joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d027a
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
cmp rsi, r10
jl 0x4d0266
test rsi, rsi
je 0x4d024b
nop dword [rax]
test r10, r10
je 0x4d023f
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0xb8], r11
mov qword [rsp + 0xb0], r10
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa8], r9
mov rdi, rsi
nop dword [rax]
call fcn.004cfb80
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x18], rsi
mov r8, qword [rsp + 0x98]
mov qword [rsp + 0x20], r8
mov r9, qword [rsp + 0xa0]
mov qword [rsp + 0x28], r9
mov r10, qword [rsp + 0xa8]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rdx
mov r10, qword [rsp + 0xb8]
mov qword [rsp + 0x40], r10
call fcn.004d8e80
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x98]
mov r8, qword [rsp + 0xb0]
nop dword [rax]
cmp rsi, r8
jle 0x4d0220
mov rax, qword [rsp + 0x58]
sub rax, r8
mov rbx, qword [rsp + 0x50]
sub rbx, r8
mov r9, r8
shl r8, 3
mov r10, rax
neg rax
sar rax, 0x3f
and rax, r8
mov r11, qword [rsp + 0x60]
add rax, r11
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], r10
mov rax, qword [rsp + 0xa0]
sub rax, r9
sub rsi, r9
mov rbx, rax
neg rax
sar rax, 0x3f
and rax, r8
mov r8, qword [rsp + 0x90]
add rax, r8
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rdx
nop dword [rax]
call fcn.004d8fc0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x38]
nop dword [rax]
test rdx, rdx
jne 0x4d0253
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.004cfb60
add rsp, 0x68
pop rbp
ret
nop
call fcn.004cfd20
add rsp, 0x68
pop rbp
ret
xor ebx, ebx
add rsp, 0x68
pop rbp
ret
lea rax, [0x00563c20]
lea rbx, [0x005d3470]
call fcn.0043d580
lea rax, [0x00563c20]
lea rbx, [0x005d3470]
call fcn.0043d580
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004d0060
Function at 0x4d04e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d060b
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x98], r10
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x80], rsi
lea rbx, [rsi + r10]
call fcn.004cfb00
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
xor eax, eax
jmp 0x4d0541
inc rax
cmp rdx, rax
jle 0x4d0605
mov rcx, qword [rsi + rax*8]
test rcx, rcx
je 0x4d053e
mov qword [rsp + 0x40], rax
mov rdx, rax
shl rax, 3
mov rbx, qword [rsp + 0x80]
lea rsi, [rbx + rdx]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x70]
sub rdi, rdx
mov r9, rdi
neg rdi
sar rdi, 0x3f
and rax, rdi
mov rdi, qword [rsp + 0x60]
add rax, rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], r9
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], rcx
nop dword [rax]
call fcn.004d9200
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
mov qword [rdx + rcx*8], rax
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
nop
jmp 0x4d053e
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004d04e0
Function at 0x4d0a60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d0b54
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004d8de0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4d0b4e
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
sub rcx, rdx
mov rbx, rcx
neg rcx
sar rcx, 0x3f
mov rsi, rdx
shl rdx, 3
and rdx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rsp], rcx
mov rdx, rsi
sar rsi, 1
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
call fcn.004d8f20
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop
jmp fcn.004d0a60
Function at 0x4d0bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d0cb4
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004d8e80
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4d0cae
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
sub rcx, rdx
mov rbx, rcx
neg rcx
sar rcx, 0x3f
mov rsi, rdx
shl rdx, 3
and rdx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rdx
mov qword [rsp], rcx
mov rdx, rsi
sar rsi, 1
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x68]
sub rcx, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
call fcn.004d8fc0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop
jmp fcn.004d0bc0
Function at 0x4d14e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d1613
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
test rsi, rsi
je 0x4d160d
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
sub rcx, r9
mov r10, rcx
neg rcx
mov r11, r9
shl r9, 3
sar rcx, 0x3f
and r9, rcx
lea rcx, [rax + r9]
mov qword [rsp], rcx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], r10
mov qword [rsp + 0x18], rcx
sub rbx, r11
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r8
call fcn.004d8de0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4d160d
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x90]
add rcx, rdx
mov rdx, qword [rsp + 0x68]
cmp rdx, rcx
jle 0x4d160d
mov rbx, qword [rsp + 0x70]
sub rbx, rcx
sub rdx, rcx
mov rsi, rbx
neg rbx
shl rcx, 3
sar rbx, 0x3f
and rbx, rcx
mov rcx, qword [rsp + 0x60]
add rcx, rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
call fcn.004d8f20
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
nop
jmp fcn.004d14e0
Function at 0x4d2d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d2fa6
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r8
nop word [rax + rax]
test r9, r9
jne 0x4d2e5d
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rbx
nop
call fcn.004d2d40
test al, al
jne 0x4d2f8b
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa0]
call fcn.004d14a0
nop
test al, al
je 0x4d2f53
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0xa8]
nop dword [rax]
test rsi, rsi
jne 0x4d2e6d
xor ebx, ebx
add rsp, 0x68
pop rbp
ret
shr r9, 6
mov qword [rsp + 0x58], r9
lea r8, [r9 + rsi]
mov qword [rsp + 0x40], r8
lea rdi, [r9 + rsi]
lea rdi, [rdi + 1]
call fcn.004cfb80
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov rdx, qword [rsp + 0x58]
sub rcx, rdx
mov r8, rcx
neg rcx
shl rdx, 3
sar rcx, 0x3f
and rdx, rcx
add rdx, rax
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0xa8]
and edx, 0x3f
mov qword [rsp + 0x30], rdx
nop dword [rax]
call fcn.004d9060
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x60]
mov qword [rax + rsi*8], rdx
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.004cfb00
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.004cfb60
add rsp, 0x68
pop rbp
ret
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa0]
call fcn.004cfd20
add rsp, 0x68
pop rbp
ret
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004d2d80
Function at 0x4d9620
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x4d96a5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x4d9806
cmp rcx, 0xe
jne 0x4d9720
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x4d9806
cmp rcx, 0xf
jne 0x4d9797
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x4d9806
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x4fa1a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa2c2
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x38], xmm15
mov qword [rsp + 0x28], 0
mov rax, qword [0x007403f0]
call fcn.004caa40
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004fa2e0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00404c60
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp + 0x18]
cmp rbx, 0xffffffffffffffff
je 0x4fa297
mov qword [rsp + 0x20], rbx
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x20]
sub rbx, rsi
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
inc rsi
and rsi, rdi
mov rdi, qword [rsp + 0x48]
lea rax, [rdi + rsi]
lea rdx, [rsp + 0x50]
nop
call rcx
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x68
pop rbp
ret
call fcn.0046d2c0
jmp fcn.004fa1a0
Function at 0x508ae0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x508b9a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00404c60
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x508b6d
xor eax, eax
lea rbx, [0x0059eb9f]
mov ecx, 1
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0059ebb6]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x70]
call fcn.004572a0
add rsp, 0x48
pop rbp
ret
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005d1758]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
call fcn.004571e0
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00508ae0

Function at 0x517640
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x517658
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x517658
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x517660
xor eax, eax
ret
cmp rbx, 3
je 0x51766c
cmp rbx, 4
jne 0x517699
cmp al, 0x2c
ja 0x517686
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x517696
cmp al, 0x24
je 0x517696
nop dword [rax]
cmp al, 0x26
jae 0x517696
jmp 0x517699
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x517696
cmp al, 0x5b
je 0x517696
cmp al, 0x5d
jne 0x517699
xor eax, eax
ret
cmp al, 0x2f
ja 0x5176d2
nop dword [rax]
cmp al, 0x26
ja 0x5176b1
cmp al, 0x24
je 0x5176f1
cmp al, 0x26
je 0x5176f1
jmp 0x51776b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5176f1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x517768
cmp al, 0x2f
je 0x5176f1
jmp 0x51776b
cmp al, 0x3d
ja 0x5176e9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5176f1
nop
cmp al, 0x3d
je 0x5176f1
jmp 0x51776b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x517760
cmp rbx, 2
jg 0x517727
cmp rbx, 1
je 0x517721
nop dword [rax]
cmp rbx, 2
jne 0x51776b
cmp al, 0x2f
je 0x517712
cmp al, 0x3b
je 0x517712
cmp al, 0x2c
jne 0x517719
mov ecx, 1
jmp 0x51771e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x51774a
cmp al, 0x40
je 0x517739
cmp al, 0x2f
je 0x517739
cmp al, 0x3f
jne 0x517742
mov ecx, 1
nop
jmp 0x517747
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x517759
cmp rbx, 7
jne 0x51776b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x517768
cmp al, 0x7e
jne 0x51776b
xor eax, eax
ret
cmp rbx, 7
jne 0x517781
cmp al, 0x21
je 0x51777d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x517781
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x534ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x534cec
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0x98], rax
mov rcx, qword [rax + 0x2c8]
mov qword [rsp + 0x58], rcx
mov rdi, qword [rax + 0x2d0]
mov qword [rsp + 0x40], rdi
mov rsi, qword [rax + 0x2d8]
mov qword [rsp + 0x48], rsi
mov edx, 1
jmp 0x534b30
inc rdx
cmp rdx, rdi
jl 0x534b39
xor ebx, ebx
jmp 0x534b68
mov qword [rsp + 0x50], rdx
movzx eax, byte [rcx + rdx]
call fcn.0047c660
xor eax, 1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov ebx, eax
mov rax, qword [rsp + 0x98]
test bl, bl
jne 0x534b2d
jmp 0x534b94
movzx r9d, byte [rsp + 0x31]
mov r10, qword [rsp + 0x50]
lea rdx, [r9 + r10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
cmp rdx, rdi
jge 0x534cb4
mov qword [rsp + 0x50], rdx
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
mov r9, qword [rsp + 0x60]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
mov r10, qword [rax + 0x1a0]
mov r11, qword [r10]
xor ebx, ebx
mov r8, rdx
mov rdx, r10
mov rax, r9
call r11
mov byte [rsp + 0x38], al
mov byte [rsp + 0x39], bl
mov byte [rsp + 0x3a], cl
mov byte [rsp + 0x3b], dil
mov byte [rsp + 0x3c], sil
mov byte [rsp + 0x3d], r8b
mov word [rsp + 0x3e], r9w
mov r9, qword [rsp + 0x38]
mov qword [rsp + 0x30], r9
movzx eax, byte [rsp + 0x30]
movzx ebx, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x32]
movzx edi, byte [rsp + 0x33]
movzx esi, byte [rsp + 0x34]
movzx r8d, byte [rsp + 0x35]
movzx r9d, word [rsp + 0x36]
call fcn.00533760
nop dword [rax + rax]
test al, al
je 0x534b6e
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rdx, rcx
sub rdx, rbx
mov rsi, qword [rsp + 0x40]
sub rsi, rbx
mov rdi, qword [rsp + 0x98]
mov qword [rdi + 0x2d0], rsi
mov qword [rdi + 0x2d8], rdx
neg rdx
sar rdx, 0x3f
and rdx, rbx
mov rax, qword [rsp + 0x58]
add rdx, rax
cmp dword [0x007c9e00], 0
je 0x534ca4
call fcn.0046f200
mov qword [r11], rdx
mov rsi, qword [rdi + 0x2c8]
mov qword [r11 + 8], rsi
mov qword [rdi + 0x2c8], rdx
add rsp, 0x88
pop rbp
ret
mov rdx, qword [rax + 0x1a8]
cmp dword [0x007c9e00], 0
je 0x534cd7
call fcn.0046f200
mov qword [r11], rdx
mov rcx, qword [rax + 0x2b0]
mov qword [r11 + 8], rcx
mov qword [rax + 0x2b0], rdx
mov rcx, qword [rdx]
call rcx
add rsp, 0x88
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.0046d2c0
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.00534ae0