3ac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14008adec
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002ff80
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400e0cf0], 0
jne 0x140030072
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x1400c8fd8]
mov qword [rsp + 0x48], rbx
lea rcx, [0x1400c8fc8]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea rdi, [0x1400e0cf0]
test eax, eax
js 0x140030035
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x1400c8fb8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x140030026
mov rcx, qword [rsp + 0x40]
lea r8, [0x1400c8fa8]
mov r9, rdi
lea rdx, [0x1400c8f98]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14003001b
mov rcx, qword [0x1400e0cf0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x140030072
cmp qword [0x1400e0cf0], 0
jne 0x140030072
lea r9, [0x1400c8fa8]
mov qword [rsp + 0x20], rdi
lea r8, [0x1400c8f98]
xor edx, edx
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x14003007f
mov rcx, qword [0x1400e0cf0]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x1400c88e8]
lea rdx, [0x1400c8900]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret