joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62bcc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x82fa48]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005e52a0
add esp, 8
mov dword [ebp - 0x21c], 0x200
lea edx, [ebp - 0x218]
push edx
call fcn.005e59b0
add esp, 4
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp + 0x10]
jbe 0x62bd19
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x21c]
push eax
push 1
mov ecx, dword [ebp - 0x220]
push ecx
call fcn.004f4005
add esp, 0x10
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x218]
add edx, dword [ebp - 4]
mov dword [ebp - 0x218], edx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp + 0x10], eax
je 0x62bd5d
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x21c]
je 0x62bcf0
lea edx, [ebp - 0x218]
push edx
call fcn.005e5970
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x62bd90
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.005e7830
add esp, 8
test eax, eax
ja 0x62bd90
mov dword [ebp - 0x224], 0
jmp 0x62bd9a
mov dword [ebp - 0x224], 1
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f1e40
mov esp, ebp
pop ebp
ret

Function at 0x62c6d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push eax
call fcn.005e6900
add esp, 4
sub eax, 1
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
jmp 0x62c6fa
mov ecx, dword [ebp + 0x10]
add ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
test edx, edx
je 0x62c7b9
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005e73f0
add esp, 8
cmp eax, 3
jne 0x62c766
cmp dword [ebp - 4], 0
je 0x62c757
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005e7280
fstp qword [esp]
push str._.14g
mov edx, dword [ebp + 0xc]
push edx
call fcn.004f7779
add esp, 0x10
test eax, eax
jle 0x62c757
mov dword [ebp - 0x14], 1
jmp 0x62c75e
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x62c7b4
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005e6130
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x62c7a7
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call fcn.004f5b31
add esp, 0x10
cmp eax, dword [ebp - 0x10]
jne 0x62c7a7
mov dword [ebp - 0x18], 1
jmp 0x62c7ae
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
jmp 0x62c6f1
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0062bb60
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x64e3b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x19c
call fcn.004051a0
movzx eax, al
test eax, eax
je 0x64e3f6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 8]
push eax
call fcn.00491290
add esp, 0xc
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x1b8
call fcn.0042a5b0
jmp 0x64e49e
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x1d0], 0
jne 0x64e437
push 0x7aade8
mov ecx, dword [ebp - 0x10]
add ecx, 0x19c
call fcn.00405130
push eax
call fcn.004f3cc2
add esp, 8
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1d0], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1d0], 0
jne 0x64e437
mov al, 1
jmp 0x64e4a0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x1d0]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f5b31
add esp, 0x10
cmp eax, dword [ebp + 0xc]
je 0x64e45c
mov al, 1
jmp 0x64e4a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x110
call fcn.00445660
cmp eax, 1
jbe 0x64e49e
mov ecx, dword [ebp - 0x10]
add ecx, 0x110
call fcn.004a6fc0
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004f3d5a
add esp, 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x110
call fcn.004b31b0
jmp 0x64e45c
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x65ca65
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x667deb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x82fa48]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x94], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 0x24]
call fcn.0064db70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.00404e40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.00404e40
mov byte [ebp - 4], 3
push 0x7ab24c
lea ecx, [ebp - 0x74]
call fcn.00404eb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x74]
push edx
call fcn.00403d00
mov ecx, eax
call fcn.0045b300
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x74]
call fcn.00404f30
push 0x7ab25c
lea ecx, [ebp - 0x90]
call fcn.00404eb0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.00403d00
mov ecx, eax
call fcn.0045b300
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x90]
call fcn.00404f30
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x30]
push edx
call fcn.005f9100
add esp, 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
push ecx
call fcn.005f9120
add esp, 8
lea edx, [ebp - 0x50]
push edx
call fcn.005f9100
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x65ca58
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.00404f30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.00404f30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00429360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404f30
jmp 0x65cb05
mov dword [ebp - 0x34], 0x3e8
mov eax, dword [ebp - 0x14]
push eax
push 1
push 3
push 0x7ab26c
call fcn.004f5b31
add esp, 0x10
mov ecx, dword [ebp - 0x14]
push ecx
push 1
push 1
lea edx, [ebp + 0x28]
push edx
call fcn.004f5b31
add esp, 0x10
mov eax, dword [ebp - 0x14]
push eax
push 1
push 4
lea ecx, [ebp - 0x34]
push ecx
call fcn.004f5b31
add esp, 0x10
mov edx, dword [ebp - 0x14]
push edx
push 1
lea ecx, [ebp - 0x58]
call fcn.00472c70
mov eax, dword [eax + 0x10]
push eax
lea ecx, [ebp - 0x58]
call fcn.00472c70
mov ecx, eax
call fcn.00473b40
push eax
call fcn.004f5b31
add esp, 0x10
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004f458f
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.00404f30
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.00404f30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00429360
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404f30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f1e40
mov esp, ebp
pop ebp
ret 0x24
Function at 0x8d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8d806a
add dl, dl
jne 0x8d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8d80dc
xor eax, eax
add dl, dl
jne 0x8d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8d817d
add dl, dl
jne 0x8d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8d8075
mov eax, 1
add dl, dl
jne 0x8d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8d80e1
sub eax, ebx
mov ebx, 1
jne 0x8d8128
mov ecx, 1
add dl, dl
jne 0x8d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8d8136
cmp eax, 0x7d00
jae 0x8d816d
cmp eax, 0x500
jb 0x8d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8d8075
cmp eax, 0x7f
ja 0x8d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1007a10c
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 0xc], ecx
jle 0x1007a132
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
movsx eax, byte [ecx + edx]
xor eax, 0xffffff80
shl eax, 0x18
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [esp + 0x10]
jl 0x1007a11d
pop esi
ret

Function at 0x1007ed43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1007ed52
pop dword [ebp - 0x40]
mov eax, 0x5c831405
sub eax, 0x4c7b26b3
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x2ac87016
sub dword [ebp - 0x50], 0xdc762acb
mov dword [ebp - 0x4c], 0xa0d13bb3
sub dword [ebp - 0x4c], 0x6e9def6e
mov dword [ebp - 0x48], 0x626965b4
sub dword [ebp - 0x48], 0x161d2186
mov dword [ebp - 0x44], 0x36340290
add dword [ebp - 0x44], 0xc9cbfd70
lea eax, [ebp - 0x50]
push eax
mov eax, 0xa55d41df
sub eax, 0x9554d1ab
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x59bf0d10
add dword [ebp - 0x50], 0x1ab35c46
mov dword [ebp - 0x4c], 0xa2b1cd31
sub dword [ebp - 0x4c], 0x61456bbc
mov dword [ebp - 0x48], 0x69b82a71
sub dword [ebp - 0x48], 0x648be05
mov dword [ebp - 0x44], 0x6baaf267
sub dword [ebp - 0x44], 0x6baaf267
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xc2743b5b
add eax, 0x4d9434c9
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3daa3
push 0
call eax
mov ecx, 0xea15cdae
add ecx, 0x15ea7b5d
xor edi, edi
add edi, eax
mov edx, 0x100b9000
add edx, dword [ebp - 0x40]
mov esi, 0x91197877
add dword [ebp - 0x10], 0xa80a6334
mov ebx, dword [edx]
sub dword [ebp - 0x2c], 0x2c63d49d
xor ebx, esi
sub dword [ebp - 0x3c], 0x163ea23b
mov dword [edi], ebx
sub dword [ebp - 0x38], 0x1164378a
add edi, 0xcee4eac5
add edi, 0x311b153f
add edx, 0xe4a74aac
sub edx, 0xe4a74aa8
loop 0x1007ee6a
add eax, 0x116ff
mov ebx, eax
add eax, 0xce3aa2d2
add eax, 0x31c55d33
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x411060
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x14
cmp dword [esp + 0x18], 0
push ebx
push ebp
push esi
push edi
mov edi, eax
jge 0x4110db
call fcn.00412330
mov edi, dword [edi + 0x8c]
cmp byte [edi + 0x8c5], 0
jne 0x41126d
fldz
mov ecx, dword [0x6a9f00]
mov edi, dword [edi + 0x784]
fst dword [esp + 0x2c]
fcomp dword [ecx + 0x1d8]
fnstsw ax
test ah, 0x44
jnp 0x4110bd
fld dword [ecx + 0x1d8]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x30]
add esp, 4
fld dword [esp + 0x2c]
push ecx
mov eax, 9
fstp dword [esp]
mov ecx, edi
call fcn.00515020
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
mov esi, dword [edi + 0x8c]
mov eax, dword [esi + 0x7f8]
cmp eax, 0x2b
jne 0x411107
mov eax, dword [esp + 0x2c]
push ecx
mov ecx, dword [esi + 0x81c]
push edx
call fcn.0051f580
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
cmp eax, 0x32
jne 0x411121
mov eax, dword [edi + 0x160]
call fcn.0042d9a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
lea eax, [esp + 0x10]
push eax
push ecx
push edx
push edi
call fcn.00411730
mov ebx, 1
cmp dword [esp + 0x14], ebx
jne 0x411152
mov ebp, dword [esp + 0x10]
cmp dword [ebp + 0x24], 0xb
jne 0x4111bd
mov ecx, dword [edi + 0x8c]
cmp dword [ecx + 0x7f8], 0x2b
je 0x4111bd
mov eax, dword [edi + 0x8c]
cmp byte [eax + 0x8c5], 0
jne 0x411268
fldz
mov ecx, dword [0x6a9f00]
mov esi, dword [eax + 0x784]
fst dword [esp + 0x2c]
fcomp dword [ecx + 0x1d8]
fnstsw ax
test ah, 0x44
jnp 0x41119a
fld dword [ecx + 0x1d8]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x30]
add esp, 4
fld dword [esp + 0x2c]
push ecx
mov eax, 9
fstp dword [esp]
mov ecx, esi
call fcn.00515020
call fcn.00412330
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
cmp dword [esp + 0x2c], 6
jne 0x411268
mov eax, dword [edi + 0x8c]
mov esi, 8
call fcn.00453630
jmp loc.0079eec8
call fcn.00412330
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x411730
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
xor edx, edx
cmp dword [ebp + 0x5600], edx
push esi
push edi
jl 0x41175a
mov eax, dword [esp + 0x34]
mov dword [eax], edx
mov dword [eax + 4], edx
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ecx + 0x7f8]
cmp eax, 0x33
jl 0x411770
cmp eax, 0x3c
jle 0x411780
cmp eax, edx
jne 0x411790
mov eax, dword [ecx + 0x82c]
cmp dword [eax + 0x24], 0x23
jne 0x411790
cmp dword [ebp + 0x5604], edx
jle 0x411790
cmp dword [ecx + 0x844], edx
jne 0x411745
mov eax, dword [ebp + 0x148]
cmp byte [eax + 0x18], dl
je 0x4117ca
cmp byte [eax + 0x1a], dl
jne 0x4117ca
cmp byte [eax + 0xf9], dl
jne 0x4117ca
mov esi, ebp
call fcn.00412490
test al, al
je 0x4117ca
mov ecx, dword [esp + 0x34]
mov dword [ecx + 4], 0x10
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [ebp + 0x14c]
test eax, eax
je 0x41180b
cmp byte [eax + 0x18], 0
je 0x41180b
cmp byte [eax + 0x1a], 0
jne 0x41180b
cmp byte [eax + 0xf9], 0
jne 0x41180b
mov esi, ebp
call fcn.00412490
test al, al
je 0x41180b
mov edx, dword [esp + 0x34]
mov dword [edx + 4], 0x11
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
lea eax, [esp + 0x10]
mov edx, ebp
call fcn.0040ae70
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebp + 0x144]
push edi
push ebx
push eax
mov eax, dword [esp + 0x40]
call fcn.00489970
test al, al
je 0x411857
mov ecx, dword [ebp + 0x138]
mov eax, dword [ecx + 0x30]
test eax, eax
je 0x4117be
cmp eax, 8
je 0x4117be
cmp eax, 7
je 0x4117be
jmp 0x797666

Function at 0x412c30
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x290
cmp dword [ebx + 0x5618], 0
push ebp
push esi
push edi
jg 0x412cd4
mov eax, dword [ebx + 0x5550]
cmp eax, 0x29
je 0x412c79
cmp eax, 0x2a
je 0x412c79
cmp eax, 0x2b
je 0x412c6f
cmp eax, 0x2c
je 0x412c6f
cmp eax, 0x2d
je 0x412c6f
mov esi, 3
lea edi, [esi + 4]
jmp 0x412c81
mov esi, 3
lea edi, [esi + 2]
jmp 0x412c81
mov esi, 2
lea edi, [esi + 1]
lea eax, [esp + 0xc]
call fcn.00412a90
mov eax, dword [esp + 0x294]
cmp esi, eax
jle 0x412c97
mov esi, eax
test eax, eax
je 0x412cd4
test esi, esi
jle 0x412cd4
mov ebp, esi
mov edx, ebx
call fcn.0040d770
mov esi, eax
jmp 0x794538
pop edi
pop esi
pop ebp
add esp, 0x290
ret
Function at 0x413d00
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64f558
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x8c]
mov eax, dword [ecx + 0x7f8]
cmp eax, 0x47
je 0x4140ec
cmp eax, 0x48
je 0x4140ec
mov eax, dword [edi + 0x5750]
test eax, eax
jle 0x413d61
add eax, 0xffffffff
mov dword [edi + 0x5750], eax
jne 0x413d61
mov eax, dword [ecx]
mov edx, dword [0x6a75dc]
mov eax, dword [eax + 0xd8]
push edx
call eax
mov eax, dword [edi + 0x5584]
cmp eax, 1
je 0x4140ec
cmp eax, 2
je 0x4140ec
cmp eax, 3
je 0x4140ec
cmp eax, 0xd
je 0x4140ec
mov eax, edi
call fcn.00413a40
test al, al
jne 0x4140ec
mov eax, dword [edi + 0x5574]
test eax, eax
jle 0x413db4
add eax, 0xffffffff
mov dword [edi + 0x5574], eax
jne 0x413db4
call fcn.00412ce0
mov eax, dword [edi + 0x55a4]
test eax, eax
je 0x413dea
lea edx, [eax - 1]
test edx, edx
mov dword [edi + 0x55a4], edx
jne 0x413e8e
lea eax, [edx + 0x29]
mov esi, edi
call fcn.0040cab0
mov eax, edi
call fcn.00413c00
mov dword [edi + 0x559c], 1
mov esi, dword [edi + 0x160]
call fcn.00426580
test al, al
jne 0x4140ec
mov esi, dword [edi + 0x557c]
mov ebx, dword [edi + 0x5564]
cmp esi, ebx
jne 0x413e45
call fcn.00413920
test al, al
jne 0x4140ec
mov ecx, dword [edi + 0x8c]
cmp dword [ecx + 0x7f8], 0x1f
je 0x4140ec
mov eax, ecx
call fcn.004536d0
test al, al
jne 0x413e45
call fcn.00453740
test al, al
je 0x4140ec
add dword [edi + 0x559c], 0xffffffff
cmp esi, ebx
mov ecx, dword [edi + 0x559c]
jne 0x413f23
mov eax, dword [edi + 0x8c]
call fcn.004536d0
test al, al
je 0x413f23
test ecx, ecx
jne 0x4140ec
mov ecx, edi
call fcn.0040c3e0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edx, 0x2d5
jne 0x413eb1
mov ecx, dword [edi + 0x8c]
mov edx, dword [ecx]
mov eax, dword [0x6a74e4]
mov edx, dword [edx + 0xd8]
push eax
call edx
jmp 0x413dea
mov eax, dword [edi + 0x8c]
mov eax, dword [eax + 0x83c]
mov ecx, dword [eax + 8]
cmp ecx, 1
je 0x413f00
cmp ecx, 3
je 0x413f00
cmp ecx, 4
je 0x413f00
cmp ecx, 5
je 0x413f00
cmp ecx, 2
jne 0x4140ec
cmp edx, 0x2bc
jne 0x4140ec
call fcn.0045b240
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
cmp edx, 0x190
jne 0x4140ec
call fcn.0045b240
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret
mov eax, dword [edi + 0x55a0]
sub eax, ecx
cmp ecx, 5
jle 0x413f5d
cmp eax, 0x190
jle 0x413f5d
add esi, 0xffffffff
push esi
mov ebx, edi
call fcn.00412e30
cmp eax, dword [edi + 0x5594]
jg 0x413f5d
mov eax, 0xc8
cmp dword [edi + 0x559c], eax
jle 0x413f5d
mov dword [edi + 0x559c], eax
jmp 0x79e6a6
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
Function at 0x418b70
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov eax, dword [ebp + 0x8c]
mov eax, dword [eax + 0x7f8]
cmp eax, 0x2b
push esi
push edi
je 0x418c3a
jmp loc.0079764a
mov edx, dword [ebp + 0x8c]
mov eax, dword [edx + 0x7f8]
cmp eax, 0x2b
je 0x418c50
cmp eax, 0x32
jne 0x418c5b
mov eax, dword [esp + 0x3c]
push eax
push ebp
call fcn.00418500
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x425550
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [ecx]
cmp dword [esi + 0x768], 0
je 0x425594
mov eax, dword [esi + 0x7f8]
cmp eax, 0x11
je 0x425581
cmp eax, 0x21
je 0x425581
test eax, eax
jne 0x425594
mov eax, dword [esi + 0x82c]
jmp loc.0079d7c0
cmp ebx, 2
jle 0x425683
pop esi
mov eax, 7
pop ebp
ret 4
mov eax, esi
call fcn.004537d0
test al, al
je 0x42560d
mov esi, dword [esi + 0x7f8]
cmp esi, 0x3d
mov ecx, 6
je 0x4255c3
cmp esi, 0x3e
je 0x4255c3
cmp esi, 0x3f
je 0x4255c3
cmp esi, 0x40
je 0x4255c3
cmp esi, 0x41
jne 0x4255c8
mov ecx, 4
cmp esi, 0x42
je 0x4255dc
cmp esi, 0x43
je 0x4255dc
cmp esi, 0x44
je 0x4255dc
cmp esi, 0x46
jne 0x4255e1
mov ecx, 5
cmp ebp, 0x42
jne 0x4255f2
xor eax, eax
cmp ebx, ecx
pop esi
setge al
pop ebp
ret 4
mov eax, ebp
call fcn.0042b530
test al, al
je 0x425683
xor eax, eax
cmp ebx, ecx
pop esi
setl al
pop ebp
ret 4
cmp dword [esi + 0x768], 0
je 0x425673
mov eax, dword [esi + 0x7f8]
cmp eax, 0x24
je 0x42562b
cmp eax, 0x28
je 0x42562b
cmp eax, 0x16
jne 0x425673
mov eax, edi
mov edx, ebx
call fcn.004249f0
cmp eax, 0xffffffff
je 0x425651
cmp eax, ebp
je 0x425651
cmp ebp, 0x10
je 0x425651
cmp ebp, 0x1e
je 0x425651
pop esi
mov eax, 6
pop ebp
ret 4
cmp dword [esi + 0x7f8], 0x24
jne 0x425683
cmp ebx, 4
je 0x425664
cmp ebx, 6
jne 0x425683
cmp edi, 1
jne 0x425683
pop esi
mov eax, 1
pop ebp
ret 4
mov ecx, esi
call fcn.004539d0
test al, al
je 0x425683
cmp ebx, 8
jge 0x425669
pop esi
xor eax, eax
pop ebp
ret 4
Function at 0x426850
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x64f408
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi]
push edi
call fcn.00453740
test al, al
je 0x4268de
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x557c]
cmp ecx, dword [eax + 0x5564]
jne 0x4268de
mov edx, dword [eax + 0x5564]
sub edx, 1
mov dword [eax + 0x557c], edx
xor edi, edi
xor eax, eax
lea esp, [esp]
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x557c]
imul edx, edx, 0x32
add edx, eax
mov ecx, dword [ecx + edx*4 + 0x6b4]
cmp ecx, 0xffffffff
je 0x4268e0
cmp ecx, 1
jne 0x4268d4
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x557c]
imul edx, edx, 0x32
add edx, eax
mov dword [ecx + edx*4 + 0x6b4], edi
add eax, 1
cmp eax, 0x32
jl 0x4268a0
jmp 0x4268e0
xor edi, edi
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x557c]
push eax
call fcn.00409080
mov ecx, dword [esi]
mov bl, al
jmp 0x79d117

Function at 0x42a040
Capabilities:
Parse credit card information

Disassembly:
cmp eax, 0x3c
jne 0x42a048
xor eax, eax
ret
cmp eax, 0x3d
jne 0x42a053
mov eax, 2
ret
cmp eax, 0x3e
jne 0x42a05e
mov eax, 2
ret
cmp eax, 0x3f
jne 0x42a069
mov eax, 4
ret
cmp eax, 0x40
jne 0x42a074
mov eax, 0x1a
ret
cmp eax, 0x41
jne 0x42a07f
mov eax, 0x1e
ret
cmp eax, 0x42
jne 0x42a08a
mov eax, 0x14
ret
cmp eax, 0x43
jne 0x42a095
mov eax, 7
ret
cmp eax, 0x44
jne 0x42a0a0
mov eax, 0x10
ret
cmp eax, 0x45
jne 0x42a0ab
mov eax, 6
ret
cmp eax, 0x46
jne 0x42a0b6
mov eax, 0xc
ret
cmp eax, 0x47
jne 0x42a0c1
mov eax, 0x12
ret
cmp eax, 0x48
jne 0x42a0cc
mov eax, 8
ret
cmp eax, 0x49
jne 0x42a0d7
mov eax, 0x17
ret
cmp eax, 0x4a
jne 0x42a0e1
mov eax, 0x18
ret
Function at 0x42a0f0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov esi, eax
mov edi, ecx
mov eax, dword [edi + 4]
push esi
push ebp
xor ebx, ebx
call fcn.0040ddc0
cmp ebp, 0x14
mov ebx, eax
jne 0x42a19a
mov edx, dword [esp + 0x18]
mov ebp, esi
imul ebp, ebp, 0x2710
lea eax, [ebp + 0x49f9c]
mov dword [ebx + 0x80], edx
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x8c]
cmp dword [ecx + 0x7f8], 0x2b
jne 0x42a16b
mov eax, dword [eax + 0x554c]
cmp eax, 6
je 0x42a158
cmp eax, 8
je 0x42a158
cmp eax, 7
jne 0x42a16b
mov eax, dword [ecx + 0x81c]
mov edi, edx
call fcn.00521450
mov dword [esp + 0x18], eax
jmp 0x42a178
lea ecx, [edx + edx*4]
shl ecx, 4
add ecx, 0x28
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
push esi
mov eax, ebx
fstp dword [ebx + 0x2c]
call fcn.00531880
add ebp, 0x497cf
fstp dword [ebx + 0x30]
mov dword [ebx + 0x20], ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edi, dword [edi + 4]
mov eax, dword [edi + 0x8c]
cmp dword [eax + 0x7f8], 0x2b
jne 0x42a1e8
mov edi, dword [edi + 0x554c]
cmp edi, 6
je 0x42a1c1
cmp edi, 8
je 0x42a1c1
cmp edi, 7
jne 0x42a1e8
mov edi, dword [esp + 0x18]
mov eax, dword [eax + 0x81c]
call fcn.00521450
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fsub qword [0x679318]
fstp dword [ebx + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x18]
lea edx, [eax + eax*4]
shl edx, 4
add edx, 0x28
mov dword [esp + 0x18], edx
fild dword [esp + 0x18]
jmp 0x7940d1