joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003d060
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x14003d0a5
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14003c344
jmp 0x14003d0a7
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14020ed60
add rsp, 0x240
pop rbx
ret

Function at 0x14003d0c0
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, eax
test eax, eax
jne 0x14003d0e6
mov ecx, 0x323658
jmp 0x14003d101
cmp dword [rbx + 4], 6
jae 0x14003d0f6
mov ecx, 0x323659
call fcn.1401e41d8
cmp dword [rbx + 0x10], 2
je 0x14003d106
mov ecx, 0x32365a
call fcn.1401e41d8
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14003d150
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov esi, edx
mov dword [rbp + 0x30], 0x40
mov rbx, rcx
xor r14d, r14d
xor edx, edx
mov qword [rbp + 0x38], r14
mov ecx, 0x80
call fcn.140070918
mov rdi, rax
test rax, rax
je 0x14003d312
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14003d1a2
mov qword [rbp + 0x38], r14
call fcn.140070920
mov qword [rbp + 0x38], rdi
lea r8, [rbp + 0x30]
mov word [rdi], r14w
mov ecx, esi
mov rdx, qword [rbp + 0x38]
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x14003d2e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x14003d249
cmp eax, 0x534
je 0x14003d2fd
cmp eax, 0x54b
je 0x14003d2fd
mov dword [rbp - 8], eax
lea rcx, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov qword [rbp - 0x30], rcx
lea rax, method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0
lea rcx, str.EXTENDED_NAME_FORMAT
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x28], rcx
lea rax, [rbp - 0x30]
lea rcx, str.LastError
mov qword [rsp + 0x28], rax
mov qword [rbp - 0x10], rcx
lea rax, [rbp - 0x18]
mov ecx, 0x11ce1a1
mov dword [rbp - 0x20], esi
lea r9, str.GetUserNameExW_failed_1
mov edx, 0x55f
mov qword [rsp + 0x20], rax
mov r8d, 0xa
call fcn.1401af15c
jmp 0x14003d2fd
mov ecx, dword [rbp + 0x30]
xor edx, edx
add rcx, rcx
call fcn.140070918
mov rdi, rax
test rax, rax
je 0x14003d2fd
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14003d274
mov qword [rbp + 0x38], r14
call fcn.140070920
lea r8, [rbp + 0x30]
mov qword [rbp + 0x38], rdi
mov rdx, rdi
mov ecx, esi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x14003d312
lea rcx, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov dword [rbp - 8], esi
mov qword [rbp - 0x18], rcx
lea rcx, str.EXTENDED_NAME_FORMAT
mov qword [rbp - 0x10], rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x20], eax
lea rcx, str.LastError
lea rax, method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x30], rax
lea r9, str.GetUserNameExW_failed_2
lea rax, [rbp - 0x18]
mov ecx, 0x11ce1a2
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
jmp 0x14003d22f
mov eax, dword [rbp + 0x30]
lea rcx, [rbp + 0x38]
lea rdx, [rax*2 + 2]
call fcn.140070928
test rax, rax
jne 0x14003d312
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x14003d316
mov rcx, rax
mov qword [rbp + 0x38], r14
call fcn.140070920
mov rax, qword [rbp + 0x38]
mov qword [rbx], rax
lea r11, [rsp + 0x60]
mov rsi, qword [r11 + 0x28]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140044cbc
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and dword [rsp + 0x40], 0
mov rsi, rdx
mov rbx, rcx
call fcn.140044b70
test al, al
jne 0x140044ce3
xor al, al
jmp 0x140044d39
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140044cf0
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test eax, eax
je 0x140044cdf
mov edx, edi
mov r8, rsi
mov rcx, rsi
call fcn.14006dc50
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
neg rax
sbb r9, r9
and r9, qword [rsi]
cmp qword [rbx + 0x18], 8
jb 0x140044d27
mov rbx, qword [rbx]
mov r8d, edi
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140045794
Capabilities:
Delete file
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r15d, r15d
mov rbx, r9
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
cmp dword [rsp + 0x290], r15d
jg 0x1400457d4
xor eax, eax
jmp 0x14004586e
cmp rbx, rsi
je 0x1400457dd
mov word [r9], r15w
cmp dword [rsp + 0x290], 0x104
jl 0x1400457f2
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x14004586e
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1402108c0
lea r9, [rsp + 0x20]
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, eax
test eax, eax
je 0x14004586c
or r9, 0xffffffffffffffff
lea rax, [rsp + 0x20]
mov rcx, r9
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x14004582a
cmp ecx, dword [rsp + 0x290]
jl 0x140045857
mov ecx, 0x3ca797
call fcn.1401e41d8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400457cd
movsxd rdx, dword [rsp + 0x290]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.14023a4c8
mov eax, esi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14020ed60
add rsp, 0x240
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x140045d88
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
xor r10d, r10d
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov r11d, r10d
test rcx, rcx
je 0x140045f30
test r8, r8
je 0x140045f30
mov r14, qword [rsp + 0x38]
test r14, r14
je 0x140045f30
test edx, edx
je 0x140045f14
mov ecx, r10d
lea r13, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rdi]
dec ebx
mov byte [rsp + rcx + 0x18], al
inc r11d
inc rcx
inc rdi
cmp rcx, 3
jne 0x140045e63
cmp r9d, 4
jb 0x140045e6b
movzx edx, byte [rsp + 0x1a]
mov r11d, r10d
movzx eax, byte [rsp + 0x18]
movzx ecx, byte [rsp + 0x19]
shr rax, 2
shr rcx, 4
mov al, byte [r13 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x18]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov cl, byte [rsp + 0x19]
mov byte [r8 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
shl cl, 2
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov rcx, r10
mov byte [r8 + 2], al
mov al, byte [r13 + rdx*2]
mov byte [r8 + 3], al
add r8, 4
add r9d, 0xfffffffc
test ebx, ebx
jne 0x140045ddb
test r11d, r11d
jle 0x140045f12
cmp r9d, 4
jb 0x140045f0f
movzx edi, byte [rsp + 0x19]
cmp r11d, 1
movzx ebx, byte [rsp + 0x1a]
mov dl, 0x3d
movzx eax, byte [rsp + 0x18]
cmovle edi, r10d
cmp r11d, 2
movzx ecx, dil
cmovle ebx, r10d
shr rax, 2
shr rcx, 4
mov al, byte [r13 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x18]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov byte [r8 + 1], al
cmp r11d, 1
jle 0x140045ee9
mov al, dil
movzx ecx, bl
shl al, 2
shr rcx, 6
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
jmp 0x140045eeb
mov al, dl
mov byte [r8 + 2], al
cmp r11d, 2
jle 0x140045f00
movzx eax, bl
and eax, 0x3f
mov dl, byte [r13 + rax*2]
mov byte [r8 + 3], dl
mov r11d, r10d
add r8, 4
add r9d, 0xfffffffc
test r11d, r11d
jne 0x140045f1f
cmp r9d, 1
jb 0x140045f1f
mov byte [r8], r10b
jmp 0x140045f25
mov r10d, 0x800700ea
sub r8d, esi
mov eax, r10d
mov dword [r14], r8d
jmp 0x140045f35
mov eax, 0x80070057
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r14
pop r13
ret
Function at 0x140046168
Capabilities:
Create directory
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
movsxd rsi, edx
mov rdi, rcx
test edx, edx
jle 0x1400462bb
mov rdx, rsi
mov word [rcx], bp
call fcn.140046670
test al, al
jne 0x1400461c9
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14020ed60
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.14003c2dc
test eax, eax
je 0x1400461d9
mov eax, 1
jmp 0x1400461a8
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], bp
jne 0x1400461dd
test ebx, ebx
jle 0x1400462c8
lea eax, [rbx - 1]
mov r14d, 0x5c
movsxd rcx, eax
cmp word [rdi + rcx*2], r14w
je 0x14004620f
cmp ebx, esi
je 0x1400461a6
movsxd rax, ebx
inc ebx
mov word [rdi + rax*2], r14w
lea eax, [rbx + 0xc]
cmp eax, ebx
jl 0x1400462db
movsxd rcx, eax
mov r15d, 0xffffffff
inc rcx
mov eax, 0x80000000
add rax, rcx
cmp rax, r15
ja 0x1400462d5
cmp ecx, esi
jg 0x1400461a6
movups xmm0, xmmword [str.Content.MSO]
movsxd rax, ebx
mov rcx, rdi
movups xmmword [rdi + rax*2], xmm0
movsd xmm1, qword [0x1402b6e48]
movsd qword [rdi + rax*2 + 0x10], xmm1
call fcn.1400466d4
test eax, eax
jne 0x1400462a1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov edx, dword [rsp + 0x20]
mov rcx, rdi
test eax, eax
cmove edx, r15d
or edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [rbx + 0xb]
movsxd rax, ecx
mov word [rdi + rax*2], r14w
lea eax, [rcx + 1]
movsxd rcx, eax
mov word [rdi + rcx*2], bp
jmp 0x1400461d2
xor edx, edx
mov ecx, 0x32284a
call fcn.1400235f8
int3
xor edx, edx
mov ecx, 0x14428f
call fcn.1400235f8
int3
call fcn.14000f8ac
int3
call fcn.14000f8ac
int3

Function at 0x1400465f8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x20
and qword [rax + 0x18], 0
lea r9, [rax + 0x18]
movsxd rdi, edx
mov rsi, rcx
xor edx, edx
lea rcx, [0x140304630]
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
mov ebx, eax
test eax, eax
js 0x14004663e
mov r8, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, rsi
call fcn.14023c530
mov rcx, qword [rsp + 0x40]
test ebx, ebx
setns bl
test rcx, rcx
je 0x140046659
and qword [rsp + 0x40], 0
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140046670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
cmp rdx, 0x104
jb 0x1400466c7
xor esi, esi
mov word [rcx], si
call fcn.14003c2dc
test eax, eax
je 0x1400466ad
mov rdx, rdi
mov ecx, ebx
call sub.KERNEL32.dll_GetTempPathW
test eax, eax
setne al
jmp 0x1400466b7
mov edx, ebx
mov rcx, rdi
call fcn.1400465f8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov ecx, 0x3617db
call fcn.1400235f8
int3

Function at 0x140046724
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa60
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov rbx, rcx
xor edi, edi
lea rcx, [rsp + 0x50]
mov word [rsp + 0x250], di
xor edx, edx
mov r8d, 0x200
call fcn.1402108c0
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x250]
mov r8, rbx
mov edx, 0x400
mov esi, edi
call fcn.14023a4c8
mov ebx, edi
lea ebp, [rdi + 0x5c]
mov edx, ebp
lea rcx, [rsp + 0x250]
call fcn.140210e70
test rax, rax
je 0x1400467ad
inc esi
mov qword [rsp + rbx*8 + 0x50], rax
inc rbx
mov word [rax], di
cmp rbx, 0x40
jge 0x1400467d7
test rax, rax
je 0x1400467d7
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x14004678c
cmp dword [rsp + 0x20], edi
jl 0x14004678c
cmp esi, 0x40
jl 0x1400467ff
xor eax, eax
jmp 0x14004680a
mov rax, qword [rsp + rbx*8 + 0x48]
lea rcx, [rsp + 0x250]
dec rbx
xor edx, edx
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140046833
cmp rbx, 1
jg 0x1400467e0
mov eax, 1
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.14020ed60
lea r11, [rsp + 0xa60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete dil
mov eax, edi
jmp 0x14004680a
Function at 0x140046b84
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rsp + 0x230], rax
or rbx, 0xffffffffffffffff
xor esi, esi
mov r8, rcx
mov word [rsp + 0x20], si
mov r9, rbx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.14023a4c8
lea rax, [rsp + 0x20]
inc rbx
cmp word [rax + rbx*2], si
jne 0x140046bd2
lea rdi, [rsp + 0x20]
mov ebp, 0x5c
lea rdi, [rdi + rbx*2]
lea rax, [rdi - 2]
cmp bp, word [rax]
jne 0x140046bf8
mov rdi, rax
mov word [rax], si
lea rax, [rsp + 0x20]
mov rbx, rdi
cmp rdi, rax
jbe 0x140046c33
cmp bp, word [rbx]
jne 0x140046c1b
lea rcx, [rsp + 0x20]
mov word [rbx], si
call fcn.1400466d4
test eax, eax
jne 0x140046c2b
sub rbx, 2
lea rax, [rsp + 0x20]
cmp rbx, rax
jbe 0x140046c2e
jmp 0x140046c05
mov word [rbx], bp
cmp rbx, rdi
ja 0x140046c64
cmp word [rbx], si
jne 0x140046c5a
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140046c57
lea rcx, [rsp + 0x20]
call fcn.1400466d4
test eax, eax
je 0x140046c60
mov word [rbx], bp
add rbx, 2
jmp 0x140046c2e
xor eax, eax
jmp 0x140046c69
mov eax, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14020ed60
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400538a8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r10, [r8 + 0x10]
mov rdi, r8
cmp qword [r10 + 0x18], 0x10
mov rsi, rdx
mov r9, rcx
mov r11, r10
jb 0x1400538d1
mov r11, qword [r10]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
cmp qword [r10 + 0x10], r8
jbe 0x140053903
movzx eax, byte [r8 + r11]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rdx
cmp r8, qword [r10 + 0x10]
jb 0x1400538e4
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14005393b
cmp qword [rcx + rdx*8], rdi
jne 0x140053930
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x140053934
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140053948
cmp qword [rcx + rdx*8], rdi
jne 0x140053948
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r10
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
call fcn.140014f1c
mov rcx, rdi
call fcn.140210c50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400557d8
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rcx
mov ecx, dword [0x1403c17d0]
cmp byte [0x1403c17d4], 0
je 0x140055805
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x14005580c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov rbx, rax
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.140057f8c
lea rcx, [rbx + 0x10]
mov rdx, rax
call fcn.1400f4348
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140055844
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x14002a211.0]
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140055890
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x1403c17d4], 0
mov ecx, dword [0x1403c17d0]
je 0x1400558ab
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400558b1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
inc qword [rax + 8]
add rsp, 0x28
ret
Function at 0x140055d9c
Capabilities:
Get thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, rcx
cmp byte [rcx + 4], 0
mov ecx, dword [rcx]
je 0x140055dc7
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140055dd0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
nop
mov rdi, rax
test rax, rax
jne 0x140055e50
lea edx, [rax + 1]
lea ebx, [rax + 0x38]
mov ecx, ebx
call fcn.140070918
mov rdi, rax
test rax, rax
jne 0x140055df3
call fcn.1401ee6e8
nop
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.1402108c0
mov byte [rdi], 0
and qword [rdi + 8], 0
lea rbx, [rdi + 0x10]
and qword [rbx], 0
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
mov r8b, 1
mov edx, 0x10
lea ecx, [rdx - 0xf]
call fcn.14000c5c0
mov qword [rbx], rax
xorps xmm0, xmm0
movdqu xmmword [rax], xmm0
mov rcx, qword [rbx]
mov qword [rcx], rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140055e64
nop
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140055e64
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x20
cmp byte [rcx + 4], 0
mov rdi, rcx
mov ecx, dword [rcx]
mov rbp, rdx
je 0x140055e93
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x140055e99
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [rdi]
xor edx, edx
mov rsi, rax
mov r15d, 7
cmp byte [rdi + 4], dl
je 0x140055eb3
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140055eb9
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140055ec2
mov rcx, r15
int 0x29
test rsi, rsi
je 0x140055ee7
lea rbx, [rsi + 0x10]
mov rcx, rbx
call fcn.1400d9330
mov rcx, qword [rbx]
call fcn.140210c50
and qword [rbx], 0
mov rcx, rsi
call fcn.140070920
cmp byte [rdi + 4], 0
mov rdx, rbp
mov ecx, dword [rdi]
je 0x140055efa
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140055f00
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140055f09
mov rcx, r15
int 0x29
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x140059558
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r15, r8
mov r12, rdx
mov r14, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x140059594
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x1400595c3
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
inc rcx
cmp rcx, r9
jb 0x1400595a5
mov r13, qword [r14 + 0x30]
and r13, rdx
mov rdi, qword [r14 + 8]
mov rsi, r13
add rsi, rsi
mov rax, qword [r14 + 0x18]
cmp rdi, qword [rax + rsi*8]
je 0x14005966f
mov rdi, qword [rax + rsi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + rsi*8]
je 0x14005966f
add r13, r13
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x140059606
mov rdx, qword [rdi + 0x10]
mov rcx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x140059613
mov rcx, qword [r15]
cmp r9, qword [rdi + 0x20]
jne 0x140059665
mov r8, r9
call fcn.140210b10
test eax, eax
jne 0x140059661
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r14 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.140014f1c
mov rcx, rbx
call fcn.140210c50
mov qword [r12], rdi
mov byte [r12 + 8], 0
mov rax, r12
jmp 0x140059706
mov r9, qword [r15 + 0x10]
mov rax, qword [r14 + 0x18]
cmp rdi, qword [rax + r13*8]
jne 0x1400595f3
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400596a4
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x1400596c1
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x1400596f0
cmp rax, rdi
jne 0x1400596cc
mov qword [rdx + rsi*8], rbx
jmp 0x1400596f0
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x1400596f0
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.14005a320
nop
mov qword [r12], rbx
mov byte [r12 + 8], 1
mov rax, r12
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006028c
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, 0x80
mov edi, edx
mov rbx, rcx
cmp word [rcx], ax
jb 0x1400602ac
xor eax, eax
jmp 0x1400603f1
cmp word [rcx], 0x20
jbe 0x1400603ec
cmp word [rcx], 0x7f
je 0x1400603ec
cmp word [rcx], 0x25
jne 0x140060351
test r8b, 0x40
jne 0x1400603ec
cmp edi, 2
jle 0x1400602f3
movzx ecx, word [rcx + 2]
call fcn.1400312c8
test eax, eax
je 0x1400602f3
movzx ecx, word [rbx + 4]
call fcn.1400312c8
test eax, eax
jne 0x1400602a5
cmp edi, 5
jle 0x1400603ec
movzx eax, word [rbx + 2]
or ax, 0x20
cmp ax, 0x75
jne 0x1400603ec
movzx ecx, word [rbx + 4]
call fcn.1400312c8
test eax, eax
je 0x1400603ec
movzx ecx, word [rbx + 6]
call fcn.1400312c8
test eax, eax
je 0x1400603ec
movzx ecx, word [rbx + 8]
call fcn.1400312c8
test eax, eax
je 0x1400603ec
movzx ecx, word [rbx + 0xa]
call fcn.1400312c8
test eax, eax
jmp 0x1400603e6
movzx ecx, word [rcx]
cmp ecx, 0x3d
jg 0x1400603bb
je 0x140060415
cmp ecx, 0x27
jg 0x14006039e
je 0x140060395
cmp ecx, 0x21
je 0x140060415
jle 0x1400602a5
cmp ecx, 0x23
jle 0x1400603ec
cmp ecx, 0x24
je 0x140060415
cmp ecx, 0x26
jne 0x1400602a5
and r8d, 0x500000
jmp 0x140060410
and r8d, 0x100020
jmp 0x140060410
cmp ecx, 0x2c
jle 0x140060415
cmp ecx, 0x2f
je 0x140060415
cmp ecx, 0x39
jle 0x1400602a5
cmp ecx, 0x3b
jle 0x140060415
cmp ecx, 0x3c
jmp 0x1400603e6
sub ecx, 0x3e
je 0x1400603ec
sub ecx, 1
je 0x140060427
sub ecx, 1
je 0x140060415
sub ecx, 0x1b
je 0x1400603fc
sub ecx, 2
je 0x1400603fc
sub ecx, 1
je 0x1400603ec
sub ecx, 2
je 0x1400603ec
sub ecx, 0x1b
je 0x1400603ec
cmp ecx, 2
jne 0x1400602a5
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r9d, r9d
jne 0x1400602a5
shr r8, 0x1d
not r8d
and r8d, 1
mov eax, r8d
jmp 0x1400603f1
test r9d, r9d
jne 0x1400602a5
and r8d, 0x100000
jmp 0x140060410
and r8d, 0x140000
jmp 0x140060410