joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400acd80
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov r14, rdx
mov rsi, rcx
lea rbp, [rcx + 0x18]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
mov rbx, qword [r15]
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov r8d, eax
mov rdx, rbx
call fcn.1400ad430
mov rdi, qword [rsi + 0x88]
and rdi, rax
add rdi, rdi
mov rbx, qword [rsi + 0x70]
mov rbx, qword [rbx + rdi*8]
mov rax, qword [rsi + 0x70]
mov rdx, qword [rsi + 0x60]
cmp qword [rax + rdi*8], rdx
jne 0x1400acec1
mov rax, rdx
cmp rbx, rax
je 0x1400acf08
mov rdx, qword [r15]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400acece
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
mov rdx, qword [rsi + 0x60]
test eax, eax
je 0x1400acf08
cmp rbx, rdx
je 0x1400acf25
mov rdi, qword [rbx + 0x28]
cmp qword [rsi + 0x40], 0
jne 0x1400acf10
mov rax, qword [rsi + 0x98]
cmp rdi, rax
je 0x1400ace6b
mov rcx, qword [rdi]
cmp rax, rcx
jne 0x1400aced6
mov rax, qword [rsi + 0x48]
lock inc qword [rax + 0x40]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x1400ace85
lock inc dword [rdx + 8]
mov rdx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x18]
mov qword [r14], rax
mov qword [r14 + 8], rdx
test rbp, rbp
je 0x1400acea4
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov rax, qword [rax + rdi*8 + 8]
mov rax, qword [rax]
jmp 0x1400acdfc
mov rbx, qword [rbx]
jmp 0x1400acde7
mov rdx, qword [rdi + 8]
mov qword [rdx], rcx
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rdi
mov r8, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov qword [rdi + 8], r8
jmp 0x1400ace6b
mov rbx, rdx
jmp 0x1400ace3f
lea rcx, [rdi + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x1400ace57
mov rax, qword [rsi + 0x48]
lock inc qword [rax + 0x48]
and qword [r14], 0
and qword [r14 + 8], 0
jmp 0x1400ace90
Function at 0x1400acf44
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rbx, qword [r8]
mov rsi, rcx
mov rcx, rbx
mov r15, r8
mov rdi, rdx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov r8d, eax
mov rdx, rbx
call fcn.1400ad430
mov rbx, qword [rsi + 0x18]
mov r14, rax
and r14, qword [rsi + 0x30]
add r14, r14
mov rbx, qword [rbx + r14*8]
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsi + 8]
cmp qword [rax + r14*8], rcx
jne 0x1400acffb
mov rax, rcx
cmp rbx, rax
je 0x1400ad010
mov rdx, qword [r15]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400ad005
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400ad00a
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
mov rax, qword [rax + r14*8 + 8]
mov rax, qword [rax]
jmp 0x1400acfa6
mov rbx, qword [rbx]
jmp 0x1400acf95
mov rbx, qword [rsi + 8]
jmp 0x1400acfd9
mov qword [rdi], rcx
jmp 0x1400acfdc
Function at 0x1400ad020
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x20], r9b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rdi, rdx
mov rbp, rcx
lea rsi, [rcx + 0x18]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rsp + 0x20], rsi
mov r12, qword [r14 + 0x10]
mov rdx, r14
mov r15, qword [r14 + 0x18]
cmp r15, 8
jb 0x1400ad06e
mov rdx, qword [r14]
lea r8, [r12 + r12]
call fcn.1400ad430
mov r11, rax
movzx r10d, byte [r14 + 0x20]
mov r8d, r10d
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rax, 0x100000001b3
imul r8, rax
mov rcx, r11
shl rcx, 6
mov rdx, r11
shr rdx, 2
add rcx, r8
mov eax, 0x9e3779b9
add rax, rdx
add rcx, rax
xor r11, rcx
mov rax, qword [rbp + 0x88]
and rax, r11
shl rax, 4
mov r8, qword [rbp + 0x70]
mov rdx, qword [r8 + rax]
mov rbx, rdx
lea r9, [rax + 8]
mov rcx, qword [rbp + 0x60]
cmp rdx, rcx
jne 0x1400ad1bf
mov rax, rcx
cmp rbx, rax
je 0x1400ad278
lea r13, [rbx + 0x10]
mov rax, r14
cmp r15, 8
jb 0x1400ad102
mov rax, qword [r14]
mov r11, qword [r13 + 0x10]
mov qword [rsp + 0x80], r13
mov rsi, qword [r13 + 0x18]
mov qword [rsp + 0x90], rsi
cmp rsi, 8
lea rsi, [rbp + 0x18]
jb 0x1400ad134
mov rsi, qword [r13]
mov qword [rsp + 0x80], rsi
lea rsi, [rbp + 0x18]
cmp r11, r12
jne 0x1400ad270
test r11, r11
jne 0x1400ad1cb
cmp byte [r13 + 0x20], r10b
jne 0x1400ad270
lea rax, [rbx + 0x10]
cmp qword [rsp + 0x90], 8
jb 0x1400ad162
mov rax, qword [rax]
cmp r15, 8
jb 0x1400ad16b
mov r14, qword [r14]
test r12, r12
jne 0x1400ad24e
cmp rbx, rcx
jne 0x1400ad218
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x48]
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
test rsi, rsi
je 0x1400ad1a3
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [r9 + r8]
mov rax, qword [rax]
jmp 0x1400ad0e9
sub qword [rsp + 0x80], rax
mov rsi, qword [rsp + 0x80]
movzx esi, word [rax + rsi]
mov word [rsp + 0x98], si
cmp si, word [rax]
lea rsi, [rbp + 0x18]
mov rcx, qword [rbp + 0x60]
jb 0x1400ad270
movzx esi, word [rax]
cmp word [rsp + 0x98], si
lea rsi, [rbp + 0x18]
ja 0x1400ad270
cmp r11, 1
je 0x1400ad146
dec r11
add rax, 2
jmp 0x1400ad1d3
mov rdx, qword [rbx + 0x48]
mov rcx, rbp
call fcn.1400fffd0
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x40]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400ad23e
lock inc dword [rcx + 8]
mov rcx, qword [rbx + 0x40]
mov rax, qword [rbx + 0x38]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
jmp 0x1400ad18f
sub r14, rax
movzx edx, word [rax + r14]
cmp dx, word [rax]
jb 0x1400ad278
ja 0x1400ad278
cmp r12, 1
je 0x1400ad174
dec r12
add rax, 2
jmp 0x1400ad251
mov rbx, qword [rbx]
jmp 0x1400ad0dd
mov rbx, rcx
jmp 0x1400ad174
Function at 0x1400ad290
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, qword [r8 + 0x18]
mov rdi, r8
mov rbx, qword [r8 + 0x10]
mov rsi, rcx
mov rdx, r8
cmp rbp, 8
jb 0x1400ad2cb
mov rdx, qword [r8]
lea r8, [rbx + rbx]
call fcn.1400ad430
movzx r15d, byte [rdi + 0x20]
mov r11, rax
mov r13, qword [rsi + 8]
movabs rax, 0xcbf29ce484222325
mov r8d, r15d
mov rcx, r11
xor r8, rax
shl rcx, 6
movabs rax, 0x100000001b3
mov rdx, r11
shr rdx, 2
imul r8, rax
mov eax, 0x9e3779b9
add rdx, rax
add rcx, r8
mov rax, qword [rsi + 0x18]
add rdx, rcx
xor rdx, r11
and rdx, qword [rsi + 0x30]
add rdx, rdx
mov r14, qword [rax + rdx*8]
lea r12, [rax + rdx*8]
mov rcx, r14
cmp r14, r13
jne 0x1400ad413
mov rax, r13
cmp rcx, rax
je 0x1400ad3ed
mov rax, rdi
cmp rbp, 8
jb 0x1400ad354
mov rax, qword [rdi]
mov rsi, qword [rcx + 0x28]
lea r10, [rcx + 0x10]
mov rdx, qword [rcx + 0x20]
cmp rsi, 8
jb 0x1400ad36a
mov r10, qword [rcx + 0x10]
cmp rdx, rbx
jne 0x1400ad420
test rdx, rdx
je 0x1400ad3a4
sub r10, rax
nop dword [rax + rax]
movzx r8d, word [rax + r10]
cmp r8w, word [rax]
ja 0x1400ad420
jb 0x1400ad420
cmp rdx, 1
je 0x1400ad3a4
dec rdx
add rax, 2
jmp 0x1400ad380
cmp byte [rcx + 0x30], r15b
jne 0x1400ad420
lea rax, [rcx + 0x10]
cmp rsi, 8
jb 0x1400ad3b7
mov rax, qword [rax]
cmp rbp, 8
jb 0x1400ad3c0
mov rdi, qword [rdi]
test rbx, rbx
je 0x1400ad3ea
sub rdi, rax
nop dword [rax + rax]
movzx edx, word [rax + rdi]
cmp dx, word [rax]
ja 0x1400ad3ed
jb 0x1400ad3ed
cmp rbx, 1
je 0x1400ad3ea
dec rbx
add rax, 2
jmp 0x1400ad3d0
mov r13, rcx
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov qword [rax], r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [r12 + 8]
mov rax, qword [rax]
jmp 0x1400ad33f
mov rcx, qword [rcx]
jmp 0x1400ad333

Function at 0x1400ad430
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400ad460
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x1400ad442
mov rax, rcx
ret
Function at 0x1400af94c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
lea r15, [rcx + 0xf8]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rbp + 0x38], r15
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x1400af994
mov rbx, qword [rbx]
movabs r8, 0xcbf29ce484222325
mov rcx, r8
xor edx, edx
movabs r10, 0x100000001b3
add r9, r9
je 0x1400af9c5
movzx eax, byte [rdx + rbx]
xor rcx, rax
imul rcx, r10
inc rdx
cmp rdx, r9
jb 0x1400af9b2
mov rax, r14
shl rax, 6
mov rdx, r14
shr rdx, 2
add rcx, rax
mov r9d, 0x9e3779b9
add r9, rdx
add r9, rcx
xor r9, r14
mov qword [rbp + 0x40], r9
xor ecx, ecx
movzx eax, byte [rbp + rcx + 0x40]
xor r8, rax
imul r8, r10
inc rcx
cmp rcx, 8
jb 0x1400af9eb
mov rcx, qword [rdi + 0xe8]
and rcx, r8
add rcx, rcx
mov r8, qword [rdi + 0xd0]
mov r10, qword [r8 + rcx*8]
mov rdx, qword [rdi + 0xc0]
cmp qword [r8 + rcx*8], rdx
jne 0x1400afa38
mov rax, rdx
cmp r10, rax
je 0x1400afa42
cmp qword [r10 + 0x10], r9
je 0x1400afa45
mov r10, qword [r10]
jmp 0x1400afa1f
mov rax, qword [r8 + rcx*8 + 8]
mov rax, qword [rax]
jmp 0x1400afa28
mov r10, rdx
add rdi, 0xb8
mov r14, qword [rbp + 0x58]
cmp r10, qword [rdi + 8]
je 0x1400afac2
and qword [rsi], 0
and qword [rsi + 8], 0
mov rdx, qword [r10 + 0x20]
test rdx, rdx
je 0x1400afa70
lock inc dword [rdx + 8]
mov rdx, qword [r10 + 0x20]
mov rax, qword [r10 + 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
test r15, r15
je 0x1400afa90
mov rcx, r15
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x1400afab1
mov rax, qword [rcx]
cmp rcx, r14
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x1401147b6.0]
and qword [r14 + 0x38], 0
mov rax, rsi
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.140239ec8
mov rbx, rax
lea r8, [rbp + 0x40]
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.1400dbde4
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
and qword [rbx], 0
and qword [rbx + 8], 0
mov qword [rax + 0x18], rcx
mov qword [rbp + 0x48], rdx
mov rcx, qword [rax + 0x20]
mov qword [rax + 0x20], rdx
test rcx, rcx
je 0x1400afb10
call fcn.14007e8c0
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400afb1e
call fcn.14007e8c0
lea rdx, [rbp + 0x40]
call fcn.1400dd360
mov r11, rax
and r11, qword [rdi + 0x30]
mov rcx, r11
add rcx, rcx
mov r10, qword [rdi + 0x18]
mov r10, qword [r10 + rcx*8]
mov rbx, qword [rbp + 0x40]
mov r8, r11
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.1400de6ec
cmp r10, qword [rax]
je 0x1400afb63
cmp qword [r10 + 0x10], rbx
je 0x1400afa56
mov r10, qword [r10]
jmp 0x1400afb40
mov r10, qword [rdi + 8]
jmp 0x1400afa56
Function at 0x1400b1938
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor ebx, ebx
mov eax, 0x5a4d
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rbx
cmp word [rcx], ax
jne 0x1400b1a1d
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x108
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
movsxd r9, dword [rsi + 0x3c]
lea rax, [rsp + 0x30]
mov r8d, 0x108
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400aaa40
test eax, eax
js 0x1400b1a16
mov rax, qword [rsp + 0x30]
add rax, 0xffffffffffffff08
test rax, 0xffffffffffffffef
jne 0x1400b1a1d
cmp dword [rsp + 0x40], 0x4550
mov eax, 0x14c
jne 0x1400b19f9
mov eax, dword [rsp + 0x48]
mov bl, 1
mov rcx, qword [rdi]
mov dword [rcx + 0x194], eax
mov rcx, qword [rdi]
mov eax, dword [rbp - 0x68]
mov dword [rcx + 0x198], eax
mov rax, qword [rdi]
movzx ecx, word [rsp + 0x44]
mov dword [rax + 0x1a0], ecx
mov al, bl
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140123570
add rsp, 0x160
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp eax, 0x800703e3
je 0x1400b1a21
xor al, al
jmp 0x1400b19fb
mov rax, qword [rdi]
bts dword [rax + 0x16c], 0x10
jmp 0x1400b1a1d

Function at 0x1400ba574
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov r11, r8
lea rdx, [r8 + 0x10]
mov rdi, rcx
call fcn.140066e50
movzx edx, byte [r11 + 0x30]
movabs rcx, 0xcbf29ce484222325
xor rdx, rcx
mov r8, rax
shl r8, 6
movabs rcx, 0x100000001b3
imul rdx, rcx
mov rcx, rax
add rdx, r8
shr rcx, 2
mov r8d, 0x9e3779b9
add r8, rcx
mov rcx, qword [rdi + 0x18]
add r8, rdx
xor r8, rax
and r8, qword [rdi + 0x30]
add r8, r8
cmp qword [rcx + r8*8 + 8], r11
jne 0x1400ba60a
cmp qword [rcx + r8*8], r11
jne 0x1400ba5ff
mov rax, qword [rdi + 8]
mov qword [rcx + r8*8], rax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 8]
jmp 0x1400ba603
mov rax, qword [r11 + 8]
mov qword [rcx + r8*8 + 8], rax
jmp 0x1400ba617
cmp qword [rcx + r8*8], r11
jne 0x1400ba617
mov rax, qword [r11]
mov qword [rcx + r8*8], rax
lea rcx, [rdi + 8]
mov r8, r11
mov rdx, rsi
call fcn.1400bae18
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bd190
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r14, qword [r8 + 0x18]
mov rbx, r8
mov r10, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
mov r9, r8
cmp r14, 8
jb 0x1400bd1c2
mov r9, qword [r8]
lea r8, [r10 + r10]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400bd1f5
movabs rdi, 0x100000001b3
movzx eax, byte [rdx + r9]
inc rdx
xor rcx, rax
imul rcx, rdi
cmp rdx, r8
jb 0x1400bd1e1
mov rax, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x30]
mov rsi, qword [r11 + 8]
and rdx, rcx
add rdx, rdx
mov qword [rsp + 0x20], rbp
mov rdi, qword [rax + rdx*8]
lea r12, [rax + rdx*8]
mov rcx, rdi
jmp 0x1400bd2e2
mov rax, rsi
cmp rcx, rax
je 0x1400bd2bd
lea r11, [rcx + 0x10]
mov rax, rbx
cmp r14, 8
jb 0x1400bd238
mov rax, qword [rbx]
mov rbp, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x10]
cmp rbp, 8
jb 0x1400bd249
mov r11, qword [r11]
cmp rdx, r10
jne 0x1400bd2df
test rdx, rdx
je 0x1400bd27c
sub r11, rax
nop word [rax + rax]
movzx r8d, word [rax + r11]
cmp r8w, word [rax]
ja 0x1400bd2df
jb 0x1400bd2df
cmp rdx, 1
je 0x1400bd27c
dec rdx
add rax, 2
jmp 0x1400bd260
lea rax, [rcx + 0x10]
cmp rbp, 8
jb 0x1400bd289
mov rax, qword [rax]
cmp r14, 8
jb 0x1400bd292
mov rbx, qword [rbx]
test r10, r10
je 0x1400bd2ba
sub rbx, rax
nop word [rax + rax]
movzx edx, word [rax + rbx]
cmp dx, word [rax]
ja 0x1400bd2bd
jb 0x1400bd2bd
cmp r10, 1
je 0x1400bd2ba
dec r10
add rax, 2
jmp 0x1400bd2a0
mov rsi, rcx
mov rbp, qword [rsp + 0x20]
mov rax, r15
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov qword [r15], rsi
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
mov rcx, qword [rcx]
cmp rdi, rsi
je 0x1400bd21c
mov rax, qword [r12 + 8]
mov rax, qword [rax]
jmp 0x1400bd21f
Function at 0x1400c2358
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x20], 0
mov rbx, r8
mov r8, qword [rbp + 0x40]
mov r14, r9
mov esi, edx
mov byte [r9], 1
mov rdi, rcx
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov r9d, 0x20019
call fcn.1400c2524
mov r15d, eax
test eax, eax
je 0x1400c2414
call fcn.1400a4e1c
cmp dword [rax], 3
jbe 0x1400c2404
cmp qword [rbx + 0x18], 8
mov dword [rbp + 0x38], esi
jb 0x1400c23be
mov rbx, qword [rbx]
lea rcx, str.Could_not_open_or_create_the_registry_path._Return_default_value
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rcx
lea rdx, [0x1403e727b]
lea rcx, [rbp + 0x38]
mov dword [rbp - 0x30], r15d
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140003c14
lea rcx, [rbp - 0x20]
call fcn.1401080e0
mov eax, esi
jmp 0x1400c24ff
cmp qword [rdi + 0x18], 8
mov rdx, rdi
mov dword [rbp - 0x2c], 4
jb 0x1400c2428
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x28]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x1400c24ed
call fcn.1400a4e1c
cmp dword [rax], 4
jbe 0x1400c24cf
cmp qword [rbx + 0x18], 8
mov dword [rbp + 0x38], esi
mov dword [rbp - 0x30], r15d
jb 0x1400c2476
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov qword [rbp - 0x10], rbx
jb 0x1400c2484
mov rdi, qword [rdi]
lea rcx, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp - 0x18], rdi
mov qword [rbp - 8], rcx
lea rdx, [0x1403e71ff]
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400062f8
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400c240d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x1400c240d
mov ebx, dword [rbp - 0x28]
lea rcx, [rbp - 0x20]
mov byte [r14], 0
call fcn.1401080e0
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400d5358
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rbx + 0x7c]
mov dil, 1
cmp ecx, 0xffffffff
je 0x1400d5543
cmp ecx, 0x7c
je 0x1400d5543
cmp ecx, 0x29
jne 0x1400d539e
cmp dword [rbx + 0x1c], 0
jne 0x1400d5543
test dword [rbx + 0x80], 0x10000000
je 0x1400d54fb
cmp ecx, 0x2e
jne 0x1400d53be
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.1400d1244
mov rcx, rbx
call fcn.1400d5790
jmp 0x1400d54ec
cmp ecx, 0x5c
jne 0x1400d5422
mov rcx, rbx
call fcn.1400d5790
test byte [rbx + 0x80], 0x80
je 0x1400d5415
cmp word [rbx + 0x78], 0x62
jne 0x1400d53f6
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.1400d1244
mov rcx, rbx
call fcn.1400d5790
jmp 0x1400d54f4
cmp word [rbx + 0x78], 0x42
jne 0x1400d5415
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.1400d1244
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x1400d53e9
mov rcx, rbx
call fcn.1400d5664
jmp 0x1400d54ec
cmp ecx, 0x5b
jne 0x1400d544d
mov rcx, rbx
call fcn.1400d5790
mov rcx, rbx
call fcn.14011bbec
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.140121b00
jmp 0x1400d54ec
cmp ecx, 0x28
jne 0x1400d5478
mov rcx, rbx
call fcn.1400d5790
mov rcx, rbx
call fcn.14015d504
mov edx, MsiGetActiveDatabase
mov rcx, rbx
mov dil, al
lea r8d, [rdx - 0x24]
call fcn.140121b00
jmp 0x1400d54e7
cmp ecx, 0x5e
jne 0x1400d5485
lea edx, [rcx - 0x5c]
jmp 0x1400d53e0
cmp ecx, 0x24
jne 0x1400d5492
lea edx, [rcx - 0x21]
jmp 0x1400d53e0
cmp ecx, 0x3f
je 0x1400d5531
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1400d5531
cmp ecx, 0x7b
je 0x1400d5531
cmp ecx, 0x7d
jne 0x1400d54c1
test dword [rbx + 0x80], 0x10000000
je 0x1400d550d
cmp ecx, 0x5d
jne 0x1400d54d2
test dword [rbx + 0x80], 0x10000000
je 0x1400d551f
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1400d5a68
mov rcx, rbx
call fcn.1400d5790
test dil, dil
je 0x1400d54f4
mov rcx, rbx
call fcn.1400d5558
mov al, 1
jmp 0x1400d5367
mov ecx, 5
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
nop dword [rax + rax]
int3
mov ecx, 6
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
nop dword [rax + rax]
int3
mov ecx, 4
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
nop dword [rax + rax]
int3
mov ecx, 0xa
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
nop dword [rax + rax]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret