joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058eb4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x140058ee1
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x140058f10
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x140058ef2
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140058f48
cmp qword [rcx + rdx*8], rdi
jne 0x140058f3d
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140058f41
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140058f55
cmp qword [rcx + rdx*8], rdi
jne 0x140058f55
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.1400492c0
mov rcx, rdi
call fcn.14027abd8
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400593b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
mov r11, rcx
mov r10, qword [r8 + 0x10]
mov r9, r8
cmp qword [r8 + 0x18], 8
jb 0x1400593f1
mov r9, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
add r10, r10
je 0x140059420
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs rdi, 0x100000001b3
imul rcx, rdi
inc rdx
cmp rdx, r10
jb 0x140059402
lea rdx, [r8 + 0x20]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
call fcn.14005bba0
nop
mov r9b, byte [rsp + 0x20]
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, r11
call fcn.14005be80
nop
lea rcx, [rsp + 0x38]
call fcn.1400595a4
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14027a710
mov rbx, qword [rsp + 0x138]
add rsp, 0x110
pop rdi
ret

Function at 0x1400597c4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rdx]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [str.__v__]
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movabs rbx, 0xcbf29ce484222325
cmovae rdx, qword [rsp + 0x20]
xor ecx, ecx
lea r8, [rax + rax]
test r8, r8
je 0x140059836
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor rbx, rax
inc rcx
imul rbx, r9
cmp rcx, r8
jb 0x140059819
lea rcx, [rsp + 0x20]
call fcn.1400492c0
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14027a710
add rsp, 0x50
pop rbx
ret
Function at 0x14005a130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rbp, rcx
movzx esi, word [rdx + 0x28]
mov r15d, 1
xor r14d, r14d
cmp byte [rdx + 0x2b], 0xb
je 0x14005a19f
movzx edx, r14w
cmp r14w, word [rdi + 0x54]
jae 0x14005a1df
mov rcx, qword [rdi + 0x58]
movzx eax, dx
add rax, rax
cmp word [rcx + rax*8 + 2], 0xb
je 0x14005a19f
add dx, r15w
cmp dx, word [rdi + 0x54]
jb 0x14005a185
jmp 0x14005a1df
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14007fa34
mov r8d, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, rdi
call fcn.14005a310
mov esi, eax
test rbx, rbx
je 0x14005a1df
mov rcx, rbx
call fcn.14027ffa8
movups xmm6, xmmword [rdi + 0x18]
lea rdi, [rbp + 0x300]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x48], esi
movq rcx, xmm6
mov r8, rcx
shr r8, 0x30
mov rax, rcx
shr rax, 0x20
movzx eax, ax
xor r8, rax
mov eax, ecx
xor r8, rax
movabs rcx, 0xcbf29ce484222325
mov rdx, r14
movzx eax, byte [rsp + rdx + 0x48]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
add rdx, r15
cmp rdx, 4
jb 0x14005a227
mov rax, r8
shl rax, 6
mov rdx, r8
shr rdx, 2
add rcx, rax
mov eax, 0x9e3779b9
add rdx, rax
add rdx, rcx
xor rdx, r8
and rdx, qword [rbp + 0x348]
mov r10, qword [rbp + 0x330]
mov rax, rdx
add rax, rax
mov rax, qword [r10 + rax*8]
lea r11, [rdx + rdx]
mov rdx, qword [rbp + 0x320]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
cmp qword [r10 + r11*8], rdx
jne 0x14005a29d
mov rcx, rdx
jmp 0x14005a2a5
mov rcx, qword [r10 + r11*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14005a2d1
cmp qword [rax + 0x10], r9
jne 0x14005a2bb
cmp qword [rax + 0x18], r8
jne 0x14005a2bb
cmp dword [rax + 0x20], esi
je 0x14005a2c0
mov rax, qword [rax]
jmp 0x14005a292
cmp r9, qword [rax + 0x10]
jne 0x14005a2d1
cmp r8, qword [rax + 0x18]
jne 0x14005a2d1
cmp esi, dword [rax + 0x20]
je 0x14005a2d4
mov rax, rdx
cmp rax, rdx
setne bl
test rdi, rdi
je 0x14005a2e8
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
mov al, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14027a710
mov rbx, qword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005a310
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r10, rdx
cmp byte [rcx + 0x2b], 0xb
lea esi, [rbx + 1]
je 0x14005a36a
movzx r9d, bx
cmp bx, word [rcx + 0x54]
jae 0x14005a364
mov rdx, qword [rcx + 0x58]
movzx eax, r9w
add rax, rax
cmp word [rdx + rax*8 + 2], 0xb
je 0x14005a36a
add r9w, si
cmp r9w, word [rcx + 0x54]
jb 0x14005a34a
movzx eax, word [rcx + 0x28]
jmp 0x14005a3e4
cmp dword [r10 + 0x44], ebx
jne 0x14005a375
mov rdx, rbx
jmp 0x14005a388
mov edx, dword [r10 + 0x44]
mov eax, r8d
lea rcx, [rdx + 2]
cmp rcx, rax
jae 0x14005a370
add rdx, r10
lea rcx, [rsp + 0x20]
call fcn.140048750
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movabs rdi, 0xcbf29ce484222325
cmovae rcx, qword [rsp + 0x20]
lea rdx, [rax + rax]
test rdx, rdx
je 0x14005a3d8
movzx eax, byte [rbx + rcx]
movabs r8, 0x100000001b3
xor rdi, rax
add rbx, rsi
imul rdi, r8
cmp rbx, rdx
jb 0x14005a3bb
lea rcx, [rsp + 0x20]
call fcn.1400492c0
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14027a710
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14005b9cc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x14005ba03
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x14005ba97
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x14005ba97
mov rcx, qword [r9]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x14005ba5d
cmp rdi, qword [rax + r8*8]
jne 0x14005ba4b
jmp 0x14005ba97
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.1400595a4
mov rcx, rbx
call fcn.14027abd8
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14005bb90
mov rax, qword [rbx]
cmp rdi, rax
je 0x14005bacc
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14005bae9
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14005bb18
cmp rax, rdi
jne 0x14005baf4
mov qword [rdx + r8*8], rbx
jmp 0x14005bb18
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14005bb18
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140307944]
test rax, rax
jns 0x14005bb39
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14005bb4a
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14005bb85
cmp rdx, 0x200
jae 0x14005bb62
shl rdx, 3
jmp 0x14005bb74
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14005bb74
add rdx, rdx
mov rcx, rsi
call fcn.1400515d0
mov rcx, rsi
call fcn.14005b66c
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14005bdb8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rdi + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 8
jb 0x14005bddc
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14005be33
cmp qword [rcx + rdx*8], rdi
jne 0x14005be28
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14005be2c
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005be40
cmp qword [rcx + rdx*8], rdi
jne 0x14005be40
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r9 + 0x10]
call fcn.1400595a4
mov rcx, rdi
call fcn.14027abd8
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005be80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r15, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x14005beb2
mov r14, qword [rsi + 0x30]
and r14, rcx
mov rdi, qword [rsi + 8]
add r14, r14
mov rax, qword [rsi + 0x18]
cmp qword [rax + r14*8], rdi
jne 0x14005beee
mov rbx, rdi
jmp 0x14005bef6
mov rbx, qword [rax + r14*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rax + r14*8]
je 0x14005bf21
mov rcx, qword [r8]
mov rbx, qword [rbx + 8]
cmp rcx, qword [rbx + 0x10]
je 0x14005bf11
cmp rbx, qword [rax + r14*8]
jne 0x14005beff
jmp 0x14005bf21
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x14005c072
mov rdi, qword [rdi]
mov r9, r8
mov r8, qword [rdi + 8]
mov rdx, rdi
call fcn.14005c7f4
mov rdx, rax
mov rax, qword [rsi + 0x10]
movabs rcx, 0x12f684bda12f683
sub rcx, rax
cmp rcx, 1
jae 0x14005bf5b
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [rsi + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14005bfae
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8]
cmp rax, qword [rsi + 8]
jne 0x14005bfcb
mov qword [rdx + r14*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r14*8 + 8], rdi
jmp 0x14005bffa
cmp rax, rbx
jne 0x14005bfd6
mov qword [rdx + r14*8], rdi
jmp 0x14005bffa
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rdi
je 0x14005bffa
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140307944]
test rax, rax
jns 0x14005c01b
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14005c02c
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14005c067
cmp rdx, 0x200
jae 0x14005c044
shl rdx, 3
jmp 0x14005c056
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14005c056
add rdx, rdx
mov rcx, rsi
call fcn.1400515d0
mov rcx, rsi
call fcn.14005b66c
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14005c47c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov r15, rdx
mov r14, rcx
movzx r9d, word [r8 + 6]
movzx eax, word [r8 + 4]
xor r9, rax
mov eax, dword [r8]
xor r9, rax
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8 + 0x10]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
inc rdx
cmp rdx, 4
jb 0x14005c4c1
mov rax, r9
shl rax, 6
mov rdx, r9
shr rdx, 2
add rcx, rax
mov eax, 0x9e3779b9
add rax, rdx
add rcx, rax
xor r9, rcx
mov rsi, qword [r14 + 0x30]
and rsi, r9
mov rbx, qword [r14 + 8]
add rsi, rsi
mov rcx, qword [r14 + 0x18]
cmp rbx, qword [rcx + rsi*8]
je 0x14005c558
mov rbx, qword [rcx + rsi*8 + 8]
mov rbx, qword [rbx]
jmp 0x14005c552
mov rbx, qword [rbx + 8]
mov rax, qword [r8]
cmp rax, qword [rbx + 0x10]
jne 0x14005c552
mov rax, qword [r8 + 8]
cmp rax, qword [rbx + 0x18]
jne 0x14005c552
mov eax, dword [rbx + 0x20]
cmp dword [r8 + 0x10], eax
jne 0x14005c552
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x14005c649
cmp rbx, qword [rcx + rsi*8]
jne 0x14005c522
mov rax, qword [r14 + 8]
mov rdi, qword [rax]
mov r9, r8
mov r8, qword [rdi + 8]
mov rdx, rdi
call fcn.14005ca34
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jae 0x14005c596
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rdi, qword [r14 + 8]
mov rdi, qword [rdi]
mov qword [rsp + 0x60], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14005c5e9
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x14005c606
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x14005c635
cmp rax, rbx
jne 0x14005c611
mov qword [rdx + rsi*8], rdi
jmp 0x14005c635
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x14005c635
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.14005c660
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14005c710
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx eax, word [r8 + 0x14]
mov r9, rcx
movzx r11d, word [r8 + 0x16]
mov rdi, rdx
xor r11, rax
movabs rcx, 0xcbf29ce484222325
mov eax, dword [r8 + 0x10]
xor r11, rax
xor r10d, r10d
movzx eax, byte [r8 + r10 + 0x20]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14005c741
mov rax, r11
mov rdx, r11
shr rdx, 2
shl rax, 6
add rcx, rax
mov eax, 0x9e3779b9
add rdx, rax
add rdx, rcx
mov rcx, qword [r9 + 0x18]
xor rdx, r11
and rdx, qword [r9 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14005c7b5
cmp qword [rcx + rdx*8], r8
jne 0x14005c7aa
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14005c7ae
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005c7c2
cmp qword [rcx + rdx*8], r8
jne 0x14005c7c2
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.14027abd8
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005c840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movzx r11d, word [r8 + 6]
movzx eax, word [r8 + 4]
xor r11, rax
mov eax, dword [r8]
xor r11, rax
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [r10 + rdx + 0x10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14005c885
mov rax, r11
shl rax, 6
mov rdx, r11
shr rdx, 2
add rcx, rax
mov eax, 0x9e3779b9
add rax, rdx
add rcx, rax
xor r11, rcx
mov r8, qword [r9 + 0x30]
and r8, r11
mov rdi, qword [r9 + 8]
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x14005c93c
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
jmp 0x14005c936
mov rdi, qword [rdi + 8]
mov rax, qword [r10]
cmp rax, qword [rdi + 0x10]
jne 0x14005c936
mov rax, qword [r10 + 8]
cmp rax, qword [rdi + 0x18]
jne 0x14005c936
mov eax, dword [rdi + 0x20]
cmp dword [r10 + 0x10], eax
jne 0x14005c936
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, rbx
call fcn.14027abd8
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14005c9d0
cmp rdi, qword [rcx + r8*8]
jne 0x14005c8e6
mov rax, qword [rbx]
cmp rdi, rax
je 0x14005c971
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14005c98e
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14005c9bd
cmp rax, rdi
jne 0x14005c999
mov qword [rdx + r8*8], rbx
jmp 0x14005c9bd
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14005c9bd
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.14005c660
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006066c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
mov rbx, rcx
mov r10, rdx
jb 0x14006069f
mov r10, qword [rdx]
lea r8, [r11 + r11]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r8, r8
je 0x1400606d2
movzx eax, byte [rcx + r10]
movabs rdi, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, rdi
cmp rcx, r8
jb 0x1400606b4
mov rcx, qword [rbx + 0x30]
mov r14, qword [rbx + 0x18]
and rcx, rdx
mov rax, rcx
add rax, rax
lea r15, [rcx + rcx]
mov rcx, qword [rbx + 8]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], rcx
jne 0x1400606fa
mov rdx, rcx
jmp 0x140060702
mov rdx, qword [r14 + r15*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x1400607af
cmp qword [r9 + 0x18], 8
lea rdx, [rax + 0x10]
mov r8, r9
jb 0x14006071c
mov r8, qword [r9]
mov rbp, qword [rdx + 0x18]
mov r10, rdx
cmp rbp, 8
jb 0x14006072c
mov r10, qword [rdx]
mov rsi, qword [rdx + 0x10]
cmp rsi, r11
jne 0x14006075e
mov rdi, rsi
test rsi, rsi
je 0x140060758
sub r10, r8
movzx edx, word [r8 + r10]
movzx ebx, word [r8]
cmp dx, bx
jne 0x140060763
add r8, 2
sub rdi, 1
jne 0x140060740
xor edx, edx
test edx, edx
je 0x14006076c
mov rax, qword [rax]
jmp 0x1400606ef
sbb edx, edx
and edx, 0xfffffffe
inc edx
jmp 0x14006075a
lea rdx, [rax + 0x10]
cmp rbp, 8
jb 0x140060779
mov rdx, qword [rdx]
cmp qword [r9 + 0x18], 8
jb 0x140060783
mov r9, qword [r9]
cmp r11, rsi
jne 0x1400607af
test r11, r11
je 0x1400607a9
sub r9, rdx
movzx r8d, word [rdx + r9]
movzx r10d, word [rdx]
cmp r8w, r10w
jne 0x1400607bb
add rdx, 2
sub r11, 1
jne 0x140060790
xor edx, edx
test edx, edx
je 0x1400607b2
mov rax, rcx
cmp rax, rcx
jne 0x1400607c4
xor al, al
jmp 0x1400607cd
sbb edx, edx
and edx, 0xfffffffe
inc edx
jmp 0x1400607ab
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140066e5c
Capabilities:
Parse credit card information

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov r10d, 0x5c
mov ecx, dword [rcx + 0x80]
movzx edx, word [r8 + 0x78]
lea r11d, [r10 + 0x1f]
bt ecx, 0x16
jae 0x140066ea2
cmp edx, 0x44
je 0x140066e9b
lea eax, [rdx - 0x53]
cmp eax, 0x24
ja 0x140066f01
movabs r9, 0x1100030011
bt r9, rax
jae 0x140066f01
xor al, al
add rsp, 0x28
ret
cmp edx, 0x2f
ja 0x140066ed5
je 0x140066ece
cmp edx, 0x22
je 0x140066ece
cmp edx, 0x24
je 0x140066f01
cmp edx, 0x27
jbe 0x140066e9b
cmp edx, 0x29
jbe 0x140066ef8
cmp edx, 0x2a
je 0x140066f01
cmp edx, 0x2b
je 0x140066ef8
cmp edx, 0x2e
je 0x140066f01
jmp 0x140066e9b
mov eax, ecx
shr eax, 0x18
jmp 0x140066efd
cmp edx, 0x3f
je 0x140066ef8
cmp edx, 0x5a
jbe 0x140066e9b
cmp edx, r10d
jbe 0x140066f01
cmp edx, 0x5e
je 0x140066f01
cmp edx, r11d
je 0x140066ef8
cmp edx, 0x7c
je 0x140066f01
cmp edx, 0x7d
jne 0x140066e9b
mov eax, ecx
shr eax, 0x17
test al, 1
je 0x140066e9b
mov dword [r8 + 0x74], edx
mov rdx, qword [r8]
cmp rdx, qword [r8 + 0x10]
je 0x140066f4f
cmp word [rdx], r10w
jne 0x140066f4b
add rdx, 2
cmp rdx, qword [r8 + 0x10]
je 0x140066f4b
test cl, 8
jne 0x140066f30
movzx eax, word [rdx]
sub ax, 0x28
cmp ax, 1
jbe 0x140066f48
test cl, 0x10
jne 0x140066f4b
movzx ecx, word [rdx]
mov r9d, 0xfffd
sub cx, r11w
test r9w, cx
jne 0x140066f4b
mov qword [r8], rdx
add qword [r8], 2
mov rcx, r8
call fcn.140061f68
mov al, 1
jmp 0x140066e9d