joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441370
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x005cfea8]
test eax, eax
jne 0x441388
xor eax, eax
add rsp, 0x28
ret
cmp dword [0x005cfea0], 1
je 0x441396
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x4413c0
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x44137e
test byte [rax + 0x40], 3
je 0x44137e
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x441380
call sym.__pthread_self_lite.part.0
test rax, rax
je 0x44137e
jmp 0x4413a7

Function at 0x4413d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x005cfea0], 1
mov ebx, ecx
je 0x4413e5
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x441420
add rax, 0x20
test ebx, ebx
jle 0x441410
lock add dword [rax], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax], 1
add rsp, 0x20
pop rbx
ret
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x4413f6
add rsp, 0x20
pop rbx
ret

Function at 0x441520
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
cmp dword [0x005cfea0], 1
je 0x441535
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x4415a0
test byte [rbx + 0x40], 0xc
jne 0x441559
mov eax, dword [0x005cfea8]
test eax, eax
jne 0x441568
add rsp, 0x28
pop rbx
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x44158b
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x44158b
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x4415b5
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp dbg.pthread_mutex_unlock
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x441549
add rsp, 0x28
pop rbx
pop r12
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x4415d3
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, r12
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x4415f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
xor r12d, r12d
test rcx, rcx
je 0x441616
call sym._pthread_time_in_ms_from_timespec
mov edx, 0xfffffffe
mov r12d, 0xffffffff
cmp rax, rdx
cmovbe r12d, eax
cmp dword [0x005cfea0], 1
je 0x441624
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x441688
test r12d, r12d
je 0x441668
call dbg.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x441698
mov edx, r12d
call dbg._pthread_wait_for_single_object
call dbg.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call dbg.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call dbg.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x441638
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x441653

Function at 0x4416b0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbx
sub rsp, 0x28
cmp dword [0x005cfea0], 1
mov r12d, ecx
je 0x4416c8
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x441730
test r12d, r12d
je 0x441710
call dbg.pthread_testcancel
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x441740
mov edx, r12d
call dbg._pthread_wait_for_single_object
call dbg.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call dbg.pthread_testcancel
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call dbg.pthread_testcancel
xor eax, eax
add rsp, 0x28
pop rbx
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
jmp 0x4416dc
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4416f7
Function at 0x441750
Capabilities:
Get thread local storage value
Hijack thread execution

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x4f8
mov rsi, rcx
test rcx, rcx
je 0x44185e
lea rcx, [0x004fd328]
call dbg.pthread_mutex_lock
mov rcx, rsi
call dbg.__pthread_get_pointer
lea rcx, [0x004fd328]
mov rbx, rax
call dbg.pthread_mutex_unlock
test rbx, rbx
je 0x44185e
mov rcx, qword [rbx + 0x28]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x44185e
lea r12, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x44185e
lea r13, [rbx + 0x38]
mov rcx, r13
call dbg.pthread_mutex_lock
cmp dword [0x005cfea0], 1
je 0x4417d7
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x441970
movzx edx, byte [rbx + 0x40]
cmp rsi, qword [rax + 0x1d8]
je 0x441878
mov eax, dword [rbx + 0x44]
and eax, 3
cmp eax, 3
je 0x4418d0
and edx, 3
jne 0x441850
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffffc
or eax, 1
mov byte [rbx + 0x40], al
lock add dword [0x005cfea8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x441831
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
mov rcx, r13
call dbg.pthread_mutex_unlock
test byte [rbx + 0x40], 0xc
je 0x441839
mov eax, 3
add rsp, 0x4f8
pop rbx
pop rsi
pop r12
pop r13
ret
test dl, 3
jne 0x441850
and edx, 0xfffffffc
or edx, 1
mov byte [rbx + 0x40], dl
lock add dword [0x005cfea8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x44189d
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [rbx + 0x44]
mov edx, eax
and edx, 3
cmp edx, 3
jne 0x441831
and eax, 0xfffffffe
mov rcx, r13
mov dword [rbx + 0x44], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xfffffff3
or eax, 4
mov byte [rbx + 0x40], al
call dbg.pthread_mutex_unlock
call dbg._pthread_invoke_cancel
nop word [rax + rax]
test dl, 0xc
jne 0x441850
and edx, 0xf
jne 0x44185e
mov rcx, qword [rbx + 0x28]
mov dword [rsp + 0x50], 0x100001
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x441831
mov rcx, qword [rbx + 0x28]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rax, [dbg._pthread_invoke_cancel]
mov rcx, qword [rbx + 0x28]
mov rdx, r12
mov qword [rsp + 0x118], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
movzx eax, byte [rbx + 0x40]
and dword [rbx + 0x44], 0xfffffffe
and eax, 0xfffffff0
or eax, 5
mov byte [rbx + 0x40], al
lock add dword [0x005cfea8], 1
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x441958
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, r13
call dbg.pthread_mutex_unlock
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x441831
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x4417ec
movzx edx, byte [rbx + 0x40]
jmp 0x4417f9
Function at 0x441990
Capabilities:
Get thread local storage value
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, [0x004fd328]
mov ebx, edx
call dbg.pthread_mutex_lock
mov rcx, r12
call dbg.__pthread_get_pointer
test rax, rax
je 0x441a08
cmp qword [rax + 0x1d8], r12
jne 0x441a08
test byte [rax + 0x40], 0xc
jne 0x441a08
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x441a08
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x441a08
lea rcx, [0x004fd328]
call dbg.pthread_mutex_unlock
test ebx, ebx
je 0x441a28
lea edx, [rbx - 2]
cmp edx, 0x15
ja 0x441a30
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
jmp dbg.pthread_cancel
lea rcx, [0x004fd328]
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x28
pop rbx
pop r12
ret
xor eax, eax
jmp 0x441a19
mov eax, 0x16
jmp 0x441a19

Function at 0x441bb0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x005cfea0], 1
mov esi, ecx
mov rdi, rdx
je 0x441bcc
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x441c48
test esi, 0xfffffffe
je 0x441c00
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
test rdi, rdi
je 0x441c19
mov eax, dword [rbx + 0x44]
and eax, 1
mov dword [rdi], eax
mov ecx, dword [rbx + 0x44]
and ecx, 0xfffffffe
or esi, ecx
mov rcx, qword [rbx + 0x1d8]
mov dword [rbx + 0x44], esi
call dbg.test_cancel_locked
mov rcx, r12
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x441be0
jmp 0x441be8

Function at 0x441c60
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x005cfea0], 1
mov esi, ecx
mov rdi, rdx
je 0x441c7c
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x441cf8
test esi, 0xfffffffd
je 0x441cb0
mov eax, 0x16
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
lea r12, [rbx + 0x38]
mov rcx, r12
call dbg.pthread_mutex_lock
test rdi, rdi
je 0x441cc9
mov eax, dword [rbx + 0x44]
and eax, 2
mov dword [rdi], eax
mov ecx, dword [rbx + 0x44]
and ecx, 0xfffffffd
or esi, ecx
mov rcx, qword [rbx + 0x1d8]
mov dword [rbx + 0x44], esi
call dbg.test_cancel_locked
mov rcx, r12
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret
call sym.__pthread_self_lite.part.0
mov rbx, rax
test rax, rax
jne 0x441c90
jmp 0x441c98
Function at 0x441ff0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
test rcx, rcx
je 0x442130
lea rcx, [0x004fd328]
call dbg.pthread_mutex_lock
mov rcx, rbx
call dbg.__pthread_get_pointer
lea rcx, [0x004fd328]
mov r12, rax
call dbg.pthread_mutex_unlock
test r12, r12
je 0x442130
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x442130
lea rdx, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x442130
test byte [r12 + 0x44], 4
jne 0x442140
cmp dword [0x005cfea0], 1
je 0x44206e
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x442150
cmp rbx, qword [rax + 0x1d8]
je 0x442168
mov eax, dword [r12 + 0xbc]
mov rcx, qword [r12 + 0x28]
test eax, eax
je 0x4420ab
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x4420bb
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [r12 + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x4420d0
call rbx
mov qword [r12 + 0x30], 0
test rsi, rsi
je 0x4420e6
mov rax, qword [r12 + 8]
mov qword [rsi], rax
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x44216f
mov qword [r12 + 0x68], 0xffffffffffffffff
xor eax, eax
cmp qword [r12 + 0x1d0], 0
jne 0x442135
mov rcx, r12
mov dword [rsp + 0x2c], eax
call sym.push_pthread_mem.part.0
mov eax, dword [rsp + 0x2c]
jmp 0x442135
mov eax, 3
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop r12
ret
call sym.__pthread_self_lite.part.0
test rax, rax
je 0x442090
jmp 0x442083
mov eax, 0x24
jmp 0x442135
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x442180
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x004fd328]
mov rsi, rdx
call dbg.pthread_mutex_lock
mov rcx, rbx
call dbg.__pthread_get_pointer
mov r12, rax
test rax, rax
je 0x4422b0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x4422b0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4422b0
test byte [r12 + 0x44], 4
jne 0x4422d0
cmp dword [0x005cfea0], 1
je 0x4421e8
call sym._pthread_once_raw.part.0.constprop.0.isra.0
mov ecx, dword [0x004fd338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x442318
mov rdx, qword [rax + 0x1d8]
cmp rbx, rdx
je 0x442340
mov edx, dword [r12 + 0xbc]
mov rcx, qword [r12 + 0x28]
test edx, edx
jne 0x442233
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4422f0
mov rcx, qword [r12 + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x442248
call rbx
mov qword [r12 + 0x30], 0
test rsi, rsi
je 0x44225e
mov rax, qword [r12 + 8]
mov qword [rsi], rax
lea rcx, [r12 + 0x38]
call dbg.pthread_mutex_destroy
lea rcx, [r12 + 0x68]
call dbg.pthread_spin_destroy
cmp eax, 1
je 0x442356
cmp qword [r12 + 0x1d0], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
je 0x442330
lea rcx, [0x004fd328]
call dbg.pthread_mutex_unlock
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x004fd328]
call dbg.pthread_mutex_unlock
mov eax, 3
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, [0x004fd328]
call dbg.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov eax, dword [r12 + 0xbc]
test eax, eax
jne 0x44222e
lea rcx, [0x004fd328]
call dbg.pthread_mutex_unlock
mov eax, 0x10
jmp 0x4422a1
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
je 0x442204
jmp 0x4421fd
mov rcx, r12
call sym.push_pthread_mem.part.0
jmp 0x442293
lea rcx, [0x004fd328]
call dbg.pthread_mutex_unlock
mov eax, 0x24
jmp 0x4422a1
call sym.replace_spin_keys.part.0
nop
nop dword [rax]

Function at 0x451010
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x45103c
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x451ca0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x005000b0], 0
jne 0x451daa
mov byte [0x005000b0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x451d80
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call sym.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x451d71
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x00594e71]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x451d6c
mov rcx, r13
call sym.free
call sym.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x451d3b
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x451e3f
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x451da5
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x451da5

Function at 0x4b2560
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x4b2587
call rbp
cmp dword [rax], 4
jne 0x4b25a4
mov rcx, rdi
call method.std::__basic_file_char_.fd__
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x4b2580
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4c5d70
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x4c5d98
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x4c5de0
cdqe
add rsi, rax
sub rbx, rax
jne 0x4c5db0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x4c5dec
call rbp
cmp dword [rax], 4
je 0x4c5db0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001400
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x20
cmp dword [rcx + 8], 0
mov rdi, rcx
je 0x140001417
mov rcx, qword [rcx]
call fcn.1400cf780
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14000143b
mov qword [rsp + 0x30], rbx
mov rbx, qword [rcx + 8]
call fcn.1400cf780
test rbx, rbx
mov rcx, rbx
jne 0x140001425
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax

Function at 0x140001450
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]

Function at 0x140001460
Capabilities:
Get common file path

Disassembly:
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400021a2
Capabilities:
Parse credit card information

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x66
je 0x140002576
cmp eax, 0x66
jg 0x140002590
cmp eax, 0x4e
je 0x140002589
cmp eax, 0x4e
jg 0x140002590
cmp eax, 0x42
je 0x140002218
cmp eax, 0x42
jg 0x140002590
cmp eax, 0x2a
je 0x140002563
cmp eax, 0x2a
jg 0x140002590
cmp eax, 7
je 0x140002550
cmp eax, 0x1b
jne 0x140002590
mov eax, 0x74f
jmp 0x140002595
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
movsx eax, al
cmp eax, 0x64
je 0x140002542
cmp eax, 0x64
jg 0x140002545
cmp eax, 0x52
je 0x1400024de
cmp eax, 0x52
jg 0x140002545
cmp eax, 0x51
je 0x1400024d0
cmp eax, 0x51
jg 0x140002545
cmp eax, 0x43
je 0x1400024c2
cmp eax, 0x43
jg 0x140002545
cmp eax, 0x19
je 0x140002285
cmp eax, 0x1e
je 0x140002548
jmp 0x140002540
mov rax, qword [rbp - 8]
mov qword [rbp - 0x10], rax
invalid
invalid
invalid
Function at 0x14006c8c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x460]
mov rdi, rcx
test rbx, rbx
je 0x14006c91a
nop
cmp dword [rbx + 0x444], 1
jne 0x14006c90e
lea rcx, [rbx + 8]
call fcn.140001400
lea rcx, [rbx + 0x80]
call fcn.140001400
mov rcx, rbx
call fcn.14005c4f0
mov rcx, rbx
call fcn.14005c580
mov rbx, qword [rbx + 0x3f0]
test rbx, rbx
jne 0x14006c8e0
xor esi, esi
cmp dword [rdi + 0x334], esi
jle 0x14006c987
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r12
mov r12, rsi
mov rax, qword [rdi + 0x310]
mov rdx, qword [r12 + rax]
movsxd rcx, dword [rdx + 0x10]
movsxd rax, dword [rdx + 0x14]
lea rbp, [rcx + rax*8]
lea rbx, [rcx + rdx]
add rbp, rdx
cmp rbx, rbp
je 0x14006c96e
mov rdx, qword [rbx]
mov r8d, 0x11
mov rcx, rdi
call fcn.140046160
add rbx, 8
cmp rbx, rbp
jne 0x14006c954
add esi, 1
add r12, 8
cmp esi, dword [rdi + 0x334]
jl 0x14006c931
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
lea rcx, [rdi + 0x338]
call fcn.140001400
lea rcx, [rdi + 0x310]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp fcn.140001400
Function at 0x1400f2380
Capabilities:
Get common file path

Disassembly:
push r12
push r15
sub rsp, 0x38
xor r12d, r12d
mov r15, rcx
cmp dword [rcx + 0x24], r12d
jle 0x1400f2455
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov r14, r12
nop
nop
mov rax, qword [r15]
mov rdx, qword [r14 + rax]
movsxd rcx, dword [rdx + 0x10]
movsxd rax, dword [rdx + 0x14]
lea r13, [rcx + rax*8]
lea rsi, [rcx + rdx]
add r13, rdx
cmp rsi, r13
je 0x1400f2429
nop
mov rbp, qword [rsi]
mov edi, 2
lea rbx, [rbp + 8]
nop
mov rax, qword [rbx]
test rax, rax
je 0x1400f240e
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400f2406
call fcn.1400cf780
mov rcx, qword [rbx]
call fcn.1400cf780
add rbx, 8
sub rdi, 1
jne 0x1400f23f0
mov rcx, rbp
call fcn.1400cf780
add rsi, 8
cmp rsi, r13
jne 0x1400f23e0
add r12d, 1
add r14, 8
cmp r12d, dword [r15 + 0x24]
jl 0x1400f23c0
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
add rsp, 0x38
pop r15
pop r12
jmp fcn.140001400
Function at 0x140126970
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x58]
mov rsi, qword [rcx + 0x50]
mov rbx, rcx
test edi, edi
je 0x1401269dd
nop
mov rdx, qword [rsi]
test byte [rdx + 0x28], 2
je 0x1401269a3
mov rcx, rdx
call fcn.1400cf780
jmp 0x1401269d4
cmp byte [rdx + 0x30], 0
lea rcx, [rdx + 0x30]
mov rax, rcx
je 0x1401269b9
add rax, 1
cmp byte [rax], 0
jne 0x1401269b0
sub eax, ecx
add eax, 0x31
movsxd rcx, eax
mov rax, qword [rbx + rcx*8 + 0xa8]
mov qword [rdx], rax
mov qword [rbx + rcx*8 + 0xa8], rdx
add rsi, 8
sub edi, 1
jne 0x140126990
mov rcx, qword [rbx + 0x50]
xor edi, edi
test rcx, rcx
mov dword [rbx + 0x58], edi
je 0x1401269f7
call fcn.1400cf780
mov qword [rbx + 0x50], rdi
mov dword [rbx + 0x5c], edi
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140126a09
call fcn.1400cf780
mov qword [rbx + 0x28], rdi
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140126a1b
call fcn.1400cf780
mov qword [rbx + 0x38], rdi
lea rcx, [rbx + 0x8a8]
call fcn.1400e47b0
lea r11, [rbx + 0xa8]
mov eax, 0x20
nop
nop
nop
nop
mov qword [r11], rdi
mov qword [r11 + 8], rdi
mov qword [r11 + 0x10], rdi
add r11, 0x40
dec rax
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 8], rdi
jne 0x140126a40
lea rcx, [rbx + 0x60]
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x20], edi
mov dword [rbx + 0x94], 0xffffffff
mov dword [rbx + 0x98], edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140001400