joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140107a00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140107a3d
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
lea r11, [r15 + r15]
test r11, r11
je 0x140107a70
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x140107a52
mov r14, qword [r9 + 0x30]
and r14, rdx
mov rdi, qword [r9 + 8]
mov r8, r14
add r8, r8
mov r12, qword [r9 + 0x18]
cmp rdi, qword [r12 + r8*8]
je 0x140107b3c
mov rdi, qword [r12 + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r12 + r8*8]
je 0x140107b3c
add r14, r14
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 8
jb 0x140107ab7
mov rdx, qword [rdi + 0x10]
mov rcx, r10
cmp qword [r10 + 0x18], 8
jb 0x140107ac4
mov rcx, qword [r10]
cmp r15, qword [rdi + 0x20]
jne 0x140107b32
mov r11, r15
test r15, r15
je 0x140107af3
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140107aea
add rcx, 2
add rdx, 2
sub r11, 1
jne 0x140107ad2
jmp 0x140107af3
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x140107af5
xor eax, eax
test eax, eax
jne 0x140107b32
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.14012f9a8
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140107bd0
cmp rdi, qword [r12 + r14*8]
jne 0x140107aa4
mov rax, qword [rbx]
cmp rdi, rax
je 0x140107b71
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140107b8e
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140107bbd
cmp rax, rdi
jne 0x140107b99
mov qword [rdx + r8*8], rbx
jmp 0x140107bbd
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140107bbd
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.14010ab00
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140107c50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140107c8d
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
lea r11, [r15 + r15]
test r11, r11
je 0x140107cc0
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x140107ca2
mov r14, qword [r9 + 0x30]
and r14, rdx
mov rdi, qword [r9 + 8]
mov r8, r14
add r8, r8
mov r12, qword [r9 + 0x18]
cmp rdi, qword [r12 + r8*8]
je 0x140107d8c
mov rdi, qword [r12 + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r12 + r8*8]
je 0x140107d8c
add r14, r14
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 8
jb 0x140107d07
mov rdx, qword [rdi + 0x10]
mov rcx, r10
cmp qword [r10 + 0x18], 8
jb 0x140107d14
mov rcx, qword [r10]
cmp r15, qword [rdi + 0x20]
jne 0x140107d82
mov r11, r15
test r15, r15
je 0x140107d43
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140107d3a
add rcx, 2
add rdx, 2
sub r11, 1
jne 0x140107d22
jmp 0x140107d43
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x140107d45
xor eax, eax
test eax, eax
jne 0x140107d82
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.14000c764
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140107e20
cmp rdi, qword [r12 + r14*8]
jne 0x140107cf4
mov rax, qword [rbx]
cmp rdi, rax
je 0x140107dc1
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140107dde
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140107e0d
cmp rax, rdi
jne 0x140107de9
mov qword [rdx + r8*8], rbx
jmp 0x140107e0d
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140107e0d
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.14010abb0
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14010ae28
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
cmp qword [r8 + 0x18], 8
mov rbx, r8
mov rsi, qword [r8 + 0x10]
mov r9, rdx
mov r11, rcx
mov r10, r8
jb 0x14010ae57
mov r10, qword [r8]
lea r8, [rsi + rsi]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r8, r8
je 0x14010ae8a
movzx eax, byte [rcx + r10]
movabs rdi, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, rdi
cmp rcx, r8
jb 0x14010ae6c
mov rcx, qword [r11 + 0x30]
mov r14, qword [r11 + 0x18]
and rcx, rdx
mov rax, rcx
add rax, rax
lea rbp, [rcx + rcx]
mov rcx, qword [r11 + 8]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + rbp*8], rcx
jne 0x14010aeb2
mov rdx, rcx
jmp 0x14010aeba
mov rdx, qword [r14 + rbp*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x14010af9d
cmp qword [rbx + 0x18], 8
mov r10, rbx
jb 0x14010aed0
mov r10, qword [rbx]
cmp qword [rax + 0x28], 8
lea r8, [rax + 0x10]
jb 0x14010aedf
mov r8, qword [rax + 0x10]
mov r11, qword [rax + 0x20]
cmp r11, rsi
jne 0x14010af0b
test r11, r11
je 0x14010af05
movzx edx, word [r10]
cmp word [r8], dx
jne 0x14010af10
add r8, 2
add r10, 2
sub r11, 1
jne 0x14010aeed
xor edx, edx
test edx, edx
je 0x14010af19
mov rax, qword [rax]
jmp 0x14010aea7
sbb edx, edx
and edx, 0xfffffffe
inc edx
jmp 0x14010af07
mov rdx, rax
cmp qword [r14 + rbp*8], rcx
jne 0x14010af27
mov r8, rcx
jmp 0x14010af2f
mov r8, qword [r14 + rbp*8 + 8]
mov r8, qword [r8]
cmp rax, r8
je 0x14010af8f
cmp qword [rax + 0x28], 8
lea r11, [rax + 0x10]
jb 0x14010af43
mov r11, qword [rax + 0x10]
cmp qword [rbx + 0x18], 8
mov r10, rbx
jb 0x14010af50
mov r10, qword [rbx]
cmp rsi, qword [rax + 0x20]
jne 0x14010af8f
mov rdi, rsi
test rsi, rsi
je 0x14010af76
movzx r8d, word [r11]
cmp word [r10], r8w
jne 0x14010af83
add r10, 2
add r11, 2
sub rdi, 1
jne 0x14010af5e
xor r8d, r8d
test r8d, r8d
jne 0x14010af8f
mov rax, qword [rax]
jmp 0x14010af1c
sbb r8d, r8d
and r8d, 0xfffffffe
inc r8d
jmp 0x14010af79
cmp rdx, rax
je 0x14010af9d
mov qword [r9], rdx
mov qword [r9 + 8], rax
jmp 0x14010afa4
mov qword [r9], rcx
mov qword [r9 + 8], rcx
mov rbx, qword [rsp + 0x10]
mov rax, r9
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x14010afc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x14010afed
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x14010b01c
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x14010affe
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14010b054
cmp qword [rcx + rdx*8], rdi
jne 0x14010b049
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14010b04d
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14010b061
cmp qword [rcx + rdx*8], rdi
jne 0x14010b061
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14000c764
mov rcx, rdi
call fcn.140210c50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140121a2c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r9, r8
mov r8, rcx
xor ecx, ecx
test r8, r8
je 0x140121a76
lea rax, [r8 + rdx]
mov r10, rax
sub r10, r8
cmp r8, rax
cmova r10, rcx
test r10, r10
je 0x140121a76
mov rdx, r8
neg rdx
movzx eax, byte [r8]
movabs rcx, 0x100000001b3
inc r8
xor r9, rax
imul r9, rcx
lea rcx, [rdx + r8]
cmp rcx, r10
jb 0x140121a55
mov rax, r9
ret
Function at 0x14012dd7c
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x150
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor edi, edi
mov qword [r11 - 0xd0], rdi
lea ebx, [rdi + 7]
mov qword [r11 - 0xc8], rbx
mov word [rsp + 0x78], di
lea r8d, [rdi + 0x29]
lea rdx, str.Microsoft.Office.Experimentation.Registry
lea rcx, [rsp + 0x78]
call fcn.140018284
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x20]
call fcn.140130020
nop
lea rcx, [rsp + 0x78]
call fcn.14000c764
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], rbx
mov word [rsp + 0xb8], di
xor r8d, r8d
lea rdx, [0x140290a68]
lea rcx, [rsp + 0xb8]
call fcn.140018284
nop
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rbx
mov word [rsp + 0x98], di
lea r8d, [rdi + 0xb]
lea rdx, str.CountryCode
lea rcx, [rsp + 0x98]
call fcn.140018284
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
lea ebx, [rdi + 1]
test r8, r8
je 0x14012de7b
lock add dword [r8 + 8], ebx
lea rcx, [rsp + 0x30]
call fcn.14025dfc0
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xe0]
call fcn.140100b1c
nop
lea rcx, [rsp + 0x98]
call fcn.14000c764
nop
lea rcx, [rsp + 0xb8]
call fcn.14000c764
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xe0]
call fcn.14010c120
nop
cmp qword [rsi + 0x10], rdi
je 0x14012dfb0
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14012deed
mov rdx, qword [rsi]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
cmp r8, qword [rsi + 0x10]
jne 0x14012df34
test r8, r8
je 0x14012df2e
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14012df25
add rcx, 2
add rdx, 2
sub r8, rbx
jne 0x14012df0e
jmp 0x14012df2e
sbb eax, eax
and eax, 0xfffffffe
add eax, ebx
jmp 0x14012df30
mov eax, edi
test eax, eax
je 0x14012df37
mov bl, dil
test bl, bl
jne 0x14012dfb0
mov rdx, rsi
lea rcx, [rsp + 0xe0]
call fcn.140102608
jmp 0x14012dfb0
lea rcx, [rsp + 0x58]
call fcn.14000c764
nop
nop dword [rax + rax]
lea rcx, [rsp + 0xe0]
call fcn.14010205c
nop
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x14012e011
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
add eax, edi
jne 0x14012e011
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14002a211.0]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x14012e011
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14002a211.0]
nop
mov rcx, rsi
call fcn.14000c764
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14020ed60
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140131924
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x140131951
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x140131980
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x140131962
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1401319b8
cmp qword [rcx + rdx*8], rdi
jne 0x1401319ad
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1401319b1
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401319c5
cmp qword [rcx + rdx*8], rdi
jne 0x1401319c5
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14012f9a8
mov rcx, rdi
call fcn.140210c50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140135e2c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r14, rdx
mov r15, rcx
mov r11, qword [r8 + 0x10]
mov r9, r8
cmp qword [r8 + 0x18], 8
jb 0x140135e62
mov r9, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
lea r10, [r11 + r11]
test r10, r10
je 0x140135e95
movzx eax, byte [rcx + r9]
xor rdx, rax
movabs rbx, 0x100000001b3
imul rdx, rbx
inc rcx
cmp rcx, r10
jb 0x140135e77
mov r10, qword [r15 + 0x30]
and r10, rdx
lea r12, [r15 + 8]
mov rdi, qword [r12]
mov rsi, r10
add rsi, rsi
mov rbx, qword [r15 + 0x18]
cmp rdi, qword [rbx + rsi*8]
je 0x140135f2f
mov rdi, qword [rbx + rsi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rbx + rsi*8]
je 0x140135f2f
add r10, r10
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 8
jb 0x140135ed8
mov rdx, qword [rdi + 0x10]
mov rcx, r8
cmp qword [r8 + 0x18], 8
jb 0x140135ee5
mov rcx, qword [r8]
cmp r11, qword [rdi + 0x20]
jne 0x140135f29
mov r9, r11
test r11, r11
je 0x140135f14
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140135f0b
add rcx, 2
add rdx, 2
sub r9, 1
jne 0x140135ef3
jmp 0x140135f14
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x140135f16
xor eax, eax
test eax, eax
jne 0x140135f29
mov qword [r14], rdi
mov byte [r14 + 8], al
mov rax, r14
jmp 0x140135fdf
cmp rdi, qword [rbx + r10*8]
jne 0x140135ec5
mov rdx, qword [r12]
mov rdx, qword [rdx]
mov rcx, r12
call fcn.140107be4
mov rbx, qword [r12]
mov rbx, qword [rbx]
mov qword [rsp + 0x70], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x140135f7f
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r12]
jne 0x140135f9c
mov qword [rdx + rsi*8], rbx
mov rax, qword [r15 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x140135fcb
cmp rax, rdi
jne 0x140135fa7
mov qword [rdx + rsi*8], rbx
jmp 0x140135fcb
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x140135fcb
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r15
call fcn.14010abb0
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140145c14
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
cmp qword [r8 + 0x18], 8
mov r10, rdx
mov r11, qword [r8 + 0x10]
mov rdx, r8
mov rdi, rcx
jb 0x140145c3e
mov rdx, qword [r8]
lea rbx, [r11 + r11]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rbx, rbx
je 0x140145c70
movzx eax, byte [rcx + rdx]
movabs rsi, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rsi
cmp rcx, rbx
jb 0x140145c53
mov rcx, qword [rdi + 0x30]
mov rsi, qword [rdi + 0x18]
and rcx, r9
mov rdi, qword [rdi + 8]
mov rax, rcx
add rax, rax
lea rbp, [rcx + rcx]
mov rax, qword [rsi + rax*8]
cmp qword [rsi + rbp*8], rdi
jne 0x140145c98
mov rcx, rdi
jmp 0x140145ca0
mov rcx, qword [rsi + rbp*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140145d50
cmp qword [r8 + 0x18], 8
mov r9, r8
jb 0x140145cb6
mov r9, qword [r8]
cmp qword [rax + 0x28], 8
lea rdx, [rax + 0x10]
jb 0x140145cc5
mov rdx, qword [rax + 0x10]
mov rbx, qword [rax + 0x20]
cmp rbx, r11
jne 0x140145cf0
test rbx, rbx
je 0x140145cea
movzx ecx, word [r9]
cmp word [rdx], cx
jne 0x140145cf5
add rdx, 2
add r9, 2
sub rbx, 1
jne 0x140145cd3
xor ecx, ecx
test ecx, ecx
je 0x140145cfe
mov rax, qword [rax]
jmp 0x140145c8d
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140145cec
cmp qword [rax + 0x28], 8
lea rdx, [rax + 0x10]
jb 0x140145d0d
mov rdx, qword [rax + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140145d17
mov r8, qword [r8]
cmp r11, qword [rax + 0x20]
jne 0x140145d3f
test r11, r11
je 0x140145d39
movzx ecx, word [rdx]
cmp word [r8], cx
jne 0x140145d47
add r8, 2
add rdx, 2
sub r11, 1
jne 0x140145d22
xor ecx, ecx
test ecx, ecx
je 0x140145d42
mov rax, rdi
mov qword [r10], rax
jmp 0x140145d53
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140145d3b
mov qword [r10], rdi
mov rbx, qword [rsp + 8]
mov rax, r10
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14014aa20
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
mov dil, 1
cmp ecx, 0xffffffff
je 0x14014abcb
cmp ecx, 0x7c
je 0x14014abcb
cmp ecx, 0x29
jne 0x14014aa66
cmp dword [rbx + 0x1c], 0
jne 0x14014abcb
test dword [rbx + 0x80], 0x10000000
je 0x14014abec
cmp ecx, 0x2e
jne 0x14014aa86
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.1400c4b9c
mov rcx, rbx
call fcn.14014bb70
jmp 0x14014abb6
cmp ecx, 0x5c
jne 0x14014aaf5
mov rcx, rbx
call fcn.14014bb70
mov eax, dword [rbx + 0x80]
and eax, 0x80
je 0x14014aac2
cmp word [rbx + 0x78], 0x62
jne 0x14014aac2
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.1400c4b9c
mov rcx, rbx
call fcn.14014bb70
jmp 0x14014abbe
test eax, eax
je 0x14014aae8
cmp word [rbx + 0x78], 0x42
jne 0x14014aae8
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.1400c4b9c
mov rax, qword [rbx + 0x48]
add rax, 0xc
xor dword [rax], 1
jmp 0x14014aab5
mov rcx, rbx
call fcn.14014ac24
jmp 0x14014abb6
cmp ecx, 0x5b
jne 0x14014ab1c
mov rcx, rbx
call fcn.14014bb70
mov rcx, rbx
call fcn.14014b030
cmp dword [rbx + 0x7c], 0x5d
mov rcx, rbx
je 0x14014aa7c
jmp 0x14014abd6
cmp ecx, 0x28
jne 0x14014ab42
mov rcx, rbx
call fcn.14014bb70
mov rcx, rbx
call fcn.14014bf94
cmp dword [rbx + 0x7c], 0x29
mov dil, al
mov rcx, rbx
je 0x14014abac
jmp 0x14014abe1
cmp ecx, 0x5e
jne 0x14014ab4f
lea edx, [rcx - 0x5c]
jmp 0x14014aaac
cmp ecx, 0x24
jne 0x14014ab5c
lea edx, [rcx - 0x21]
jmp 0x14014aaac
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x14014ac16
cmp ecx, 0x3f
je 0x14014ac16
cmp ecx, 0x7b
je 0x14014ac16
cmp ecx, 0x7d
jne 0x14014ab8b
test dword [rbx + 0x80], 0x10000000
je 0x14014abfa
cmp ecx, 0x5d
jne 0x14014ab9c
test dword [rbx + 0x80], 0x10000000
je 0x14014ac08
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14014a668
mov rcx, rbx
call fcn.14014bb70
test dil, dil
je 0x14014abbe
mov rcx, rbx
call fcn.14014bc40
mov ecx, dword [rbx + 0x7c]
mov al, 1
mov dil, al
jmp 0x14014aa35
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 4
call fcn.14014bb64
int3
mov edx, 5
call fcn.14014bb64
int3
mov edx, 5
mov rcx, rbx
call fcn.14014bb64
int3
mov edx, 6
mov rcx, rbx
call fcn.14014bb64
int3
mov edx, 4
mov rcx, rbx
call fcn.14014bb64
int3
mov edx, 0xa
mov rcx, rbx
call fcn.14014bb64
int3
Function at 0x14014ef44
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x3e0
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x14014efe9
cmp qword [rdx + 0x18], 8
mov dword [rsp + 0x30], 0xb
mov dword [rsp + 0x34], 8
jb 0x14014ef8c
mov rdx, qword [rdx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14014efbb
cmp eax, 2
je 0x14014efc6
cmp eax, 0xea
je 0x14014efc6
jmp 0x14014f011
cmp dword [rsp + 0x30], 0xb
jne 0x14014efc6
mov al, 1
jmp 0x14014efc8
xor al, al
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.14020ed60
mov rbx, qword [rsp + 0x408]
add rsp, 0x3e0
pop rdi
ret
lea r8, str.ORegistryKey.GetValue_failure:_Cannot_get_QWORD_value._The_registry_key_is_closed_or_not_set
mov edx, 0x3a
lea rcx, [rsp + 0x40]
call fcn.14006a0d4
lea rdx, [0x140320d70]
lea rcx, [rsp + 0x40]
call fcn.14021017c
int3
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea r9, str.ORegistryKey.GetValue_failure:_Cannot_get_registry__s_value__s
lea rcx, [rsp + 0x40]
mov r8d, eax
mov edx, 0xf
call fcn.140069c48
lea rdx, [0x140320d70]
lea rcx, [rsp + 0x40]
call fcn.14021017c
int3