joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a0d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp edx, ecx
ja 0x43a108
jb 0x43a0fe
cmp eax, ebx
jae 0x43a108
mov eax, ebx
mov edx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x18]
push 0
push eax
push edx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
jne 0x43a12e
call fcn.004233e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0x10]
test ebx, ebx
jne 0x43a13f
mov ecx, dword [ebp - 8]
sub ecx, edx
mov dword [esi + 4], ecx
jmp 0x43a142
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
push 0
mov dword [esi + 0x14], edx
mov edx, dword [esi + 4]
push edx
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push ecx
push eax
mov dword [esi + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
test eax, eax
jne 0x43a190
call fcn.004233e0
mov edi, eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x43a3d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x24]
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
push edx
push eax
mov dword [ebp - 8], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x43a3ff
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.0043a250
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43a470
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_1
test ecx, ecx
je 0x43a49e
mov eax, dword [ebp + 8]
push eax
call fcn.00439ee0
jmp 0x43a4a8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x43a50d
call fcn.004233e0
test eax, eax
js 0x43a520
mov eax, dword [edi]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x43a4d7
call fcn.004233e0
test eax, eax
js 0x43a520
mov eax, dword [ebp - 8]
push esi
mov esi, dword [ebp - 4]
test esi, esi
jne 0x43a4e3
test eax, eax
je 0x43a511
mov edx, dword [ebp + 0x14]
xor ecx, ecx
cmp esi, ecx
ja 0x43a511
jb 0x43a4f2
cmp eax, edx
ja 0x43a511
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
push 4
push 2
push 0
push 0
push 0
push eax
call fcn.0043a0d0
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
jmp 0x43a4b6
or eax, esi
mov eax, 0x800703ee
je 0x43a51f
mov eax, 0x800700df
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x43a5c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [ebp + 8]
push 0
push 0x10
push 0x5c564c
push eax
call dword [sym.imp.WS2_32.dll_sendto]
pop ebp
ret

Function at 0x43a6a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
push esi
xor esi, esi
push esi
push eax
push esi
lea ecx, [ebp - 4]
push ecx
mov dword [eax + 0x34], edx
mov dword [eax + 0x18], 3
push 1
lea edx, [eax + 0x1c]
mov dword [ebp - 4], esi
mov dword [eax + 0x28], 2
mov eax, dword [eax + 0x34]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x43a6ee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43a700
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
push esi
xor esi, esi
push esi
push eax
mov dword [eax + 0x34], edx
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push edx
mov edx, dword [eax + 0x34]
push 1
lea ecx, [eax + 0x1c]
push ecx
push edx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [eax + 0x18], 4
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x43a74c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x3e5
jne 0x43a75b
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43a770
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
xor edx, edx
lea ecx, [eax + 0x34]
xor esi, esi
cmp word [ecx], 2
push esi
setne dl
push eax
mov dword [eax + 0x18], 3
mov dword [ebp - 4], esi
add eax, 0x1c
dec edx
and edx, 0xfffffff4
add edx, 0x1c
mov dword [eax + 0x34], edx
mov edx, dword [eax + 0x34]
push edx
mov edx, dword [ebp + 8]
push ecx
push esi
lea ecx, [ebp - 4]
push ecx
mov dword [eax + 0xc], 2
push 1
push eax
push edx
call dword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x43a7cd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43a7e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
xor ecx, ecx
cmp word [esi + 0x34], 2
push edi
lea edi, [esi + 0x34]
setne al
lea ebx, [esi + 0x50]
mov dword [ebp - 4], ecx
mov dword [esi + 0x18], 4
dec eax
and eax, 0xfffffff4
add eax, 0x1c
mov dword [ebx], eax
mov edx, dword [ebp + 8]
push ecx
push esi
push ebx
push edi
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], ecx
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
push ecx
push 1
lea eax, [esi + 0x1c]
push eax
push edx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x43a843
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
jmp 0x43a846
mov eax, dword [ebp - 4]
cmp eax, 0x2744
je 0x43a854
cmp eax, 0x2746
jne 0x43a868
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
xor ecx, ecx
jmp 0x43a811
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a8e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
xor ecx, ecx
cmp word [eax + 0x34], 2
push esi
lea esi, [eax + 0x34]
setne cl
push edi
lea edi, [eax + 0x50]
mov dword [ebp - 4], 0
lea ebx, [eax + 0x1c]
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
mov dword [edi], ecx
nop
mov edx, dword [ebp + 8]
xor eax, eax
push eax
push eax
push edi
push esi
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 1
push ebx
push edx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x43a941
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 4], eax
jmp 0x43a94a
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43a964
mov dword [ebx], eax
cmp dword [ebp - 4], 0x2744
je 0x43a910
mov eax, dword [ebp - 4]
cmp eax, 0x2746
je 0x43a910
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x2775
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ad10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
push esi
xor esi, esi
push esi
push eax
push esi
lea ecx, [ebp - 4]
push ecx
mov dword [eax + 0x34], edx
mov dword [eax + 0x18], 3
push 1
lea edx, [eax + 0x1c]
mov dword [ebp - 4], esi
mov dword [eax + 0x28], 2
mov eax, dword [eax + 0x34]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x43ad5b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x3e5
jne 0x43ad6a
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43ae00
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x644a10]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [esi + 2], eax
mov dword [esi + 6], eax
mov dword [esi + 0xa], eax
mov dword [esi + 0xe], eax
mov dword [esi + 0x12], eax
push edi
mov dword [esi + 0x16], eax
mov dword [ebp - 0xa8], eax
mov word [esi + 0x1a], ax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
movzx eax, word [esi]
push 3
lea edx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xac], 0x100
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x88], edx
call fcn.0043a9e0
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0xac]
push ecx
push 0
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
mov eax, dword [ebp - 0x88]
lea ecx, [ebp - 0x84]
cmp eax, ecx
je 0x43aec9
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
test edi, edi
je 0x43aee6
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b2129
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x8c]
xor edi, edi
mov eax, ebx
test ebx, ebx
je 0x43af21
mov ecx, dword [eax + 4]
cmp ecx, 2
je 0x43af0b
cmp ecx, 0x17
je 0x43af0b
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x43aef5
jmp 0x43af21
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
push edx
push eax
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
mov edi, 1
push ebx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop ebx
test edi, edi
je 0x43af4d
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 2], ax
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b2129
mov esp, ebp
pop ebp
ret
push 0x2af9
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.005b2129
mov esp, ebp
pop ebp
ret
Function at 0x43be70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov al, byte [edx]
push esi
push edi
mov edi, ecx
mov esi, 0x811c9dc5
test al, al
je 0x43bea3
lea ecx, [eax - 0x41]
inc edx
cmp cl, 0x19
ja 0x43be92
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x43be87
mov edx, dword [edi + 0x20]
mov eax, edx
and eax, esi
cmp dword [edi + 0x24], eax
pop edi
pop esi
ja 0x43beba
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4

Function at 0x43c3d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
push esi
mov eax, edx
lea esi, [eax + 1]
push ebx
nop
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x43c3e0
sub eax, esi
add eax, edx
mov esi, 0x811c9dc5
pop ebx
cmp edx, eax
je 0x43c407
push edi
movsx edi, byte [edx]
imul esi, esi, 0x1000193
inc edx
xor esi, edi
cmp edx, eax
jne 0x43c3f6
pop edi
mov edx, dword [ecx + 0x20]
mov eax, edx
and eax, esi
pop esi
cmp dword [ecx + 0x24], eax
ja 0x43c41d
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4

Function at 0x4403c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x4403ef
cmp ecx, eax
jne 0x4403ef
mov ecx, ebx
call fcn.0043fe90
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x4404ab
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x440405
sub eax, edi
add eax, edx
mov edi, 0x811c9dc5
cmp edx, eax
je 0x440430
lea esp, [esp]
movsx ecx, byte [edx]
imul edi, edi, 0x1000193
inc edx
xor edi, ecx
cmp edx, eax
jne 0x440420
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edi
cmp dword [ebx + 0x24], eax
ja 0x440445
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x44046e
cmp dword [ecx], esi
jne 0x440466
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 0x10]
mov dword [edx + eax*8 + 4], ecx
jmp 0x440476
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x440476
cmp dword [ecx], esi
jne 0x440476
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [ebx + 4]
je 0x44049e
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
lea ecx, [esi + 8]
mov dword [edx + 4], eax
call fcn.0042a070
push esi
call sub.mfc100u.dll_delete
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x4403f8
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x441e40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax]
jne 0x441e6f
cmp ecx, eax
jne 0x441e6f
mov ecx, ebx
call fcn.00441b20
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 0xc
cmp esi, ecx
je 0x441f2b
push edi
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov edx, dword [esi + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x441e85
sub eax, edi
add eax, edx
mov edi, 0x811c9dc5
cmp edx, eax
je 0x441eb0
lea esp, [esp]
movsx ecx, byte [edx]
imul edi, edi, 0x1000193
inc edx
xor edi, ecx
cmp edx, eax
jne 0x441ea0
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, edi
cmp dword [ebx + 0x24], eax
ja 0x441ec5
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea edx, [ecx + eax*8]
jne 0x441eee
cmp dword [edx], esi
jne 0x441ee6
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
mov dword [edx + eax*8 + 4], ecx
jmp 0x441ef6
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
jmp 0x441ef6
cmp dword [edx], esi
jne 0x441ef6
mov ecx, dword [esi]
mov dword [edx], ecx
cmp esi, dword [ebx + 4]
je 0x441f1e
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov dword [edx], eax
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
lea ecx, [esi + 8]
call fcn.004402d0
push esi
call sub.mfc100u.dll_delete
add esp, 4
dec dword [ebx + 8]
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebp + 0x10]
jne 0x441e78
pop edi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x442e30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bc10b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x644a10]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 4]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp edi, dword [eax]
jne 0x442e93
cmp ecx, eax
jne 0x442e93
mov ecx, ebx
call fcn.00442b40
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, ecx
je 0x442fc5
jmp 0x442ea0
mov edx, dword [edi]
mov dword [ebp + 0xc], edx
mov ecx, dword [edi + 8]
mov al, byte [ecx]
mov esi, 0x811c9dc5
test al, al
je 0x442ecf
lea edx, [eax - 0x41]
inc ecx
cmp dl, 0x19
ja 0x442ebe
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x442eb3
mov ecx, dword [ebx + 0x20]
mov eax, ecx
and eax, esi
cmp dword [ebx + 0x24], eax
ja 0x442ee4
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + eax*8 + 4], edi
lea ecx, [ecx + eax*8]
jne 0x442f0d
cmp dword [ecx], edi
jne 0x442f05
mov edx, dword [ebx + 4]
mov dword [ecx], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 0x10]
mov dword [edx + eax*8 + 4], ecx
jmp 0x442f15
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x442f15
cmp dword [ecx], edi
jne 0x442f15
mov edx, dword [edi]
mov dword [ecx], edx
cmp edi, dword [ebx + 4]
je 0x442fb9
mov eax, dword [edi + 4]
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi]
mov eax, dword [edi + 4]
lea ebx, [edi + 8]
mov dword [edx + 4], eax
mov dword [ebp - 0x18], ebx
xor ecx, ecx
lea eax, [ebx + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
lea esi, [eax + 0x10]
mov byte [ebp - 4], 1
cmp dword [esi], ecx
je 0x442f61
mov ecx, esi
call dword [sym.imp.MSVCP100.dll_public:_void___thiscall_std::_Container_base0::_Orphan_all_void_]
mov eax, dword [esi]
push eax
call sub.mfc100u.dll_delete
mov eax, dword [ebp - 0x14]
add esp, 4
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
lea esi, [eax + 4]
mov dword [ebp - 0x14], esi
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004416e0
mov esi, dword [esi]
push esi
call sub.mfc100u.dll_delete
mov eax, dword [ebx]
or esi, 0xffffffff
sub eax, 0x10
add esp, 4
mov dword [ebp - 4], esi
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x442fa8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
call sub.mfc100u.dll_delete
mov eax, dword [ebp - 0x10]
add esp, 4
add dword [eax + 8], esi
mov ebx, eax
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x10]
jne 0x442ea0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x446c50
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [edx - 2]
cmp ecx, 0xa
ja case.default.0x446c5c
jmp dword [ecx*4 + 0x446db8]
cmp al, 0x40
jne 0x446c6d
mov eax, 4
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x446c7c
cmp cl, 0x7a
jbe 0x446ccc
cmp al, 0x30
jl 0x446c84
cmp al, 0x39
jle 0x446ccc
cmp al, 0x2d
je 0x446ccc
cmp al, 0x5f
je 0x446ccc
cmp al, 0x2e
je 0x446ccc
cmp al, 0x21
je 0x446ccc
cmp al, 0x7e
je 0x446ccc
cmp al, 0x2a
je 0x446ccc
cmp al, 0x27
je 0x446ccc
cmp al, 0x28
je 0x446ccc
cmp al, 0x29
je 0x446ccc
cmp al, 0x25
je 0x446ccc
cmp al, 0x3b
je 0x446ccc
cmp al, 0x3a
je 0x446ccc
cmp al, 0x26
je 0x446ccc
cmp al, 0x3d
je 0x446ccc
cmp al, 0x2b
je 0x446ccc
cmp al, 0x24
je 0x446ccc
cmp al, 0x2c
jne case.default.0x446c5c
mov eax, 3
ret
cmp al, 0x5b
jne 0x446cdc
mov eax, 5
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x446ceb
cmp cl, 0x7a
jbe 0x446cff
cmp al, 0x30
jl 0x446cf3
cmp al, 0x39
jle 0x446cff
cmp al, 0x2e
je 0x446cff
cmp al, 0x2d
jne case.default.0x446c5c
mov eax, 6
ret
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x446d14
cmp cl, 0x7a
jbe 0x446cff
cmp al, 0x30
jl 0x446d1c
cmp al, 0x39
jle 0x446cff
cmp al, 0x2e
je 0x446cff
cmp al, 0x2d
je 0x446cff
cmp al, 0x3a
jne case.default.0x446c5c
mov eax, 0xb
ret
cmp al, 0x5d
jne case.0x446c5c.5
mov eax, 8
ret
cmp al, 0x30
jl 0x446d44
cmp al, 0x39
jle 0x446d6a
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x446d53
cmp cl, 0x66
jbe 0x446d6a
cmp al, 0x3a
je 0x446d6a
cmp al, 0x2e
je 0x446d6a
cmp edx, 7
jne case.default.0x446c5c
cmp al, 0x25
jne case.default.0x446c5c
mov eax, 9
ret
mov eax, 7
ret
cmp al, 0x5d
je 0x446d36
mov cl, al
or cl, 0x20
cmp cl, 0x61
jb 0x446d83
cmp cl, 0x7a
jbe 0x446d9f
cmp al, 0x30
jl 0x446d8b
cmp al, 0x39
jle 0x446d9f
cmp al, 0x25
je 0x446d9f
cmp al, 0x2e
je 0x446d9f
cmp al, 0x2d
je 0x446d9f
cmp al, 0x5f
je 0x446d9f
cmp al, 0x7e
jne case.default.0x446c5c
mov eax, 0xa
ret
sub al, 0x30
cmp al, 9
mov eax, 0xc
jbe 0x446db5
mov eax, 1
ret
Function at 0x44c180
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x44c1ef
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x44c265
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x44c1e4
cmp eax, 0xffffffff
jne 0x44c1dc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x44c1e4
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x44c265
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x44c265
mov dword [esi + 0x4c], 1
push 0
mov dword [esi + 0x50], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0xb0]
mov ecx, esi
call edx
cmp eax, 2
jne 0x44c1e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44c25e
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x44c450
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18c]
push edi
test eax, eax
jne 0x44c50c
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
lea esp, [esp]
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x5c]
mov edx, dword [esi + 0x1c]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x44c4df
push 0
call ebx
mov eax, dword [esi + 0x5c]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xc0]
mov ecx, esi
call eax
cmp eax, 2
jne 0x44c4e8
mov edx, dword [esi + 0x24]
push edx
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.00449e70
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44c4c4
mov eax, 0x4c7
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
je 0x44c4ff
test edi, edi
je 0x44c515
mov ecx, dword [esi + 0x18c]
test ecx, ecx
je 0x44c470
pop edi
pop esi
mov eax, 1
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x44c4c4
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], 0
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret