joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f15b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10, r8
mov r9, rdx
test rdx, rdx
jne 0x1400f15c6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x140164440]
not ecx
cmp r10, 8
jb 0x1400f16b4
mov r11, r10
shr r11, 3
imul rax, r11, 0xfffffffffffffff8
add r10, rax
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x1400f15f0
test r10, r10
je 0x1400f16e0
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
sub r10, 1
jne 0x1400f16c0
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x1400f4bf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbp, rdx
mov rcx, qword [rcx + 0xb8]
test rcx, rcx
je 0x1400f4c69
mov eax, dword [rdi + 0xc4]
mov esi, dword [rdi + 0xc0]
cmp eax, esi
jae 0x1400f4cb9
sub esi, eax
lea rdx, [rcx + rax]
cmp esi, r8d
mov rcx, rbp
cmova esi, r8d
mov r8d, esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rdi + 0xa0]
mov rdx, rbp
add dword [rdi + 0xc4], esi
add dword [rdi + 0x9c], esi
mov r8d, esi
call fcn.1400f15b0
mov dword [rdi + 0xa0], eax
mov eax, esi
jmp 0x1400f4cbb
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x1400f4cb2
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f4cb9
mov ebx, dword [rsp + 0x40]
mov rdx, rbp
add dword [rdi + 0x9c], ebx
mov r8d, ebx
mov ecx, dword [rdi + 0xa0]
call fcn.1400f15b0
mov dword [rdi + 0xa0], eax
mov eax, ebx
jmp 0x1400f4cbb
mov dword [rdi + 0x24], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400f5570
Capabilities:
Write file on windows

Disassembly:
test r8d, r8d
jne 0x1400f5578
xor eax, eax
ret
jmp fcn.1400f55e0

Function at 0x1400f5580
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx]
mov r10, rcx
movsx rax, dl
mov r8d, r9d
xor r8, rax
shr r9d, 8
movzx eax, r8b
lea r8, [0x140164440]
mov edx, dword [r8 + rax*4]
xor edx, r9d
movzx eax, dl
add eax, dword [rcx + 4]
mov dword [rcx], edx
imul edx, eax, 0x8088405
inc edx
mov dword [rcx + 4], edx
mov ecx, dword [rcx + 8]
movzx eax, cl
shr rdx, 0x18
xor rdx, rax
shr ecx, 8
mov eax, dword [r8 + rdx*4]
xor eax, ecx
mov dword [r10 + 8], eax
ret
Function at 0x1400f55e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
je 0x1400f5681
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x58], rbp
mov rax, rcx
test rcx, rcx
je 0x1400f5620
cmp dword [rbx + 0x58], edi
jae 0x1400f5620
call sub.mfc140u.dll_operator_1
xor eax, eax
mov qword [rbx + 0x50], 0
test rax, rax
jne 0x1400f5634
lea ecx, [rdi + rdi]
call sub.mfc140u.dll_operator
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbp, rdi
call sub.VCRUNTIME140.dll_memcpy
test edi, edi
je 0x1400f5678
mov qword [rsp + 0x60], r14
xor esi, esi
mov rax, qword [rbx + 0x50]
lea rcx, [rbx + 0x44]
movzx edx, byte [rsi + rax]
call fcn.1400f5710
mov rcx, qword [rbx + 0x50]
lea rsi, [rsi + 1]
mov byte [rsi + rcx - 1], al
sub rbp, 1
jne 0x1400f5650
mov r14, qword [rsp + 0x60]
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1400f56c1
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x1400f56a6
mov dword [rbx + 0x24], 0x30000
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x38], edi
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400f56f0
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov dword [rbx + 0x24], 0x1000000
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400011d0
Capabilities:
Enumerate processes

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CreateToolhelp32Snapshot
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea ecx, [rdx + 2]
call rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov r13, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov qword [rsp + 0x2c0], rbx
xor r14d, r14d
mov qword [rsp + 0x2c8], rbp
mov r12d, r14d
mov r15d, 1
mov qword [rsp + 0x2d0], rsi
xorps xmm0, xmm0
lea rax, [rsp + 0x6c]
movups xmmword [rsp + 0x20], xmm0
mov r8d, 0xa
movabs rdx, 0x7fffffffffffffff
movabs rcx, 0x7ffffffffffffffe
inc r15d
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x140001285
cmp rdi, rcx
ja 0x140001460
cmp rdi, 7
ja 0x1400012dc
lea rbx, [rdi + rdi]
mov qword [rsp + 0x30], rdi
mov r8, rbx
mov qword [rsp + 0x38], 7
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x20], r14w
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x20]
jmp 0x140001378
mov rbp, rdi
or rbp, 7
cmp rbp, rcx
jbe 0x1400012f1
mov rbp, rcx
lea rcx, [rdx + rdx]
jmp 0x140001312
cmp rbp, 0xa
cmovb rbp, r8
lea rcx, [rbp + 1]
cmp rcx, rdx
ja 0x14000145a
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000133e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000145a
mov rcx, rax
call fcn.140001740
test rax, rax
je 0x140001443
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001350
test rcx, rcx
je 0x14000134d
call fcn.140001740
mov rsi, rax
jmp 0x140001350
mov rsi, r14
lea rbx, [rdi + rdi]
mov qword [rsp + 0x20], rsi
mov r8, rbx
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x38], rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rsi], r14w
cmp rbp, 7
lea r8, [rsp + 0x20]
cmova r8, rsi
cmp rdi, 0xa
jne 0x1400013b8
lea rbx, str.WeChat.exe
mov rdx, rdi
mov rax, rbx
sub r8, rbx
nop dword [rax + rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x1400013b8
add rax, 2
sub rdx, 1
jne 0x1400013a0
lea r12d, [rdx + 1]
cmp rbp, 7
jbe 0x1400013ef
lea rdx, [rbp*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400013e7
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001443
mov rcx, rsi
call fcn.14000177c
lea rdx, [rsp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001254
test r12d, r12d
jne 0x14000144a
mov rsi, qword [rsp + 0x2d0]
mov rbp, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140001720
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp r15d, 0xc8
setg r14b
mov eax, r14d
jmp 0x14000140a
call fcn.140001110
int3
call fcn.1400011b0
int3
Function at 0x140001340
Capabilities:
Link function at runtime on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400150a8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov qword [r11 - 0x40], rdx
test rcx, rcx
jne 0x140001419
mov rcx, qword [rdx + 0x18]
cmp rcx, 0x10
jb 0x140001385
mov rdx, qword [rdx]
mov rax, qword [rbx + 0x10]
lea r8, [rdx + rax]
cmp rcx, 0x10
jb 0x140001398
mov rdx, qword [rbx]
jmp 0x14000139b
mov rdx, rbx
mov qword [rsp + 0x48], 7
xor edi, edi
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
lea rcx, [rsp + 0x30]
call fcn.140005200
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
cmp qword [rsp + 0x48], 8
jb 0x1400013e6
mov rcx, qword [rsp + 0x30]
call fcn.1400057cc
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp qword [rbx + 0x18], 0x10
jb 0x140001408
mov rcx, qword [rbx]
call fcn.1400057cc
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
mov byte [rbx], 0
jmp 0x14000144c
cmp qword [rdx + 0x18], 0x10
jb 0x140001423
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
cmp qword [rbx + 0x18], 0x10
jb 0x14000143b
mov rcx, qword [rbx]
call fcn.1400057cc
mov qword [rbx + 0x18], 0xf
xor edi, edi
mov qword [rbx + 0x10], rdi
mov byte [rbx], dil
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400055f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400150a8]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rdx
mov rsi, rcx
call fcn.140001050
mov dword [rbp - 0x20], 0x6e004e
mov dword [rbp - 0x1c], 0x4c007a
mov eax, 0x66
mov word [rbp - 0x18], ax
mov eax, 0x68
mov word [rbp - 0x16], ax
mov eax, 0x63
mov word [rbp - 0x14], ax
mov eax, 0x54
mov word [rbp - 0x12], ax
mov dword [rbp - 0x10], 0x7a0074
mov eax, 0x71
mov dword [rbp - 0xc], 0x710072
mov word [rbp - 8], ax
xor r12d, r12d
mov dword [rbp - 6], 0x67
mov dword [rbp - 0x30], 0x460072
mov eax, 0x4d
mov word [rbp - 0x2c], ax
mov eax, 0x65
mov word [rbp - 0x2a], ax
mov eax, 0x6d
mov word [rbp - 0x28], ax
mov dword [rbp - 0x26], 0x4e004f
mov word [rbp - 0x22], r12w
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400046c0
nop
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r12
mov word [rsp + 0x58], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.1400046c0
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.1400010e0
nop
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], r12
mov byte [rbp - 0x80], r12b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x80]
call fcn.140003fb0
mov edi, 0x1bb
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140001340
xor r9d, r9d
movzx r8d, di
lea rdx, str.jerry2024.oss_cn_beijing.aliyuncs.com
mov rcx, rsi
call rax
mov rdi, rax
cmp qword [rbp - 0x40], 0x10
jb 0x140001cd7
mov rcx, qword [rbp - 0x58]
call fcn.1400057cc
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400055f0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140006587
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400150a8]
jne 0x14000560a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005606
repz ret
ror rcx, 0x10
jmp 0x1400064e0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400164c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400165b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140006565
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400164c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140006587
mov rax, qword [rsp + 0x88]
mov qword [0x1400165b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140016558], rax
mov rax, qword [0x1400165b8]
mov qword [0x140016430], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140016540], rax
mov dword [0x140016420], 0xc0000409
mov dword [0x140016424], 1
mov rax, qword [0x1400150a8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400150b0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400164b8], eax
mov ecx, 1
call fcn.14000a474
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400103a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400164b8], 0
jne 0x14000660e
mov ecx, 1
call fcn.14000a474
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140009438
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400092a8
Function at 0x14000c574
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400150a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140006b24
xor ebx, ebx
cmp qword [0x140017478], rbx
mov rdi, rax
jne 0x14000c687
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000c75e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000c75e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140017478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140017480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140017488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140017498], rax
test rax, rax
je 0x14000c67e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140017490], rax
jmp 0x14000c68e
mov rax, qword [0x140017490]
jmp 0x14000c695
mov rax, qword [0x140017490]
mov r11, qword [0x140017498]
cmp rax, rdi
je 0x14000c6fc
cmp r11, rdi
je 0x14000c6fc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140017498]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000c6fc
test rax, rax
je 0x14000c6fc
call rsi
test rax, rax
je 0x14000c6f6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000c6f6
test byte [rsp + 0x40], 1
jne 0x14000c6fc
bts ebp, 0x15
jmp 0x14000c73c
mov rcx, qword [0x140017480]
cmp rcx, rdi
je 0x14000c73c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c73c
call rax
mov rbx, rax
test rax, rax
je 0x14000c73c
mov rcx, qword [0x140017488]
cmp rcx, rdi
je 0x14000c73c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c73c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140017478]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000c75e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000c760
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400055f0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400223e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140022414
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140022400
ret
Function at 0x140028fb0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002907c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x14002907c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140029095
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x14002906c
cmp byte [rax], 0x5c
jne 0x140029066
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140029066
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140029052
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140029063
test r8b, 0x10
jne 0x140029066
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140029066
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400249d0
test edi, edi
jne 0x140028fd0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400249c0
int3
Function at 0x14003d130
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14003d30f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14003c410
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14003d2d4
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14003d24c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14003d2c3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14003d289
mov r10, qword [rdx]
cmp r10, rax
je 0x14003d283
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14003d2c3
cmp r9, rdx
je 0x14003d29f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14003d2e9
cmp r9, rdx
jne 0x14003d290
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14003d1d0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14003d2c3
lea rcx, str.invalid_hash_bucket_count
call fcn.14009f870
int3
Function at 0x140047010
Capabilities:
Hash data using fnv

Disassembly:
test r8, r8
jne 0x140047019
mov rax, rcx
ret
movsx rax, byte [rdx]
movabs r9, 0x100000001b3
imul rcx, r9
dec r8
xor rcx, rax
inc rdx
jmp fcn.140047010

Function at 0x14004d990
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14004d9c1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14004da3b
mov rdi, r14
mov rcx, rbx
call fcn.14001f850
test rax, rax
jle 0x14004da13
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400ca750
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14004da2b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14004da33
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14004d9d5
sub r14, rdi
jmp 0x14004db1f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14004da52
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004da54
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14004da86
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400ca750
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14004db1c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004dac1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14004dafd
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400b4f70
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14004db1c
cmp rbp, rax
ja 0x14004dad0
test rbp, rbp
je 0x14004db1c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400b4f70
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret