joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005178c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x20
call fcn.1800903f0
mov r8, qword [rbx]
mov qword [rax], r8
mov r8, qword [0x18010f2b8]
mov qword [rax + 8], r8
movups xmm0, xmmword [rdi]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180051838]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x18005180e
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.18008eb50
int3
Function at 0x180052980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
call fcn.180054a54
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.180079680
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.1800903f0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.180008f74
nop
mov dword [rbp - 0x18], WSASetLastError
mov byte [rbp - 0x14], 0x1b
mov byte [rbp - 0x13], 0xb
mov byte [rbp - 0x12], 0
mov byte [rbp - 0x11], 0x3f
mov byte [rbp - 0x10], 0x1b
mov byte [rbp - 0xf], 0xd
mov byte [rbp - 0xe], 0x1c
mov byte [rbp - 0xd], 0x2e
mov byte [rbp - 0xc], 0x19
mov byte [rbp - 0xb], 0xa
mov byte [rbp - 0xa], 0xa
mov byte [rbp - 9], 9
mov byte [rbp - 8], 0x1e
mov byte [rbp - 7], 0x1f
xor eax, eax
mov byte [rbp - 6], al
mov al, byte [rbp - 0x14]
xor edx, edx
mov al, byte [rbp + rdx - 0x14]
mov ecx, dword [rbp - 0x18]
xor cl, al
mov byte [rbp + rdx - 0x14], cl
inc rdx
cmp rdx, 0xe
jb 0x180052a75
mov byte [rbp - 6], 0
lea rdx, [rbp - 0x14]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180052ac9
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x180052844]
mov rdx, rax
mov rcx, rsi
call fcn.180073a20
mov qword [0x18010f2c8], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180059e1c
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x180059fd8
cmp qword [rcx + 0x178], 0
je 0x180059fd8
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.18005aa44
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steam_api64.dll_SteamAPI_ISteamApps_RequestPublisherOwnedAppData]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x180056a04]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x180059ed2
mov qword [rdi + 0x168], rax
call fcn.18001cc5c
mov rcx, qword [rdi + 0x168]
call fcn.180019cd8
mov rsi, qword [0x18010ece0]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x180059f1d
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x180059f4f
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memset]
mov qword [rbx + 0x60], 0x100
jmp 0x180059f51
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.180018ff4
mov rcx, rdi
call fcn.18005526c
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.180018704
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x18005b85c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x11
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005b869
mov byte [rcx + 0x15], r10b
ret

Function at 0x18005b884
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x16
jb 0x18005b88b
mov byte [rcx + 0x1a], 0
ret
Function at 0x18005b8ac
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x15
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005b8b9
mov byte [rcx + 0x19], r10b
ret

Function at 0x18005b8d4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xd
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005b8e1
mov byte [rcx + 0x11], r10b
ret

Function at 0x18005b918
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x14
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005b925
mov byte [rcx + 0x18], r10b
ret

Function at 0x18005b95c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x17
jb 0x18005b963
mov byte [rcx + 0x1b], 0
ret

Function at 0x18005b9bc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x23
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005b9c9
mov byte [rcx + 0x27], r10b
ret

Function at 0x18005ba00
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x1c
jb 0x18005ba07
mov byte [rcx + 0x20], 0
ret

Function at 0x18005ba44
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x13
jb 0x18005ba4b
mov byte [rcx + 0x17], 0
ret

Function at 0x18005baa4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xc
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bab1
mov byte [rcx + 0x10], r10b
ret

Function at 0x18005bacc
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x1a
jb 0x18005bad3
mov byte [rcx + 0x1e], 0
ret

Function at 0x18005baf4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x12
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bb01
mov byte [rcx + 0x16], r10b
ret

Function at 0x18005bb38
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x11
jb 0x18005bb3f
mov byte [rcx + 0x15], 0
ret

Function at 0x18005bc5c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x16
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18005bc69
mov byte [rcx + 0x1a], r10b
ret
Function at 0x18005bcbc
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x18
jb 0x18005bcc3
mov byte [rcx + 0x1c], 0
ret

Function at 0x18005c754
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x18010ece8]
mov rbp, rcx
lea r14, [rdi + 0x90]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [rbp + 0xc]
lea r15, [rdi + 8]
mov dword [rsp + 0x50], r9d
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x50]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x18005c798
mov rax, qword [rdi + 0x38]
mov rcx, qword [rdi + 0x20]
and rax, rdx
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, qword [rdi + 0x10]
je 0x18005c7e8
mov rcx, qword [rcx + rax*8]
jmp 0x18005c7e0
cmp rbx, rcx
je 0x18005c7e8
mov rbx, qword [rbx + 8]
cmp r9d, dword [rbx + 0x10]
jne 0x18005c7d7
jmp 0x18005c7ea
xor ebx, ebx
test rbx, rbx
cmove rbx, qword [rdi + 0x10]
cmp rbx, qword [rdi + 0x10]
je 0x18005c873
mov rdx, qword [rbx + 0x20]
mov rsi, qword [rbx + 0x18]
jmp 0x18005c80b
cmp qword [rsi], rbp
je 0x18005c810
add rsi, 8
cmp rsi, rdx
jne 0x18005c802
cmp rsi, rdx
je 0x18005c853
lea rax, [rsi + 8]
jmp 0x18005c82e
mov rcx, qword [rax]
cmp rcx, rbp
je 0x18005c82a
mov qword [rsi], rcx
add rsi, 8
add rax, 8
cmp rax, rdx
jne 0x18005c81b
cmp rsi, rdx
je 0x18005c853
mov rdi, qword [rbx + 0x20]
mov rcx, rsi
sub rdi, rdx
mov r8, rdi
call qword [sym.imp.msvcrt.dll_memmove]
lea rax, [rdi + rsi]
mov qword [rbx + 0x20], rax
mov rax, qword [rbx + 0x20]
sub rax, qword [rbx + 0x18]
test rax, 0xfffffffffffffff8
jne 0x18005c873
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.18003e798
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800659b8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edi, edi
xor ebx, ebx
xor esi, esi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x180065a51
cmp esi, edi
jne 0x180065a09
lea r15d, [rdi + 0x3e8]
mov edx, edi
mov r8d, r15d
mov rcx, rbx
call fcn.1800640b8
test rax, rax
je 0x180065a64
mov rbx, rax
mov edi, r15d
call qword [sym.imp.msvcrt.dll__errno]
movsxd rcx, esi
mov r9, r14
add rcx, rbx
mov edx, 1
and dword [rax], 0
mov eax, edi
sub eax, esi
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, r14
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x180065a8d
mov rcx, r14
add esi, r15d
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
je 0x1800659e6
cmp esi, edi
jne 0x180065acb
lea r8d, [rdi + 1]
mov edx, edi
mov rcx, rbx
call fcn.1800640b8
test rax, rax
jne 0x180065ac8
lea r8, str.out_of_memory
mov edx, 0xc8
mov rcx, rbp
call fcn.18003f31c
test rbx, rbx
je 0x180065a89
mov rax, qword [fcn.180094c84]
mov rcx, rbx
call rax
xor eax, eax
jmp 0x180065af4
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0
je 0x180065aa8
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.msvcrt.dll_strerror]
jmp 0x180065aaf
lea rax, str.Error_reading_file
mov r9, rax
lea r8, [0x1800ce6b4]
mov edx, 0xc8
mov rcx, rbp
call fcn.18003f31c
jmp 0x180065a78
mov rbx, rax
movsxd rax, esi
mov rdx, rbp
mov rcx, rbx
mov byte [rax + rbx], 0
call fcn.1800652fc
mov rdi, rax
test rbx, rbx
je 0x180065af1
mov rdx, qword [fcn.180094c84]
mov rcx, rbx
call rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x180066d08
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
lea rbx, [0x1800c05a0]
mov r9d, ecx
not r9d
cmp r8, 4
jb 0x180066d5a
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
xor r11d, r11d
movzx ecx, byte [r11 + rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rbx + rax*4]
cmp r11, 4
jl 0x180066d31
add rdx, 4
sub r10, 1
jne 0x180066d2e
test r8, r8
je 0x180066d7c
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
sub r8, 1
jne 0x180066d5f
mov rbx, qword [rsp + 8]
not r9d
mov eax, r9d
ret
Function at 0x180070e00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, rdx
mov rdi, r8
sub rax, r8
mov rsi, rdx
sub rax, 5
cmp rax, 0xffffffff80000000
jle 0x180070f0c
cmp rax, 0x7fffffff
jge 0x180070f0c
mov dword [rbp - 0x20], 0x23
mov eax, dword [rbp - 0x20]
xor al, 0x6a
mov byte [rbp - 0x1c], al
mov eax, dword [rbp - 0x20]
inc al
xor al, 0x6d
mov byte [rbp - 0x1b], al
mov eax, dword [rbp - 0x20]
add al, 2
xor al, 0x70
mov byte [rbp - 0x1a], al
mov eax, dword [rbp - 0x20]
add al, 3
xor al, 0x20
mov byte [rbp - 0x19], al
mov eax, dword [rbp - 0x20]
add al, 4
xor al, 0x30
mov byte [rbp - 0x18], al
mov eax, dword [rbp - 0x20]
add al, 5
xor al, 0x78
mov byte [rbp - 0x17], al
mov eax, dword [rbp - 0x20]
add al, 6
xor al, 0x25
mov byte [rbp - 0x16], al
mov eax, dword [rbp - 0x20]
add al, 7
xor al, 0x30
mov byte [rbp - 0x15], al
mov eax, dword [rbp - 0x20]
add al, 8
xor al, 0x31
mov byte [rbp - 0x14], al
mov eax, dword [rbp - 0x20]
add al, 9
xor al, 0x36
mov byte [rbp - 0x13], al
mov eax, dword [rbp - 0x20]
add al, 0xa
xor al, 0x6c
mov byte [rbp - 0x12], al
mov eax, dword [rbp - 0x20]
add al, 0xb
xor al, 0x6c
mov byte [rbp - 0x11], al
mov eax, dword [rbp - 0x20]
add al, 0xc
xor al, 0x78
mov byte [rbp - 0x10], al
xor eax, eax
mov byte [rbp - 0xf], al
movzx eax, byte [rbp - 0x1c]
xor eax, eax
nop dword [rax]
movzx ecx, byte [rbp + rax - 0x1c]
mov edx, dword [rbp - 0x20]
add dl, al
xor dl, cl
mov byte [rbp + rax - 0x1c], dl
inc rax
cmp rax, 0xd
jb 0x180070ed0
mov r8, rsi
mov byte [rbp - 0xf], 0
lea rdx, [rbp - 0x1c]
mov rcx, rdi
call fcn.180079c60
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
mov dword [rbp - 0x30], 0x26
mov eax, dword [rbp - 0x30]
xor al, 0x6a
mov qword [rsp + 0x60], rbx
mov byte [rbp - 0x2c], al
mov eax, dword [rbp - 0x30]
inc al
xor al, 0x6d
mov byte [rbp - 0x2b], al
mov eax, dword [rbp - 0x30]
add al, 2
xor al, 0x70
mov byte [rbp - 0x2a], al
mov eax, dword [rbp - 0x30]
add al, 3
xor al, 0x20
mov byte [rbp - 0x29], al
mov eax, dword [rbp - 0x30]
add al, 4
xor al, 0x5b
mov byte [rbp - 0x28], al
mov eax, dword [rbp - 0x30]
add al, 5
xor al, 0x72
mov byte [rbp - 0x27], al
mov eax, dword [rbp - 0x30]
add al, 6
xor al, 0x69
mov byte [rbp - 0x26], al
mov eax, dword [rbp - 0x30]
add al, 7
xor al, 0x70
mov byte [rbp - 0x25], al
mov eax, dword [rbp - 0x30]
add al, 8
xor al, 0x5d
mov byte [rbp - 0x24], al
xor eax, eax
mov byte [rbp - 0x23], al
movzx eax, byte [rbp - 0x2c]
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rbp + rax - 0x2c]
mov edx, dword [rbp - 0x30]
add dl, al
xor dl, cl
mov byte [rbp + rax - 0x2c], dl
inc rax
cmp rax, 9
jb 0x180070f80
lea rdx, [rbp - 0x2c]
mov byte [rbp - 0x23], 0
mov rcx, rdi
call fcn.180079c60
mov r8d, 8
mov qword [rbp + 0x18], rsi
lea rdx, [rbp + 0x18]
mov rbx, rax
lea rcx, [rax + rdi]
call fcn.18007a850
mov rsi, qword [rsp + 0x70]
add rax, rbx
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x180070fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x48], rbp
mov rbp, r8
mov qword [rsp + 0x50], rsi
mov rsi, rdx
mov qword [rsp + 0x20], r14
mov r14, rcx
mov ecx, 0x10
call fcn.1800903f0
mov qword [rsp + 0x40], rax
mov rbx, rax
test rax, rax
je 0x18007106f
mov qword [rsp + 0x28], rdi
lea rax, vtable.MemoryAllocator.0
mov rdi, rbp
mov qword [rbx], rax
and rdi, 0xfffffffffffff000
mov qword [rbx + 8], 0
test rbp, rbp
cmove rdi, rbp
nop dword [rax]
add rdi, 0x1000
mov r9d, 0x40
mov rcx, rdi
mov r8d, 0x3000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 8], rax
test rax, rax
je 0x180071040
mov rdi, qword [rsp + 0x28]
jmp 0x180071071
xor ebx, ebx
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 8]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov qword [rsp + 0x40], rbx
cmp rdx, qword [rcx + 0x10]
je 0x1800710a5
mov qword [rdx], rbx
add qword [rcx + 8], 8
mov rax, qword [rbx + 8]
add rsp, 0x30
pop rbx
ret
lea r8, [rsp + 0x40]
call fcn.18006d620
mov rax, qword [rbx + 8]
add rsp, 0x30
pop rbx
ret
Function at 0x180073ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov rax, r8
sub rax, rdx
mov r14, rcx
add rax, 0x7ffffffa
mov ecx, 0xfffffffd
cmp rax, rcx
mov r12, r8
mov r8d, 0xe
mov edx, 5
cmova edx, r8d
mov rcx, rsi
call fcn.18007a2c0
lea rcx, [r14 + 8]
mov r8, rsi
mov rdi, rax
lea rdx, [rax + 0x100]
call fcn.180070fe0
mov r9, rdi
mov r8, rsi
mov rdx, rax
mov rcx, r14
mov r15, rax
call fcn.18007ac80
add r15, rax
mov rcx, r15
call fcn.180072430
mov dword [rbp - 0x20], 0x79
lea rbx, [r15 + rax]
mov eax, dword [rbp - 0x20]
xor al, 0x6d
mov byte [rbp - 0x1c], al
mov eax, dword [rbp - 0x20]
inc al
xor al, 0x6f
mov byte [rbp - 0x1b], al
mov eax, dword [rbp - 0x20]
add al, 2
xor al, 0x76
mov byte [rbp - 0x1a], al
mov eax, dword [rbp - 0x20]
add al, 3
xor al, 0x20
mov byte [rbp - 0x19], al
mov eax, dword [rbp - 0x20]
add al, 4
xor al, 0x72
mov byte [rbp - 0x18], al
mov eax, dword [rbp - 0x20]
add al, 5
xor al, 0x63
mov byte [rbp - 0x17], al
mov eax, dword [rbp - 0x20]
add al, 6
xor al, 0x78
mov byte [rbp - 0x16], al
mov eax, dword [rbp - 0x20]
add al, 7
xor al, 0x2c
mov byte [rbp - 0x15], al
mov eax, dword [rbp - 0x20]
add al, 8
xor al, 0x20
mov byte [rbp - 0x14], al
mov eax, dword [rbp - 0x20]
add al, 9
xor al, 0x72
mov byte [rbp - 0x13], al
mov eax, dword [rbp - 0x20]
add al, 0xa
xor al, 0x73
mov byte [rbp - 0x12], al
mov eax, dword [rbp - 0x20]
add al, 0xb
xor al, 0x70
mov byte [rbp - 0x11], al
xor eax, eax
mov byte [rbp - 0x10], al
movzx eax, byte [rbp - 0x1c]
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [rbp + rax - 0x1c]
mov edx, dword [rbp - 0x20]
add dl, al
xor dl, cl
mov byte [rbp + rax - 0x1c], dl
inc rax
cmp rax, 0xc
jb 0x180073dc0
lea rdx, [rbp - 0x1c]
mov byte [rbp - 0x10], 0
mov rcx, rbx
call fcn.180079c60
add rbx, rax
mov rdx, r12
mov r8, rbx
mov rcx, r14
call fcn.18006fd20
add rbx, rax
mov rcx, rbx
call fcn.1800710c0
add rbx, rax
mov r9, rdi
mov rdx, rbx
mov r8, rsi
mov rcx, r14
call fcn.1800704b0
lea rdx, [rdi + rsi]
mov rcx, r14
lea r8, [rax + rbx]
call fcn.180070e00
mov r8, rsi
mov rdx, r15
mov rcx, r14
call fcn.180070e00
sub rdi, rax
mov rdx, rdi
lea rcx, [rax + rsi]
call fcn.18007a8f0
mov rbx, qword [rsp + 0x60]
mov al, 1
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x180075c60
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x180075d2c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x180075d2c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x180075d45
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x180075d1c
cmp byte [rax], 0x5c
jne 0x180075d16
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x180075d16
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x180075d02
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x180075d13
test r8b, 0x10
jne 0x180075d16
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x180075d16
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1800780d0
test edi, edi
jne 0x180075c80
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.180076c30
int3

Function at 0x180078680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800786b4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800786a0
ret