joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4502fd
Capabilities:
Check if file exists
Delete file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51181d
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x571268]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
push esi
mov eax, dword [0x571268]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
push eax
call fcn.00473819
pop ecx
xor ebx, ebx
mov dword [esp + 0xb8], ebx
xor eax, eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], ax
mov byte [esp + 0xb8], 1
jmp 0x4504b8
lea eax, [esp + 0x8c]
push eax
lea esi, [esp + 0x20]
call fcn.00405639
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x40]
mov ecx, esi
mov byte [esp + 0xc0], 2
call fcn.00404feb
mov eax, esi
push eax
lea esi, [esp + 0x58]
call fcn.00405639
push str._search.json
mov eax, esi
push eax
mov byte [esp + 0xc0], 3
call fcn.0040512d
push str._searchplugins_
lea eax, [esp + 0x20]
push eax
call fcn.0040512d
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x24]
call fcn.00404feb
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x450402
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x450498
cmp byte [ebp + 0x14], bl
je 0x450443
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x450426
lea eax, [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
cmp dword [esp + 0x6c], 8
mov eax, dword [esp + 0x58]
jae 0x45043e
lea eax, [esp + 0x58]
push eax
call esi
jmp 0x450498
mov eax, dword [esp + 0x14]
mov byte [eax], 1
cmp dword [edi + 0x14], ebx
je 0x450498
cmp dword [esp + 0x34], 8
mov ecx, dword [esp + 0x20]
jae 0x45045e
lea ecx, [esp + 0x20]
lea eax, [esp + 0x70]
push eax
mov edx, str.SearchPlugin_ShortName
call fcn.0041ae96
pop ecx
lea ecx, [esp + 0x70]
mov eax, edi
mov byte [esp + 0xb8], 4
call fcn.004180d5
test eax, eax
jne 0x45048c
mov eax, dword [esp + 0x18]
mov byte [eax], 1
push ebx
push 1
lea esi, [esp + 0x78]
call fcn.0040754f
push ebx
push 1
lea esi, [esp + 0x5c]
call fcn.0040754f
push ebx
push 1
lea esi, [esp + 0x24]
mov byte [esp + 0xc0], 1
call fcn.0040754f
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call fcn.00473d4c
pop ecx
test al, al
jne 0x45038c
push ebx
push 1
lea esi, [esp + 0x40]
call fcn.0040754f
push ebx
push 1
lea esi, [esp + 0x94]
call fcn.0040754f
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.004e6e1c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45050f
Capabilities:
Access peb ldr_data
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5117c1
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x571268]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
push edi
mov eax, dword [0x571268]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
lea eax, [esp + 0x64]
push eax
call fcn.00473819
pop ecx
xor edi, edi
mov dword [esp + 0x90], edi
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], edi
mov word [esp + 0x30], ax
mov byte [esp + 0x90], 1
jmp 0x450616
lea eax, [esp + 0x64]
push eax
lea esi, [esp + 0x4c]
call fcn.00405639
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x34]
mov ecx, esi
mov byte [esp + 0x98], 2
call fcn.00404feb
mov eax, esi
push eax
lea esi, [esp + 0x14]
call fcn.00405639
push str._search.json
mov eax, esi
push eax
mov byte [esp + 0x98], 3
call fcn.0040512d
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x4505d4
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4505f6
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x4505ef
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 1
lea esi, [esp + 0x18]
call fcn.0040754f
push edi
push 1
lea esi, [esp + 0x50]
mov byte [esp + 0x98], 1
call fcn.0040754f
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10]
call fcn.00473d4c
pop ecx
test al, al
jne 0x450580
push edi
push 1
lea esi, [esp + 0x34]
call fcn.0040754f
push edi
push 1
lea esi, [esp + 0x6c]
call fcn.0040754f
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004e6e1c
mov esp, ebp
pop ebp
ret
Function at 0x463c5b
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, eax
cmp byte [esi + 0x24], 0
je 0x463cfc
cmp dword [esi + 0x1c], 8
jb 0x463c73
mov eax, dword [esi + 8]
jmp 0x463c76
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x463cfc
push ebx
push edi
lea edi, [esi + 0x20]
mov eax, edi
xor bl, bl
call fcn.004d38c6
test al, al
je 0x463cf6
push 8
pop ebx
cmp dword [esi + 0x1c], ebx
jb 0x463ca0
mov esi, dword [esi + 8]
jmp 0x463ca3
add esi, 8
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x18], ebx
jb 0x463cb1
mov edx, dword [eax + 4]
jmp 0x463cb4
lea edx, [eax + 4]
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x18], ebx
jb 0x463cc2
mov ecx, dword [eax + 4]
jmp 0x463cc5
lea ecx, [eax + 4]
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x18], ebx
jb 0x463cd3
mov eax, dword [eax + 4]
jmp 0x463cd6
add eax, 4
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ebx, eax
mov eax, dword [edi]
dec ebx
neg ebx
sbb bl, bl
inc bl
test eax, eax
je 0x463cf6
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
mov al, bl
pop ebx
jmp 0x463cfe
xor al, al
pop esi
ret 0xc
Function at 0x4647c2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x504884
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x571268]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp byte [esi + 0x24], bl
je 0x464948
cmp dword [esi + 0x1c], 8
jb 0x46480b
mov eax, dword [esi + 8]
jmp 0x46480e
lea eax, [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x464948
lea eax, [esi + 0x20]
mov dword [esp + 0x20], eax
call fcn.004d38c6
test al, al
je 0x464948
mov eax, dword [0x5741d8]
mov ecx, 0x5741d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x40], ebx
mov ebx, dword [edi + 0xc]
lea esi, [esp + 0x24]
call fcn.0040d905
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x2c]
call fcn.0040d905
mov edi, esi
lea esi, [esp + 0x24]
call fcn.004183d7
test al, al
je 0x46492b
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
add eax, 4
add edi, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
jmp 0x464895
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x18], 8
jb 0x4648a0
mov eax, dword [eax]
push dword [esp + 0x10]
push eax
push str._s_d
lea eax, [esp + 0x20]
call fcn.0040d9ff
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x1c], 8
jb 0x4648c4
mov ebx, dword [eax + 8]
jmp 0x4648c7
lea ebx, [eax + 8]
lea esi, [esp + 0x24]
call fcn.00411274
cmp dword [eax + 0x18], 8
jb 0x4648db
mov eax, dword [eax + 4]
jmp 0x4648de
add eax, 4
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x18], 8
jb 0x4648e9
mov edi, dword [edi]
push ebx
push eax
lea esi, [esp + 0x1c]
call fcn.0040d6b1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
inc dword [esp + 0x10]
lea esi, [esp + 0x24]
call fcn.004183ac
mov edi, dword [ebp + 0x14]
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x2c]
call fcn.0040d905
mov edi, esi
lea esi, [esp + 0x24]
call fcn.004183d7
test al, al
jne 0x46488d
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x46493c
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.0040df81
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46612e
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x509058
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x571268]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x571268]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x466199
mov ecx, esi
call fcn.004662bf
test al, al
jne 0x466199
xor al, al
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004e6e1c
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x4661a6
mov eax, dword [edi]
jmp 0x4661a8
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4661b7
mov al, 1
jmp 0x46617b
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], ax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x44], ebx
call fcn.00466240
pop ecx
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.0046612e
pop ecx
pop ecx
push ebx
test al, al
jne 0x4661ff
push 1
lea esi, [esp + 0x1c]
call fcn.0040754f
jmp 0x466179
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esi + 0x18], 8
jb 0x46620d
mov edi, dword [edi]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x46623c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x46623c
xor bl, bl
push 0
push 1
lea esi, [esp + 0x1c]
call fcn.0040754f
mov al, bl
jmp 0x46617b
mov bl, 1
jmp 0x466228

Function at 0x468273
Capabilities:
Check if file exists

Disassembly:
push 0x78
mov eax, 0x51937c
call fcn.004ec766
mov edi, 0x575200
xor ebx, ebx
mov esi, edi
mov dword [ebp - 0x4c], 0x5751fc
mov byte [0x5751fc], bl
call fcn.00407257
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
push 0x525140
lea esi, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.004076aa
push 0x525794
lea esi, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.004076aa
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0041cf3d
pop ecx
pop ecx
push ebx
push 1
call fcn.0040754f
push ebx
push 1
lea esi, [ebp - 0x84]
mov byte [ebp - 4], 1
call fcn.0040754f
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2c]
mov ecx, edi
call fcn.00407341
cmp dword [0x575214], ebx
je 0x468345
cmp dword [0x575218], 8
mov eax, dword [0x575204]
jae 0x46832c
mov eax, 0x575204
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x468345
push str.loggingserver.exe
push edi
call fcn.0040512d
jmp 0x468350
push 0x525140
push edi
call fcn.00407685
lea ebx, [ebp - 0x48]
call fcn.00422529
push 0x525ad4
mov eax, ebx
mov byte [ebp - 4], 4
call fcn.0040551f
neg eax
sbb al, al
push 0
inc al
push 1
mov esi, ebx
mov byte [0x57521c], al
call fcn.0040754f
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.0040754f
mov eax, 0x5751fc
call fcn.004ec7e9
ret
Function at 0x4685a8
Capabilities:
Check if file exists

Disassembly:
push 0xd4
mov eax, 0x5111f8
call fcn.004ec79c
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], ebx
call fcn.0046878e
test al, al
jne 0x46875f
call fcn.00411dd9
cmp byte [eax], bl
jne 0x468651
lea eax, [ebp - 0xe0]
push eax
call fcn.004071c6
lea eax, [ebp - 0xd8]
push str.CLoggerServer::LoggerPropertiesExist_____failed_to_get_properties_path
push eax
mov byte [ebp - 4], 1
call fcn.004058d5
pop ecx
pop ecx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040574e
lea edi, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00405549
push ebx
push 1
mov esi, edi
call fcn.0040754f
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], bl
call fcn.00405a60
xor bl, bl
push 0
push 1
lea esi, [ebp - 0x4c]
call fcn.0040754f
mov al, bl
call fcn.004ec7f8
ret
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 3
call fcn.00405430
mov byte [ebp - 4], 4
call fcn.00411dd9
lea ecx, [ebp - 0x30]
call fcn.00405346
mov byte [ebp - 4], 5
cmp dword [eax + 0x18], 8
jb 0x468681
mov esi, dword [eax + 4]
jmp 0x468684
lea esi, [eax + 4]
lea eax, [ebp - 0xd8]
push 0x5251c8
push eax
call fcn.004058d5
pop ecx
pop ecx
push esi
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x5251c0
push eax
call fcn.004058d5
pop ecx
pop ecx
push str.CLoggerServer::LoggerPropertiesExist_____failed_to_get_properties_path
push eax
call fcn.004058d5
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.0040754f
lea eax, [ebp - 0x54]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x9c40
push esi
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x468718
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0040532c
push 0x71
push str..LoggerServer.cpp
push eax
push esi
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 7
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp - 0x30]
call fcn.0040754f
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 3
call fcn.0040539b
jmp 0x46863b
push str.logger.properties
lea eax, [ebp - 0x4c]
push eax
call fcn.0040512d
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x468779
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
jmp 0x46863d
Function at 0x4694a1
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x5047f0
call fcn.004ec766
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x4695b3
cmp byte [esi + 0x42], bl
je 0x4695b3
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x4694dd
xor al, al
jmp 0x4695b5
push ebx
push 8
lea ecx, [ebp - 0x30]
call fcn.004693d6
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x46954d
dec eax
je 0x469551
dec eax
dec eax
je 0x4695af
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004065f9
mov al, bl
jmp 0x4695b5
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x469591
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004e981b
add esp, 0x10
cmp edi, eax
jne 0x46953b
cmp byte [esi + 0x42], 0
je 0x4695af
test edi, edi
jne 0x4694eb
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004047b9
jmp 0x4694eb
mov bl, 1
jmp 0x46953d
mov al, 1
call fcn.004ec7e9
ret
Function at 0x47079c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x571268]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x28], 0
push ebx
push esi
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
lea ebx, [ebp - 0x28]
mov esi, edx
mov byte [ebp - 0x21], 0
call fcn.00470834
cmp dword [ebp - 0xc], 0
jbe 0x470815
cmp dword [esi + 0x18], 8
jb 0x4707da
mov esi, dword [esi + 4]
jmp 0x4707dd
add esi, 4
push 0x538ec8
push esi
call fcn.004e8897
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x470815
cmp dword [ebp - 8], 0x10
mov eax, dword [ebp - 0x1c]
jae 0x4707fc
lea eax, [ebp - 0x1c]
push esi
push dword [ebp - 0x28]
push 1
push eax
call fcn.004e981b
push esi
call fcn.004e7463
add esp, 0x14
mov byte [ebp - 0x21], 1
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.004065f9
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
pop esi
xor ecx, ebp
pop ebx
call fcn.004e6e1c
leave
ret 4
Function at 0x478227
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x504777
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x571268]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x571268]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x47828a
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004e6e1c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x4782b2
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x4782b2
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x47826a
mov eax, dword [esi + 0x4c]
cmp eax, edi
jne 0x4782be
or eax, 0xffffffff
jmp 0x47826a
cmp dword [esi + 0x3c], edi
jne 0x4782d6
push eax
movsx eax, bl
push eax
call fcn.004eacf2
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x4782b9
jmp 0x4782ae
push edi
push 8
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1b], bl
call fcn.004693d6
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x74], edi
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov edi, dword [esp + 0x58]
mov ebx, eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
lea edx, [esp + 0x18]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x4783e2
cmp eax, 1
jg 0x47841f
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x48]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov edi, dword [esp + 0x18]
sub edi, eax
je 0x47837b
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x48]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004e981b
add esp, 0x10
cmp edi, eax
jne 0x478408
lea eax, [esp + 0x13]
mov byte [esi + 0x41], 1
cmp dword [esp + 0x1c], eax
jne 0x47843b
test edi, edi
ja 0x4783a5
cmp dword [esp + 0x58], 0x20
jae 0x478408
push 0
push 8
lea ecx, [esp + 0x4c]
call fcn.004047b9
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov edi, dword [esp + 0x58]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x48]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x24]
push edx
lea edx, [esp + 0x27]
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x478329
or esi, 0xffffffff
push 0
push 1
lea ecx, [esp + 0x4c]
call fcn.004065f9
mov eax, esi
jmp 0x47826a
cmp eax, 3
jne 0x478408
movsx eax, byte [esp + 0x13]
push dword [esi + 0x4c]
push eax
call fcn.004eacf2
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x47840b
mov esi, dword [ebp + 8]
jmp 0x47840b
Function at 0x478d4e
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x5047f0
call fcn.004ec766
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x478e5a
cmp byte [esi + 0x41], 0
je 0x478e5a
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x478d84
xor al, al
jmp 0x478e5c
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004693d6
mov dword [ebp - 4], edi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x478df4
dec eax
je 0x478df8
dec eax
dec eax
je 0x478e56
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004065f9
mov al, bl
jmp 0x478e5c
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x478e38
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.004693fc
mov ecx, eax
call fcn.00469620
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004e981b
add esp, 0x10
cmp edi, eax
jne 0x478de2
cmp byte [esi + 0x41], 0
je 0x478e56
test edi, edi
jne 0x478d92
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004047b9
jmp 0x478d92
mov bl, 1
jmp 0x478de4
mov al, 1
call fcn.004ec7e9
ret
Function at 0x47aa62
Capabilities:
Parse credit card information

Disassembly:
push ecx
mov ecx, dword [esi + 0x40]
push ebx
xor al, al
push edi
mov bl, 1
cmp ecx, 0xffffffff
je 0x47abf8
mov edi, 0x10000000
cmp ecx, 0x7c
je 0x47abf8
cmp ecx, 0x29
jne 0x47aaa4
cmp dword [esi + 0x10], 0
jne 0x47abf8
test dword [esi + 0x44], edi
jne 0x47aaa4
push 5
call fcn.004e6615
pop ecx
jmp 0x47abe1
cmp ecx, 0x2e
jne 0x47aac0
push 5
lea eax, [esi + 0x18]
push eax
call fcn.0047acdb
mov eax, esi
call fcn.0047aa3a
jmp 0x47abe1
cmp ecx, 0x5c
jne 0x47ab1f
mov eax, esi
call fcn.0047aa3a
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x47aaf3
cmp byte [esi + 0x3e], 0x62
jne 0x47aaf3
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0047acdb
mov eax, esi
call fcn.0047aa3a
jmp 0x47abe8
test eax, eax
je 0x47ab13
cmp byte [esi + 0x3e], 0x42
jne 0x47ab13
push 4
lea eax, [esi + 0x18]
push eax
call fcn.0047acdb
mov eax, dword [esi + 0x1c]
add eax, 8
or dword [eax], 1
jmp 0x47aae7
mov eax, esi
call fcn.0047b454
jmp 0x47abe1
cmp ecx, 0x5b
jne 0x47ab49
mov eax, esi
call fcn.0047aa3a
mov eax, esi
call fcn.0047b409
cmp dword [esi + 0x40], 0x5d
je 0x47aab4
push 4
call fcn.004e6615
pop ecx
jmp 0x47aab4
cmp ecx, 0x28
jne 0x47ab75
mov eax, esi
call fcn.0047aa3a
mov eax, esi
call fcn.0047b520
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x47ab6c
push 5
call fcn.004e6615
pop ecx
mov eax, esi
call fcn.0047aa3a
jmp 0x47abdd
cmp ecx, 0x5e
jne 0x47ab81
push 2
jmp 0x47aade
cmp ecx, 0x24
jne 0x47ab8d
push 3
jmp 0x47aade
cmp ecx, 0x2a
je 0x47abd5
cmp ecx, 0x2b
je 0x47abd5
cmp ecx, 0x3f
je 0x47abd5
cmp ecx, 0x7b
je 0x47abd5
cmp ecx, 0x7d
jne 0x47abb2
test dword [esi + 0x44], edi
jne 0x47abb2
push 6
jmp 0x47aa99
cmp ecx, 0x5d
jne 0x47abc3
test dword [esi + 0x44], edi
jne 0x47abc3
push 4
jmp 0x47aa99
movzx eax, byte [esi + 0x3e]
push eax
lea eax, [esi + 0x18]
call fcn.0047b6b6
jmp 0x47aab4
push 0xa
call fcn.004e6615
pop ecx
test bl, bl
je 0x47abe8
mov eax, esi
call fcn.0047b5ee
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x47aa7a
pop edi
pop ebx
pop ecx
ret