joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008dae8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14008db15
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14008db49
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14008db2b
and rcx, qword [0x14044ff30]
mov r14, qword [0x14044ff18]
mov rax, rcx
mov r10, qword [0x14044ff08]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14008db77
mov rcx, r10
jmp 0x14008db7f
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008dc2c
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14008db99
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14008dba9
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14008dbdb
mov rdi, rsi
test rsi, rsi
je 0x14008dbd5
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14008dbe0
add r8, 2
sub rdi, 1
jne 0x14008dbbd
xor ecx, ecx
test ecx, ecx
je 0x14008dbe9
mov rax, qword [rax]
jmp 0x14008db6c
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008dbd7
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14008dbf6
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14008dc00
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14008dc2c
test r11, r11
je 0x14008dc26
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14008dc38
add rcx, 2
sub r11, 1
jne 0x14008dc0d
xor ecx, ecx
test ecx, ecx
je 0x14008dc2f
mov rax, r10
cmp rax, r10
jne 0x14008dc41
xor al, al
jmp 0x14008dc4a
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008dc28
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14008dc68
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14008dc95
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14008dcc9
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14008dcab
and rcx, qword [0x14044fef0]
mov r14, qword [0x14044fed8]
mov rax, rcx
mov r10, qword [0x14044fec8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14008dcf7
mov rcx, r10
jmp 0x14008dcff
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008ddac
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14008dd19
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14008dd29
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14008dd5b
mov rdi, rsi
test rsi, rsi
je 0x14008dd55
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14008dd60
add r8, 2
sub rdi, 1
jne 0x14008dd3d
xor ecx, ecx
test ecx, ecx
je 0x14008dd69
mov rax, qword [rax]
jmp 0x14008dcec
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008dd57
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14008dd76
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14008dd80
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14008ddac
test r11, r11
je 0x14008dda6
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14008ddb8
add rcx, 2
sub r11, 1
jne 0x14008dd8d
xor ecx, ecx
test ecx, ecx
je 0x14008ddaf
mov rax, r10
cmp rax, r10
jne 0x14008ddc1
xor al, al
jmp 0x14008ddca
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008dda8
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14008de70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x49], rcx
mov ebx, 1
lea r13d, [rbx + 0xf]
mov r8b, bl
mov rdx, rcx
lea rcx, [rbp - 0x39]
call fcn.14005f560
lea r8, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae r8, qword [rbp - 0x39]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
mov r11, qword [rbp - 0x29]
lea r9, [r11 + r11]
test r9, r9
je 0x14008df0a
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
add rdx, rbx
cmp rdx, r9
jb 0x14008deec
and rcx, qword [0x14044fe10]
mov rax, rcx
add rax, rax
mov r15, qword [0x14044fdf8]
mov rax, qword [r15 + rax*8]
lea r12, [rcx + rcx]
mov r10, qword [0x14044fde8]
cmp qword [r15 + r12*8], r10
jne 0x14008df38
mov rcx, r10
jmp 0x14008df40
mov rcx, qword [r15 + r12*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008dff1
lea rdx, [rax + 0x10]
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rcx, qword [rbp - 0x39]
mov r9, rdx
mov r14, qword [rdx + 0x18]
cmp r14, 8
jb 0x14008df6b
mov r9, qword [rdx]
mov rsi, qword [rdx + 0x10]
cmp rsi, r11
jne 0x14008df9d
mov rdi, rsi
test rsi, rsi
je 0x14008df97
sub r9, rcx
movzx edx, word [rcx + r9]
movzx r8d, word [rcx]
cmp dx, r8w
jne 0x14008dfa2
add rcx, 2
sub rdi, rbx
jne 0x14008df7f
xor ecx, ecx
test ecx, ecx
je 0x14008dfab
mov rax, qword [rax]
jmp 0x14008df2d
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, ebx
jmp 0x14008df99
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x14008dfb8
mov rcx, qword [rcx]
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
cmp r11, rsi
jne 0x14008dff1
test r11, r11
je 0x14008dfeb
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14008e00e
add rcx, 2
sub r11, rbx
jne 0x14008dfd3
xor ecx, ecx
test ecx, ecx
je 0x14008dff4
mov rax, r10
cmp rax, r10
je 0x14008dfff
mov r13d, dword [rax + 0x30]
xor bl, bl
lea rcx, [rbp - 0x39]
call fcn.14004b500
test bl, bl
jne 0x14008e047
jmp 0x14008e017
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, ebx
jmp 0x14008dfed
mov eax, r13d
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, qword [rbp - 0x49]
lea rcx, [rbp - 0x19]
call fcn.14008390c
nop
mov r8, rax
lea rdx, str.Failed_mapping_the_TransformerTypeStr_to_enum
lea rcx, [rbp + 7]
call fcn.140085f70
nop
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140085fc8
lea rdx, [0x14042f0b8]
lea rcx, [rbp - 0x39]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x1400945b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400945dd
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140094611
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x1400945f3
and rcx, qword [0x14044fe70]
mov r14, qword [0x14044fe58]
mov rax, rcx
mov r10, qword [0x14044fe48]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009463f
mov rcx, r10
jmp 0x140094647
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400946f4
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x140094661
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140094671
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400946a3
mov rdi, rsi
test rsi, rsi
je 0x14009469d
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400946a8
add r8, 2
sub rdi, 1
jne 0x140094685
xor ecx, ecx
test ecx, ecx
je 0x1400946b1
mov rax, qword [rax]
jmp 0x140094634
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009469f
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400946be
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400946c8
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x1400946f4
test r11, r11
je 0x1400946ee
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140094700
add rcx, 2
sub r11, 1
jne 0x1400946d5
xor ecx, ecx
test ecx, ecx
je 0x1400946f7
mov rax, r10
cmp rax, r10
jne 0x140094709
xor al, al
jmp 0x140094712
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400946f0
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140094b8c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rdx]
mov ebx, r8d
xor edx, edx
mov r9, rcx
test rax, rax
je 0x140094cbe
mov r11, qword [rax + 0x40]
movabs r8, 0xcbf29ce484222325
mov qword [rsp + 0x58], r11
mov r10, r8
mov ecx, edx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rcx + 0x58]
inc rcx
xor r10, rax
imul r10, rbp
cmp rcx, 8
jb 0x140094bd6
mov rcx, qword [r9 + 0x70]
and rcx, r10
mov r10, qword [r9 + 0x58]
mov rax, rcx
add rax, rax
lea rdi, [rcx + rcx]
mov rsi, qword [r10 + rdi*8]
mov rax, qword [r10 + rax*8]
cmp rsi, qword [r9 + 0x48]
jne 0x140094c14
mov rcx, qword [r9 + 0x48]
jmp 0x140094c1c
mov rcx, qword [r10 + rdi*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140094c2c
cmp qword [rax + 0x10], r11
je 0x140094c30
mov rax, qword [rax]
jmp 0x140094c08
mov rax, qword [r9 + 0x48]
cmp rax, qword [r9 + 0x48]
jne 0x140094c95
mov qword [rsp + 0x58], r11
movzx eax, byte [rsp + rdx + 0x58]
inc rdx
xor r8, rax
imul r8, rbp
cmp rdx, 8
jb 0x140094c3b
mov rdx, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x30]
and rcx, r8
mov rax, rcx
add rax, rax
lea r8, [rcx + rcx]
mov r10, qword [rdx + r8*8]
mov rax, qword [rdx + rax*8]
cmp r10, qword [r9 + 8]
jne 0x140094c79
mov rcx, qword [r9 + 8]
jmp 0x140094c81
mov rcx, qword [rdx + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140094c91
cmp qword [rax + 0x10], r11
je 0x140094c95
mov rax, qword [rax]
jmp 0x140094c6d
mov rax, qword [r9 + 8]
cmp rax, qword [r9 + 8]
je 0x140094ca9
cmp ebx, dword [rax + 0x130]
jge 0x140094ca9
mov dword [rax + 0x130], ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rdx, str.name_is_null
lea rcx, [rsp + 0x20]
call fcn.140063f38
lea rdx, [0x14042f0b8]
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x140096344
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x140096371
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x1400963a5
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140096387
and rcx, qword [0x14044feb0]
mov r14, qword [0x14044fe98]
mov rax, rcx
mov r10, qword [0x14044fe88]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400963d3
mov rcx, r10
jmp 0x1400963db
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140096488
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400963f5
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140096405
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140096437
mov rdi, rsi
test rsi, rsi
je 0x140096431
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14009643c
add r8, 2
sub rdi, 1
jne 0x140096419
xor ecx, ecx
test ecx, ecx
je 0x140096445
mov rax, qword [rax]
jmp 0x1400963c8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140096433
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x140096452
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14009645c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140096488
test r11, r11
je 0x140096482
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140096494
add rcx, 2
sub r11, 1
jne 0x140096469
xor ecx, ecx
test ecx, ecx
je 0x14009648b
mov rax, r10
cmp rax, r10
jne 0x14009649d
xor al, al
jmp 0x1400964a6
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140096484
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140097724
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x140097751
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140097785
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140097767
and rcx, qword [0x140450010]
mov r14, qword [0x14044fff8]
mov rax, rcx
mov r10, qword [0x14044ffe8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400977b3
mov rcx, r10
jmp 0x1400977bb
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140097868
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400977d5
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400977e5
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140097817
mov rdi, rsi
test rsi, rsi
je 0x140097811
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14009781c
add r8, 2
sub rdi, 1
jne 0x1400977f9
xor ecx, ecx
test ecx, ecx
je 0x140097825
mov rax, qword [rax]
jmp 0x1400977a8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140097813
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x140097832
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14009783c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140097868
test r11, r11
je 0x140097862
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140097874
add rcx, 2
sub r11, 1
jne 0x140097849
xor ecx, ecx
test ecx, ecx
je 0x14009786b
mov rax, r10
cmp rax, r10
jne 0x14009787d
xor al, al
jmp 0x140097886
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140097864
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140098590
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400985bd
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x1400985f1
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x1400985d3
and rcx, qword [0x140450090]
mov r14, qword [0x140450078]
mov rax, rcx
mov r10, qword [0x140450068]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009861f
mov rcx, r10
jmp 0x140098627
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400986d4
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x140098641
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140098651
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140098683
mov rdi, rsi
test rsi, rsi
je 0x14009867d
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x140098688
add r8, 2
sub rdi, 1
jne 0x140098665
xor ecx, ecx
test ecx, ecx
je 0x140098691
mov rax, qword [rax]
jmp 0x140098614
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009867f
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14009869e
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400986a8
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x1400986d4
test r11, r11
je 0x1400986ce
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400986e0
add rcx, 2
sub r11, 1
jne 0x1400986b5
xor ecx, ecx
test ecx, ecx
je 0x1400986d7
mov rax, r10
cmp rax, r10
jne 0x1400986e9
xor al, al
jmp 0x1400986f2
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400986d0
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140098710
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14009873d
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140098771
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140098753
and rcx, qword [0x140450050]
mov r14, qword [0x140450038]
mov rax, rcx
mov r10, qword [0x140450028]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009879f
mov rcx, r10
jmp 0x1400987a7
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140098854
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400987c1
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400987d1
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140098803
mov rdi, rsi
test rsi, rsi
je 0x1400987fd
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x140098808
add r8, 2
sub rdi, 1
jne 0x1400987e5
xor ecx, ecx
test ecx, ecx
je 0x140098811
mov rax, qword [rax]
jmp 0x140098794
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400987ff
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14009881e
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x140098828
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140098854
test r11, r11
je 0x14009884e
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140098860
add rcx, 2
sub r11, 1
jne 0x140098835
xor ecx, ecx
test ecx, ecx
je 0x140098857
mov rax, r10
cmp rax, r10
jne 0x140098869
xor al, al
jmp 0x140098872
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140098850
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14009a29c
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x7c]
xor al, al
mov rbx, rcx
cmp edx, 0xffffffff
je 0x14009a443
mov ecx, edx
cmp ecx, 0x7c
je 0x14009a443
cmp ecx, 0x29
jne 0x14009a2e5
cmp dword [rbx + 0x1c], 0
jne 0x14009a443
cmp ecx, ecx
jne 0x14009a2e5
test dword [rbx + 0x80], 0x10000000
je 0x14009a464
cmp ecx, 0x2e
jne 0x14009a305
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.14009a490
mov rcx, rbx
call fcn.14009a238
jmp 0x14009a42b
cmp ecx, 0x5c
jne 0x14009a36c
mov rcx, rbx
call fcn.14009a238
test byte [rbx + 0x80], 0x80
je 0x14009a35f
cmp word [rbx + 0x78], 0x62
jne 0x14009a33d
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.14009a490
mov rcx, rbx
call fcn.14009a238
jmp 0x14009a433
cmp word [rbx + 0x78], 0x42
jne 0x14009a35f
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.14009a490
mov rax, qword [rbx + 0x48]
add rax, 0xc
xor dword [rax], 1
jmp 0x14009a330
mov rcx, rbx
call fcn.14009a6a0
jmp 0x14009a42b
cmp ecx, 0x5b
jne 0x14009a390
mov rcx, rbx
call fcn.14009a238
mov rcx, rbx
call fcn.14009a538
cmp dword [rbx + 0x7c], 0x5d
jne 0x14009a44e
jmp 0x14009a2f8
cmp ecx, 0x28
jne 0x14009a3b4
mov rcx, rbx
call fcn.14009a238
mov rcx, rbx
call fcn.14009a7fc
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x14009a459
jmp 0x14009a41e
cmp ecx, 0x5e
jne 0x14009a3c1
lea edx, [rcx - 0x5c]
jmp 0x14009a327
cmp ecx, 0x24
jne 0x14009a3ce
lea edx, [rcx - 0x21]
jmp 0x14009a327
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14009a485
cmp ecx, 0x3f
je 0x14009a485
cmp ecx, 0x7b
je 0x14009a485
cmp edx, 0x7d
jne 0x14009a3fd
test dword [rbx + 0x80], 0x10000000
je 0x14009a46f
cmp edx, 0x5d
jne 0x14009a40e
test dword [rbx + 0x80], 0x10000000
je 0x14009a47a
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14009aac0
mov dil, 1
mov rcx, rbx
call fcn.14009a238
test dil, dil
je 0x14009a433
mov rcx, rbx
call fcn.14009a9c0
mov edx, dword [rbx + 0x7c]
mov al, 1
mov ecx, edx
cmp edx, 0xffffffff
jne 0x14009a2b9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 4
call fcn.140099d78
int3
mov edx, 5
call fcn.140099d78
int3
mov edx, 5
call fcn.140099d78
int3
mov edx, 6
call fcn.140099d78
int3
mov edx, 4
call fcn.140099d78
int3
mov edx, 0xa
call fcn.140099d78
int3