joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013f9b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140fb5d20]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5bfc], ecx
test rbx, rbx
je 0x14013fa1f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.14013fa30
lea rdx, [0x140391a14]
mov rcx, rbx
mov rdi, rax
call fcn.140133c60
mov rbx, rax
test rax, rax
je 0x14013fa1a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x140144270
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x20
mov rbx, qword [0x140fb5d20]
cmp byte [rbx + 0x5bf9], 0
jne 0x1401443ca
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1401443c3
lea rdx, [0x140391a10]
mov qword [rsp + 0x40], rdi
call fcn.140133c60
mov rdi, rax
test rax, rax
je 0x1401443be
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1401443ab
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1401443ab
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1401443ab
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1401443ab
cmp rsi, 0xffffffffffffffff
je 0x1401443ab
mov rax, qword [0x140fb5d20]
test rax, rax
je 0x140144335
inc dword [rax + 0xec]
mov rdx, qword [0x140fb5d30]
mov rcx, rsi
call qword [section..data]
mov rbp, rax
test rax, rax
je 0x1401443ab
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x140144371
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140144387
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140144387
mov rdx, rsi
mov rcx, rbp
call fcn.1401367d0
mov rax, qword [0x140fb5d20]
test rax, rax
je 0x140144399
dec dword [rax + 0xec]
mov rdx, qword [0x140fb5d30]
mov rcx, rbp
call qword [0x140474008]
jmp 0x1401443b4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x5bf9], 1
movss xmm0, dword [rbx + 0x5bfc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14014440d
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5bfc], xmm0
jb 0x14014440d
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1401443fc
call fcn.14013f9b0
jmp 0x140144403
mov byte [rbx + 0xd4], 1
mov dword [rbx + 0x5bfc], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14015c390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x140fb5d20]
mov r10, rcx
mov r9, qword [rcx + 0x180]
movsxd rax, edx
imul rbx, rax, 0x70
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x74], edx
test dword [rbx], 0x10000
movss xmm1, dword [rbx + 0x34]
je 0x14015c3d3
addss xmm1, dword [rcx + 0x8c]
lea rsi, [r9 + 0x100]
movss dword [rsi], xmm1
movss xmm0, dword [rcx + 0xc0]
addss xmm0, dword [rcx + 0x7c]
movss dword [r9 + 0x118], xmm1
subss xmm1, dword [r9 + 0x20]
movss dword [r9 + 0x104], xmm0
subss xmm1, dword [r9 + 0x144]
movss dword [r9 + 0x148], xmm1
mov eax, dword [rcx + 0x88]
mov dword [r9 + 0x138], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x158], eax
movss dword [r9 + 0x21c], xmm0
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x218], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x220], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1bc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xbb], al
cmp byte [rbx + 0x68], 0
je 0x14015c473
xor eax, eax
mov dword [rdi + 0x4778], eax
mov dword [rdi + 0x4780], eax
test dword [rcx + 4], 0x100000
je 0x14015c487
mov r8d, 2
jmp 0x14015c507
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x298]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x238], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x298]
mov rcx, qword [r10 + 0x198]
call fcn.14014e470
cmp byte [rdi + 0x5c98], 0
je 0x14015c545
cmp byte [rbx + 0x68], 0
jne 0x14015c545
xor r8d, r8d
lea rdx, [0x140395c2c]
mov rcx, rsi
call fcn.140136a80
mov dword [rdi + 0x5cc8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14015e5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140fb5d20]
mov r8, qword [rax + 0x4b38]
cmp ecx, 0xffffffff
jne 0x14015e5d0
cmp dword [r8 + 0x74], ecx
cmovne ecx, dword [r8 + 0x74]
cmp ecx, dword [r8 + 0x6c]
mov eax, 0xffffffff
cmove ecx, eax
test byte [r8 + 4], 7
je 0x14015e61b
movzx eax, word [r8 + 0x78]
xor edx, edx
mov word [r8 + 0x218], cx
lea rcx, str.ContextMenu
mov word [r8 + 0x7a], ax
mov byte [r8 + 0x22f], 1
mov r8d, dword [r8]
call fcn.140134960
xor edx, edx
mov ecx, eax
add rsp, 0x28
jmp fcn.14013bb70
add rsp, 0x28
ret
Function at 0x14015e620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140fb5d20]
mov rcx, qword [rax + 0x4b38]
mov r10, qword [rax + 0x3ed8]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x168]
movss xmm4, dword [rcx + 0x168]
movss xmm3, dword [rcx + 0x16c]
movss xmm2, dword [rcx + 0x170]
movss xmm1, dword [rcx + 0x174]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x298]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x238], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x298]
mov rcx, qword [rcx + 0x198]
add rsp, 0x38
jmp fcn.14014e470

Function at 0x14015e6f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140fb5d20]
mov rcx, qword [rax + 0x4b38]
mov r9, qword [rax + 0x3ed8]
movups xmm0, xmmword [r9 + 0x238]
movups xmmword [rcx + 0x168], xmm0
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rcx + 0x148]
movss xmm4, dword [rcx + 0x148]
movss xmm3, dword [rcx + 0x14c]
movss xmm2, dword [rcx + 0x150]
movss xmm1, dword [rcx + 0x154]
movups xmmword [r9 + 0x238], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x226]
mov rcx, qword [rcx + 0x198]
mov rdx, qword [r9 + 0x298]
add rsp, 0x38
jmp fcn.14014e470

Function at 0x140171010
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov ecx, 8
call fcn.140384e20
test rax, rax
je 0x140171032
mov qword [rax], rdi
lea rdi, [rbx + 8]
mov r9, rax
mov qword [rsp + 0x28], rdi
lea r8, [0x140177160]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14017106d
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 6
mov dword [rdi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14017a8a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
mov rbp, rcx
sar rdi, 2
test rdi, rdi
je 0x14017aa7f
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 8]
sub rbx, qword [rcx]
mov qword [rsp + 0x60], r13
sar rbx, 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x14017a8f0
mov eax, reloc.WS2_32.dll_inet_addr
jmp 0x14017a91e
cmp rdi, 0x44
jb 0x14017a8fd
mov eax, 7
jmp 0x14017a91e
cmp rdi, 0x27
jb 0x14017a90a
mov eax, 5
jmp 0x14017a91e
cmp rdi, 7
jb 0x14017a917
mov eax, 3
jmp 0x14017a91e
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x14017a937
mov r15, rdi
mov r8, rdi
mov edx, 0x8b8b8b8b
shl r8, 2
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
test r15, r15
je 0x14017a9ef
mov qword [rsp + 0x58], r12
nop dword [rax + rax]
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea r12, [rsi + rdx*4]
mov r8d, r11d
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
xor r8d, dword [rsi + rdx*4]
xor r8d, dword [r12]
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x14017a9ad
mov rax, rbx
jmp 0x14017a9c2
cmp rcx, rbx
ja 0x14017a9bf
mov rax, qword [rbp]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x14017a9c2
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [r12], r8d
cmp rcx, r15
jb 0x14017a960
mov r12, qword [rsp + 0x58]
add r15, rdi
cmp rcx, r15
jae 0x14017aa6b
inc r14
lea rbp, [rcx - 1]
inc r13
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, r10d
add ecx, dword [rsi + r9*4]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x14017aa01
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140189da0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [0x140fb8300]
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x140189e9b
cmp dword [0x140fb834c], 0x7fffffff
je 0x140189e86
mov r10, qword [0x140474020]
cmp r10, 0xffffffffffffffff
je 0x140189e67
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x140189deb
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140189df2
xor r9d, r9d
lea rdx, [rsp + 0x20]
inc eax
mov rcx, r10
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 4]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140189e5c
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x140189e28
mov rdx, qword [rbx]
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
mov rcx, qword [0x140474020]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140189e5c
lea rcx, [0x140fb8300]
call sub.MSVCP140.dll__Mtx_unlock
mov rcx, rbx
call fcn.1401847a0
add rsp, 0x30
pop rbx
ret
mov qword [0x140474020], 0xffffffffffffffff
lea rcx, [0x140fb8300]
call sub.MSVCP140.dll__Mtx_unlock
call fcn.14019b330
mov rcx, rbx
call fcn.1401847a0
add rsp, 0x30
pop rbx
ret
mov ecx, 6
mov dword [0x140fb834c], 0x7ffffffe
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140195ac0
Capabilities:
Create thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
movss xmm0, dword [0x140395ffc]
call fcn.140140e20
movaps xmm0, xmmword [0x14039b980]
lea rdx, [rbp - 0x40]
xor ecx, ecx
movups xmmword [rbp - 0x40], xmm0
call fcn.14013c860
lea rcx, str.UPDATE_AVAILABLE
call fcn.14016ecd0
mov ecx, 1
call fcn.14013c080
movss xmm0, dword [0x140391bfc]
call fcn.140140e20
call fcn.14016c8b0
lea rcx, str.UPDATE_YOUR_LAUNCHER_TO_THE_nLATEST_VERSION_TO_USE_TONGA_n
call fcn.14016ecd0
call fcn.14016c8b0
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], 0
lea rcx, str.YES__INSTALL_IT_
call fcn.1401675a0
test al, al
je 0x140195bb7
mov ecx, 8
call fcn.140384e20
test rax, rax
je 0x140195b5a
lea rcx, [0x140195d10]
mov qword [rax], rcx
lea rcx, [rbp - 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140177160]
xor ecx, ecx
mov dword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x140195cf7
cmp dword [rbp - 0x38], 0
je 0x140195cec
movaps xmm0, xmmword [rbp - 0x40]
lea rcx, [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140195cec
mov byte [0x140fb5dab], 1
movss xmm1, dword [0x140391c70]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
call fcn.14013f900
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], 0
lea rcx, str.NO__IGNORE_FOR_NOW.
call fcn.1401675a0
test al, al
je 0x140195c46
lea rcx, [0x140fabd60]
lea rdx, [0x140fabda0]
cmp rcx, rdx
je 0x140195c1c
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov r8, qword [0x140fabdb0]
cmovae rdx, qword [0x140fabda0]
call fcn.1401a79b0
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rdx, [0x140fabd80]
mov r8, qword [0x140fabd90]
lea rcx, [0x140fabd40]
cmovae rdx, qword [0x140fabd80]
call fcn.1401a79b0
call fcn.140133c20
movaps xmm7, xmm0
call fcn.140133c40
movaps xmm6, xmm0
subss xmm6, xmm7
call fcn.140133c40
divss xmm0, dword [0x140391c28]
lea rcx, [rbp + 0x10]
mov dword [rbp + 0x14], 0
addss xmm0, xmm6
movss dword [rbp + 0x10], xmm0
call fcn.140140300
movaps xmm1, xmmword [0x140391cd0]
lea rax, [rbp - 0x30]
mov rcx, qword [0x140fb7dc0]
lea r9, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x18]
lea rax, [rbp - 0x40]
movss dword [rbp + 0x20], xmm7
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x20]
movss dword [rbp + 0x24], xmm7
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp + 0x10], 0x3f800000
movups xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x14], 0x3f800000
mov qword [rbp + 0x18], 0
call fcn.140168e50
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbp
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 6
mov dword [rbp - 0x38], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14019bad0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
mov rax, qword [0x140fb3878]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x40], xmm0
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x50], xmm1
nop dword [rax + rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x14019bb00
mov rdx, rcx
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x40]
call fcn.140172b30
mov ecx, 0x28
call fcn.140384e20
test rax, rax
je 0x14019bb53
movups xmm0, xmmword [rsp + 0x40]
lea rcx, [fcn.140189da0]
mov ebx, reloc.WS2_32.dll_ntohs
movups xmm1, xmmword [rsp + 0x50]
mov byte [rsp + 0x40], 0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rax + 0x20], rcx
jmp 0x14019bb58
mov rbx, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x1401770b0]
xor ecx, ecx
mov dword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14019bbfb
cmp rbx, 0x10
jb 0x14019bbc4
mov rcx, qword [rsp + 0x40]
lea rdx, [rbx + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019bbbf
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14019bbbf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140384ad0
cmp dword [rsp + 0x38], 0
je 0x14019bc0e
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14019bc0e
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140384b70
add rsp, 0x78
ret
mov ecx, 6
mov dword [rsp + 0x38], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1401a1460
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1401a152c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1401a152c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1401a1545
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x1401a151c
cmp byte [rax], 0x5c
jne 0x1401a1516
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x1401a1516
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1401a1502
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x1401a1513
test r8b, 0x10
jne 0x1401a1516
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x1401a1516
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1401a6cb0
test edi, edi
jne 0x1401a1480
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.1401a39f0
int3

Function at 0x1401a37c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140fb3878]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1401a3893
cmp byte [rcx + 0x71], 0
je 0x1401a3893
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1401a388f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401a3854
sub eax, 1
je 0x1401a3858
cmp eax, 2
jne 0x1401a388f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140384b70
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1401a3886
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1401a388f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1401a383c
xor al, al
jmp 0x1401a383c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140384b70
add rsp, 0x60
pop rbx
ret
Function at 0x1401a7d40
Capabilities:
Encode data using base64

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x50], rbp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rsp + 0x58], rsi
xor ebp, ebp
mov qword [rsp + 0x60], rdi
lea rsi, [rdx + 0x10]
mov qword [rcx + 0x10], rbp
mov rdi, rdx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov rbx, rcx
mov byte [rcx], bpl
mov rdx, qword [rsi]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.1401b82f0
cmp qword [rdi + 0x18], 0x10
lea r15d, [rbp - 6]
jb 0x1401a7da3
mov r14, qword [rdi]
mov rcx, r14
mov rdi, r14
jmp 0x1401a7da9
mov r14, rdi
mov rcx, rdi
mov r13, qword [rsi]
add r13, rcx
cmp rdi, r13
je 0x1401a7ec4
mov qword [rsp + 0x38], r12
lea r8, [0x140398000]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r14]
shl ebp, 8
add ebp, eax
add r15d, 8
js 0x1401a7e5d
lea ecx, [r15 + 6]
movsxd rdi, r15d
mov eax, 0xaaaaaaab
movsxd r12, ebp
mul ecx
shr edx, 2
imul eax, edx, 0xfffffffa
mov esi, edx
add r15d, eax
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
mov rcx, rdi
mov rax, r12
sar rax, cl
mov rcx, qword [rbx + 0x10]
and eax, 0x3f
movzx r9d, byte [rax + r8]
cmp rcx, rdx
jae 0x1401a7e3d
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1401a7e32
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1401a7e53
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1401775f0
lea r8, [0x140398000]
sub rdi, 6
sub rsi, 1
jne 0x1401a7e00
inc r14
cmp r14, r13
jne 0x1401a7dd0
mov r12, qword [rsp + 0x38]
cmp r15d, 0xfffffffa
jle 0x1401a7ec4
mov rdx, qword [rbx + 0x18]
lea ecx, [r15 + 8]
shl ebp, 8
movsxd rax, ebp
sar rax, cl
mov rcx, qword [rbx + 0x10]
and eax, 0x3f
movzx r9d, byte [rax + r8]
cmp rcx, rdx
jae 0x1401a7eb5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1401a7eaa
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1401a7ec4
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1401775f0
mov rcx, qword [rbx + 0x10]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
test cl, 3
je 0x1401a7f30
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1401a7f15
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x1401a7f0d
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x1401a7f27
xor r8d, r8d
mov r9b, 0x3d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1401775f0
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x1401a7ef0
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x1401ab600
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1401ab634
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1401ab620
ret