joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140206770
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140291040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea r14, [rsp + 0x78]
movabs r15, 0xff00ff00ff00ff00
mov qword [r11 - 0x30], r15
mov qword [r11 - 0x28], r14
mov rbp, qword [r14]
xor rbp, r15
mov qword [r11 - 0x38], rbp
xor esi, esi
mov qword [r14], rsi
movups xmmword [rsp + 0x20], xmm0
mov qword [r11 - 0x48], rsi
mov qword [r11 - 0x40], 0xf
mov byte [rsp + 0x20], sil
cmp qword [rcx + 0x18], 0xf
jbe 0x1402067f1
mov rdi, qword [rcx]
mov rbx, rdi
add rdi, qword [rcx + 0x10]
jmp 0x1402067f8
mov rdi, qword [rcx + 0x10]
add rdi, rcx
cmp rbx, rdi
je 0x1402068eb
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
test eax, eax
je 0x14020684e
movzx r9d, byte [rbx]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
cmp rcx, rdx
jae 0x140206844
lea rax, [rcx + 1]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x20]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14020684e
lea rcx, [rsp + 0x20]
call fcn.14024c2e0
inc rbx
cmp rbx, rdi
jne 0x140206801
mov rax, qword [rsp + 0x30]
add rax, 0xfffffffffffffff3
cmp rax, 6
ja 0x1402068eb
lea rbx, [rsp + 0x78]
mov r11, qword [rbx]
mov qword [rbx], rsi
xor r8b, r8b
mov eax, dword [rsp + 0x30]
sub eax, 1
movsxd rdx, eax
js 0x1402068bf
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x20]
nop dword [rax]
lea rax, [rsp + 0x20]
cmp r9, 0xf
cmova rax, r10
movsx ecx, byte [rdx + rax]
sub ecx, 0x30
test r8b, r8b
je 0x1402068b3
add ecx, ecx
cmp ecx, 9
jle 0x1402068b3
sub ecx, 9
add esi, ecx
xor r8b, 1
sub rdx, 1
jns 0x140206890
mov qword [rbx], r11
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
cmp esi, eax
jne 0x1402068eb
lea rcx, [rsp + 0x20]
call fcn.140204370
movzx ebx, al
jmp 0x1402068ed
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.140248aa0
nop
xor rbp, r15
mov qword [r14], rbp
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14026d9f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140206930
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x140291040]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov rdi, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r11 - 0x48], xmm0
lea r12, [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
movabs r13, 0xff00ff00ff00ff00
mov qword [r11 - 0x40], r13
mov qword [r11 - 0x38], r12
mov r14, qword [r12]
xor r14, r13
mov qword [r11 - 0x48], r14
mov qword [r12], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1402069d8
lea rdx, str.Failed_to_create_snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14024a3c0
lea rdx, [0x14024a5a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor sil, sil
jmp 0x140206abb
mov dword [rsp + 0x20], 0x238
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140206a03
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor sil, sil
jmp 0x140206abb
xor sil, sil
mov r15d, 1
nop dword [rax]
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140206a20
mov rdx, qword [rdi + 0x10]
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140206a3b
mov r8, qword [rdi]
cmp rdx, rax
jne 0x140206a9b
lea rax, [rsp + 0x4c]
test rdx, rdx
je 0x140206a65
lea rcx, [rsp + 0x4c]
sub r8, rcx
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140206a9b
add rax, 2
sub rdx, r15
jne 0x140206a52
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140206a9b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movzx esi, sil
test eax, eax
cmovne esi, r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140206a10
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor r14, r13
mov qword [r12], r14
movzx eax, sil
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.14026d9f0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402442d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1402442f8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14024431e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140244320
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140244379
test ecx, ecx
jle 0x140244359
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140244379
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140244379
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x1402443a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1402443c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1402443d8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1402443f4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1402443f6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140244432
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1402444ce
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14024446d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1402444ae
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1402444ce
cmp rbx, rax
ja 0x140244480
test rbx, rbx
je 0x1402444ce
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1402448f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140291040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14024491d
xor eax, eax
jmp 0x140244a89
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140244957
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140244957
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140244a89
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140244a7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14024499a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1402449c5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140244a81
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140244a34
sub eax, 1
je 0x140244a34
cmp eax, 2
jne 0x140244a7c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140244a81
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140244a62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140244a7c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140244a81
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14026d9f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1402453e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140291040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140245411
xor eax, eax
jmp 0x14024555b
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14024544e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14024544e
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14024555b
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140245550
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140245495
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1402454a3
movzx ecx, di
jmp 0x1402454f7
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140245510
sub eax, 1
je 0x140245510
cmp eax, 2
jne 0x140245550
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140245553
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14024553e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140245550
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14026d9f0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x140246530
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 0x1384], 0xffffffff
lea r9, [rcx + 8]
mov dword [rcx + 4], edx
mov r8d, 1
nop word [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9 - 4], edx
cmp r8, 0x270
jb 0x140246550
mov dword [rcx], 0x270
mov rax, rcx
ret

Function at 0x140246be0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140246c14
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140246c00
ret
Function at 0x140247ff0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140291040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1402480c3
cmp byte [rcx + 0x71], 0
je 0x1402480c3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1402480bf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140248084
sub eax, 1
je 0x140248088
cmp eax, 2
jne 0x1402480bf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14026d9f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1402480b6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1402480bf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14024806c
xor al, al
jmp 0x14024806c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14026d9f0
add rsp, 0x60
pop rbx
ret

Function at 0x1402482e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140291040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1402483b5
cmp byte [rcx + 0x72], 0
je 0x1402483b5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x1402483b1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140248376
sub eax, 1
je 0x14024837a
cmp eax, 2
jne 0x1402483b1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14026d9f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1402483a8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1402483b1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14024835e
xor al, al
jmp 0x14024835e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14026d9f0
add rsp, 0x60
pop rbx
ret
Function at 0x14025a000
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14025a061
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14025a020
mov ecx, dword [r9]
jmp 0x14025a14b
cmp ecx, 0x4e0
jb 0x14025a14b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14025a080
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14025a0d0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140260590
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140260655
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140260655
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14026066e
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x140260645
cmp byte [rcx], 0x5c
jne 0x14026063e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x14026063e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14026062c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x14026063b
test r8b, 0x10
jne 0x14026063e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x14026063e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140255a90
test edi, edi
jne 0x1402605b0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140255a80
int3
Function at 0x140268d20
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140291040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rcx + 0x10], 0
mov rdi, rcx
mov ebx, 0x1e00000
jne 0x140268db9
mov rax, qword [rcx + 0x20]
cmp rax, qword [rcx + 0x28]
je 0x140268d56
mov qword [rcx + 0x28], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
je 0x140268d7c
nop
inc ebx
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
jne 0x140268d70
imul edx, ebx, 0x21
xor ecx, ecx
mov r9d, 4
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rdi + 0x10], rax
mov rdx, rax
test rax, rax
je 0x140268daf
mov ecx, ebx
mov qword [rdi + 8], rcx
mov dword [rdi], 0x21
mov qword [rdi + 0x18], rax
xor eax, eax
test rdx, rdx
setne al
jmp 0x140268dbb
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14026d9f0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1402690f0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rsi, rcx
add rcx, 0x10
mov r8d, 0x4d
lea rdx, str.Mozilla_5.0__Windows_NT_6.1__Win64__x64__rv:89.0__Gecko_20100101_Firefox_89.0
call fcn.140248d40
lea rcx, [rsi + 0x30]
xor r8d, r8d
lea rdx, [0x14027b146]
call fcn.140248d40
lea rcx, [rsi + 0x50]
xor r8d, r8d
lea rdx, [0x14027b146]
call fcn.140248d40
lea rcx, [rsi + 0x70]
xor r8d, r8d
lea rdx, [0x14027b146]
call fcn.140248d40
lea rcx, [rsi + 0x90]
xor r8d, r8d
lea rdx, [0x14027b146]
call fcn.140248d40
lea rcx, [rsi + 0xb0]
xor r8d, r8d
lea rdx, [0x14027b146]
call fcn.140248d40
lea rcx, [rsi + 0xd0]
mov r8d, 3
lea rdx, [0x14027fe50]
call fcn.140248d40
lea rcx, [rsi + 0xf0]
xor r8d, r8d
lea rdx, [0x14027b146]
call fcn.140248d40
lea rcx, [rsi + 0x110]
mov r8d, 0xf
lea rdx, str.www.example.com
call fcn.140248d40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x50], xmm1
xor r8d, r8d
lea rdx, [0x14027b146]
lea rcx, [rsp + 0x40]
call fcn.14020c680
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
xor r8d, r8d
lea rdx, [0x14027b146]
lea rcx, [rsp + 0x60]
call fcn.14020c680
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1401f3810
lea rdi, [rsi + 0x130]
lea rax, [rsp + 0x20]
cmp rdi, rax
je 0x14026929f
mov rbx, qword [rdi]
mov r8, qword [rbx + 8]
mov rdx, rdi
mov rcx, rdi
call fcn.14024b8f0
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [rdi + 8], 0
mov r8, qword [rdi]
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
mov qword [rsp + 0x20], r8
mov rcx, qword [rdi + 8]
mov rax, qword [rsp + 0x28]
mov qword [rdi + 8], rax
mov qword [rsp + 0x28], rcx
jmp 0x1402692a4
mov r8, qword [rsp + 0x20]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.14024b8f0
mov edx, 0x60
mov rcx, qword [rsp + 0x20]
call fcn.14026da10
nop
lea r9, [fcn.1401f39a0]
mov edx, 0x40
mov r8d, 1
lea rcx, [rsp + 0x40]
call fcn.14026ddec
mov qword [rsi + 0x140], 0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret