joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53bee0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x53c146
push rbp
mov rbp, rsp
sub rsp, 0xa0
movzx ecx, byte [rbx + 0x1f]
shl rcx, 0x38
mov qword [rsp + 0x98], rcx
movzx edx, byte [rbx + 0x1e]
shl rdx, 0x30
mov qword [rsp + 0x90], rdx
movzx esi, byte [rbx + 0x1d]
shl rsi, 0x28
mov qword [rsp + 0x88], rsi
movzx edi, byte [rbx + 0x1c]
shl rdi, 0x20
mov qword [rsp + 0x80], rdi
movzx r8d, byte [rbx + 0x1b]
shl r8, 0x18
mov qword [rsp + 0x78], r8
movzx r9d, byte [rbx + 0x1a]
shl r9, 0x10
mov qword [rsp + 0x70], r9
movzx r10d, byte [rbx + 0x19]
shl r10, 8
mov qword [rsp + 0x68], r10
movzx r11d, byte [rbx + 0x18]
mov qword [rsp + 0x60], r11
movzx r12d, byte [rbx + 0x17]
shl r12, 0x38
mov qword [rsp + 0x58], r12
movzx r13d, byte [rbx + 0x16]
shl r13, 0x30
mov qword [rsp + 0x50], r13
movzx r15d, byte [rbx + 0x15]
shl r15, 0x28
mov qword [rsp + 0x48], r15
movzx ecx, byte [rbx + 0x14]
shl rcx, 0x20
mov qword [rsp + 0x40], rcx
movzx edx, byte [rbx + 0x13]
shl rdx, 0x18
mov qword [rsp + 0x38], rdx
movzx esi, byte [rbx + 0x12]
shl rsi, 0x10
mov qword [rsp + 0x30], rsi
movzx edi, byte [rbx + 0x11]
shl rdi, 8
mov qword [rsp + 0x28], rdi
movzx r8d, byte [rbx + 0x10]
mov qword [rsp + 0x20], r8
movzx r9d, byte [rbx + 0xf]
shl r9, 0x38
mov qword [rsp + 0x18], r9
movzx r10d, byte [rbx + 0xe]
shl r10, 0x30
mov qword [rsp + 0x10], r10
movzx r11d, byte [rbx + 0xd]
shl r11, 0x28
mov qword [rsp + 8], r11
movzx r12d, byte [rbx + 0xc]
shl r12, 0x20
mov qword [rsp], r12
movzx r13d, byte [rbx + 0xb]
shl r13, 0x18
movzx r15d, byte [rbx + 0xa]
shl r15, 0x10
movzx ecx, byte [rbx + 9]
shl rcx, 8
movzx edx, byte [rbx + 8]
movzx esi, byte [rbx + 7]
shl rsi, 0x38
movzx edi, byte [rbx + 6]
shl rdi, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r9d, byte [rbx + 4]
shl r9, 0x20
movzx r10d, byte [rbx + 3]
shl r10, 0x18
movzx r11d, byte [rbx + 2]
shl r11, 0x10
movzx r12d, byte [rbx + 1]
shl r12, 8
movzx ebx, byte [rbx]
add rbx, r12
add rbx, r11
add rbx, r10
add rbx, r9
add rbx, r8
add rbx, rdi
add rbx, rsi
mov qword [rax], rbx
add rcx, rdx
add rcx, r15
add rcx, r13
mov rdx, qword [rsp]
add rcx, rdx
mov rdx, qword [rsp + 8]
add rcx, rdx
mov rdx, qword [rsp + 0x10]
add rcx, rdx
mov rdx, qword [rsp + 0x18]
add rcx, rdx
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
add rcx, rdx
mov rdx, qword [rsp + 0x30]
add rcx, rdx
mov rdx, qword [rsp + 0x38]
add rcx, rdx
mov rdx, qword [rsp + 0x40]
add rcx, rdx
mov rdx, qword [rsp + 0x48]
add rcx, rdx
mov rdx, qword [rsp + 0x50]
add rcx, rdx
mov rdx, qword [rsp + 0x58]
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
add rcx, rdx
mov rdx, qword [rsp + 0x70]
add rcx, rdx
mov rdx, qword [rsp + 0x78]
add rcx, rdx
mov rdx, qword [rsp + 0x80]
add rcx, rdx
mov rdx, qword [rsp + 0x88]
add rcx, rdx
mov rdx, qword [rsp + 0x90]
add rcx, rdx
mov rdx, qword [rsp + 0x98]
add rcx, rdx
mov qword [rax + 0x18], rcx
add rsp, 0xa0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0053bee0
Function at 0x53eb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53ed17
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x88], r9
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rdi
lea rax, [0x00653740]
call fcn.0040eb20
mov qword [rsp + 0x38], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x53ebc5
mov rax, rdx
mov rcx, r10
mov rdx, qword [rsp + 0x30]
mov rbx, r8
mov rsi, qword [rsp + 0x60]
cmp rsi, rcx
jle 0x53ecd9
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x38]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x38]
mov ecx, 4
mov rdi, rcx
call rsi
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x30]
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
mov rdi, qword [rsp + 0x30]
call rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rsp + 0x70]
mov rsi, qword [rdx + 0x20]
mov rax, qword [rsp + 0x78]
call rsi
mov rdx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x20]
xor eax, eax
jmp 0x53ecf6
mov rdx, qword [rsp + 0x38]
movzx r11d, byte [rdx + 3]
lea r12d, [r11 + 1]
mov byte [rdx + 3], r12b
cmp r11b, 0xff
jne 0x53ebb7
movzx r11d, byte [rdx + 2]
lea r12d, [r11 + 1]
mov byte [rdx + 2], r12b
cmp r11b, 0xff
jne 0x53ebb7
movzx r11d, byte [rdx + 1]
lea r12d, [r11 + 1]
mov byte [rdx + 1], r12b
nop
cmp r11b, 0xff
jne 0x53ebb7
movzx r11d, byte [rdx]
inc r11d
mov byte [rdx], r11b
jmp 0x53ebb7
add rsp, 0x48
pop rbp
ret
movzx r11d, byte [r10 + rsi]
movzx r12d, byte [rax + r8]
xor r11d, r12d
mov byte [rsi + r10], r11b
inc rax
inc r10
cmp rdx, rax
jle 0x53ec7f
nop dword [rax + rax]
cmp r9, r10
jle 0x53ec7f
ja 0x53ecdf
mov rax, r10
mov rcx, r9
call fcn.0046c440
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
nop
call fcn.0046a160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
jmp fcn.0053eb60
Function at 0x53ed80
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x1f8]
cmp r12, qword [r14 + 0x10]
jbe 0x53f00e
push rbp
mov rbp, rsp
sub rsp, 0x270
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x290], rcx
mov qword [rsp + 0x288], rbx
nop
nop
call fcn.0049af20
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x280]
mov rcx, qword [rax]
mov rax, rcx
call fcn.0051ed00
test rbx, rbx
jne 0x53ef82
mov qword [rsp + 0x238], rax
lea rdi, [rsp + 0x130]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046c6f4
mov rbp, qword [rbp]
mov qword [rsp + 0x258], 0
movups xmmword [rsp + 0x260], xmm15
mov qword [rsp + 0x260], 0
mov qword [rsp + 0x268], 0x20
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x258], rdx
mov rbx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x290]
mov rdi, qword [rsp + 0x298]
mov rsi, rax
lea rax, [rsp + 0x258]
call fcn.0051e4e0
nop dword [rax + rax]
test rbx, rbx
jne 0x53ef6c
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rdx + 8]
lea rdi, [rsp + 0x30]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046c6f4
mov rbp, qword [rbp]
mov qword [rsp + 0x240], 0
movups xmmword [rsp + 0x248], xmm15
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x250], 0x20
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x240], rdx
mov rbx, rax
mov rdi, qword [rsp + 0x238]
lea rax, [rsp + 0x240]
call fcn.00520fa0
mov qword [rsp + 0x230], rax
mov rdx, qword [rsp + 0x238]
mov rsi, qword [rdx]
mov rsi, qword [rsi + 8]
shl rsi, 6
sub rsi, qword [rdx + 8]
lea rdx, [rsi + 7]
sar rdx, 0x3f
shr rdx, 0x3d
lea rcx, [rdx + rsi]
lea rcx, [rcx + 7]
sar rcx, 3
mov qword [rsp + 0x28], rcx
nop
mov rbx, rcx
lea rax, [0x00650540]
call fcn.0044f700
mov rdx, qword [rsp + 0x230]
mov rsi, qword [rdx]
mov rdx, qword [rdx + 8]
mov r8, qword [rsp + 0x28]
mov rcx, r8
xor ebx, ebx
jmp 0x53efa0
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
xor eax, eax
mov rdi, rbx
mov rsi, rcx
xor ebx, ebx
mov rcx, rbx
add rsp, 0x270
pop rbp
ret
inc rbx
mov r8, r10
nop
cmp rbx, rdx
jge 0x53efb9
mov r9, qword [rsi + rbx*8]
xor edi, edi
jmp 0x53efd8
test r9, r9
je 0x53ef98
jmp 0x53efee
mov r10, r8
jmp 0x53ef98
mov rbx, rcx
xor edi, edi
xor esi, esi
add rsp, 0x270
pop rbp
ret
mov byte [r8 + rax - 1], r9b
inc rdi
shr r9, 8
mov r8, r10
cmp rdi, 8
jge 0x53efb4
lea r10, [r8 - 1]
test r10, r10
jl 0x53efad
cmp rcx, r10
ja 0x53efc9
jmp 0x53f005
lea rax, [0x006504c0]
lea rbx, [0x00717a60]
nop dword [rax]
call fcn.00438a20
mov rax, r10
call fcn.0046c440
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax + rax]
jmp fcn.0053ed80
Function at 0x53f6e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53f91b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
nop
call fcn.0049af20
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x53f82a
nop dword [rax]
cmp rdx, 0x40
ja 0x53f90d
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x53f799
mov rax, rdx
mov rcx, rsi
nop
call fcn.0046ce00
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x53f801
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.0053fe60
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x53f902
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rax
sub r8, rsi
add rbx, rdx
jmp 0x53f837
mov r8, rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x40
jl 0x53f8b5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.0053fe60
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test r8, r8
je 0x53f8f8
lea rdx, [rcx + 0x20]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
cmp rbx, rdx
je 0x53f8f4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
nop dword [rax + rax]
call fcn.0046ce00
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rcx, rax
mov rax, rsi
call fcn.0046c500
mov rax, rdx
mov ecx, 0x40
call fcn.0046c500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046a160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0053f6e0
Function at 0x554f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5550ae
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x38], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x0091ad90]
call fcn.005063a0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x005550c0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403bc0
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x555072
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x5550a8
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x55509d
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x48]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call fcn.0046c500
call fcn.0046c480
nop
call fcn.0046a160
jmp fcn.00554f60
Function at 0x566960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x566b40
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
cmp rsi, 2
jne 0x5669d6
cmp word [rdi], 0x7069
jne 0x566a32
mov qword [rsp], r8
mov qword [rsp + 8], r9
mov byte [rsp + 0x10], 0x3a
call fcn.004034e0
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
setg al
mov rbx, qword [rsp + 0x68]
mov ecx, eax
mov rax, qword [rsp + 0x60]
jmp 0x566a34
cmp rsi, 3
jne 0x566a32
cmp word [rdi], 0x6374
jne 0x5669e9
cmp byte [rdi + 2], 0x70
je 0x5669f6
cmp word [rdi], 0x6475
jne 0x566a32
cmp byte [rdi + 2], 0x70
jne 0x566a32
mov qword [rsp], r8
mov qword [rsp + 8], r9
mov byte [rsp + 0x10], 0x5b
call fcn.004034e0
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
setg al
mov rbx, qword [rsp + 0x68]
mov ecx, eax
mov rax, qword [rsp + 0x60]
jmp 0x566a34
xor ecx, ecx
test cl, cl
je 0x566a45
mov rdx, rax
mov rcx, rbx
nop
jmp 0x566ae6
mov rsi, rax
mov rcx, rbx
jmp 0x566a68
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov rbx, qword [rsp + 0x30]
dec rbx
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
test rbx, rbx
jle 0x566aab
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rax + 8]
mov qword [rsp + 0x38], rbx
mov rsi, qword [fcn.00566800]
lea rdx, fcn.00566800
mov rax, rcx
call rsi
test al, al
je 0x566a4d
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
jmp 0x566ab7
test rcx, rcx
jbe 0x566ac1
mov rcx, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rcx
add rsp, 0x50
pop rbp
nop
ret
xor eax, eax
mov rcx, rax
call fcn.0046c440
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov rbx, qword [rsp + 0x30]
dec rbx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
test rbx, rbx
jle 0x566b20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov rbx, qword [rax + 8]
mov qword [rsp + 0x40], rbx
mov rax, rcx
call fcn.00566800
test al, al
jne 0x566acb
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x40]
jmp 0x566b2c
test rcx, rcx
jbe 0x566b35
mov rcx, qword [rdx]
mov rbx, qword [rdx + 8]
mov rax, rcx
add rsp, 0x50
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.0046c440
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046a160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.00566960
Function at 0x57b3a0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x57b3b8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x57b3b8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x57b3c0
xor eax, eax
ret
cmp rbx, 3
je 0x57b3cc
cmp rbx, 4
jne 0x57b3f9
cmp al, 0x2c
ja 0x57b3e6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x57b3f6
cmp al, 0x24
je 0x57b3f6
nop dword [rax]
cmp al, 0x26
jae 0x57b3f6
jmp 0x57b3f9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x57b3f6
cmp al, 0x5b
je 0x57b3f6
cmp al, 0x5d
jne 0x57b3f9
xor eax, eax
ret
cmp al, 0x2f
ja 0x57b432
nop dword [rax]
cmp al, 0x26
ja 0x57b411
cmp al, 0x24
je 0x57b451
cmp al, 0x26
je 0x57b451
jmp 0x57b4cb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x57b451
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x57b4c8
cmp al, 0x2f
je 0x57b451
jmp 0x57b4cb
cmp al, 0x3d
ja 0x57b449
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x57b451
nop
cmp al, 0x3d
je 0x57b451
jmp 0x57b4cb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x57b4c0
cmp rbx, 2
jg 0x57b487
cmp rbx, 1
je 0x57b481
nop dword [rax]
cmp rbx, 2
jne 0x57b4cb
cmp al, 0x2f
je 0x57b472
cmp al, 0x3b
je 0x57b472
cmp al, 0x2c
jne 0x57b479
mov ecx, 1
jmp 0x57b47e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x57b4aa
cmp al, 0x40
je 0x57b499
cmp al, 0x2f
je 0x57b499
cmp al, 0x3f
jne 0x57b4a2
mov ecx, 1
nop
jmp 0x57b4a7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x57b4b9
cmp rbx, 7
jne 0x57b4cb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x57b4c8
cmp al, 0x7e
jne 0x57b4cb
xor eax, eax
ret
cmp rbx, 7
jne 0x57b4e1
cmp al, 0x21
je 0x57b4dd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x57b4e1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x580400
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58060b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x580524
cmp rdx, 0x40
ja 0x5805fd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x580494
mov rax, rdx
mov rcx, rsi
call fcn.0046ce00
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x580500
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00580880
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x5805f5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x580527
mov r8, rcx
cmp r8, 0x40
jl 0x5805a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.00580880
xorps xmm15, xmm15
mov r14, qword [0x009b5010]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x5805e8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x5805e4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046ce00
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046c500
mov rax, rdx
mov ecx, 0x40
call fcn.0046c500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046a160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00580400
Function at 0x59a080
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x59a147
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x59a0ac
test r15, r15
je 0x59a18a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x59a15c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x59a0bb
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x59b600
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x59b6a7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x59b74a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x59b6a7
cmp r9, 0
je 0x59b803
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x59b760
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret