joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d7c20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x20], 0
mov r8, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1401d7c62
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1401d7c93
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1401d7c80
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400249b0
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1401d7cb0
mov rdx, qword [rbp + 8]
cmp rdx, qword [rbp + 8]
je 0x1401d7cc7
add rdx, 0x30
mov rcx, rsi
call fcn.140027320
jmp 0x1401d7d9d
mov rdi, qword [0x140627790]
test rdi, rdi
je 0x1401d7d91
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
test al, al
je 0x1401d7d91
lea rax, [rbp + 0x40]
cmp qword [rax + 0x18], 0xf
jbe 0x1401d7cf6
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
cmp qword [rbx + 0x18], 0xf
jbe 0x1401d7d05
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, str.Cannot_find_Language_Code__s__Returning_default_culture__s_
lea rcx, [rsp + 0x48]
call fcn.14013ee30
nop
mov rax, qword [rdi]
lea r9, [rsp + 0x48]
lea r8, str.eax::services::localization::LocalizationSystem::getCultureFromISO639
mov edx, 2
mov rcx, rdi
call qword [rax + gethostname]
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1401d7d7a
inc rdx
mov rcx, qword [rsp + 0x48]
cmp rdx, 0x1000
jb 0x1401d7d75
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401d7dc5
mov rcx, r8
call fcn.140283db0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
lea rdx, [rbp + 0x40]
mov rcx, rsi
call fcn.140027320
mov dword [rsp + 0x20], 1
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140284180
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1401dffd0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r9, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
mov rax, qword [r10 + 0x18]
imul r8, rcx
and rdx, r8
lea rcx, [rdx + rdx]
mov rax, qword [rax + rcx*8 + 8]
cmp rax, qword [r10 + 8]
je 0x1401e005e
mov rcx, qword [r10 + 0x18]
add rdx, rdx
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r9]
cmp ecx, dword [rax + 0x10]
je 0x1401e0055
cmp rax, rdx
je 0x1401e005e
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1401e0047
add rax, 0x18
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x1401ea270
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
movss xmm2, dword [0x1404689ac]
mov r11d, 0x138
mov r8, rcx
xorps xmm1, xmm1
cmp dword [rcx], r11d
jne 0x1401ea2e5
lea r9, [rcx + 0x10]
movabs r10, 0xb5026f5aa96619e9
nop word [rax + rax]
mov eax, dword [r9]
mov rdx, qword [r9 - 8]
lea r9, [r9 + 8]
btr eax, 0x1f
and rdx, 0xffffffff80000000
or rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r9 + 0x4d0]
xor rcx, rdx
mov qword [r9 + 0x9b0], rcx
sub r11, 1
jne 0x1401ea2a0
jmp 0x1401ea3dc
cmp dword [rcx], 0x270
jb 0x1401ea3dc
lea r9, [rcx + 0x9c8]
mov r11d, 0x9c
movabs r10, 0xb5026f5aa96619e9
nop dword [rax + rax]
mov edx, dword [r9 + 8]
mov rax, qword [r9]
lea r9, [r9 + 8]
and rax, 0xffffffff80000000
btr edx, 0x1f
or rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r9 + 0x4d8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x1401ea310
lea r9, [r8 + 0xea8]
mov r11d, 0x9b
nop dword [rax]
mov edx, dword [r9 + 8]
mov rax, qword [r9]
lea r9, [r9 + 8]
and rax, 0xffffffff80000000
btr edx, 0x1f
or rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r9 - 0xea8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x1401ea360
mov eax, dword [r8 + 8]
mov rdx, qword [r8 + 0x1380]
btr eax, 0x1f
and rdx, 0xffffffff80000000
or rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 + 0x9c0], rcx
mov dword [r8], r11d
mov eax, dword [r8]
movabs rdx, 0x38eb3ffff6d3
xorps xmm0, xmm0
mov rcx, qword [r8 + rax*8 + 8]
inc dword [r8]
mov rax, rcx
shr rax, 0x1d
and rax, qword [r8 + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x1401ea435
cvtsi2ss xmm0, rdx
jmp 0x1401ea44a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
subss xmm0, xmm1
mulss xmm0, xmm2
mulss xmm2, dword [0x14043cd04]
addss xmm1, xmm0
divss xmm1, xmm2
movaps xmm0, xmm1
ret
Function at 0x1401ea470
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1400
call fcn.140284120
sub rsp, rax
movaps xmmword [rsp + 0x13f0], xmm6
movaps xmmword [rsp + 0x13e0], xmm7
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov rsi, rdx
mov rdi, rcx
call fcn.140040320
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov ecx, 0x20
call fcn.140283d70
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0x18
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.telemetry.disableCulling]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14046f6b0]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14013fe10
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1401ea561
inc rdx
mov rcx, qword [rsp + 0x20]
cmp rdx, 0x1000
jb 0x1401ea55c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401ea63a
mov rcx, r8
call fcn.140283db0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
test bl, bl
jne 0x1401ea636
cmp byte [rsi + 0x5d], bl
jne 0x1401ea636
xorps xmm7, xmm7
comiss xmm7, dword [rdi + 0x40]
jae 0x1401ea636
movss xmm0, dword [rdi + 0x40]
movss xmm6, dword [0x1404689ac]
comiss xmm0, xmm6
jae 0x1401ea641
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
movabs rax, 0x5555555555555555
mov qword [rsp + 0x13c8], rax
mov qword [rsp + 0x48], rdx
mov ecx, 1
movabs r8, 0x5851f42d4c957f2d
nop dword [rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rsp + rcx*8 + 0x48], rdx
inc rcx
cmp rcx, 0x138
jb 0x1401ea5e0
mov dword [rsp + 0x40], 0x138
lea rcx, [rsp + 0x40]
call fcn.1401ea270
addss xmm0, xmm7
comiss xmm0, dword [rdi + 0x40]
jb 0x1401ea641
subss xmm6, dword [rdi + 0x40]
movss xmm0, dword [rdi + 0x40]
divss xmm0, xmm6
addss xmm0, dword [rsi + 0x54]
movss dword [rsi + 0x54], xmm0
xor al, al
jmp 0x1401ea643
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov al, 1
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.140284180
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401fcd20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, r9
mov rsi, r8
mov rdi, rdx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
lea ecx, [rbp + 0x20]
call fcn.140283d70
mov r9, rax
test rax, rax
je 0x1401fcd7a
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax]
mov qword [r9 + 8], rcx
mov rax, qword [rbx]
mov qword [r9 + 0x10], rax
mov rax, qword [rsi]
mov qword [r9 + 0x18], rax
jmp 0x1401fcd7d
mov r9, rbp
mov qword [rsp + 0x78], r9
mov ebx, 1
mov dword [rsp + 0x30], ebx
lea rax, [rdi + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
lea r8, [0x1401fc4b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1401fcdd2
mov qword [rsp + 0x78], rbp
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov dword [rdi + 8], ebp
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1401ffa40
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x10
mov r11, rcx
xor ebx, ebx
mov dword [rsp], ebx
movzx r9d, r8b
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [rsp + 0x31]
xor r9, rax
imul r9, rcx
movzx eax, byte [rsp + 0x32]
xor r9, rax
imul r9, rcx
movzx eax, byte [rsp + 0x33]
xor r9, rax
imul r9, rcx
mov r10, qword [r11 + 0x1d0]
and r10, r9
lea rcx, [r10 + r10]
mov rax, qword [r11 + 0x1b8]
mov rax, qword [rax + rcx*8 + 8]
cmp rax, qword [r11 + 0x1a8]
je 0x1401ffae2
add r10, r10
mov rcx, qword [r11 + 0x1b8]
mov r9, qword [rcx + r10*8]
cmp r8d, dword [rax + 0x10]
je 0x1401ffae5
cmp rax, r9
je 0x1401ffae2
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1401ffad1
jmp 0x1401ffae5
mov rax, rbx
test rax, rax
jne 0x1401ffaf1
mov rax, qword [r11 + 0x1a8]
cmp rax, qword [r11 + 0x1a8]
mov qword [rdx], rbx
mov qword [rdx + 8], rbx
je 0x1401ffb1e
cmp qword [rax + 0x20], rbx
je 0x1401ffb0f
mov rcx, qword [rax + 0x20]
lock inc dword [rcx + 8]
mov rcx, qword [rax + 0x18]
mov qword [rdx], rcx
mov rcx, qword [rax + 0x20]
mov qword [rdx + 8], rcx
mov dword [rsp], 1
mov rax, rdx
add rsp, 0x10
pop rbx
ret
Function at 0x140201ae0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x40], r14d
mov sil, 1
cmp dword [rcx + 8], r14d
jne 0x140201c61
lea rbx, [rcx + 0x40]
lea rax, [rbx + 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rbx
mov byte [rbp - 8], r14b
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x140201c97
cmp dword [rbx + 0x4c], 0x7fffffff
je 0x140201c7a
mov byte [rbp - 8], sil
mov dword [rbp - 0x40], 1
lea rcx, [rbp - 0x20]
call fcn.1401ff5d0
mov rbx, rax
mov rcx, qword [rax + 8]
cmp qword [rax], rcx
je 0x140201b72
mov r8, rax
mov rdx, rcx
mov rcx, qword [rax]
call fcn.1401fbd90
mov rcx, qword [rbx]
mov qword [rbx + 8], rcx
lea rcx, [rbp - 0x20]
call fcn.1401ff5d0
mov byte [rax + 0x18], 0
mov ecx, 8
call fcn.140283d70
test rax, rax
je 0x140201b93
mov qword [rax], rdi
jmp 0x140201b96
mov rax, r14
mov qword [rbp + 0x20], rax
mov ebx, 3
mov dword [rbp - 0x40], ebx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x1401fc4f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140201c88
mov qword [rbp + 0x20], r14
and ebx, 0xfffffffd
mov dword [rbp - 0x40], ebx
cmp dword [rdi + 8], 0
je 0x140201be8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xorps xmm0, xmm0
movaps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
movups xmmword [rdi], xmm1
cmp dword [rbp - 0x28], 0
je 0x140201c04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
lea rcx, [rbp - 0x20]
call fcn.1401ff5d0
cmp byte [rax + 0x18], 0
jne 0x140201c3f
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbp - 0x10]
lea rcx, [rdi + 0xc0]
call sub.MSVCP140.dll__Cnd_wait
lea rcx, [rbp - 0x20]
call fcn.1401ff5d0
cmp byte [rax + 0x18], 0
je 0x140201c20
lea rcx, [rbp - 0x20]
call fcn.1401ff5d0
movzx esi, byte [rax + 0x19]
and ebx, 0xfffffffe
mov dword [rbp - 0x40], ebx
cmp byte [rbp - 8], 0
je 0x140201c61
mov rcx, qword [rbp - 0x10]
call fcn.1402836b4
movzx eax, sil
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
dec dword [rbx + 0x4c]
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rbp - 0x28], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140208130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1402081ab
mov rax, qword [rdi + 0x38]
mov rdx, qword [rdi + 8]
shr rax, 3
cmp rax, rcx
jbe 0x140208166
mov r8, rdx
mov rcx, rdi
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp fcn.14002a090
lea rcx, [rdi + 8]
mov qword [rsp + 0x38], rbx
call fcn.140024aa0
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rcx, qword [rdi + 8]
mov qword [rcx + 8], rcx
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140026a50
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140211ed0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x30], esi
movsd xmm0, qword [0x14046d8a8]
divsd xmm0, xmm1
mulsd xmm0, qword [0x140467370]
cvttsd2si eax, xmm0
cdqe
cmp dword [rcx + 0xd8], esi
jne 0x140211fab
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea ecx, [rsi + 0x10]
call fcn.140283d70
test rax, rax
je 0x140211f2f
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
jmp 0x140211f32
mov rax, rsi
mov qword [rsp + 0x70], rax
mov ebx, 1
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140210520]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140211fbe
mov qword [rsp + 0x70], rsi
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
cmp dword [rdi + 0xd8], 0
je 0x140211f88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movups xmmword [rdi + 0xd0], xmm1
cmp dword [rsp + 0x48], 0
je 0x140211fab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov dword [rsp + 0x48], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14021c200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rbx, rcx
mov rcx, qword [rdx + 0x10]
mov r10, rdx
jbe 0x14021c21a
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test rcx, rcx
je 0x14021c254
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor r9, rax
imul r9, r11
cmp r8, rcx
jb 0x14021c240
mov r8, rdx
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.1400249b0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14021c271
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx + 8]
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x14021c590
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rdi, rcx
mov rcx, qword [rdx + 0x10]
movzx esi, r8b
mov r10, rdx
jbe 0x14021c5b7
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test rcx, rcx
je 0x14021c5f4
movabs r11, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor r9, rax
imul r9, r11
cmp r8, rcx
jb 0x14021c5e0
mov r8, rdx
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.1400249b0
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x14021c611
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 8]
je 0x14021c6a6
cmp qword [rbx + 0x40], 0
je 0x14021c6a6
cmp qword [rbx + 0x48], 0xf
lea rcx, [rbx + 0x30]
jbe 0x14021c635
mov rcx, qword [rbx + 0x30]
mov r8, qword [rbx + 0x40]
mov edi, 1
cmp r8, rdi
jne 0x14021c657
lea rdx, [0x14043a84c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14021c657
mov eax, edi
jmp 0x14021c659
xor eax, eax
test al, al
jne 0x14021c690
cmp qword [rbx + 0x48], 0xf
lea rcx, [rbx + 0x30]
jbe 0x14021c66c
mov rcx, qword [rbx + 0x30]
mov r8, qword [rbx + 0x40]
cmp r8, 5
jne 0x14021c68a
lea rdx, [0x14043718c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14021c68a
mov eax, edi
jmp 0x14021c68c
xor eax, eax
test al, al
je 0x14021c692
xor edi, edi
movzx eax, dil
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
movzx eax, sil
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14021c6c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x40
mov rsi, r9
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
mov r11, qword [r8 + 0x10]
mov r10, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14021c6f6
mov r10, qword [r8]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x14021c725
movabs rcx, 0x100000001b3
movzx eax, byte [r10 + rdx]
xor r9, rax
imul r9, rcx
inc rdx
cmp rdx, r11
jb 0x14021c711
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400249b0
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x14021c73f
mov rdx, qword [rdi + 8]
mov rcx, rbx
cmp rdx, qword [rdi + 8]
je 0x14021c753
add rdx, 0x30
call fcn.140027320
jmp 0x14021c776
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
call fcn.140012c70
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140223e60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call fcn.140027320
mov ebp, 1
mov dword [rsp + 0x20], ebp
lea rsi, [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x48]
cmp r9, 0xf
cmova rsi, rcx
lea rbx, [rsp + 0x30]
cmova rbx, rcx
mov r8, qword [rsp + 0x40]
add rbx, r8
lea rdi, [rsp + 0x30]
cmp r9, 0xf
cmova rdi, rcx
cmp rdi, rbx
je 0x140223f03
sub rsi, rdi
nop dword [rax + rax]
movzx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbx
jne 0x140223ee0
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
cmp r9, 0xf
cmova rdx, rcx
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
test r8, r8
je 0x140223f43
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x140223f30
and ebp, 0xfffffffe
mov dword [rsp + 0x20], ebp
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140223f83
inc rdx
mov rcx, qword [rsp + 0x30]
cmp rdx, 0x1000
jb 0x140223f7e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140223fc0
mov rcx, r8
call fcn.140283db0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140284180
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1402262c0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140226391
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140226391
mov ecx, 0x7fffffff
mov eax, 0x66666667
sub ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp dword [rbx + 0x74], edx
jg 0x1402263aa
mov eax, dword [rbx + 0x74]
dec edi
lea ecx, [rax + rax*4]
lea eax, [r8 + rcx*2]
mov dword [rbx + 0x74], eax
mov rax, qword [rbx + 0x10]
cmp qword [rbx], rax
je 0x140226381
mov rax, qword [rbx]
cmp byte [rax], 0x5c
jne 0x14022637e
inc rax
cmp rax, qword [rbx + 0x10]
je 0x140226375
test byte [rbx + 0x80], 8
jne 0x14022635b
cmp byte [rax], 0x28
je 0x14022636e
cmp byte [rax], 0x29
je 0x14022636e
test byte [rbx + 0x80], 0x10
jne 0x140226375
cmp byte [rax], 0x7b
je 0x14022636e
cmp byte [rax], 0x7d
jne 0x140226375
mov eax, 1
jmp 0x140226377
xor eax, eax
test al, al
je 0x14022637e
inc qword [rbx]
inc qword [rbx]
mov rcx, rbx
call fcn.1402285a0
test edi, edi
jne 0x1402262e0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140227510
int3
Function at 0x140232820
Capabilities:
Query environment variable

Disassembly:
jmp 0x14025d460
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rbx, rax
mov qword [rsp + 0x38], rax
mov rdx, rdi
mov rcx, rax
call fcn.14025cf90
movzx edi, al
test rbx, rbx
je 0x14025d49b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
movzx eax, dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1402382e0
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10040
call fcn.140284120
sub rsp, rax
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x10030], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov word [rsp + 0x30], ax
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x32]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r8d, 0xffffffff
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14024bc40
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x10030]
xor rcx, rsp
call fcn.140284180
add rsp, 0x10040
pop rbx
ret