joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008ae74
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14008aea1
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14008aed5
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14008aeb7
and rcx, qword [0x1403f1900]
mov r14, qword [0x1403f18e8]
mov rax, rcx
mov r10, qword [0x1403f18d8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14008af03
mov rcx, r10
jmp 0x14008af0b
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008afb8
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14008af25
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14008af35
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14008af67
mov rdi, rsi
test rsi, rsi
je 0x14008af61
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14008af6c
add r8, 2
sub rdi, 1
jne 0x14008af49
xor ecx, ecx
test ecx, ecx
je 0x14008af75
mov rax, qword [rax]
jmp 0x14008aef8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008af63
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14008af82
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14008af8c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14008afb8
test r11, r11
je 0x14008afb2
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14008afc4
add rcx, 2
sub r11, 1
jne 0x14008af99
xor ecx, ecx
test ecx, ecx
je 0x14008afbb
mov rax, r10
cmp rax, r10
jne 0x14008afcd
xor al, al
jmp 0x14008afd6
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008afb4
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14008e3f4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14008e421
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14008e455
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14008e437
and rcx, qword [0x1403f1a20]
mov r14, qword [0x1403f1a08]
mov rax, rcx
mov r10, qword [0x1403f19f8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14008e483
mov rcx, r10
jmp 0x14008e48b
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008e538
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14008e4a5
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14008e4b5
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14008e4e7
mov rdi, rsi
test rsi, rsi
je 0x14008e4e1
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14008e4ec
add r8, 2
sub rdi, 1
jne 0x14008e4c9
xor ecx, ecx
test ecx, ecx
je 0x14008e4f5
mov rax, qword [rax]
jmp 0x14008e478
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008e4e3
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14008e502
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14008e50c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14008e538
test r11, r11
je 0x14008e532
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14008e544
add rcx, 2
sub r11, 1
jne 0x14008e519
xor ecx, ecx
test ecx, ecx
je 0x14008e53b
mov rax, r10
cmp rax, r10
jne 0x14008e54d
xor al, al
jmp 0x14008e556
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008e534
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14008e574
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14008e5a1
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14008e5d5
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14008e5b7
and rcx, qword [0x1403f19e0]
mov r14, qword [0x1403f19c8]
mov rax, rcx
mov r10, qword [0x1403f19b8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14008e603
mov rcx, r10
jmp 0x14008e60b
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008e6b8
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14008e625
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14008e635
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14008e667
mov rdi, rsi
test rsi, rsi
je 0x14008e661
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14008e66c
add r8, 2
sub rdi, 1
jne 0x14008e649
xor ecx, ecx
test ecx, ecx
je 0x14008e675
mov rax, qword [rax]
jmp 0x14008e5f8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008e663
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14008e682
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14008e68c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14008e6b8
test r11, r11
je 0x14008e6b2
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14008e6c4
add rcx, 2
sub r11, 1
jne 0x14008e699
xor ecx, ecx
test ecx, ecx
je 0x14008e6bb
mov rax, r10
cmp rax, r10
jne 0x14008e6cd
xor al, al
jmp 0x14008e6d6
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008e6b4
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140094e48
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x140094e75
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140094ea9
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140094e8b
and rcx, qword [0x1403f1960]
mov r14, qword [0x1403f1948]
mov rax, rcx
mov r10, qword [0x1403f1938]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x140094ed7
mov rcx, r10
jmp 0x140094edf
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140094f8c
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x140094ef9
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140094f09
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140094f3b
mov rdi, rsi
test rsi, rsi
je 0x140094f35
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x140094f40
add r8, 2
sub rdi, 1
jne 0x140094f1d
xor ecx, ecx
test ecx, ecx
je 0x140094f49
mov rax, qword [rax]
jmp 0x140094ecc
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140094f37
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x140094f56
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x140094f60
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140094f8c
test r11, r11
je 0x140094f86
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140094f98
add rcx, 2
sub r11, 1
jne 0x140094f6d
xor ecx, ecx
test ecx, ecx
je 0x140094f8f
mov rax, r10
cmp rax, r10
jne 0x140094fa1
xor al, al
jmp 0x140094faa
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140094f88
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140095684
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [r8 + 0x18], 8
mov rdi, rdx
mov r11, qword [r8 + 0x10]
mov rbx, rcx
mov r10, r8
jb 0x1400956b4
mov r10, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x1400956e7
movzx eax, byte [rcx + r10]
movabs rsi, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rsi
cmp rcx, rdx
jb 0x1400956c9
mov rcx, qword [rbx + 0x30]
mov r15, qword [rbx + 0x18]
and rcx, r9
mov r10, qword [rbx + 8]
mov rax, rcx
add rax, rax
lea r12, [rcx + rcx]
mov rax, qword [r15 + rax*8]
cmp qword [r15 + r12*8], r10
jne 0x14009570f
mov rcx, r10
jmp 0x140095717
mov rcx, qword [r15 + r12*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400957d4
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x140095731
mov rdx, qword [r8]
mov r14, qword [rcx + 0x18]
mov r9, rcx
cmp r14, 8
jb 0x140095741
mov r9, qword [rcx]
mov rbp, qword [rcx + 0x10]
cmp rbp, r11
jne 0x140095772
mov rsi, rbp
test rbp, rbp
je 0x14009576c
sub r9, rdx
movzx ecx, word [rdx + r9]
movzx ebx, word [rdx]
cmp cx, bx
jne 0x140095777
add rdx, 2
sub rsi, 1
jne 0x140095755
xor ecx, ecx
test ecx, ecx
je 0x140095780
mov rax, qword [rax]
jmp 0x140095704
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009576e
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x14009578d
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x140095797
mov r8, qword [r8]
cmp r11, rbp
jne 0x1400957c3
test r11, r11
je 0x1400957bd
sub r8, rcx
movzx edx, word [rcx + r8]
movzx r9d, word [rcx]
cmp dx, r9w
jne 0x1400957cb
add rcx, 2
sub r11, 1
jne 0x1400957a4
xor ecx, ecx
test ecx, ecx
je 0x1400957c6
mov rax, r10
mov qword [rdi], rax
jmp 0x1400957d7
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400957bf
mov qword [rdi], r10
mov rbx, qword [rsp + 0x20]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
Function at 0x140096be0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x140096c0d
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140096c41
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140096c23
and rcx, qword [0x1403f19a0]
mov r14, qword [0x1403f1988]
mov rax, rcx
mov r10, qword [0x1403f1978]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x140096c6f
mov rcx, r10
jmp 0x140096c77
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140096d24
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x140096c91
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140096ca1
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140096cd3
mov rdi, rsi
test rsi, rsi
je 0x140096ccd
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x140096cd8
add r8, 2
sub rdi, 1
jne 0x140096cb5
xor ecx, ecx
test ecx, ecx
je 0x140096ce1
mov rax, qword [rax]
jmp 0x140096c64
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140096ccf
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x140096cee
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x140096cf8
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140096d24
test r11, r11
je 0x140096d1e
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140096d30
add rcx, 2
sub r11, 1
jne 0x140096d05
xor ecx, ecx
test ecx, ecx
je 0x140096d27
mov rax, r10
cmp rax, r10
jne 0x140096d39
xor al, al
jmp 0x140096d42
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140096d20
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140097c44
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x140097c71
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140097ca5
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140097c87
and rcx, qword [0x1403f1b00]
mov r14, qword [0x1403f1ae8]
mov rax, rcx
mov r10, qword [0x1403f1ad8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x140097cd3
mov rcx, r10
jmp 0x140097cdb
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140097d88
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x140097cf5
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140097d05
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140097d37
mov rdi, rsi
test rsi, rsi
je 0x140097d31
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x140097d3c
add r8, 2
sub rdi, 1
jne 0x140097d19
xor ecx, ecx
test ecx, ecx
je 0x140097d45
mov rax, qword [rax]
jmp 0x140097cc8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140097d33
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x140097d52
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x140097d5c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140097d88
test r11, r11
je 0x140097d82
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140097d94
add rcx, 2
sub r11, 1
jne 0x140097d69
xor ecx, ecx
test ecx, ecx
je 0x140097d8b
mov rax, r10
cmp rax, r10
jne 0x140097d9d
xor al, al
jmp 0x140097da6
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140097d84
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140098620
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14009864d
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140098681
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140098663
and rcx, qword [0x1403f1b40]
mov r14, qword [0x1403f1b28]
mov rax, rcx
mov r10, qword [0x1403f1b18]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400986af
mov rcx, r10
jmp 0x1400986b7
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140098764
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400986d1
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400986e1
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140098713
mov rdi, rsi
test rsi, rsi
je 0x14009870d
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x140098718
add r8, 2
sub rdi, 1
jne 0x1400986f5
xor ecx, ecx
test ecx, ecx
je 0x140098721
mov rax, qword [rax]
jmp 0x1400986a4
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009870f
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14009872e
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x140098738
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140098764
test r11, r11
je 0x14009875e
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140098770
add rcx, 2
sub r11, 1
jne 0x140098745
xor ecx, ecx
test ecx, ecx
je 0x140098767
mov rax, r10
cmp rax, r10
jne 0x140098779
xor al, al
jmp 0x140098782
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140098760
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14009a7f0
Capabilities:
Parse credit card information

Disassembly:
sub rsp, 0x28
mov r9d, dword [rcx + 0x80]
mov r10d, 0x5c
movzx edx, word [rcx + 0x78]
mov r8, rcx
lea r11d, [r10 + 0x1f]
bt r9d, 0x16
jae 0x14009a837
cmp edx, 0x44
je 0x14009a830
lea eax, [rdx - 0x53]
cmp eax, 0x24
ja 0x14009a898
movabs rcx, 0x1100030011
bt rcx, rax
jae 0x14009a898
xor al, al
add rsp, 0x28
ret
cmp edx, 0x2f
ja 0x14009a86b
je 0x14009a863
cmp edx, 0x22
je 0x14009a863
cmp edx, 0x24
je 0x14009a898
cmp edx, 0x27
jbe 0x14009a830
cmp edx, 0x29
jbe 0x14009a88e
cmp edx, 0x2a
je 0x14009a898
cmp edx, 0x2b
je 0x14009a88e
cmp edx, 0x2e
je 0x14009a898
jmp 0x14009a830
mov eax, r9d
shr eax, 0x18
jmp 0x14009a894
cmp edx, 0x3f
je 0x14009a88e
cmp edx, 0x5a
jbe 0x14009a830
cmp edx, r10d
jbe 0x14009a898
cmp edx, 0x5e
je 0x14009a898
cmp edx, r11d
je 0x14009a88e
cmp edx, 0x7c
je 0x14009a898
cmp edx, 0x7d
jne 0x14009a830
mov eax, r9d
shr eax, 0x17
test al, 1
je 0x14009a830
mov rcx, qword [r8]
mov dword [r8 + 0x74], edx
cmp rcx, qword [r8 + 0x10]
je 0x14009a8e8
cmp word [rcx], r10w
jne 0x14009a8e4
add rcx, 2
cmp rcx, qword [r8 + 0x10]
je 0x14009a8e4
test r9b, 8
jne 0x14009a8c8
movzx eax, word [rcx]
sub ax, 0x28
cmp ax, 1
jbe 0x14009a8e1
test r9b, 0x10
jne 0x14009a8e4
movzx edx, word [rcx]
mov r9d, 0xfffd
sub dx, r11w
test r9w, dx
jne 0x14009a8e4
mov qword [r8], rcx
add qword [r8], 2
mov rcx, r8
call fcn.140098e70
mov al, 1
jmp 0x14009a832
Function at 0x14009cd78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r8
mov r15, rdx
mov r14, rcx
mov r12, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x14009cdb3
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r12, r12
je 0x14009cde2
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
inc rcx
cmp rcx, r12
jb 0x14009cdc4
mov rsi, qword [r14 + 0x30]
and rsi, rdx
mov rdi, qword [r14 + 8]
add rsi, rsi
mov r13, qword [r14 + 0x18]
cmp rdi, qword [r13 + rsi*8]
je 0x14009ce4d
mov rdi, qword [r13 + rsi*8 + 8]
mov rdi, qword [rdi]
jmp 0x14009ce46
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x14009ce18
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14009ce25
mov rcx, qword [rbx]
cmp r12, qword [rdi + 0x20]
jne 0x14009ce46
mov r8, r12
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x14009ce46
mov qword [r15], rdi
mov byte [r15 + 8], al
mov rax, r15
jmp 0x14009cf3e
cmp rdi, qword [r13 + rsi*8]
jne 0x14009ce05
mov rax, qword [r14 + 8]
mov r13, qword [rax]
mov r9, rbx
mov r8, qword [r13 + 8]
mov rdx, r13
call fcn.14009d2d4
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jae 0x14009ce8b
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [r13 + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rbx, qword [r14 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x70], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14009cede
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x14009cefb
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x14009cf2a
cmp rax, rdi
jne 0x14009cf06
mov qword [rdx + rsi*8], rbx
jmp 0x14009cf2a
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x14009cf2a
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.14009cf58
nop
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14009d008
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r10, [r8 + 0x10]
mov rdi, r8
cmp qword [r10 + 0x18], 0x10
mov rsi, rdx
mov r9, rcx
mov r11, r10
jb 0x14009d031
mov r11, qword [r10]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
cmp qword [r10 + 0x10], r8
jbe 0x14009d063
movzx eax, byte [r8 + r11]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rdx
cmp r8, qword [r10 + 0x10]
jb 0x14009d044
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14009d09b
cmp qword [rcx + rdx*8], rdi
jne 0x14009d090
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14009d094
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14009d0a8
cmp qword [rcx + rdx*8], rdi
jne 0x14009d0a8
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r10
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
call fcn.14004c91c
mov rcx, rdi
call fcn.14027abd8
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret