joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47eac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ed06
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x47eb3f
cmp rbx, 1
je 0x47eb06
cmp rbx, 8
jle 0x47eb4c
movups xmmword [rsp + 0x1c], xmm15
movups xmmword [rsp + 0x2c], xmm15
xor edx, edx
jmp 0x47eca1
movzx edx, byte [rax]
cmp edx, 0x80
mov esi, 0xfffd
cmovge edx, esi
mov rax, rcx
mov rbx, rdi
mov ecx, edx
nop
call fcn.0047e780
test rax, rax
jl 0x47eb32
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
nop dword [rax]
cmp rdi, 1
jne 0x47eb85
movzx esi, byte [rcx]
cmp esi, 0x80
mov edi, 0xfffd
cmovge esi, edi
mov dword [rsp + 0x5c], esi
mov rcx, rbx
nop
jmp 0x47ec40
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], rcx
mov rdx, rbx
jmp 0x47ebc0
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rbx, rcx
mov rcx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
jle 0x47ec0e
cmp rdx, rbx
jb 0x47ec1b
mov qword [rsp + 0x68], rbx
call fcn.0047bfa0
mov qword [rsp + 0x60], rbx
mov ecx, eax
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
call fcn.0047e780
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub rcx, rdx
nop dword [rax]
test rax, rax
jl 0x47eb9a
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rcx, rbx
nop
call fcn.00471380
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov esi, edx
mov rbx, rcx
mov rcx, rdi
nop dword [rax]
test rbx, rbx
jle 0x47ec6d
cmp rcx, rbx
jb 0x47ec7a
mov qword [rsp + 0x70], rbx
call fcn.0047bfa0
mov rcx, qword [rsp + 0x70]
sub rcx, rbx
mov edx, dword [rsp + 0x5c]
cmp eax, edx
jne 0x47ec25
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.00471380
mov r8d, esi
shr sil, 5
movzx esi, sil
mov r9d, dword [rsp + rsi*4 + 0x1c]
bts r9d, r8d
mov dword [rsp + rsi*4 + 0x1c], r9d
inc rdx
cmp rdi, rdx
jle 0x47ecb3
movzx esi, byte [rcx + rdx]
cmp sil, 0x80
jb 0x47ec85
cmp rdi, rdx
movups xmm0, xmmword [rsp + 0x1c]
movups xmmword [rsp + 0x3c], xmm0
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsp + 0x4c], xmm0
jg 0x47eb4c
lea rcx, [rbx - 1]
jmp 0x47ecd6
dec rcx
test rcx, rcx
jl 0x47ecf9
movzx edx, byte [rax + rcx]
mov ebx, edx
shr dl, 5
movzx edx, dl
mov edx, dword [rsp + rdx*4 + 0x3c]
bt edx, ebx
jae 0x47ecd3
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046f060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0047eac0
Function at 0x48eae0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48f21f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x48eb0d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x48ed91
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x48edbd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005f3200]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x00560ae0]
lea rbx, [0x005ef590]
call fcn.00469240
inc rax
cmp rax, r8
jge 0x48ede2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x48ee17
lea rdi, [0x00560b60]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x48eb03
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x48edfb
jmp 0x48edd0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046f060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.0048eae0

Function at 0x48f3c0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x48f3d7
inc rax
cmp rax, 4
jge 0x48f3ef
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x48f3d4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x48f400
inc rax
cmp rax, 4
jge 0x48f40e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x48f437
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x48f41b
jmp 0x48f3fd
Function at 0x494dc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494e8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403800
xorps xmm15, xmm15
mov r14, qword [0x011d4410]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x494e6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00560be0]
xor ebx, ebx
mov rcx, rdx
call fcn.0046a880
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00496820
inc rbx
cmp rcx, rbx
jae 0x494e5e
mov edi, 1
lea rsi, [0x00560be0]
call fcn.0046a960
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005efac0]
lea rsi, [0x005eeaa0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046f060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00494dc0

Function at 0x4a70a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a714c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.00403800
xorps xmm15, xmm15
mov r14, qword [0x011d4410]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x4a7113
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.00450900
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x4a7126
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x4a7139
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x4a7123
mov byte [rax + rcx], dl
jmp 0x4a7123
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0046b2c0
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0046f060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.004a70a0

Function at 0x4d01b0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4d022a
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4d01e0
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4d0200
cmp rdx, 0
je 0x4d024c
test rdx, 0xf
je 0x4d01cd
test rdx, 7
jne 0x4d0200
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4d01cd
ret
Function at 0x4dafe0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db110
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
call fcn.004dad00
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x4db074
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x4db0b7
mov rdx, qword [rsp + rax*8 + 0x40]
imul rsi, rax, 0x33
mov rdi, rsi
sar rsi, 0x3f
shr rsi, 0x3d
add rsi, rdi
mov r8, rsi
and rsi, 0xfffffffffffffff8
sub rdi, rsi
mov rbx, rcx
mov rcx, rdi
shl rdx, cl
cmp rcx, 0x40
sbb rsi, rsi
and rdx, rsi
mov qword [rsp + 0x10], rdx
xor ecx, ecx
jmp 0x4db0e3
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x68
pop rbp
ret
test byte [rbx], al
movzx edi, byte [rbx + rsi]
movzx r9d, byte [rsp + rcx + 0x10]
or edi, r9d
mov byte [rbx + rsi], dil
inc rcx
mov r8, rdx
cmp rcx, 8
jge 0x4db06e
mov rdx, r8
sar r8, 3
lea rsi, [r8 + rcx]
cmp rsi, 0x20
jge 0x4db06e
nop
jb 0x4db0ca
mov rax, rsi
mov ecx, 0x20
call fcn.00471340
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046f060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004dafe0
Function at 0x4e1080
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e11c6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4e11b6
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004eb140
xorps xmm15, xmm15
mov r14, qword [0x011d4410]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4e119b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4e11b1
cmp rsi, rcx
ja 0x4e11a9
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4e11a1
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.004eb280
xorps xmm15, xmm15
mov r14, qword [0x011d4410]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.00471400
mov rax, rsi
call fcn.00471400
call fcn.004713c0
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.004713c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046f060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004e1080
Function at 0x4e1220
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e1366
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x4e1356
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004eb1e0
xorps xmm15, xmm15
mov r14, qword [0x011d4410]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4e133b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x4e1351
cmp rsi, rcx
ja 0x4e1349
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x4e1341
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.004eb320
xorps xmm15, xmm15
mov r14, qword [0x011d4410]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.00471400
mov rax, rsi
call fcn.00471400
call fcn.004713c0
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.004713c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046f060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004e1220
Function at 0x4eba60
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4ebae5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4ebc46
cmp rcx, 0xe
jne 0x4ebb60
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4ebc46
cmp rcx, 0xf
jne 0x4ebbd7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4ebc46
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x500000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50013e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x28], 0
mov rax, qword [0x01179740]
call fcn.0048f660
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rbx
lea rcx, [0x00500160]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403800
xorps xmm15, xmm15
mov r14, qword [0x011d4410]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x500102
mov rdx, qword [rsp + 0x20]
cmp rdx, rcx
jb 0x500138
mov qword [rsp + 0x30], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x30]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
cmp rbx, rcx
jb 0x50012d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.00471400
call fcn.00471380
nop
nop
call fcn.0046f060
jmp fcn.00500000
Function at 0x51f7e0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x51f7f8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x51f7f8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x51f800
xor eax, eax
ret
cmp rbx, 3
je 0x51f80c
cmp rbx, 4
jne 0x51f839
cmp al, 0x2c
ja 0x51f826
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x51f836
cmp al, 0x24
je 0x51f836
nop dword [rax]
cmp al, 0x26
jae 0x51f836
jmp 0x51f839
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x51f836
cmp al, 0x5b
je 0x51f836
cmp al, 0x5d
jne 0x51f839
xor eax, eax
ret
cmp al, 0x2f
ja 0x51f872
nop dword [rax]
cmp al, 0x26
ja 0x51f851
cmp al, 0x24
je 0x51f891
cmp al, 0x26
je 0x51f891
jmp 0x51f90b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x51f891
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x51f908
cmp al, 0x2f
je 0x51f891
jmp 0x51f90b
cmp al, 0x3d
ja 0x51f889
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x51f891
nop
cmp al, 0x3d
je 0x51f891
jmp 0x51f90b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x51f900
cmp rbx, 2
jg 0x51f8c7
cmp rbx, 1
je 0x51f8c1
nop dword [rax]
cmp rbx, 2
jne 0x51f90b
cmp al, 0x2f
je 0x51f8b2
cmp al, 0x3b
je 0x51f8b2
cmp al, 0x2c
jne 0x51f8b9
mov ecx, 1
jmp 0x51f8be
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x51f8ea
cmp al, 0x40
je 0x51f8d9
cmp al, 0x2f
je 0x51f8d9
cmp al, 0x3f
jne 0x51f8e2
mov ecx, 1
nop
jmp 0x51f8e7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x51f8f9
cmp rbx, 7
jne 0x51f90b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x51f908
cmp al, 0x7e
jne 0x51f90b
xor eax, eax
ret
cmp rbx, 7
jne 0x51f921
cmp al, 0x21
je 0x51f91d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x51f921
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140003990
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400039ed
lea rbx, [0x1401259a0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400039d4
cmp r10, 2
jb 0x1400039d4
cmp byte [r9], r8b
jne 0x1400039d4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400039b0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003a2f
lea rbx, [0x1401259a0]
cmp r8b, 0x23
jne 0x140003a13
cmp byte [r9], r8b
jne 0x140003a13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003a00
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003b70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140003b8a
mov qword [r8], 0
lea rdx, [0x140125518]
call fcn.140003a40
mov rbx, rax
test rax, rax
jne 0x140003baa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003c83
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003c83
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003c83
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003c83
cmp rdi, 0xffffffffffffffff
je 0x140003c83
mov rax, qword [0x140246648]
test rax, rax
je 0x140003c20
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003c83
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003c70
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140246648]
test rax, rax
je 0x140003c65
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003c8c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140003c7e
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003c8e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret