joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800531ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
call fcn.18005523c
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.180079820
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.180090580
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.1800090cc
nop
mov byte [rbp - 0x18], 0x7b
mov byte [rbp - 0x17], 0x6b
mov byte [rbp - 0x16], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x15], 0x57
mov byte [rbp - 0x14], 0x7b
mov byte [rbp - 0x13], 0x65
mov byte [rbp - 0x12], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x11], 0x46
mov byte [rbp - 0x10], 0x79
mov byte [rbp - 0xf], 0x6a
mov byte [rbp - 0xe], 0x6a
mov byte [rbp - 0xd], 0x69
mov byte [rbp - 0xc], 0x76
mov byte [rbp - 0xb], 0x77
mov byte [rbp - 0xa], 0
mov al, byte [rbp - 0x18]
xor edx, edx
mov al, byte [rbp + rdx - 0x18]
sub al, 4
mov byte [rbp + rdx - 0x18], al
inc rdx
cmp rdx, 0xe
jb 0x180053299
lea rdx, [rbp - 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800532e6
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x180053070]
mov rdx, rax
mov rcx, rsi
call fcn.180073bc0
mov qword [0x18010f1b8], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180054a3c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp - 0x34], reloc.WS2_32.dll_WSACleanup
xor eax, eax
mov byte [rbp - 0x30], 0x30
mov rbx, rcx
mov byte [rbp - 0x2f], 0x1d
xor edx, edx
mov byte [rbp - 0x2e], 7
mov byte [rbp - 0x2d], 4
mov byte [rbp - 0x2c], 0x15
mov byte [rbp - 0x2b], 0
mov byte [rbp - 0x2a], 0x17
mov byte [rbp - 0x29], 0x1c
mov byte [rbp - 0x28], 0x39
mov byte [rbp - 0x27], 0x11
mov byte [rbp - 0x26], 7
mov byte [rbp - 0x25], 7
mov byte [rbp - 0x24], 0x15
mov byte [rbp - 0x23], 0x13
mov byte [rbp - 0x22], 0x11
mov byte [rbp - 0x21], 0x35
mov byte [rbp - 0x20], al
mov al, byte [rbp - 0x30]
mov al, byte [rbp + rdx - 0x30]
mov ecx, dword [rbp - 0x34]
xor cl, al
mov byte [rbp + rdx - 0x30], cl
inc rdx
cmp rdx, 0x10
jb 0x180054a9d
mov byte [rbp - 0x20], 0
xor ecx, ecx
mov byte [rbp + 0x18], 0x5d
mov byte [rbp + 0x19], 0x7b
mov byte [rbp + 0x1a], WSASetLastError
mov byte [rbp + 0x1b], 0x7a
mov byte [rbp + 0x1c], 0x3b
mov byte [rbp + 0x1d], 0x3a
mov byte [rbp + 0x1e], 0
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rcx + 0x18]
sub al, 8
mov byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x180054ad8
lea r8, [rbp - 0x30]
mov rcx, rbx
lea rdx, [rbp + 0x18]
call fcn.18007a520
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x180054258]
mov rcx, rbx
call fcn.180073bc0
mov dword [rbp - 0x1c], 0x5d
xor eax, eax
mov byte [rbp - 0x18], 0x19
xor edx, edx
mov byte [rbp - 0x17], 0x34
mov byte [rbp - 0x16], 0x2e
mov byte [rbp - 0x15], 0x2d
mov byte [rbp - 0x14], 0x3c
mov byte [rbp - 0x13], 0x29
mov byte [rbp - 0x12], 0x3e
mov byte [rbp - 0x11], 0x35
mov byte [rbp - 0x10], 0x10
mov byte [rbp - 0xf], 0x38
mov byte [rbp - 0xe], 0x2e
mov byte [rbp - 0xd], 0x2e
mov byte [rbp - 0xc], 0x3c
mov byte [rbp - 0xb], 0x3a
mov byte [rbp - 0xa], 0x38
mov byte [rbp - 9], 0xa
mov byte [rbp - 8], al
mov al, byte [rbp - 0x18]
mov al, byte [rbp + rdx - 0x18]
mov ecx, dword [rbp - 0x1c]
xor cl, al
mov byte [rbp + rdx - 0x18], cl
inc rdx
cmp rdx, 0x10
jb 0x180054b69
mov byte [rbp - 8], 0
mov dword [rbp - 0x40], 0x4e
mov eax, dword [rbp - 0x40]
xor al, 0x55
mov byte [rbp - 0x3c], al
mov eax, dword [rbp - 0x40]
inc al
xor al, 0x73
mov byte [rbp - 0x3b], al
mov eax, dword [rbp - 0x40]
add al, 2
xor al, 0x65
mov byte [rbp - 0x3a], al
mov eax, dword [rbp - 0x40]
add al, 3
xor al, 0x72
mov byte [rbp - 0x39], al
mov eax, dword [rbp - 0x40]
add al, 4
xor al, 0x33
mov byte [rbp - 0x38], al
mov eax, dword [rbp - 0x40]
add al, 5
xor al, 0x32
mov byte [rbp - 0x37], al
xor eax, eax
mov byte [rbp - 0x36], al
xor edx, edx
mov al, byte [rbp - 0x3c]
mov al, byte [rbp + rdx - 0x3c]
mov ecx, dword [rbp - 0x40]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x3c], cl
inc rdx
cmp rdx, 6
jb 0x180054bce
lea r8, [rbp - 0x18]
mov byte [rbp - 0x36], 0
lea rdx, [rbp - 0x3c]
mov rcx, rbx
call fcn.18007a520
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x180054258]
mov rcx, rbx
call fcn.180073bc0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x18005a194
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x18005a350
cmp qword [rcx + 0x178], 0
je 0x18005a350
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.18005adbc
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steam_api64.dll_SteamAPI_ISteamApps_RequestPublisherOwnedAppData]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x180057164]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x18005a24a
mov qword [rdi + 0x168], rax
call fcn.18001ccc4
mov rcx, qword [rdi + 0x168]
call fcn.180019d40
mov rsi, qword [0x18010ebd0]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x18005a295
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x18005a2c7
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memset]
mov qword [rbx + 0x60], 0x100
jmp 0x18005a2c9
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.18001905c
mov rcx, rdi
call fcn.180055a54
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.18001876c
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x18005bbf0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x16
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bbfd
mov byte [rcx + 0x1a], r10b
ret

Function at 0x18005bc50
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x14
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bc5d
mov byte [rcx + 0x18], r10b
ret
Function at 0x18005bc94
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xb
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bca1
mov byte [rcx + 0xf], r10b
ret

Function at 0x18005bcbc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x24
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bcc9
mov byte [rcx + 0x28], r10b
ret

Function at 0x18005bd1c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1d
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bd29
mov byte [rcx + 0x21], r10b
ret

Function at 0x18005bd44
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1c
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bd51
mov byte [rcx + 0x20], r10b
ret

Function at 0x18005bd88
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x13
jb 0x18005bd8f
mov byte [rcx + 0x17], 0
ret

Function at 0x18005bdcc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x19
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bdd9
mov byte [rcx + 0x1d], r10b
ret

Function at 0x18005be10
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x1a
jb 0x18005be17
mov byte [rcx + 0x1e], 0
ret

Function at 0x18005be54
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x13
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005be61
mov byte [rcx + 0x17], r10b
ret

Function at 0x18005beec
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x11
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bef9
mov byte [rcx + 0x15], r10b
ret
Function at 0x18005ca48
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x18010ebd8]
mov rbp, rcx
lea r14, [rdi + 0x90]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [rbp + 0xc]
lea r15, [rdi + 8]
mov dword [rsp + 0x50], r9d
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x50]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x18005ca8c
mov rax, qword [rdi + 0x38]
mov rcx, qword [rdi + 0x20]
and rax, rdx
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, qword [rdi + 0x10]
je 0x18005cadc
mov rcx, qword [rcx + rax*8]
jmp 0x18005cad4
cmp rbx, rcx
je 0x18005cadc
mov rbx, qword [rbx + 8]
cmp r9d, dword [rbx + 0x10]
jne 0x18005cacb
jmp 0x18005cade
xor ebx, ebx
test rbx, rbx
cmove rbx, qword [rdi + 0x10]
cmp rbx, qword [rdi + 0x10]
je 0x18005cb67
mov rdx, qword [rbx + 0x20]
mov rsi, qword [rbx + 0x18]
jmp 0x18005caff
cmp qword [rsi], rbp
je 0x18005cb04
add rsi, 8
cmp rsi, rdx
jne 0x18005caf6
cmp rsi, rdx
je 0x18005cb47
lea rax, [rsi + 8]
jmp 0x18005cb22
mov rcx, qword [rax]
cmp rcx, rbp
je 0x18005cb1e
mov qword [rsi], rcx
add rsi, 8
add rax, 8
cmp rax, rdx
jne 0x18005cb0f
cmp rsi, rdx
je 0x18005cb47
mov rdi, qword [rbx + 0x20]
mov rcx, rsi
sub rdi, rdx
mov r8, rdi
call qword [sym.imp.msvcrt.dll_memmove]
lea rax, [rdi + rsi]
mov qword [rbx + 0x20], rax
mov rax, qword [rbx + 0x20]
sub rax, qword [rbx + 0x18]
test rax, 0xfffffffffffffff8
jne 0x18005cb67
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.18003e800
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180065cbc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edi, edi
xor ebx, ebx
xor esi, esi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x180065d55
cmp esi, edi
jne 0x180065d0d
lea r15d, [rdi + 0x3e8]
mov edx, edi
mov r8d, r15d
mov rcx, rbx
call fcn.1800643bc
test rax, rax
je 0x180065d68
mov rbx, rax
mov edi, r15d
call qword [sym.imp.msvcrt.dll__errno]
movsxd rcx, esi
mov r9, r14
add rcx, rbx
mov edx, 1
and dword [rax], 0
mov eax, edi
sub eax, esi
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, r14
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x180065d91
mov rcx, r14
add esi, r15d
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
je 0x180065cea
cmp esi, edi
jne 0x180065dcf
lea r8d, [rdi + 1]
mov edx, edi
mov rcx, rbx
call fcn.1800643bc
test rax, rax
jne 0x180065dcc
lea r8, str.out_of_memory
mov edx, 0xc8
mov rcx, rbp
call fcn.18003f37c
test rbx, rbx
je 0x180065d8d
mov rax, qword [fcn.180094a84]
mov rcx, rbx
call rax
xor eax, eax
jmp 0x180065df8
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0
je 0x180065dac
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.msvcrt.dll_strerror]
jmp 0x180065db3
lea rax, str.Error_reading_file
mov r9, rax
lea r8, [0x1800ce744]
mov edx, 0xc8
mov rcx, rbp
call fcn.18003f37c
jmp 0x180065d7c
mov rbx, rax
movsxd rax, esi
mov rdx, rbp
mov rcx, rbx
mov byte [rax + rbx], 0
call fcn.180065600
mov rdi, rax
test rbx, rbx
je 0x180065df5
mov rdx, qword [fcn.180094a84]
mov rcx, rbx
call rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18006700c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
lea rbx, [0x1800c0640]
mov r9d, ecx
not r9d
cmp r8, 4
jb 0x18006705e
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
xor r11d, r11d
movzx ecx, byte [r11 + rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rbx + rax*4]
cmp r11, 4
jl 0x180067035
add rdx, 4
sub r10, 1
jne 0x180067032
test r8, r8
je 0x180067080
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
sub r8, 1
jne 0x180067063
mov rbx, qword [rsp + 8]
not r9d
mov eax, r9d
ret
Function at 0x180071290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, rdx
mov ecx, 0xfffffffd
sub rax, r8
mov rdi, r8
add rax, 0x7ffffffa
mov rsi, rdx
cmp rax, rcx
ja 0x180071333
mov byte [rbp - 0x16], 0x6b
mov byte [rbp - 0x15], WSASetLastError
mov byte [rbp - 0x14], WSACleanup
mov byte [rbp - 0x13], 0x21
mov byte [rbp - 0x12], 0x31
mov byte [rbp - 0x11], 0x79
mov byte [rbp - 0x10], 0x26
mov byte [rbp - 0xf], 0x31
mov byte [rbp - 0xe], 0x32
mov byte [rbp - 0xd], 0x37
mov byte [rbp - 0xc], WSASetLastError
mov byte [rbp - 0xb], WSASetLastError
mov byte [rbp - 0xa], 0x79
mov byte [rbp - 9], 0
movzx eax, byte [rbp - 0x16]
xor eax, eax
nop dword [rax]
movzx ecx, byte [rbp + rax - 0x16]
dec cl
mov byte [rbp + rax - 0x16], cl
inc rax
cmp rax, 0xd
jb 0x180071300
mov r8, rsi
lea rdx, [rbp - 0x16]
mov rcx, rdi
call fcn.180079e00
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
mov byte [rbp - 0x20], 0x6c
mov byte [rbp - 0x1f], WSASetLastError
mov byte [rbp - 0x1e], WSACleanup
mov byte [rbp - 0x1d], 0x22
mov byte [rbp - 0x1c], 0x5d
mov byte [rbp - 0x1b], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x1a], 0x6b
mov byte [rbp - 0x19], WSACleanup
mov byte [rbp - 0x18], 0x5f
mov byte [rbp - 0x17], 0
movzx eax, byte [rbp - 0x20]
xor eax, eax
mov qword [rsp + 0x50], rbx
nop word [rax + rax]
movzx ecx, byte [rbp + rax - 0x20]
sub cl, 2
mov byte [rbp + rax - 0x20], cl
inc rax
cmp rax, 9
jb 0x180071370
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.180079e00
mov r8d, 8
mov qword [rbp + 0x18], rsi
lea rdx, [rbp + 0x18]
mov rbx, rax
lea rcx, [rax + rdi]
call fcn.18007a9e0
mov rsi, qword [rsp + 0x60]
add rax, rbx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1800713d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x48], rbp
mov rbp, r8
mov qword [rsp + 0x50], rsi
mov rsi, rdx
mov qword [rsp + 0x20], r14
mov r14, rcx
mov ecx, 0x10
call fcn.180090580
mov qword [rsp + 0x40], rax
mov rbx, rax
test rax, rax
je 0x18007145f
mov qword [rsp + 0x28], rdi
lea rax, vtable.MemoryAllocator.0
mov rdi, rbp
mov qword [rbx], rax
and rdi, 0xfffffffffffff000
mov qword [rbx + 8], 0
test rbp, rbp
cmove rdi, rbp
nop dword [rax]
add rdi, 0x1000
mov r9d, 0x40
mov rcx, rdi
mov r8d, 0x3000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 8], rax
test rax, rax
je 0x180071430
mov rdi, qword [rsp + 0x28]
jmp 0x180071461
xor ebx, ebx
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 8]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov qword [rsp + 0x40], rbx
cmp rdx, qword [rcx + 0x10]
je 0x180071495
mov qword [rdx], rbx
add qword [rcx + 8], 8
mov rax, qword [rbx + 8]
add rsp, 0x30
pop rbx
ret
lea r8, [rsp + 0x40]
call fcn.18006d920
mov rax, qword [rbx + 8]
add rsp, 0x30
pop rbx
ret
Function at 0x180073e80
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, rdx
mov rax, r8
sub rax, rdx
mov rbp, rcx
add rax, 0x7ffffffa
mov ecx, 0xfffffffd
cmp rax, rcx
mov r15, r8
mov r8d, 0xe
mov edx, 5
cmova edx, r8d
mov rcx, rdi
call fcn.18007a460
lea rcx, [rbp + 8]
mov r8, rdi
mov r14, rax
lea rdx, [rax + 0x100]
call fcn.1800713d0
mov r9, r14
mov r8, rdi
mov rdx, rax
mov rcx, rbp
mov rsi, rax
call fcn.18007ae10
add rsi, rax
mov rcx, rsi
call fcn.180072760
mov dword [rsp + 0x20], 0x50
mov byte [rsp + 0x24], 0x3d
mov byte [rsp + 0x25], 0x3f
mov byte [rsp + 0x26], 0x26
lea rbx, [rsi + rax]
mov byte [rsp + 0x27], reloc.WS2_32.dll_WSASetLastError
xor eax, eax
mov byte [rsp + 0x28], 0x22
mov byte [rsp + 0x29], 0x33
mov byte [rsp + 0x2a], 0x28
mov byte [rsp + 0x2b], 0x7c
mov byte [rsp + 0x2c], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x2d], 0x22
mov byte [rsp + 0x2e], 0x23
mov byte [rsp + 0x30], al
mov byte [rsp + 0x2f], 0x20
movzx eax, byte [rsp + 0x24]
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0x24]
mov edx, dword [rsp + 0x20]
xor dl, cl
mov byte [rsp + rax + 0x24], dl
inc rax
cmp rax, 0xc
jb 0x180073f60
lea rdx, [rsp + 0x24]
mov byte [rsp + 0x30], 0
mov rcx, rbx
call fcn.180079e00
add rbx, rax
mov rdx, r15
mov r8, rbx
mov rcx, rbp
call fcn.180070020
add rbx, rax
mov rcx, rbx
call fcn.1800714b0
add rbx, rax
mov r9, r14
mov rdx, rbx
mov r8, rdi
mov rcx, rbp
call fcn.180070940
lea rdx, [r14 + rdi]
mov rcx, rbp
lea r8, [rax + rbx]
call fcn.180071290
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.180071290
sub r14, rax
mov rdx, r14
lea rcx, [rax + rdi]
call fcn.18007aa80
mov rbx, qword [rsp + 0x60]
mov al, 1
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180075e00
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x180075ecc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x180075ecc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x180075ee5
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x180075ebc
cmp byte [rax], 0x5c
jne 0x180075eb6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x180075eb6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x180075ea2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x180075eb3
test r8b, 0x10
jne 0x180075eb6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x180075eb6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.180078270
test edi, edi
jne 0x180075e20
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.180076dd0
int3

Function at 0x180078820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180078854
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180078840
ret
Function at 0x18007a830
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x230
mov r12, r9
mov r14, r8
mov rbx, rdx
xor sil, sil
call fcn.18007a1e0
mov r15, rax
test rax, rax
je 0x18007a9ba
mov qword [rsp + 0x250], rbp
mov qword [rsp + 0x258], rdi
test rbx, rbx
jne 0x18007a87d
xor ecx, ecx
jmp 0x18007a889
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov r8d, 0x104
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x1800a6e60]
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__wfopen
xor edx, edx
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 2]
call sub.msvcrt.dll_fseek
mov rcx, rdi
call sub.msvcrt.dll_ftell
xor r8d, r8d
movsxd rbx, eax
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_fseek
mov rcx, rbx
call fcn.180090b24
mov r9, rdi
mov r8d, 1
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call sub.msvcrt.dll_fread
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov rdi, qword [rsp + 0x258]
mov eax, 0x5a4d
cmp word [rbp], ax
jne 0x18007a9aa
movsxd rcx, dword [rbp + 0x3c]
add rcx, rbp
cmp dword [rcx], 0x4550
jne 0x18007a9aa
movzx ebx, word [rcx + 0x14]
xor r9d, r9d
movzx r11d, word [rcx + 6]
add rbx, rcx
test r11d, r11d
je 0x18007a9aa
nop dword [rax]
movsxd rax, r9d
lea r8, [rbx + 0x18]
lea rcx, [rax + rax*4]
mov rax, r14
lea r10, [rcx*8]
add r8, r10
sub r8, r14
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18007a973
inc rax
test ecx, ecx
jne 0x18007a960
test edx, edx
je 0x18007a981
inc r9d
cmp r9d, r11d
jl 0x18007a940
jmp 0x18007a9aa
mov eax, dword [r10 + rbx + 0x24]
mov sil, 1
add rax, r15
mov qword [r12], rax
mov ecx, dword [r10 + rbx + 0x28]
cmp ecx, dword [r10 + rbx + 0x20]
mov rax, qword [rsp + 0x270]
cmovbe ecx, dword [r10 + rbx + 0x20]
mov dword [rax], ecx
mov rcx, rbp
call fcn.180090a0c
mov rbp, qword [rsp + 0x250]
lea r11, [rsp + 0x230]
movzx eax, sil
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret

Function at 0x18007a9e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov dword [rsp + 0x50], 0
mov rbx, rdx
lea r9, [rsp + 0x50]
mov rdx, rsi
mov r8d, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rsi
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret