joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180048d00
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180080040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbp, rcx
mov rsi, qword [0x180081d28]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x180048f20
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x180048f20
mov ecx, 0x50
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
mov r8, qword [0x180081d28]
xor ebx, ebx
test r8, r8
je 0x180048dd1
mov r9d, dword [r8 + 0x3f60]
movsx rdx, word [r8 + 0x6078]
lea rax, [r8 + 0x607c]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x180048dc6
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rax, [rax*8 + 0x607c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6070]
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
test rdi, rdi
je 0x180048e02
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x180048e05
mov rdi, rbx
mov qword [rsi + 0x90], rdi
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
or dword [rsi + 0xc], 6
mov qword [rdi], rbp
mov rax, qword [rsp + 0x68]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x180048e48
mov rsi, qword [r8 + 0x90]
jmp 0x180048e4b
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
movzx ecx, ax
mov r9d, 4
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180048e76
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x180081d28]
mov rcx, qword [rax + 0x4ae0]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
mov byte [rdi + 0x31], 1
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x28], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x180048ef0
inc rbx
cmp rbx, 5
jl 0x180048ed0
mov al, 1
jmp 0x180048f22
mov qword [rdi + 0x38], rsi
lea rdx, str.XInputGetCapabilities
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x40], rax
lea rdx, str.XInputGetState
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov al, 1
jmp 0x180048f22
xor al, al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180066840
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000bd48
Capabilities:
Check os version
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x370
mov rax, qword [0x140048148]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rcx, [rsp + 0x30]
xor ebp, ebp
mov dword [rsp + 0x30], 0x11c
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebp
je 0x14000be1d
cmp dword [rsp + 0x34], 5
jb 0x14000be1d
jne 0x14000bda4
lea eax, [rbp + 1]
jmp 0x14000be1f
lea rdx, [rsp + 0x150]
lea rcx, [0x140002b50]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp eax, ebp
je 0x14000be1d
cmp eax, 0x104
ja 0x14000be1d
lea r8d, [rax + 1]
lea rdx, [rsp + 0x150]
lea rcx, [0x140002b50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
jne 0x14000be1d
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
cmp rax, rbp
je 0x14000be1d
lea rdx, [0x140002b88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
cmp rax, rbp
jne 0x14000be48
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140037b50
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rdx, [rsp + 0x20]
lea rcx, [0x140002cb0]
call rdi
cmp eax, ebp
mov esi, eax
jge 0x14000be98
cmp dword [rsp + 0x34], 6
jne 0x14000be8b
lea rdx, [0x140002c00]
lea rcx, [0x140002cb0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebp
jne 0x14000be8b
lea rdx, [rsp + 0x20]
lea rcx, [0x140002bb0]
call rdi
mov esi, eax
mov eax, dword [rsp + 0x20]
cmp esi, ebp
cmovl eax, ebp
mov dword [rsp + 0x20], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x20]
jmp 0x14000be1f
Function at 0x14000beb0
Capabilities:
Accept command line arguments
Get keyboard layout

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
and dword [rax + 0x28], 0
mov rbp, r8
mov r14, rdx
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ebx, [r15 + 1]
mov r13, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000c08a
mov ecx, dword [rsp + 0x80]
cmp ecx, ebx
jle 0x14000c08a
dec ecx
mov esi, ebx
cmp ecx, ebx
jle 0x14000bf71
lea rdi, [rax + 8]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000bf5e
lea rdx, [0x140002c60]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000bf5e
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000bf5e
call qword [sym.imp.msvcrt.dll__wtoi]
test rbp, rbp
je 0x14000bf54
mov dword [rbp], eax
cmp dword [rbp], r15d
jne 0x14000bf5e
or dword [rbp], 0xffffffff
mov eax, dword [rsp + 0x80]
add esi, ebx
add rdi, 8
dec eax
cmp esi, eax
jl 0x14000bf24
cmp dword [rsp + 0x80], ebx
mov r12d, ebx
jle 0x14000c06c
lea rsi, [r13 + 8]
mov r13, qword [rsp + 0x78]
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000c048
lea eax, [r12 + 1]
cmp eax, dword [rsp + 0x80]
jge 0x14000c048
cmp qword [rsi + 8], 0
je 0x14000c048
lea rdx, [0x140002c70]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000bfea
mov rcx, qword [rsi + 8]
lea rdx, [0x140002c80]
mov r15d, ebx
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000c048
test r14, r14
je 0x14000c048
mov dword [r14], 0x80004005
jmp 0x14000c048
mov rcx, qword [rsi]
lea rdx, [0x140002c90]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000c02a
mov rdx, qword [rsi + 8]
test rdx, rdx
jne 0x14000c00b
xor ecx, ecx
jmp 0x14000c01d
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
mov r8d, ecx
mov rcx, r13
call fcn.14000d0f0
jmp 0x14000c048
mov rcx, qword [rsi]
lea rdx, [0x140002ca0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14000c048
mov rcx, qword [rsi + 8]
call qword [sym.imp.msvcrt.dll__wtoi]
add r12d, ebx
add rsi, 8
cmp r12d, dword [rsp + 0x80]
jl 0x14000bf8a
mov r13, qword [rsp + 0x20]
test r15d, r15d
je 0x14000c06c
mov ebx, 2
test rbp, rbp
je 0x14000c085
cmp dword [rbp], 0
jne 0x14000c085
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, ax
mov dword [rbp], ecx
mov rcx, r13
jmp 0x14000c08d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000ce0c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rdi, qword [0x1400493c0]
mov rsi, rcx
mov ebx, 1
jmp 0x14000cea8
test ebx, ebx
js 0x14000ceb7
mov rbp, qword [rdi]
test rbp, rbp
je 0x14000cea4
mov rax, qword [rbp + 0x10]
and qword [rsp + 0x90], 0
test rax, rax
jne 0x14000ce4f
xor ebx, ebx
jmp 0x14000cea4
mov rcx, qword [rbp + 0x18]
lea r8, [rsp + 0x90]
lea rdx, [0x1400030a8]
call rax
mov ebx, eax
test eax, eax
js 0x14000ce91
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rbp]
mov r9d, 1
lea rax, [rbp + 0x28]
lea r8d, [r9 + 3]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov ebx, eax
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14000cea4
mov rax, qword [rcx]
call qword [rax + 0x10]
add rdi, 8
cmp rdi, qword [0x1400493c8]
jb 0x14000ce29
test ebx, ebx
jne 0x14000cf14
cmp byte [rsi + 0x60], 0
je 0x14000cf18
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x50], rax
test rax, rax
je 0x14000cf0d
lea rax, [rsp + 0x80]
lea r8, [0x14000d364]
mov r9, rsi
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000cf18
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x80004005
jmp 0x14000cf18
mov byte [rsi + 0x60], 0
test ebx, ebx
jne 0x14000cf62
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x14000cf64
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x14000cf33
test ebx, ebx
js 0x14000cfa6
mov rdi, qword [0x1400493c0]
xor ebx, ebx
jmp 0x14000cf8e
test ebx, ebx
jne 0x14000cf97
mov rax, qword [rdi]
test rax, rax
je 0x14000cf8a
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x14000cf8a
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
mov ebx, eax
add rdi, 8
cmp rdi, qword [0x1400493c8]
jb 0x14000cf6f
cmp byte [rsi + 0x60], 0
je 0x14000cfa6
mov ecx, dword [rsi + 0x5c]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f100
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140048148]
xor rax, rsp
mov qword [rsp + 0x270], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
mov rdi, rcx
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x14000f204
test rcx, rcx
je 0x14000f17a
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x14000f1a0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000f100
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x14000f204
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor edx, edx
mov dword [rsp + 0x40], 0x100
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x14000f188
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000f1f2
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.14000f27c
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x14000f20f
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140037b50
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000ffe8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x140048148]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x14001005c
call fcn.14000e5fc
mov ebx, eax
jmp 0x14001019d
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x14001007f
call fcn.14000e5fc
mov ebx, eax
jmp 0x140010193
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x1400100a4
call fcn.14000e5fc
mov ebx, eax
jmp 0x140010193
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x1400100dd
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400100d3
lea rcx, [rsp + 0x70]
call fcn.14000e598
nop
mov eax, 0x8007000e
jmp 0x1400101b6
mov ecx, eax
cmp rcx, rbx
je 0x14001011b
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x140010111
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14001011b
lea rcx, [rsp + 0x70]
call fcn.14000e5c8
mov rax, qword [rsp + 0x70]
jmp 0x140010125
mov ecx, 0x80070057
call fcn.14000f038
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14001013c
cmp rax, rbx
jne 0x140010148
mov ebx, 0x8007000e
jmp 0x140010193
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x14001016f
call fcn.14000e5fc
mov ebx, eax
jmp 0x140010193
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000fe28
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x1400101b4
lea rcx, [rsp + 0x70]
call fcn.14000e598
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140037b50
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x14001133c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov edx, 0x82
mov r13, rcx
mov rcx, qword [rcx]
lea r8d, [rdx - 0x78]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r15d, r15d
mov ebp, 0x400
mov rdi, rax
cmp rax, r15
je 0x140011407
mov rcx, qword [r13]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [r13]
mov ebx, ebp
shr eax, 2
mov rdx, rdi
cmp eax, ebp
cmovl ebx, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
cmp rax, r15
je 0x140011407
cmp ebx, r15d
je 0x140011407
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r15
je 0x1400113fe
xor esi, esi
movsxd r12, ebx
test ebx, ebx
jle 0x1400113fe
xor ebp, ebp
cmp word [rdi + rsi*4], bp
je 0x1400113f6
movzx ebx, word [rdi + rsi*4 + 2]
movsxd rax, r15d
lea rcx, [r13 + 0x20]
lea rdx, [rdi + rax*4]
call fcn.140011be0
inc rsi
inc r15d
cmp rsi, r12
mov dword [rax], ebx
jl 0x1400113ce
mov ebp, 0x400
xor r15d, r15d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, qword [r13]
mov edx, 0x83
lea r8d, [rdx - 0x79]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
cmp rax, r15
je 0x1400114a6
mov rcx, qword [r13]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [r13]
mov rdx, rbx
shr eax, 2
cmp eax, ebp
cmovl ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
cmp rax, r15
je 0x1400114a6
cmp ebp, r15d
je 0x1400114a6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r15
je 0x14001149d
movsxd rbp, ebp
mov r14d, r15d
mov rsi, r15
cmp rbp, r15
jle 0x14001149d
cmp word [rdi + rsi*4], r15w
je 0x14001149d
movzx ebx, word [rdi + rsi*4 + 2]
movsxd rax, r14d
lea rcx, [r13 + 0x40]
lea rdx, [rdi + rax*4]
call fcn.140011be0
inc rsi
inc r14d
cmp rsi, rbp
mov dword [rax], ebx
jl 0x140011474
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140021f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140021fa4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140021f90
ret
Function at 0x140028b40
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140028c0c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140028c0c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140028c25
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140028bfc
cmp byte [rax], 0x5c
jne 0x140028bf6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140028bf6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140028be2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140028bf3
test r8b, 0x10
jne 0x140028bf6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140028bf6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140024560
test edi, edi
jne 0x140028b60
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140024550
int3
Function at 0x14003ccc0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14003ce9f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14003bfa0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14003ce64
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14003cddc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14003ce53
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14003ce19
mov r10, qword [rdx]
cmp r10, rax
je 0x14003ce13
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14003ce53
cmp r9, rdx
je 0x14003ce2f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14003ce79
cmp r9, rdx
jne 0x14003ce20
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14003cd60
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14003ce53
lea rcx, str.invalid_hash_bucket_count
call fcn.14009fe30
int3
Function at 0x140046ba0
Capabilities:
Hash data using fnv

Disassembly:
test r8, r8
jne 0x140046ba9
mov rax, rcx
ret
movsx rax, byte [rdx]
movabs r9, 0x100000001b3
imul rcx, r9
dec r8
xor rcx, rax
inc rdx
jmp fcn.140046ba0

Function at 0x14004d520
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14004d551
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14004d5cb
mov rdi, r14
mov rcx, rbx
call fcn.14001f3e0
test rax, rax
jle 0x14004d5a3
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400cad10
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14004d5bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14004d5c3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14004d565
sub r14, rdi
jmp 0x14004d6af
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14004d5e2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004d5e4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14004d616
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400cad10
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14004d6ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004d651
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14004d68d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400b5530
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14004d6ac
cmp rbp, rax
ja 0x14004d660
test rbp, rbp
je 0x14004d6ac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400b5530
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret