joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bf620
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov rbp, rcx
mov rbx, qword [rax]
cmp rbx, qword [rax + 8]
je 0x1800bf68d
mov qword [rsp + 0x38], rdi
lea rdi, [rbx + 4]
mov qword [rsp + 0x30], rsi
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1800bf671
mov rsi, qword [rbp + 8]
mov rdx, rdi
mov rcx, rbx
mov r8, qword [rsi + 8]
sub r8, rdi
call fcn.180232390
add qword [rsi + 8], 0xfffffffffffffffc
jmp 0x1800bf679
add rbx, 4
add rdi, 4
mov rax, qword [rbp + 8]
cmp rbx, qword [rax + 8]
jne 0x1800bf648
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
Function at 0x1800c29a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x6b
mov rcx, qword [rcx + 0x1f8]
mov rax, qword [rcx]
call qword [rax]
mov ecx, 0x12
mov ebp, eax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
lea ecx, [rbp - 1]
not eax
and eax, 1
cmp ecx, 2
ja 0x1800c2b50
test eax, eax
je 0x1800c2b50
cmp dword [rsi + 0xa8], 0
jne 0x1800c2b50
mov qword [rsp + 0x38], rdi
lea rdx, [0x1802abc2c]
lea rdi, [rsi + 0xe0]
xor r8d, r8d
mov rcx, rdi
call fcn.18005c660
mov rcx, qword [rsi + 0x1f8]
mov edx, 0xf
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800c2a9a
mov rax, qword [rsi + 0x120]
mov qword [rsp + 0x40], r14
mov r14, qword [rax + 0x450]
test r14, r14
je 0x1800c2a82
mov rax, qword [r14 + 8]
mov qword [rsp + 0x30], rbx
mov rcx, rax
mov rbx, qword [r14]
sub rcx, rbx
sar rcx, 7
test rcx, rcx
je 0x1800c2a7d
cmp rbx, rax
je 0x1800c2a7d
nop
lea rdx, [rbx + 0x20]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rdi
call fcn.18005bc80
sub rbx, 0xffffffffffffff80
cmp rbx, qword [r14 + 8]
jne 0x1800c2a60
mov rbx, qword [rsp + 0x30]
lea rdx, [rsi + 0x20]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rdi
call fcn.18005bc80
mov r14, qword [rsp + 0x40]
movzx eax, byte [rsi + 0x2c1]
movzx ecx, byte [rsi + 0x2c0]
and eax, 0x80
and ecx, 0x80
je 0x1800c2abd
test eax, eax
jne 0x1800c2b4b
cmp ebp, 1
jne 0x1800c2ace
cmp qword [rdi + 0x18], 8
jb 0x1800c2af8
mov rcx, qword [rdi]
jmp 0x1800c2afb
cmp ebp, 2
jne 0x1800c2ae3
test ecx, ecx
je 0x1800c2b4b
cmp qword [rdi + 0x18], 8
jb 0x1800c2af8
mov rcx, qword [rdi]
jmp 0x1800c2afb
cmp ebp, 3
jne 0x1800c2b4b
test eax, eax
je 0x1800c2b4b
cmp qword [rdi + 0x18], 8
jb 0x1800c2af8
mov rcx, qword [rdi]
jmp 0x1800c2afb
mov rcx, rdi
mov rdx, qword [rdi + 0x10]
lea r8, [0x1802abc2c]
xor r9d, r9d
call fcn.18005c450
test eax, eax
je 0x1800c2b39
mov rcx, rsi
call fcn.1800d0fc0
mov edx, 1
mov rcx, rsi
call fcn.1800d0a40
xor r8d, r8d
lea rdx, [0x1802abc2c]
mov rcx, rdi
call fcn.18005c660
mov rcx, qword [rsi + 0x208]
test rcx, rcx
je 0x1800c2b4b
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1800c4c60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x40
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, r8
mov ebx, edx
mov rbp, rcx
call fcn.180211d54
mov edx, 1
mov rcx, rax
mov r9, qword [rax]
call qword [r9 + 0x30]
test al, al
jne 0x1800c4ca5
xor eax, eax
jmp 0x1800c4e2e
mov qword [rsp + 0x58], rdi
call fcn.180211d54
mov edx, 2
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x10]
movsxd rdi, eax
lea ecx, [rdi - 1]
cmp ecx, 0xb
ja 0x1800c4e27
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1800c4e27
mov eax, 0xff
xor r8d, r8d
and bx, ax
cmp bx, 0x20
jne 0x1800c4cfa
mov r9d, r8d
jmp 0x1800c4d7b
cmp bx, 0xd
jne 0x1800c4d05
mov r9d, r8d
jmp 0x1800c4d7b
lea eax, [rbx - 0x30]
cmp ax, 9
ja 0x1800c4d18
movzx r9d, bx
sub r9d, 0x2f
jmp 0x1800c4d7b
lea eax, [rbx - 0x41]
cmp ax, 0x19
ja 0x1800c4d2b
movzx r9d, bx
sub r9d, 0x36
jmp 0x1800c4d7b
mov ecx, 0xba
movzx eax, bx
sub ax, cx
cmp ax, 5
ja 0x1800c4d49
movzx r9d, bx
sub r9d, 0x95
jmp 0x1800c4d7b
mov ecx, 0xdb
movzx eax, bx
sub ax, cx
cmp ax, 3
ja 0x1800c4d67
movzx r9d, bx
sub r9d, 0xaf
jmp 0x1800c4d7b
mov eax, 0xc0
cmp bx, ax
jne 0x1800c4e20
mov r9d, 0x2b
cmp byte [rsi + 0x14], 1
mov ecx, r8d
movzx eax, byte [rsi + 0x10]
sete cl
shr eax, 7
cmp ecx, eax
je 0x1800c4dab
movsxd rax, r9d
imul rcx, rdi, 0x62
add rcx, rax
lea rax, [0x180000000]
movzx eax, word [rax + rcx*2 + 0x2a2f20]
jmp 0x1800c4dc4
imul rdx, rdi, 0x62
movsxd rcx, r9d
lea rax, [0x180000000]
add rdx, rcx
movzx eax, word [rax + rdx*2 + 0x2a3920]
mov ecx, 0x3000
cmp ax, cx
je 0x1800c4e20
xor ecx, ecx
mov word [rsp + 0x20], ax
mov qword [rsp + 0x22], rcx
mov word [rsp + 0x22], r8w
test ax, ax
je 0x1800c4dfa
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], cx
jne 0x1800c4df0
lea rcx, [rbp + 0xe0]
lea rdx, [rsp + 0x20]
call fcn.18005c660
mov rcx, rbp
call fcn.1800d0fc0
mov edx, 1
mov rcx, rbp
call fcn.1800d0a40
mov eax, 1
jmp 0x1800c4e29
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1802037a0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
Function at 0x1800c8db0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx edi, dx
mov rcx, qword [rcx + 0x130]
call fcn.1800803f0
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cmp al, 1
jne 0x1800c8df0
movzx edx, di
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800c8330
mov qword [rsp + 0x30], rsi
cmp di, 0x3a
jne 0x1800c8e49
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x4a
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800c8e49
cmp qword [rbx + 0x38], 8
lea rsi, [rbx + 0x20]
jb 0x1800c8e20
mov rcx, qword [rsi]
jmp 0x1800c8e23
mov rcx, rsi
call fcn.18008f350
test eax, eax
jne 0x1800c8e42
cmp qword [rsi + 0x18], 8
jb 0x1800c8e36
mov rsi, qword [rsi]
mov rcx, rsi
call fcn.18008ef60
test eax, eax
je 0x1800c8e49
mov edx, 0x3a
jmp 0x1800c8e6f
cmp dword [rbx + 0x40], 0
jle 0x1800c8e8e
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x4a
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800c8e8e
cmp di, 0x40
jne 0x1800c8e8e
mov edx, 0x40
mov rcx, rbx
call fcn.1800d0960
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800cd420
call fcn.180211d54
mov edx, 3
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x10]
test eax, eax
jne 0x1800c8f09
lea eax, [rdi - 0x61]
cmp ax, 0x19
ja 0x1800c8ed1
movzx edx, di
mov rcx, rbx
call fcn.1800d0960
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800cdaa0
lea eax, [rdi - 0x41]
cmp ax, 0x19
ja 0x1800c8f09
mov rcx, qword [rbx + 0x1f8]
mov edx, 0xe
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800c8f09
movzx edx, di
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800cbf20
movzx edx, di
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800c8330
Function at 0x1800c92b0
Capabilities:
Check for time delay via gettickcount
Parse credit card information

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [0x180344fa0], 0
mov rbx, rcx
jne 0x1800c92ee
mov ecx, 0x28
call fcn.1802037c4
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [0x180344fa0], rax
mov qword [rax + 0x20], rcx
mov qword [rax + 0x10], rcx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x40], rdi
call fcn.18007d480
mov rcx, rbx
call fcn.1800d2020
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x46
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800c93a7
mov rcx, rbx
call fcn.1800cc3d0
cmp eax, 1
jne 0x1800c9366
cmp dword [rbx + 0x40], eax
je 0x1800c9370
mov eax, dword [rbx + 0x214]
cmp eax, 0xffffffff
jne 0x1800c934f
mov edi, 1
mov rcx, rbx
mov edx, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
jmp fcn.1800c6ec0
lea edi, [rax + 1]
mov rcx, rbx
mov edx, edi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
jmp fcn.1800c6ec0
cmp eax, 2
jne 0x1800c93a7
cmp dword [rbx + 0x40], eax
jne 0x1800c93a7
mov edi, 1
lea rcx, [rbx + 0xe0]
mov r8d, edi
lea rdx, [0x1802b0ac0]
call fcn.18005c660
mov rcx, rbx
call fcn.1800d0fc0
mov edx, edi
mov rcx, rbx
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
jmp fcn.1800d0a40
cmp byte [0x18034236c], 0
mov qword [rsp + 0x30], rsi
jne 0x1800c93c6
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov esi, eax
jmp 0x1800c93ce
call fcn.1800e0420
mov esi, dword [rax + 0x60]
cmp dword [rbx + 0x1e0], 0
jle 0x1800c9402
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x88]
test eax, eax
jne 0x1800c9402
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
jmp fcn.1800cdaa0
lea eax, [rsi + 1]
mov edi, 1
mov edx, edi
cmp esi, 0xffffffff
mov rcx, rbx
cmovne edx, eax
call fcn.1800c6ec0
test eax, eax
jne 0x1800c947b
mov rcx, qword [rbx + 0x1f8]
lea edx, [rdi + 0x3f]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800c948b
call fcn.180211d54
lea edx, [rdi + 2]
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x10]
test eax, eax
jne 0x1800c948b
cmp dword [rbx + 0x40], eax
je 0x1800c94a3
mov rcx, rbx
call fcn.1800d0fc0
mov rcx, qword [rbx + 0x200]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rbx + 0x200]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rbx + 0x200]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
cmp dword [rbx + 0x40], 0
jne 0x1800c944c
cmp dword [rbx + 0xa8], 0
jne 0x1800c947b
cmp dword [rbx + 0xac], 0
jne 0x1800c947b
lea rcx, [rbx + 0xe0]
mov r8, rdi
lea rdx, [0x1802b0abc]
call fcn.18005c660
mov rcx, rbx
call fcn.1800d0fc0
mov edx, edi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
jmp fcn.1800d0a40
Function at 0x1800ca710
Capabilities:
Check for time delay via gettickcount
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x40], 0
movzx edi, r8w
mov rbx, rcx
jne 0x1800ca73c
mov rcx, qword [rcx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
je 0x1800ca844
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x35
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800ca7b2
cmp qword [rbx + 0x18], 8
jb 0x1800ca75d
mov rcx, qword [rbx]
jmp 0x1800ca760
mov rcx, rbx
call fcn.18008ae30
test eax, eax
je 0x1800ca789
cmp dword [rbx + 0x198], 0
jne 0x1800ca793
mov edx, 0x2d
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cd2d0
cmp dword [rbx + 0x40], 0
je 0x1800ca844
cmp dword [rbx + 0xd0], 0
mov rcx, rbx
jne 0x1800ca847
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cb730
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x39
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800ca828
cmp qword [rbx + 0x18], 8
jb 0x1800ca7d3
mov rcx, qword [rbx]
jmp 0x1800ca7d6
mov rcx, rbx
call fcn.18008ae30
test eax, eax
jne 0x1800ca772
cmp dword [rbx + 0xd0], eax
jne 0x1800ca844
cmp dword [rbx + 0x1dc], 3
mov rcx, rbx
jl 0x1800ca814
mov dword [rbx + 0x1dc], eax
call fcn.1800c92b0
movzx r8d, di
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5010
mov edx, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5990
cmp qword [rbx + 0x18], 8
jb 0x1800ca834
mov rcx, qword [rbx]
jmp 0x1800ca837
mov rcx, rbx
call fcn.18008ae30
test eax, eax
jne 0x1800ca772
mov rcx, rbx
mov edx, 0x2d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c8330
Function at 0x1800ca860
Capabilities:
Check for time delay via gettickcount
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x40], 0
movzx edi, r8w
mov rbx, rcx
jne 0x1800ca88c
mov rcx, qword [rcx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
je 0x1800ca9ae
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x35
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800ca918
cmp qword [rbx + 0x18], 8
jb 0x1800ca8ad
mov rcx, qword [rbx]
jmp 0x1800ca8b0
mov rcx, rbx
call fcn.18008ae30
test eax, eax
je 0x1800ca8ef
cmp dword [rbx + 0x198], 0
je 0x1800ca997
cmp dword [rbx + 0xd0], 0
mov rcx, rbx
je 0x1800ca909
mov edx, 0x3d
call fcn.1800c8330
cmp qword [rbx + 0x18], 8
jb 0x1800ca98b
mov rcx, qword [rbx]
jmp 0x1800ca98e
cmp dword [rbx + 0x40], 0
je 0x1800ca9ae
cmp dword [rbx + 0xd0], 0
mov rcx, rbx
jne 0x1800ca9b1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cb810
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x39
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800ca8dc
cmp qword [rbx + 0x18], 8
jb 0x1800ca939
mov rcx, qword [rbx]
jmp 0x1800ca93c
mov rcx, rbx
call fcn.18008ae30
test eax, eax
jne 0x1800ca997
cmp dword [rbx + 0xd0], eax
jne 0x1800ca9ae
cmp dword [rbx + 0x1dc], 3
mov rcx, rbx
jl 0x1800ca97a
mov dword [rbx + 0x1dc], eax
call fcn.1800c92b0
movzx r8d, di
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5010
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5990
mov rcx, rbx
call fcn.18008ae30
test eax, eax
je 0x1800ca9ae
mov edx, 0x3d
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cd2d0
mov rcx, rbx
mov edx, 0x3d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c8330

Function at 0x1800ca9d0
Capabilities:
Check for time delay via gettickcount
Parse credit card information

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x40], 0
mov rbx, rcx
jne 0x1800ca9ee
mov edx, 0x27
add rsp, 0x20
pop rbx
jmp fcn.1800c8330
mov rcx, qword [rcx + 0x1f8]
mov edx, 0x6d
mov rax, qword [rcx]
call qword [rax]
cmp eax, 2
jne 0x1800caa28
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp eax, 3
jl 0x1800caa28
mov edx, 3
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800c6ec0
mov r8d, dword [rbx + 0x44]
xor ecx, ecx
mov edx, 1
test r8d, r8d
jle 0x1800caa5a
cmp qword [rbx + 0x18], 8
lea eax, [r8 - 1]
movsxd r9, eax
jb 0x1800caa4b
mov rax, qword [rbx]
jmp 0x1800caa4e
mov rax, rbx
cmp word [rax + r9*2], 0x27
cmove edx, ecx
test r8d, r8d
cmovne ecx, edx
test ecx, ecx
je 0x1800caa96
mov edx, 0x27
mov rcx, rbx
call fcn.1800d0960
cmp dword [rbx + 0x1e0], 0
mov rcx, rbx
jle 0x1800caa8c
call fcn.1800ced30
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800cf800
add rsp, 0x20
pop rbx
jmp fcn.1800cdaa0
add rsp, 0x20
pop rbx
ret
Function at 0x1800caaa0
Capabilities:
Check for time delay via gettickcount
Parse credit card information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18008f1d0
test eax, eax
je 0x1800caada
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x6d
mov rax, qword [rcx]
call qword [rax]
cmp eax, 2
jne 0x1800caada
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp eax, 1
jg 0x1800cab09
call fcn.18008edd0
mov rcx, qword [rbx + 0x1f8]
test eax, eax
mov edx, 0x6d
mov rax, qword [rcx]
call qword [rax]
cmp eax, 2
jne 0x1800cab1b
mov rcx, qword [rbx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp eax, 1
jle 0x1800cab1b
mov edx, 2
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800c6ec0
mov edx, 0x3b
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800c8330

Function at 0x1800cad30
Capabilities:
Check for time delay via gettickcount
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x40], 0
movzx edi, r8w
mov rbx, rcx
jne 0x1800cad58
mov rcx, qword [rcx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
je 0x1800cadc2
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x36
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800cadda
cmp qword [rbx + 0x18], 8
jb 0x1800cad79
mov rcx, qword [rbx]
jmp 0x1800cad7c
mov rcx, rbx
call fcn.18008ae30
test eax, eax
je 0x1800cadad
cmp dword [rbx + 0x198], 0
je 0x1800cae6c
cmp dword [rbx + 0xd0], 0
mov rcx, rbx
jne 0x1800cadc5
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cb730
cmp dword [rbx + 0xd0], 0
mov rcx, rbx
jne 0x1800cadc5
call fcn.1800cb730
test eax, eax
jne 0x1800cadcf
mov rcx, rbx
mov edx, 0x5b
call fcn.1800c8330
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x3a
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800cae50
cmp qword [rbx + 0x18], 8
jb 0x1800cadfb
mov rcx, qword [rbx]
jmp 0x1800cadfe
mov rcx, rbx
call fcn.18008ae30
test eax, eax
jne 0x1800cae6c
cmp dword [rbx + 0xd0], eax
jne 0x1800cadc2
cmp dword [rbx + 0x1dc], 3
mov rcx, rbx
jl 0x1800cae3c
mov dword [rbx + 0x1dc], eax
call fcn.1800c92b0
movzx r8d, di
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5010
mov edx, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5990
cmp qword [rbx + 0x18], 8
jb 0x1800cae5c
mov rcx, qword [rbx]
jmp 0x1800cae5f
mov rcx, rbx
call fcn.18008ae30
test eax, eax
je 0x1800cadc2
mov edx, 0x5b
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cd2d0
Function at 0x1800cae90
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x40], 0
movzx edi, r8w
mov rbx, rcx
jne 0x1800caebc
mov rcx, qword [rcx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
je 0x1800cafb7
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x36
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800caf15
cmp qword [rbx + 0x18], 8
jb 0x1800caedd
mov rcx, qword [rbx]
jmp 0x1800caee0
mov rcx, rbx
call fcn.18008ae30
test eax, eax
je 0x1800caef6
cmp dword [rbx + 0x198], 0
je 0x1800cafa0
cmp dword [rbx + 0xd0], 0
mov rcx, rbx
jne 0x1800cafba
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cb810
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x3a
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800caf88
cmp qword [rbx + 0x18], 8
jb 0x1800caf36
mov rcx, qword [rbx]
jmp 0x1800caf39
mov rcx, rbx
call fcn.18008ae30
test eax, eax
jne 0x1800cafa0
cmp dword [rbx + 0xd0], eax
jne 0x1800cafb7
cmp dword [rbx + 0x1dc], 3
mov rcx, rbx
jl 0x1800caf77
mov dword [rbx + 0x1dc], eax
call fcn.1800c92b0
movzx r8d, di
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5010
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5990
cmp qword [rbx + 0x18], 8
jb 0x1800caf94
mov rcx, qword [rbx]
jmp 0x1800caf97
mov rcx, rbx
call fcn.18008ae30
test eax, eax
je 0x1800cafb7
mov edx, 0x5d
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cd2d0
mov rcx, rbx
mov edx, 0x5d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c8330
Function at 0x1800cafd0
Capabilities:
Check for time delay via gettickcount
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x40], 0
movzx edi, r8w
mov rbx, rcx
jne 0x1800cb055
mov rcx, qword [rcx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x58]
test eax, eax
jne 0x1800cb055
cmp dword [rbx + 0xb4], eax
je 0x1800cb085
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x48
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800cb085
mov rcx, rbx
call fcn.1800d28a0
test al, al
je 0x1800cb085
lea rcx, [rbx + 0xe0]
mov r8d, 1
lea rdx, [0x1802ac5d0]
call fcn.18005c660
mov edx, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800d0a40
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x37
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800cb09d
cmp dword [rbx + 0x40], 0
je 0x1800cb085
cmp dword [rbx + 0xd0], 0
mov rcx, rbx
jne 0x1800cb088
call fcn.1800cb730
test eax, eax
jne 0x1800cb092
mov rcx, rbx
mov edx, 0x2c
call fcn.1800c8330
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x1f8]
mov edx, 0x3b
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x1800cb085
cmp qword [rbx + 0x18], 8
jb 0x1800cb0be
mov rcx, qword [rbx]
jmp 0x1800cb0c1
mov rcx, rbx
call fcn.18008ae30
test eax, eax
je 0x1800cb0e1
mov edx, 0x2c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cd2d0
cmp dword [rbx + 0xd0], 0
jne 0x1800cb085
cmp dword [rbx + 0x1dc], 3
mov rcx, rbx
jl 0x1800cb11b
mov dword [rbx + 0x1dc], 0
call fcn.1800c92b0
movzx r8d, di
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5010
mov edx, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c5990
Function at 0x1800cd2d0
Capabilities:
Check for time delay via gettickcount
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x198], 0
movzx edi, dx
mov rbx, rcx
mov dword [rcx + 0xc8], 1
jne 0x1800cd31b
call fcn.1800d0960
cmp dword [rbx + 0x1e0], 0
mov rcx, rbx
je 0x1800cd35f
call fcn.1800ced30
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cf800
mov rcx, qword [rcx + 0x128]
mov rax, qword [rcx]
call qword [rax + 0x60]
test eax, eax
jle 0x1800cd351
cmp di, 0x31
jb 0x1800cd351
movzx edx, di
add eax, 0x30
cmp edx, eax
jg 0x1800cd351
add edx, 0xffffffd0
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800c6ec0
movzx edx, di
mov rcx, rbx
call fcn.1800d0960
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800cdaa0
Function at 0x1800d5f20
Capabilities:
Hash data using fnv

Disassembly:
test rdx, rdx
je 0x1800d6039
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [r11 + 8], rdi
movabs rcx, 0x100000001b3
mov r9, rdx
movabs rax, 0xcbf29ce484222325
movzx r8d, r9b
xor r8, rax
movzx eax, byte [r11 + 0x11]
mov rdx, qword [rbx + 0x28]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x13]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x14]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x15]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x16]
imul r8, rcx
xor r8, rax
movzx eax, byte [r11 + 0x17]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [rbx + 0x40]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r10, qword [rdx + rcx*8]
lea r11, [rdx + rcx*8]
cmp r10, r8
jne 0x1800d5fe0
mov rcx, r8
jmp 0x1800d5fe7
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1800d5ffd
cmp r9, qword [rax + 0x10]
je 0x1800d5ff7
mov rax, qword [rax]
jmp 0x1800d5fd6
cmovne rax, r8
jmp 0x1800d6000
mov rax, r8
cmp rax, qword [rbx + 0x18]
jne 0x1800d602f
movzx r9d, byte [rsp + 0x48]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x10]
call fcn.1800d6700
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x1800d602f
call rcx
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret