joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1ebb7e720
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x1ebb7e768
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x1ebb7e768
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x1ebb7e778
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [0x1ebce98c0]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.1ebb66680
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x1ebb7e851
mov rcx, qword [rsp + 0x58]
mov rdx, qword [0x1ebce98c8]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.1ebb66900
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x1ebb7e851
cmp qword [rcx + 8], rax
ja 0x1ebb7e773
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x1ebb86880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x1ebb869f7
movzx edx, byte [rax]
test edx, edx
jne 0x1ebb868b4
nop dword [rax]
test r8b, r8b
jne 0x1ebb868b4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x1ebb868c7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x1ebb869b7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x1ebb869a5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x1ebb86997
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x1ebb8691d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x1ebb86960
mov eax, 1
cmp rax, rbx
ja 0x1ebb8694b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.1ebb9bf40
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x1ebb8698f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x1ebb86953
mov rcx, r11
mov eax, r12d
jmp 0x1ebb86922
mov rcx, rbx
call fcn.1ebb9be80
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.1ebb9be80
mov eax, r8d
mov rcx, rbx
call fcn.1ebb9bf40
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x1ebb869ed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x1ebb869b0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x1ebb868cd
mov eax, edx
mov rcx, rbx
call fcn.1ebb9be80
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.1ebb9be80
nop
int3

Function at 0x1ebb8ca00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebb8cab5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.1ebb8a680
nop
test bl, bl
je 0x1ebb8caaf
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x1ebb8cb00]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.1ebb99a60
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.1ebb8ca00
Function at 0x1ebb8fa20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebb8facf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x1ebb8fb20]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.1ebb99a60
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.1ebb8fa20
Function at 0x1ebb9b980
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebb34a63
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.1ebb3aac0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x1ebb34a40
cmp byte [0x1ebf3e92d], 0
je 0x1ebb9b995
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x1ebb98be0
jmp 0x1ebb34a40

Function at 0x1ebb9b9a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1ebf3edc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1ebf3e92d], 0
je 0x1ebb9b9d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x1ebf3f140]
aesenc xmm0, xmmword [0x1ebf3f150]
aesenc xmm0, xmmword [0x1ebf3f160]
movq rax, xmm0
ret
jmp 0x1ebb3ace0

Function at 0x1ebb9b9e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1ebf3edc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1ebf3e92d], 0
je 0x1ebb9ba16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x1ebf3f140]
aesenc xmm0, xmmword [0x1ebf3f150]
aesenc xmm0, xmmword [0x1ebf3f160]
movq rax, xmm0
ret
jmp 0x1ebb3ad40

Function at 0x1ebba97c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebba988a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.1ebb33f40
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x1ebba986f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x1ebd12700]
xor ebx, ebx
mov rcx, rdx
call fcn.1ebb7f2e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.1ebbab220
inc rbx
cmp rcx, rbx
jae 0x1ebba985e
mov edi, 1
lea rsi, [0x1ebd12700]
call fcn.1ebb7f3c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x1ebdac5a0]
lea rsi, [0x1ebdaaf18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1ebba97c0
Function at 0x1ebbb94e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebbb95de
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x1ebbb9562
cmp rdi, r8
jb 0x1ebbb95d2
cmp rbx, rsi
je 0x1ebbb9545
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x1ebbb9542
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x1ebbb95bf
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x1ebbb9545
mov rbx, rdx
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x1ebbb95b7
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
nop
jmp 0x1ebbb95a0
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x1ebbb9568
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call fcn.1ebb9be80
lea rax, [0x1ebd12600]
lea rbx, [0x1ebdab4d0]
call fcn.1ebb68600
mov rcx, r8
mov rdx, rdi
call fcn.1ebb9bf00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.1ebbb94e0
Function at 0x1ebbc7980
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebbc7bbb
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x1ebbc7a1a
mov qword [rsp + 0x88], rax
lea rbx, [0x1ebd47c00]
mov rcx, rax
lea rax, [0x1ebeb8880]
call fcn.1ebba17a0
test cl, cl
jne 0x1ebbc7a03
mov rax, qword [rsp + 0x88]
call fcn.1ebbc6ce0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x1ebda9930]
call fcn.1ebb83080
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
call fcn.1ebbc8d20
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x1ebbc7a37
lea rdx, [0x1ebd430a0]
cmp rax, rdx
jne 0x1ebbc7a25
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call fcn.1ebb97380
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x1ebd197a0]
call fcn.1ebb3bb40
inc rdx
cmp rbx, rdx
jle 0x1ebbc7a81
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x1ebbc7a34
lea rax, [0x1ebeb8880]
lea rbx, [0x1ebd47c00]
lea rdi, [0x1ebd430a0]
nop dword [rax + rax]
call fcn.1ebba1960
lea rdx, [0x1ebd430a0]
cmp rax, rdx
jne 0x1ebbc7bab
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x1ebd0cf60]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rcx
lea rax, [0x1ebd23700]
call fcn.1ebb3eec0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x1ebf3eca0], 0
nop
je 0x1ebbc7adb
mov rbx, rax
lea rax, [0x1ebd23700]
call fcn.1ebb44aa0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.1ebb31a00
call fcn.1ebb97440
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x1ebbc7b42
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x1ebbc7b34
mov dword [rsi + 0x10], edx
cmp dword [0x1ebf3eca0], 0
je 0x1ebbc7b63
call fcn.1ebb9bae0
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x1ebeb8880]
lea rbx, [0x1ebd47c00]
lea rdi, [0x1ebd430a0]
nop dword [rax]
call fcn.1ebba1960
lea rdx, [0x1ebd430a0]
cmp rax, rdx
jne 0x1ebbc7b9c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x1ebd197a0]
call fcn.1ebb3bb40
mov rbx, rdx
lea rcx, [0x1ebd197a0]
call fcn.1ebb3bb40
nop
mov qword [rsp + 8], rax
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
jmp fcn.1ebbc7980
Function at 0x1ebbf8520
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebbf8c5f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x1ebbf854d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x1ebbf87d1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x1ebbf87fd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x1ebdb0040]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x1ebd12600]
lea rbx, [0x1ebdabc30]
call fcn.1ebb68600
inc rax
cmp rax, r8
jge 0x1ebbf8822
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x1ebbf8857
lea rdi, [0x1ebd12680]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x1ebbf8543
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x1ebbf883b
jmp 0x1ebbf8810
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.1ebbf8520

Function at 0x1ebbf8e00
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x1ebbf8e17
inc rax
cmp rax, 4
jge 0x1ebbf8e2f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x1ebbf8e14
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x1ebbf8e40
inc rax
cmp rax, 4
jge 0x1ebbf8e4e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x1ebbf8e77
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x1ebbf8e5b
jmp 0x1ebbf8e3d
Function at 0x1ebc08de0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebc08f2e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x1ebce9ba8]
call fcn.1ebbf9080
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x1ebc08f40]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.1ebb33f40
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x1ebc08ef2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x1ebc08f28
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x1ebc08f1d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.1ebb9bf40
call fcn.1ebb9bec0
nop
call fcn.1ebb99b80
jmp fcn.1ebc08de0
Function at 0x1ebc49de0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x1ebc49df8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x1ebc49df8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x1ebc49e00
xor eax, eax
ret
cmp rbx, 3
je 0x1ebc49e0c
cmp rbx, 4
jne 0x1ebc49e39
cmp al, 0x2c
ja 0x1ebc49e26
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x1ebc49e36
cmp al, 0x24
je 0x1ebc49e36
nop dword [rax]
cmp al, 0x26
jae 0x1ebc49e36
jmp 0x1ebc49e39
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x1ebc49e36
cmp al, 0x5b
je 0x1ebc49e36
cmp al, 0x5d
jne 0x1ebc49e39
xor eax, eax
ret
cmp al, 0x2f
ja 0x1ebc49e72
nop dword [rax]
cmp al, 0x26
ja 0x1ebc49e51
cmp al, 0x24
je 0x1ebc49e91
cmp al, 0x26
je 0x1ebc49e91
jmp 0x1ebc49f0b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x1ebc49e91
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x1ebc49f08
cmp al, 0x2f
je 0x1ebc49e91
jmp 0x1ebc49f0b
cmp al, 0x3d
ja 0x1ebc49e89
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x1ebc49e91
nop
cmp al, 0x3d
je 0x1ebc49e91
jmp 0x1ebc49f0b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x1ebc49f00
cmp rbx, 2
jg 0x1ebc49ec7
cmp rbx, 1
je 0x1ebc49ec1
nop dword [rax]
cmp rbx, 2
jne 0x1ebc49f0b
cmp al, 0x2f
je 0x1ebc49eb2
cmp al, 0x3b
je 0x1ebc49eb2
cmp al, 0x2c
jne 0x1ebc49eb9
mov ecx, 1
jmp 0x1ebc49ebe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x1ebc49eea
cmp al, 0x40
je 0x1ebc49ed9
cmp al, 0x2f
je 0x1ebc49ed9
cmp al, 0x3f
jne 0x1ebc49ee2
mov ecx, 1
nop
jmp 0x1ebc49ee7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x1ebc49ef9
cmp rbx, 7
jne 0x1ebc49f0b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x1ebc49f08
cmp al, 0x7e
jne 0x1ebc49f0b
xor eax, eax
ret
cmp rbx, 7
jne 0x1ebc49f21
cmp al, 0x21
je 0x1ebc49f1d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x1ebc49f21
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x1ebc53300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebc53446
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x1ebc53436
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.1ebc5dd00
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1ebc5341b
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x1ebc53431
cmp rsi, rcx
ja 0x1ebc53429
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x1ebc53421
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.1ebc5de40
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.1ebb9bf40
mov rax, rsi
call fcn.1ebb9bf40
call fcn.1ebb9bf00
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.1ebb9bf00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.1ebc53300
Function at 0x1ebc534a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1ebc535e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
cmp rcx, r9
jb 0x1ebc535d6
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.1ebc5dda0
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1ebc535bb
mov rbx, qword [rsp + 0x90]
mov rsi, rbx
sar rbx, 1
lea rcx, [rsi + rbx]
mov rdx, qword [rsp + 0x70]
cmp rdx, rcx
jb 0x1ebc535d1
cmp rsi, rcx
ja 0x1ebc535c9
sub rdx, rsi
mov rdi, rdx
neg rdx
mov r8, rsi
shl rsi, 3
sar rdx, 0x3f
and rsi, rdx
mov rdx, qword [rsp + 0x60]
add rdx, rsi
mov rcx, qword [rsp + 0x68]
cmp rcx, r8
jb 0x1ebc535c1
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], rdx
sub rcx, r8
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.1ebc5dee0
xorps xmm15, xmm15
mov r14, qword [0x1ebf3ebe8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov rax, r8
call fcn.1ebb9bf40
mov rax, rsi
call fcn.1ebb9bf40
call fcn.1ebb9bf00
mov rdx, rcx
mov rcx, r9
nop dword [rax]
call fcn.1ebb9bf00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.1ebb99b80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.1ebc534a0