joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501460
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x5016c3
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x5016a7
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x5014ad
xor ebx, ebx
xor ecx, ecx
jmp 0x5014c0
mov rax, rdx
call fcn.004f4680
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x5015db
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0047bd60
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f9b09]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e6e0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x50159e
xor eax, eax
lea rbx, [0x00666a8c]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005f9bc5]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e7c0
jmp 0x5015cb
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005f9b13]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e6e0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.0047bd60
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x50166a
xor eax, eax
lea rbx, [0x00666a8c]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005f9bc5]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e7c0
jmp 0x501697
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f9b13]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e6e0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x005fa0e6]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00461440
mov rax, qword [rsp + 8]
jmp fcn.00501460
Function at 0x502b80
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x502de3
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x502dc7
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x502bcd
xor ebx, ebx
xor ecx, ecx
jmp 0x502be0
mov rax, rdx
call fcn.004f4680
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x502cfb
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.0047bd60
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f9b09]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e6e0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x502cbe
xor eax, eax
lea rbx, [0x00666a8c]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x005f9bc5]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e7c0
jmp 0x502ceb
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005f9b13]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e6e0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.0047bd60
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402ea0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x502d8a
xor eax, eax
lea rbx, [0x00666a8c]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x005f9bc5]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e7c0
jmp 0x502db7
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005f9b13]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e6e0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x005fa0e6]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00461440
mov rax, qword [rsp + 8]
jmp fcn.00502b80
Function at 0x50e200
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e3bc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x50e247
nop
jae 0x50e2be
jmp 0x50e3b0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x50e28b
lea rax, [0x005c1180]
mov ebx, 1
mov rcx, rbx
call fcn.0044a9c0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x50e2be
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x005c1180]
call fcn.0044a9c0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x50e2d3
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x50e305
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x50e2c6
nop dword [rax + rax]
jmp 0x50e3a5
test rsi, rsi
jle 0x50e312
xor r8d, r8d
xor r9d, r9d
jmp 0x50e36e
jmp 0x50e317
dec rbx
test rbx, rbx
jle 0x50e326
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x50e314
cmp rbx, rcx
ja 0x50e335
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rdx, rcx
mov rcx, rbx
nop dword [rax + rax]
call fcn.00463ba0
cmp r8, 0x40
sbb r11, r11
lea r12, [r8 + 8]
movzx r13d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r13, cl
and r13, r11
or r9, r13
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x50e37e
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x50e345
jmp 0x50e399
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x50e38e
mov qword [rax + rbx*8 - 8], r9
jmp 0x50e312
mov rax, rsi
mov rcx, rbx
call fcn.00463b20
mov rax, r10
mov rcx, rdx
nop
call fcn.00463b20
mov rax, r9
mov rcx, rbx
call fcn.00463b20
mov rdx, rcx
mov rcx, rbx
call fcn.00463ba0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00461440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
nop dword [rax]
jmp fcn.0050e200
Function at 0x515940
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x51597f
jb 0x515994
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x515a00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x515a3f
jb 0x515a54
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x515ac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x515b90
jb 0x515bef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.005158e0
aeskeygenassist xmm1, xmm0, 1
call fcn.00515900
aeskeygenassist xmm1, xmm2, 2
call fcn.005158e0
aeskeygenassist xmm1, xmm0, 2
call fcn.00515900
aeskeygenassist xmm1, xmm2, 4
call fcn.005158e0
aeskeygenassist xmm1, xmm0, 4
call fcn.00515900
aeskeygenassist xmm1, xmm2, 8
call fcn.005158e0
aeskeygenassist xmm1, xmm0, 8
call fcn.00515900
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005158e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00515900
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005158e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00515900
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005158e0
jmp 0x515c5d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00515840
aeskeygenassist xmm1, xmm2, 2
call fcn.005158a0
aeskeygenassist xmm1, xmm2, 4
call fcn.00515840
aeskeygenassist xmm1, xmm2, 8
call fcn.005158a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00515840
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005158a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00515840
aeskeygenassist xmm1, xmm2, 0x80
call fcn.005158a0
jmp 0x515c5d
aeskeygenassist xmm1, xmm0, 1
call fcn.00515800
aeskeygenassist xmm1, xmm0, 2
call fcn.00515800
aeskeygenassist xmm1, xmm0, 4
call fcn.00515800
aeskeygenassist xmm1, xmm0, 8
call fcn.00515800
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00515800
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00515800
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00515800
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00515800
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00515800
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00515800
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x515c6a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x518fe0
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5191ec
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movzx ecx, byte [rbx + 0x1b]
mov qword [rsp + 0x78], rcx
movzx edx, byte [rbx + 0x1a]
mov qword [rsp + 0x70], rdx
movzx esi, byte [rbx + 0x19]
mov qword [rsp + 0x68], rsi
movzx edi, byte [rbx + 0x18]
mov qword [rsp + 0x60], rdi
movzx r8d, byte [rbx + 0x17]
mov qword [rsp + 0x58], r8
movzx r9d, byte [rbx + 0x16]
mov qword [rsp + 0x50], r9
movzx r10d, byte [rbx + 0x15]
mov qword [rsp + 0x48], r10
movzx r11d, byte [rbx + 0x14]
mov qword [rsp + 0x40], r11
movzx r12d, byte [rbx + 0x13]
mov qword [rsp + 0x38], r12
movzx r13d, byte [rbx + 0x12]
mov qword [rsp + 0x30], r13
movzx r15d, byte [rbx + 0x11]
mov qword [rsp + 0x28], r15
movzx edi, byte [rbx + 0x10]
mov qword [rsp + 0x20], rdi
movzx esi, byte [rbx + 0xf]
movzx edx, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
movzx r15d, byte [rbx + 0xb]
mov qword [rsp + 0x18], r15
movzx r13d, byte [rbx + 0xa]
mov qword [rsp + 0x10], r13
movzx r12d, byte [rbx + 9]
mov qword [rsp + 8], r12
movzx r11d, byte [rbx + 8]
mov qword [rsp], r11
movzx r10d, byte [rbx + 7]
shl r10, 0x38
movzx r9d, byte [rbx + 6]
shl r9, 0x30
movzx r8d, byte [rbx + 5]
shl r8, 0x28
movzx r11d, byte [rbx + 4]
shl r11, 0x20
movzx r12d, byte [rbx + 3]
shl r12, 0x18
movzx r13d, byte [rbx + 2]
shl r13, 0x10
movzx r15d, byte [rbx + 1]
shl r15, 8
movzx ebx, byte [rbx]
add rbx, r15
add rbx, r13
add rbx, r12
add rbx, r11
add rbx, r8
add rbx, r9
add rbx, r10
mov qword [rax], rbx
shl rsi, 0x38
shl rdx, 0x30
shl rcx, 0x28
shl rdi, 0x20
mov rbx, qword [rsp + 0x18]
shl rbx, 0x18
mov r8, qword [rsp + 0x10]
shl r8, 0x10
mov r9, qword [rsp + 8]
shl r9, 8
mov r10, qword [rsp]
add r9, r10
add r8, r9
add rbx, r8
add rbx, rdi
add rcx, rbx
add rcx, rdx
add rcx, rsi
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x58]
shl rcx, 0x38
mov rdx, qword [rsp + 0x50]
shl rdx, 0x30
mov rbx, qword [rsp + 0x48]
shl rbx, 0x28
mov rsi, qword [rsp + 0x40]
shl rsi, 0x20
mov rdi, qword [rsp + 0x38]
shl rdi, 0x18
mov r8, qword [rsp + 0x30]
shl r8, 0x10
mov r9, qword [rsp + 0x28]
shl r9, 8
mov r10, qword [rsp + 0x20]
add r9, r10
add r8, r9
add rdi, r8
add rsi, rdi
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x78]
shl rcx, 0x18
mov rdx, qword [rsp + 0x70]
shl rdx, 0x10
mov rbx, qword [rsp + 0x68]
shl rbx, 8
mov rsi, qword [rsp + 0x60]
add rbx, rsi
add rdx, rbx
add rcx, rdx
mov qword [rax + 0x18], rcx
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00518fe0
Function at 0x538880
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5389d4
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.00538520
mov qword [rsp + 0x10], 0
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x538924
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x538975
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x5389a0
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
nop dword [rax + rax]
cmp rcx, 8
jge 0x53891e
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
cmp rsi, 0x20
jge 0x53891e
test byte [rbx], al
nop
cmp rsi, 0x20
jb 0x53898c
mov rax, rsi
mov ecx, 0x20
call fcn.00463b20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.00461440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00538880
Function at 0x540280
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x540298
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x540298
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x5402a0
xor eax, eax
ret
cmp rbx, 3
je 0x5402ac
cmp rbx, 4
jne 0x5402d9
cmp al, 0x2c
ja 0x5402c6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x5402d6
cmp al, 0x24
je 0x5402d6
nop dword [rax]
cmp al, 0x26
jae 0x5402d6
jmp 0x5402d9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x5402d6
cmp al, 0x5b
je 0x5402d6
cmp al, 0x5d
jne 0x5402d9
xor eax, eax
ret
cmp al, 0x2f
ja 0x540312
nop dword [rax]
cmp al, 0x26
ja 0x5402f1
cmp al, 0x24
je 0x540331
cmp al, 0x26
je 0x540331
jmp 0x5403ab
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x540331
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5403a8
cmp al, 0x2f
je 0x540331
jmp 0x5403ab
cmp al, 0x3d
ja 0x540329
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x540331
nop
cmp al, 0x3d
je 0x540331
jmp 0x5403ab
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5403a0
cmp rbx, 2
jg 0x540367
cmp rbx, 1
je 0x540361
nop dword [rax]
cmp rbx, 2
jne 0x5403ab
cmp al, 0x2f
je 0x540352
cmp al, 0x3b
je 0x540352
cmp al, 0x2c
jne 0x540359
mov ecx, 1
jmp 0x54035e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x54038a
cmp al, 0x40
je 0x540379
cmp al, 0x2f
je 0x540379
cmp al, 0x3f
jne 0x540382
mov ecx, 1
nop
jmp 0x540387
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x540399
cmp rbx, 7
jne 0x5403ab
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5403a8
cmp al, 0x7e
jne 0x5403ab
xor eax, eax
ret
cmp rbx, 7
jne 0x5403c1
cmp al, 0x21
je 0x5403bd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5403c1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x5481c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x548295
movdqa xmm0, xmmword [0x00667100]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x548201
movdqa xmm0, xmmword [0x00667110]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x548317
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5482eb
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00666c58]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x006674d0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x563fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x564137
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov byte [rsp + 0xb0], bl
mov dword [rsp + 0xb4], ecx
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xbc], esi
mov dword [rsp + 0xc0], r8d
mov dword [rsp + 0xc4], r9d
mov dword [rsp + 0xc8], r10d
mov dword [rsp + 0xcc], r11d
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x78], rdx
mov rax, qword [0x007b5598]
mov qword [rsp + 0x70], rax
nop
call fcn.005634a0
test rax, rax
jne 0x56412b
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx + 0x20]
mov rcx, qword [rsp + 0x80]
mov r12d, dword [rsp + 0xc8]
mov r12d, r12d
mov r13, qword [rsp + 0x78]
mov rax, qword [rdx + 0x18]
mov qword [rsp], r12
mov edx, dword [rsp + 0xcc]
mov edx, edx
mov qword [rsp + 8], rdx
mov edx, dword [rsp + 0x98]
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r13
mov qword [rsp + 0x20], 0
movzx edx, byte [rsp + 0xb0]
movzx edi, dl
mov edx, dword [rsp + 0xb4]
mov esi, edx
mov edx, dword [rsp + 0xb8]
mov r8d, edx
mov edx, dword [rsp + 0xbc]
mov r9d, edx
mov edx, dword [rsp + 0xc0]
mov r10d, edx
mov edx, dword [rsp + 0xc4]
mov r11d, edx
mov ebx, 0xb
call fcn.0045fe80
test rax, rax
jne 0x564111
test rcx, rcx
jne 0x5640e3
mov rcx, qword [0x007ac450]
mov rdx, qword [0x007ac458]
jmp 0x564115
cmp rcx, 0x3e5
jne 0x5640fc
mov rcx, qword [0x007ac460]
mov rdx, qword [0x007ac468]
jmp 0x564115
mov rax, rcx
nop
call fcn.0040a9e0
lea rcx, [0x00667ec0]
mov rdx, rax
jmp 0x564115
xor ecx, ecx
xor edx, edx
mov rax, rcx
mov rbx, rdx
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
je 0x564131
mov rax, qword [rax + 8]
call fcn.00436900
nop
mov qword [rsp + 0x18], rax
mov byte [rsp + 0x20], bl
mov dword [rsp + 0x24], ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x3c], r11d
call fcn.00461440
mov rax, qword [rsp + 0x18]
movzx ebx, byte [rsp + 0x20]
mov ecx, dword [rsp + 0x24]
mov edi, dword [rsp + 0x28]
mov esi, dword [rsp + 0x2c]
mov r8d, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov r10d, dword [rsp + 0x38]
mov r11d, dword [rsp + 0x3c]
jmp fcn.00563fa0