joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400533f4
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x140053443
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x14005341a
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x1400549e0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140054a2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140054a2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140054a2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140054a2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140054a2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140054a2c
xor al, al
add rsp, 0x28
ret
Function at 0x18064d108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.18064d28f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x18064d139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18064d11f
add dl, dl
jne 0x18064d146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18064d1a6
xor eax, eax
add dl, dl
jne 0x18064d155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18064d25d
add dl, dl
jne 0x18064d166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18064d173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18064d180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18064d18d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x18064d19a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18064d12e
mov eax, 1
add dl, dl
jne 0x18064d1b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18064d1c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18064d1ab
sub eax, ebx
mov ebx, 1
jne 0x18064d1fc
mov ecx, 1
add dl, dl
jne 0x18064d1de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18064d1eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18064d1d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064d12e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x18064d218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18064d225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18064d20d
cmp eax, 0x7d00
jae 0x18064d24b
cmp eax, 0x500
jb 0x18064d246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064d12e
cmp eax, 0x7f
ja 0x18064d24e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18064d12e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x18064d282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18064d12e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140745058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407451df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140745089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14074506f
add dl, dl
jne 0x140745096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407450f6
xor eax, eax
add dl, dl
jne 0x1407450a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407451ad
add dl, dl
jne 0x1407450b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407450c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407450d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407450dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407450ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14074507e
mov eax, 1
add dl, dl
jne 0x140745106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140745113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407450fb
sub eax, ebx
mov ebx, 1
jne 0x14074514c
mov ecx, 1
add dl, dl
jne 0x14074512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14074513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140745123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140745168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140745175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14074515d
cmp eax, 0x7d00
jae 0x14074519b
cmp eax, 0x500
jb 0x140745196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074507e
cmp eax, 0x7f
ja 0x14074519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14074507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407451d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14074507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400afdb0]
mov dword [rax], 1
mov rax, qword [0x1400afdc0]
mov dword [rax], 1
mov rax, qword [0x1400afdd0]
mov dword [rax], 1
mov rax, qword [0x1400afd60]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400266e0
Capabilities:
Query environment variable

Disassembly:
push r15
mov eax, 0x10088
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14008c6d0
sub rsp, rax
xor edx, edx
mov rbp, rcx
xor ecx, ecx
mov word [rsp + 0x80], dx
lea r15, [rsp + 0x30]
movzx eax, byte [rbp]
mov word [rsp + 0x30], cx
test al, al
je 0x1400267a5
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14009d50c
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x140026786
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140026778
test rsi, rsi
je 0x14009d50c
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x140026738
lea rbx, [rsp + 0x80]
mov r8d, 0x10000
mov rcx, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [rax - 1]
xor eax, eax
cmp edx, 0xffff
ja 0x1400267d4
mov rcx, rbx
call sub.msvcrt.dll__wcsdup
add rsp, 0x10088
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
Function at 0x1400267f0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx eax, byte [rcx]
mov qword [rsp + 0xd8], rdx
xor edx, edx
mov rbp, rcx
lea r15, [rsp + 0x30]
mov word [rsp + 0x30], dx
test al, al
je 0x1400268ad
xor edi, edi
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x2a]
mov r12d, 0x28
lea r13, [rsp + 0x2c]
nop dword [rax]
mov rsi, r12
mov r8d, 2
mov rdx, r14
mov rcx, r13
sub rsi, rdi
mov byte [rsp + 0x2a], al
lea rbx, [r15 + rdi*2]
mov byte [rsp + 0x2b], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x14009d512
cmp word [r15 + rdi*2], 0
movzx eax, word [rsp + 0x2c]
je 0x14002688e
nop dword [rax + rax]
add rbx, 2
sub rsi, 1
cmp word [rbx], 0
jne 0x140026880
test rsi, rsi
je 0x14009d512
mov word [rbx], ax
add rdi, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rbp + rdi]
test al, al
jne 0x140026840
mov rdx, qword [rsp + 0xd8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140088f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [0x1400c1871], 0
mov rbp, rcx
mov rdi, rdx
mov r12, r8
je 0x140088fd8
lea rdx, [0x1400abf5a]
mov rcx, r12
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140089040
mov rbx, qword [0x1400c1718]
jmp 0x140088f7d
lea rbx, [rdx + rax + 4]
mov rdx, rbx
mov rcx, r12
call sub.msvcrt.dll_strcmp
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_strlen
lea rdx, [rbx + rax + 1]
mov eax, dword [rdx]
test esi, esi
jne 0x140088f78
movzx eax, word [rdx + 4]
lea r8, [rdx + 6]
test ax, ax
je 0x140088fc7
lea rbx, [rdi + rax*8]
nop
mov rdx, rdi
mov rcx, rbp
add rdi, 8
call fcn.140077e70
mov r8, rax
cmp rdi, rbx
jne 0x140088fb0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8d, 0xa
xor ecx, ecx
mov edx, 3
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
lea rdx, [rax + 4]
mov qword [0x1400c1718], rax
mov ebx, dword [rax]
mov qword [0x1400c1718], rdx
mov r8d, dword [rax + 4]
lea rdx, [rax + 8]
mov qword [0x1400c1718], rdx
call fcn.140088060
cmp eax, ebx
jne 0x1400890da
mov byte [0x1400c1871], 1
jmp 0x140088f52
cmp byte [0x1400c1870], 0
jne 0x140088f69
mov rbx, qword [sym.imp.python37.dll_PyDict_New]
lea rsi, [0x1400c0f08]
call rbx
mov qword [0x1400c23c8], rax
call rbx
mov qword [0x1400c23c0], rax
call rbx
mov qword [0x1400c23b8], rax
call rbx
mov qword [0x1400c23b0], rax
call rbx
mov qword [0x1400c23a8], rax
call rbx
mov qword [0x1400c23a0], rax
call rbx
mov qword [0x1400c2398], rax
call rbx
mov r13, qword [sym.imp.python37.dll_PyLong_FromLong]
mov rbx, 0xfffffffffffffffb
mov qword [0x1400c2390], rax
nop dword [rax]
mov ecx, ebx
call r13
mov qword [rsi + rbx*8], rax
add rbx, 1
cmp rbx, 0x101
jne 0x1400890b8
mov byte [0x1400c1870], 1
jmp 0x140088f69
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x14008b3b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14009ca90
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14009ca90
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
Function at 0x14008c082
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400c2828]
test eax, eax
je 0x14008c11a
lea rax, [0x1400c2800]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400c2830]
mov qword [rbp - 8], rax
jmp 0x14008c0fe
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14008c0f2
cmp qword [rbp - 0x10], 0
je 0x14008c0f2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14008c0b8
lea rax, [0x1400c2800]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14008c11b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14008c220
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14008c248
mov eax, 0
jmp 0x14008c296
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14008c271
mov eax, 0
jmp 0x14008c296
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14008c291
mov eax, 0
jmp 0x14008c296
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14008c29c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14008c31a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14008c311
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14008c311
mov rax, qword [rbp - 8]
jmp 0x14008c32f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14008c2e4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1800017c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov rbx, rcx
call fcn.180001790
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1800019d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
cmp eax, 0x270
jne 0x1800019e9
call fcn.180001c70
jmp 0x1800019f5
cmp eax, 0x4e0
jb 0x1800019f5
call fcn.180001b80
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
jmp 0x1800019d0
mov rcx, qword [rcx]
jmp 0x180001a40

Function at 0x180001b40
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
cmp eax, 0x270
jne 0x1800019e9
call fcn.180001c70
jmp 0x1800019f5
cmp eax, 0x4e0
jb 0x1800019f5
call fcn.180001b80
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
jmp 0x1800019d0
mov rcx, qword [rcx]
jmp 0x180001a40

Function at 0x180001b80
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
nop word [rax + rax]
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180001ba0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180001bf0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
mov dword [r9], ebx
mov rbx, qword [rsp + 8]
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x180001c70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea rax, [rcx + 8]
mov r9d, 0x270
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x180001c80
ret

Function at 0x180001cd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11, rcx
test r9, r9
je 0x180001db5
cmp r9, 0x40
jb 0x180001d93
movsx eax, byte [rcx]
lea rcx, [rdx - 1]
add rcx, r9
movd xmm2, eax
lea rax, [r8 - 1]
punpcklbw xmm2, xmm2
add rax, r9
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
cmp rdx, rax
ja 0x180001d1d
cmp rcx, r8
jae 0x180001d93
cmp rdx, r11
ja 0x180001d27
cmp rcx, r11
jae 0x180001d93
mov rcx, r9
mov qword [rsp + 0x10], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rbx, r8
lea rax, [rdx + 0x10]
sub rbx, rdx
movdqu xmm0, xmmword [rbx + rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rbx + rax]
lea rax, [rax + 0x40]
xorps xmm0, xmm2
xorps xmm1, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rbx + rax - 0x30]
movdqu xmmword [rax - 0x40], xmm1
xorps xmm0, xmm2
movdqu xmm1, xmmword [rbx + rax - 0x20]
movdqu xmmword [rax - 0x30], xmm0
xorps xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp r10, rcx
jb 0x180001d41
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r10, r9
jae 0x180001db5
sub r8, rdx
lea rax, [r10 + rdx]
sub r9, r10
nop dword [rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor cl, byte [r11]
mov byte [rax - 1], cl
sub r9, 1
jne 0x180001da0
add rsp, 8
ret

Function at 0x180002200
Capabilities:
Encode data using xor

Disassembly:
mov dword [rcx + 4], edx
lea r10, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r9d, edx
lea r10, [r10 + 4]
shr r9d, 0x1e
xor edx, r9d
imul edx, r8d
add edx, eax
inc rax
mov dword [r10 - 4], edx
cmp rax, 0x270
jb 0x180002210
mov dword [rcx], 0x270
ret

Function at 0x180009380
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret
Function at 0x18000d150
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x18000d308
cmp ecx, 0x7c
je 0x18000d308
cmp ecx, 0x29
jne 0x18000d198
cmp dword [rbx + 0x1c], 0
jne 0x18000d308
test dword [rbx + 0x80], 0x10000000
je 0x18000d321
jmp 0x18000d2d8
cmp ecx, 0x2e
jne 0x18000d1ab
lea rcx, [rbx + 0x40]
call fcn.18000c9f0
jmp 0x18000d2e5
cmp ecx, 0x5c
jne 0x18000d20f
mov rcx, rbx
call fcn.180010860
test byte [rbx + 0x80], 0x80
je 0x18000d202
movzx eax, byte [rbx + 0x78]
cmp al, 0x62
jne 0x18000d1df
lea rcx, [rbx + 0x40]
call fcn.18000d070
mov rcx, rbx
call fcn.180010860
jmp 0x18000d2f5
cmp al, 0x42
jne 0x18000d202
lea rcx, [rbx + 0x40]
call fcn.18000d070
lea rcx, [rbx + 0x40]
call fcn.1800107e0
mov rcx, rbx
call fcn.180010860
jmp 0x18000d2f5
mov rcx, rbx
call fcn.18000d3a0
jmp 0x18000d2ed
cmp ecx, 0x5b
jne 0x18000d23c
mov rcx, rbx
call fcn.180010860
mov rcx, rbx
call fcn.18000dfb0
mov edx, 0x5d
mov r8d, 4
mov rcx, rbx
call fcn.18000f630
jmp 0x18000d2ed
cmp ecx, 0x28
jne 0x18000d272
mov rcx, rbx
call fcn.180010860
mov rcx, rbx
call fcn.1800114c0
mov edx, 0x29
mov r8d, 5
mov rcx, rbx
movzx edi, al
call fcn.18000f630
test dil, dil
je 0x18000d2f5
jmp 0x18000d2ed
cmp ecx, 0x5e
jne 0x18000d28a
lea rcx, [rbx + 0x40]
call fcn.18000c780
mov rcx, rbx
call fcn.180010860
jmp 0x18000d2f5
cmp ecx, 0x24
jne 0x18000d2a2
lea rcx, [rbx + 0x40]
call fcn.18000caa0
mov rcx, rbx
call fcn.180010860
jmp 0x18000d2f5
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x18000d313
cmp ecx, 0x3f
je 0x18000d313
cmp ecx, 0x7b
je 0x18000d313
cmp ecx, 0x7d
jne 0x18000d2c7
test dword [rbx + 0x80], 0x10000000
je 0x18000d32f
jmp 0x18000d2d8
cmp ecx, 0x5d
jne 0x18000d2d8
test dword [rbx + 0x80], 0x10000000
je 0x18000d33d
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.18000c790
mov rcx, rbx
call fcn.180010860
mov rcx, rbx
call fcn.180010910
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
je 0x18000d308
cmp ecx, 0x7c
jne 0x18000d174
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.18000f5e0
int3
mov edx, 5
mov rcx, rbx
call fcn.18000f5e0
int3
mov edx, 6
mov rcx, rbx
call fcn.18000f5e0
int3
mov edx, 4
mov rcx, rbx
call fcn.18000f5e0
int3