joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006e2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x16c
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x10240ebc], 0xf5e
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x10006eff
mov eax, dword [ebp - 0x13c]
mov cl, byte [eax + 0x100086d6]
mov dl, byte [eax + 0x100086a7]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x13c], eax
jne 0x10006e60
lea eax, [ebp - 0x12c]
mov dword [0x10240ebc], 0xfffeb770
mov dword [ebp - 0x140], eax
call fcn.10006aab
mov dword [esp], eax
mov eax, dword [ebp - 0x140]
mov dword [esp + 4], eax
call fcn.10006b85
mov ecx, eax
mov dword [0x10240ed4], eax
mov eax, esp
mov edx, dword [ebp - 0x144]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
jmp 0x10006f6a
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
xor edx, edx
lea esi, section..data
imul edi, eax, 0x118
mov ebx, esi
add ebx, edi
add ebx, 0x24
mov edi, eax
add edi, 1
imul eax, eax, 0x118
add esi, eax
add esi, 0x6c
mov eax, dword [esi]
movzx esi, word [ebx]
xor esi, eax
add esi, ecx
cmp edi, 0x1a7
mov eax, esi
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], edi
je 0x10006e60
jmp 0x10006eff
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0x118
mov edi, edx
add edi, esi
add edi, 0x6c
mov esi, dword [edi]
imul edi, eax, 0x118
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x118
add edx, ebx
add edx, 0x24
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.10005d02
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x1a7
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x10006f6a
lea eax, [0x100086b5]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x10240ebc], 0x14c0
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.100065df
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x144]
mov dword [esp + 0xc], edx
call fcn.100061fc
mov eax, dword [0x10240ec0]
add eax, 0x571
mov dword [ebp - 0x168], eax
xor eax, eax
mov ecx, dword [ebp - 0x168]
mov dword [0x10240ec0], ecx
mov edx, dword [ebp - 0x148]
add edx, 0x11b83b
mov esi, dword [ebp - 0x130]
mov dword [esi], edx
mov dword [esi + 4], 0x123400
mov dword [0x10240ebc], 0x733
mov edx, dword [ebp - 0x148]
add edx, 0x8623e
mov dword [esi + 8], edx
mov dword [esi + 0xc], 0x2010
add esp, 0x16c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x401d99
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43107c]
jne 0x401da3
repz ret
jmp fcn.004026c7

Function at 0x4081dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43107c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405ea4
and dword [ebp - 0x14], 0
cmp dword [0x433e50], 0
mov dword [ebp - 0x18], eax
jne 0x40828f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408337
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408337
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x433e50], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x433e54], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x433e58], eax
call edi
push eax
call esi
mov dword [0x433e60], eax
test eax, eax
je 0x40828f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x433e5c], eax
mov eax, dword [0x433e5c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4082e8
cmp dword [0x433e60], ecx
je 0x4082e8
push eax
call esi
push dword [0x433e60]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4082e8
test ebx, ebx
je 0x4082e8
call edi
test eax, eax
je 0x4082df
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4082df
test byte [ebp - 8], 1
jne 0x4082e8
or dword [ebp + 0x10], 0x200000
jmp 0x40831b
mov eax, dword [0x433e54]
cmp eax, dword [ebp - 0x18]
je 0x40831b
push eax
call esi
test eax, eax
je 0x40831b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40831b
mov eax, dword [0x433e58]
cmp eax, dword [ebp - 0x18]
je 0x40831b
push eax
call esi
test eax, eax
je 0x40831b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x433e50]
call esi
test eax, eax
je 0x408337
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408339
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401d99
leave
ret
Function at 0x40ca60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40ca82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40ca89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40ca78
mov eax, 1
add ebx, ebx
jne 0x40ca9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40ca90
jne 0x40caac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40ca90
xor ecx, ecx
sub eax, 3
jb 0x40cac0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40cb32
mov ebp, eax
add ebx, ebx
jne 0x40cacb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40cad8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40cafc
inc ecx
add ebx, ebx
jne 0x40cae8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40cadd
jne 0x40caf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40cadd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40cb1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40cb0d
jmp 0x40ca7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40cb1c
add edi, ecx
jmp 0x40ca7e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40cb7b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe99c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe9f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40cb39
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe9fc]
or eax, eax
je 0x40cb75
mov dword [ebx], eax
add ebx, 4
jmp 0x40cb56
call dword [esi + 0xe9f8]
mov ebp, dword [esi + 0xea00]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40cbaf
sub esp, 0xffffff80
jmp 0x401978
Function at 0x4020e7
Capabilities:
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
and al, 0x18
push edx
push 0x4a7d14
call fcn.00411691
add esp, 8
lea ecx, [esp + 0x18]
lea eax, [esp + 0x3c]
sub ebp, 2
call fcn.00401a70
mov esi, dword [esp + 0x18]
cmp word [0x4a7d14], 0
je 0x42c219
test ebp, ebp
jl 0x42c243
mov edi, dword [esp + 0x64]
lea eax, [ebp + 1]
push eax
push 1
mov eax, edi
call fcn.0040e7e0
push 0
push 1
push 0
push edi
call fcn.0040d030
add esp, 0x18
mov esi, eax
call fcn.004092c0
mov dword [esi + 8], 1
mov dword [esi], ebp
test ebp, ebp
jle 0x402184
xor ebx, ebx
inc ebx
push ebx
push 1
push 0
push edi
call fcn.0040d030
add esp, 0x10
lea edi, [esp + 0x18]
mov esi, eax
call fcn.0040e640
mov ecx, edi
lea eax, [esp + 0x3c]
call fcn.00401a70
cmp ebx, ebp
jl 0x42c23a
lea ecx, [esp + 0x18]
call fcn.00402620
lea esi, [esp + 0x28]
call fcn.004092c0
lea edi, [esp + 0x50]
call fcn.00401a30
mov dword [esp + 0x3c], 0
mov dword [esp + 0x50], 0x4848ec
call fcn.00401a30
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004112ef
add esp, 4
lea ecx, [esp + 0x40]
call fcn.00402620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4
mov al, byte [0x5e004966]
mov eax, dword [ecx]
push eax
call fcn.0045db0f
test al, al
je 0x42c816
add esi, 2
mov dword [esp + 0x10], esi
jmp 0x408fbb
add byte [eax], al
call fcn.0040be57
mov ecx, dword [esp + 0x60]
and al, 0x60
mov edx, dword [ecx + 4]
mov dword [esp + 0x84], 0
mov esi, dword [edx + esi*4 + 8]
movzx eax, word [esi + 8]
cmp ax, 0x4a
mov edx, dword [esp + 0x60]
mov eax, dword [edx + 4]
mov ecx, dword [eax + esi*4]
movsx edx, word [ecx + 0xa]
mov eax, dword [ebp + 8]
push edx
push 0x79
push eax
call fcn.0045d2a5
lea ecx, [esp + 0xd0]
push ecx
call fcn.0044a0ca
lea ecx, [esp + 0xc0]
call fcn.0040d9d7
jmp 0x42d24e
Function at 0x4023e7
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x50
lea ecx, [esp + 0x8c]
push ecx
push edi
mov ecx, esi
call fcn.0040ab50
test eax, eax
jne 0x42f8f6
lea eax, [esp + 0x18]
push eax
lea ebx, [esp + 0x5c]
call fcn.00409210
mov ecx, dword [edi + 4]
mov edx, dword [esp + 0x84]
mov eax, dword [ecx + edx*4]
cmp word [eax + 8], 0
je 0x42f721
lea esi, [esp + 0x68]
call fcn.004092c0
mov esi, dword [esp + 0x7c]
mov eax, 1
mov dword [esp + 0x70], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x10]
cmp dword [eax + 8], 4
je 0x42f763
mov ebx, dword [esp + 0x60]
cmp ebx, 4
je 0x42f76e
test byte [edx], dl
rol dword [edx], cl
invalid
mov edx, dword [edi + 4]
mov eax, dword [esp + 0x84]
mov eax, dword [edx + eax*4]
cmp word [eax + 8], 0x7f
jne 0x42f781
xor esi, esi
xor dl, dl
jmp 0x402480
push esp
and al, 0x3c
mov eax, dword [esp + 0x44]
inc edx
mov dword [eax], edx
jmp fcn.0040a1aa
sbb bl, 2
add cl, ch
jne 0x42f6d2
std
dec dword [ebp - 0x17d7db8c]
add al, 0x88
std
invalid
sub al, 0x24
dec eax
add byte [ebx - 0x17afffbb], cl
test byte [edi], 0xfe
inc dword [ebx + 0x4ce904c4]
test eax, 0x458bfffd
add byte [ebp + 0x41840fc0], al
test eax, 0xe850fffd
invalid
std
call dword [eax - 0x18]
jge 0x42f7c3
add dword [eax], eax
jmp 0x40a0c4
std
call dword [eax - 0x18]
test al, 1
add cl, ch
hlt
push esp
and al, 0x2c
mov ecx, dword [edx]
mov dword [eax], ecx
mov edx, dword [ebp]
mov eax, dword [edx]
add esp, 4
test eax, eax
je 0x42f93c
push eax
call fcn.00410391
mov ecx, dword [ebp]
mov dword [ecx + 4], eax
mov ebp, dword [ebp]
mov edx, dword [ebp]
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 4]
add esp, 4
push edx
mov edx, dword [ebp + 4]
push ecx
push edx
call fcn.0040fbe7
add esp, 0xc
jmp fcn.0040a117
push 1
call fcn.00410391
mov ecx, dword [ebp]
mov dword [ecx + 4], eax
mov edx, dword [ebp]
mov eax, dword [edx + 4]
add esp, 4
mov byte [eax], 0
jmp fcn.0040a117

Function at 0x402dd0
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x28
or eax, 0xffffffff
mov word [esp + 0x10], ax
push ebp
xor ecx, ecx
mov eax, 0x65
xor ebp, ebp
mov dword [esp + 0x20], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
mov dword [esp + 0x24], ebp
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
xor ecx, ecx
push 4
mov dword [esp + 0x24], eax
mov word [eax], cx
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42b3f4
mov dword [eax], 1
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x3c]
cmp dword [edx + 8], ebp
jbe 0x402e63
xor edi, edi
mov eax, edx
add byte [eax], al
test esi, 0x100000
je 0x42b448
test esi, 0x10038
Function at 0x402e47
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
mov ecx, dword [eax + 4]
mov esi, dword [ecx + edi*4]
test esi, esi
je 0x402e5d
movzx eax, word [esi + 8]
cmp ax, 0x3f
cmp eax, 0x3f
cmp eax, 0x3f
jle 0x402f2d
push esi
call fcn.004112ef
mov eax, dword [esp + 0x40]
add esp, 4
inc edi
cmp edi, dword [eax + 8]
jb 0x402e38
mov edx, dword [esp + 0x3c]
cmp ax, 0x30
jl 0x402e50
mov ecx, dword [esi]
test ecx, ecx
je 0x402e50
mov eax, dword [ecx + 0xc]
dec dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x10], ecx
cmp dword [edx], ebp
je 0x42b3fd
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004112ef
add esp, 4
jmp 0x402e50
test byte [esi], al
Function at 0x402f67
Capabilities:
Parse credit card information

Disassembly:
mov edi, 0x40
lea esi, [esp + 0x14]
call fcn.00402b00
mov edi, dword [esp + 0x3c]
push esi
call fcn.00402cc0
inc ebp
jmp 0x40304f

Function at 0x4034b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
sub esp, 0xc
cmp dword [esi + 8], eax
jb 0x4034bd
add esp, 0xc
ret
cmp eax, 0x41c2
jae 0x42a0ba
add eax, eax
mov dword [esi + 8], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x42a18b
add eax, 7
shr eax, 3
add eax, eax
add eax, eax
add eax, eax
xor ecx, ecx
mov dword [esi + 8], eax
mov edx, 2
mul edx
seto cl
push edi
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
mov edi, eax
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x403523
mov ecx, dword [esi + 4]
lea edx, [ecx + ecx + 2]
push edx
push eax
push edi
call fcn.00410f70
mov eax, dword [esi]
push eax
call fcn.004112ef
add esp, 0x10
mov dword [esi], edi
pop edi
add esp, 0xc
ret
movzx eax, word [ebx + ebp*2]
cmp ax, 0x41
jb 0x42a0c8
or al, byte [eax]
add byte [eax], al
cmp ax, 0x5a
jbe 0x42a125
cmp ax, 0x61
jb 0x42a0dc
cmp ax, 0x7a
jbe 0x42a125
cmp ax, 0x30
jb 0x42a0f0
cmp ax, 0x39
jbe 0x42a125
cmp ax, 0x5f
je 0x42a125
cmp dword [esp + 0x24], 0
je 0x42a247
mov edi, 0x35
lea esi, [esp + 0x14]
call fcn.00401777
lea esi, [esp + 0x20]
lea edi, [esp + 0x14]
call fcn.004012c7
jmp fcn.00401cb8
push eax
lea eax, [esp + 0x24]
call fcn.004020e7
inc ebp
jmp 0x42a0b0
call fcn.00401777
mov edi, dword [esp + 0x3c]
push esi
call fcn.00401937
inc ebp
jmp fcn.00401cc6
mov ecx, dword [esp + 0x38]
dec ebp
push ebp
push 0x138b
push ecx
call fcn.0045ec20
lea ecx, [esp + 0x20]
call fcn.00401297
lea edx, [esp + 0x14]
push edx
call fcn.0044a0ca
mov eax, 1
jmp fcn.00401d2c

Function at 0x403530
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, eax
call fcn.00403770
mov ecx, dword [edi]
cmp word [ebx + ecx*2 + 2], 0
lea eax, [ecx + 1]
mov dword [edi], eax
je 0x42b3da
movzx edx, word [ebx + ecx*2]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
jmp 0x403564
mov edx, dword [esp + 0xc]
mov eax, dword [edi]
lea ecx, [ebx + eax*2]
movzx eax, word [ecx]
cmp ax, dx
je 0x4035b0
movzx ebp, ax
mov eax, dword [esi + 0xc]
cmp dword [eax], 1
jg 0x42b384
mov eax, dword [esi + 4]
inc eax
call fcn.004034b0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov word [ecx + eax*2], bp
inc dword [esi + 4]
mov eax, dword [esi + 4]
mov edx, dword [esi]
xor ecx, ecx
inc dword [edi]
mov word [edx + eax*2], cx
mov edx, dword [edi]
cmp word [ebx + edx*2], 0
jne 0x403560
jmp 0x42b3d6
cmp word [ecx + 2], dx
je 0x42b374
inc dword [edi]
xor eax, eax
pop esi
pop ebp
add esp, 0x10
ret 4
add byte [eax], al
mov eax, ebp
call 0x40bed7
push eax
mov eax, ebp
call fcn.0040b277
push eax
call fcn.0044210b
call dword [eax - 0x18]
sub byte [ebp + 1], 0
fstp qword [esp + 0x10]
jmp 0x42b5f5
Function at 0x409110
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
inc dword [eax]
mov ecx, dword [eax]
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov edx, dword [ebp + 4]
lea edx, [edx + ecx*4]
push esi
mov esi, dword [edx]
cmp word [esi + 8], 0x47
jne 0x42c051
mov edx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0xc]
push ecx
push edx
lea edx, [esp + 0x30]
mov esi, ebp
call fcn.0040c2a0
test eax, eax
jne 0x42c065
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
cmp dword [esp + 0x28], ebx
jae 0x409204
jmp 0x409172
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov esi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], eax
call fcn.0040be00
mov ecx, dword [edi + 4]
mov eax, dword [edi + 8]
mov eax, dword [ecx + eax*4 - 4]
mov esi, dword [esp + 0x24]
push ebx
push eax
lea edx, [esp + 0x30]
push edx
push ebp
mov ecx, esi
call fcn.0040ab50
test eax, eax
jne 0x42c082
mov eax, dword [esp + 0x2c]
inc dword [eax]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4091fb
mov ecx, dword [ebp + 4]
mov edx, dword [ecx + eax*4]
cmp word [edx + 8], 0x40
jne 0x42c06f
lea ecx, [eax + 1]
cmp ecx, ebx
je 0x42c06f
lea esi, [esp + 0x10]
mov dword [esp + 0x28], ecx
call fcn.004092c0
cmp dword [esp + 0x28], ebx
jb 0x409170
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
lea esi, [esp + 0x10]
call fcn.004092c0
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
push dword [ebx]
shr cl, 0xba
leave
std
inc dword [ebx + 0x2102444]
jmp fcn.00408a5d
push 0x91
jmp 0x42d245
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
mov ecx, dword [eax + ecx*4]
movsx edx, word [ecx + 0xa]
mov eax, dword [ebp + 8]
push edx
push 0x91
push eax
jmp fcn.0042d249
add byte [eax], al
add byte [eax - 0x17], dl
mov esi, 0x8b000011
dec ebp
or al, 0x8b
push ecx
add al, 0x8b
inc esp
and al, 0x58
mov ecx, dword [edx + eax*4]
movsx edx, word [ecx + 0xa]
mov eax, dword [ebp + 8]
push edx
push 0x79
push eax
jmp fcn.0042d249
mov ecx, dword [ebp + 8]
push ecx

Function at 0x409560
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xec]
cmp eax, 0xf3c
Function at 0x40ab50
Capabilities:
Authenticate hmac
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
in al, dx
test byte [eax], al
add byte [eax], al
push ebx
push esi
push edi
mov ebx, 1
xor edi, edi
mov dword [esp + 0x24], ecx
test byte [0x4a9398], bl
je 0x40b26c
or dword [0x4a9398], ebx
push 0x429292
Function at 0x40bd00
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, 1
cmp dword [edi + 4], ebx
je 0x40bd20
cmp byte [edi + 0xd], 0
push esi
jne 0x40bd25
cmp byte [edi + 0xc], 0
je 0x42a406
mov byte [edi + 0xd], bl
pop esi
dec dword [edi + 4]
pop ebx
ret
mov esi, dword [edi + 8]
push ebp
mov ebp, dword [esi + 0x10]
test esi, esi
je 0x40bd3e
call fcn.004092c0
push esi
call fcn.004112ef
add esp, 4
mov dword [edi + 8], ebp
mov byte [edi + 0xd], 0
pop ebp
jmp 0x40bd12
les ecx, [eax + edx*2]

Function at 0x40be90
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
inc ebx
add dword [ebx], esi
leave
lea esi, [esp + 0x38]
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], ebx
call fcn.004019e0
lea ecx, [esp + 0x14]
push ecx
mov eax, dword [ecx + 8]
cmp eax, 1
jne 0x40be9b
fild dword [ecx]
ret
sub esp, 8
sub eax, 2
cmp eax, 8
ja case.0x40bea6.5
jmp dword [eax*4 + 0x40bebc]
fld qword [ecx]
add esp, 8
ret
fldz
add esp, 8
or bl, al
mov bh, ch
dec dword [ebx + 0x74c08506]
push es
push eax
call fcn.0044236d
mov dword [esi], 0
jmp 0x402331
leave
mov dword [esi + 8], eax
mov edx, 2
add byte [eax], al
add bh, dh
loop 0x429903
nop
sal edi, 0xd9
invalid
add byte [eax], al
add bh, dh
loop 0x429903
nop
sal edi, 0xd9
invalid
invalid
or ecx, eax
push ecx
call fcn.00410391
add esp, 4
mov dword [esi], eax
jmp fcn.00402c50

Function at 0x40bfa7
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
mov edi, eax
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x40bfbc
mov eax, dword [edi + 8]
cmp eax, 1
jne 0x42a3a1
mov eax, dword [esi]
mov edx, dword [edi]
mov ecx, eax
imul ecx, edx
imul edx
mov edi, eax
mov eax, ecx
mov ebx, edx
cdq
cmp eax, edi
jne 0x42a390
cmp edx, ebx
jne 0x42a390
jecxz 0x40bfaa
invalid
mov dword [esi], ecx
mov eax, dword [esi + 0xc]
pop edi
pop ebx
test eax, eax
jne 0x42a3d3
mov eax, esi
ret
sub eax, 2
cmp eax, 9
ja case.0x40bfcb.5
movzx eax, byte [eax + 0x40bff0]
jmp dword [eax*4 + 0x40bfe0]
mov ecx, edi
call fcn.0040be90
fmul qword [esi]
fstp qword [esi]
jmp case.0x40bfcb.5
or byte [edx - 0x18], dl
xchg ebx, eax
cmp esi, 0xffffffff
je 0x42a394
add cl, ch
jno 0x42a398
invalid
push edi
call fcn.004421ed
add dword [esi], eax
adc dword [esi + 4], edx
jmp fcn.0040a5c9
push esi
add al, 0xe9
and dword [edx], eax
invalid
pop edi
invalid
add al, 0x83
les eax, [ecx + edx*2]
push edx
push ebp
call fcn.0040fbe7
add esp, 0xc
push edi
Function at 0x40cde0
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov edx, dword [esp + 0x60]
push ebx
mov ebx, dword [esp + 0x60]
push ebp
push esi
push edi
lea eax, [esp + 0x17]
push eax
push ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 1
call fcn.0040cd80
test eax, eax
ror byte [edi], 0x85
pop ebx
add dword [eax], eax
invalid
mov esi, dword [esp + 0x70]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x18]
mov edx, dword [ecx + eax*4]
xor edi, edi
cmp word [edx + 8], di
jne 0x42fb6a
cmp dword [edx], 5
jne 0x42fb6a
mov ebp, dword [esp + 0x74]
inc eax
mov dword [esp + 0x18], eax
inc esp
and al, 0x18
mov ebx, dword [ecx + eax*4]
mov edx, 0x7f
cmp word [ebx + 8], dx
jne 0x40ceec
lea eax, [esp + 0x38]
mov byte [esp + 0x70], 0
xor bl, bl
cmp byte [esp + 0x17], 0
je 0x40cf69
mov ebx, 0x485234
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov edi, dword [ecx + eax*4]
cmp word [edi + 8], dx
je 0x40cf36
add byte [eax], al
add bh, bh
and al, 0x85
add al, 0x10
inc ebx
add byte [ebx - 0x75], dl
invalid

Function at 0x40ce07
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov edx, dword [esp + 0x60]
push ebx
mov ebx, dword [esp + 0x60]
push ebp
push esi
push edi
lea eax, [esp + 0x17]
push eax
push ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 1
call fcn.0040cd80
test eax, eax
ror byte [edi], 0x85
pop ebx
add dword [eax], eax
invalid
mov esi, dword [esp + 0x70]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x18]
mov edx, dword [ecx + eax*4]
xor edi, edi
cmp word [edx + 8], di
jne 0x42fb6a
cmp dword [edx], 5
jne 0x42fb6a
mov ebp, dword [esp + 0x74]
inc eax
mov dword [esp + 0x18], eax
inc esp
and al, 0x18
mov ebx, dword [ecx + eax*4]
mov edx, 0x7f
cmp word [ebx + 8], dx
jne 0x40ceec
lea eax, [esp + 0x38]
mov byte [esp + 0x70], 0
xor bl, bl
cmp byte [esp + 0x17], 0
je 0x40cf69
mov ebx, 0x485234
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov edi, dword [ecx + eax*4]
cmp word [edi + 8], dx
je 0x40cf36
add byte [eax], al
add bh, bh
and al, 0x85
add al, 0x10
inc ebx
add byte [ebx - 0x75], dl
invalid