joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4057bb
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x247489f0], cl
adc byte [ebx - 0x7bf00002], al
leave
call 0xf6c557d0
jle 0x4440aa
mov eax, dword [edi + 4]
mov eax, dword [eax]
cmp dword [eax + 0xc], 4
jne 0x444128
push 0x38
call fcn.004249c0
mov edi, eax
mov dword [esp], 0x10000
and dword [edi], 0
call fcn.00424a01
pop ecx
mov ecx, edi
mov dword [edi + 4], eax
call fcn.0040ae47
lea ecx, [edi + 0x18]
call fcn.0040f56a
mov ecx, edi
call fcn.0040ae56
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov esi, dword [eax]
mov ecx, esi
call fcn.0040c12f
mov esi, dword [esi + 8]
mov ecx, edi
call fcn.0040ae6f
mov eax, 0x8000
mov ecx, edi
push eax
push esi
mov dword [edi + 0x28], eax
call fcn.0040a37f
test al, al
je 0x4440a2
mov ecx, edi
call fcn.0040a1e3
mov ecx, edi
call fcn.0040a02e
mov ecx, edi
call fcn.0040a01e
test byte [edi + 0x28], 3
jne 0x4ca740d9
push ecx
mov ecx, edi
call fcn.004496bc
mov eax, dword [ebx]
mov eax, dword [eax + 4]
add eax, ebx
cmp byte [eax + 0xd], 0
mov ecx, dword [eax + 8]
je 0x4440bd
mov ecx, dword [ecx + 0x38]
mov dword [ecx + 0x14], 1
cmp byte [eax + 0xd], 0
mov ecx, dword [eax + 8]
je 0x4440d0
mov ecx, dword [ecx + 0x38]
mov byte [ecx + 0x18], 0
jmp 0x448dca
push 0
push eax
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call 0x4bd1dd
test al, al
je 0x4440aa
invalid
mov ecx, dword [ebx + 0x19c]
mov eax, dword [esp + 0x14]
mov eax, dword [ecx + eax*4]

Function at 0x405984
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
inc esp
and al, 0x10
lea edx, [ebx + 6]
cmp eax, edx
ja 0x4442be
lea edx, [ebx + 5]
cmp eax, edx
ja 0x4442d6
lea edx, [ebx + 4]
cmp eax, edx
jbe 0x4059ba
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + edx*4]
call fcn.00410315
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
lea edx, [ebx + 3]
cmp eax, edx
jbe 0x4059d5
mov eax, dword [ecx + 4]
mov ecx, dword [eax + edx*4]
call fcn.0044ec2c
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
jmp 0x449064
invalid
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + edx*4]
call fcn.0044ec47
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
jmp 0x44908a
add byte [ebx - 0x48f00783], cl
add byte [ebx + 0x7d8902c7], al
clc
lock add byte [edi], cl
test dword [ebp + 0x3e], edi
add byte [eax], al

Function at 0x405bd2
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
or byte [ebx + 0x308bb804], cl
test ah, dh
out 3, eax
add byte [ebx - 0x7bf0f006], al
jmp 0x405b4a
loopne 0x405b57
cli
sbb eax, 0xec34870f
add eax, dword [eax]
Function at 0x4070b0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi]
mov edx, dword [ecx]
cmp edx, 1
jg 0x444cfb
xor al, al
test al, al
jne 0x444d0e
cmp dword [ecx], 0x7fffffff
mov eax, ecx
je 0x444d2a
xor dl, dl
test dl, dl
jne 0x4070ec
mov dword [ecx], 1
mov eax, dword [esi]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x407128
mov dword [eax + 0x210], 0
jle 0x407128
lea edx, [ebp + 0x10]
mov eax, dword [esi]
lea edx, [edx + 4]
mov ebx, dword [edx]
mov edi, dword [eax + 0x210]
cmp edi, 0x40
jge 0x407123
mov dword [eax + edi*4 + 0x110], ebx
mov eax, dword [esi]
inc dword [eax + 0x210]
sub ecx, 1
jne 0x407102
mov ecx, dword [esi]
mov ebx, dword [ecx + 8]
test ebx, ebx
je 0x407226
mov edi, dword [ecx + 0x10c]
cmp edi, dword [ecx + 0x210]
jne 0x407226
xor edx, edx
test edi, edi
jle 0x407176
lea eax, [ecx + 0xc]
cmp edx, 0x7fffffff
je 0x4070c6
mov al, 1
jmp 0x44b1d2
lea eax, [edx - 1]
mov dword [ecx], eax
mov ecx, esi
push esi
call fcn.0045e849
mov eax, dword [esi]
mov dword [eax], 1
mov ecx, dword [esi]
jmp 0x44b1f6
invalid
mov dl, 1
jmp 0x44b20d
invalid
inc dword [ebx + 0xf00d87d]
mov bh, 0x17
pop ss

Function at 0x407b27
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
adc dword [ebx - 0x70f0fe06], eax
in al, 0xd9
add eax, dword [eax]

Function at 0x40867c
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
movzx edx, word [edx]
cmp edx, 0xff
ja 0x446242
mov ecx, edx
mov eax, 1
and ecx, 7
shr edx, 3
shl eax, cl
mov ecx, dword [ebp - 0x34]
test byte [edx + ecx], al
mov edx, dword [ebp + 0x10]
jne 0x4086ca
add edx, 2
mov dword [ebp + 0x10], edx
cmp edx, edi
jb 0x408660
mov eax, dword [ebp - 4]
jmp 0x408530
mov eax, dword [ebp - 4]
jmp 0x408530
mov edx, 0xff
jmp 0x44dcb7
add ch, cl
fadd dword [edx - 0x67f0000]
test dword [eax], eax
add byte [eax], al
je fcn.0044dcd4
lea eax, [ecx - 0x2028]
cmp eax, 1
ja case.0x408896.157
Function at 0x40b38f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
sub eax, 1
je 0x40b3cb
sub eax, 1
je 0x44ff36
sub eax, 1
je 0x40b3d0
sub eax, 1
jne 0x44fea7
mov edx, dword [esi + 8]
mov eax, dword [edx]
cmp word [eax], 0x30
je 0x40b3f4
push eax
call fcn.00430abe
pop ecx
pop esi
leave
ret
mov eax, dword [esi]
cdq
jmp 0x40b3c8
fld qword [esi]
fld st(0)
call fcn.0044c885
fldz
mov ecx, eax
fcompp
fnstsw ax
test ah, 5
jp 0x40b3f0
test edx, edx
jg 0x40b3f0
jl 0x40b40b
test ecx, ecx
jb 0x40b40b
mov eax, ecx
jmp 0x40b3c8
movzx ecx, word [eax + 2]
cmp ecx, 0x78
je 0x44ff06
cmp ecx, 0x58
jne 0x40b3c1
jmp 0x44ff06
or eax, 0xffffffff
mov edx, 0x7fffffff
jmp 0x40b3c8
sub eax, 3
je 0x40b3cb
dec eax
sub eax, 1
je 0x44fef7
dec eax
sub eax, 1
cmp byte [esi], 0
je 0x44feda
xor eax, eax
inc eax
cmp dword [edx + 4], 0x12
ja 0x40b3c1
push 0x10
lea ecx, [eax + 4]
lea edx, [ebp - 8]
call fcn.00469291
mov eax, dword [esi + 8]
pop ecx
cmp dword [eax + 4], 0xa
mov eax, dword [ebp - 8]
jbe 0x40b3cd
mov eax, dword [esi]
mov edx, dword [esi + 4]
jmp 0x45a704
sub byte [ebx + 0xc798bd6], cl

Function at 0x40b491
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0xffffffff
jg 0x40b458
jl 0x40b49a
cmp edi, 0x80000000
jb 0x40b49a
cmp eax, ebx
jl 0x40b466
jg 0x40b49a
cmp edi, 0x7fffffff
ja 0x40b49a
mov ecx, esi
call fcn.00417809
ret
add byte [eax], al
mov dword [esi], edi
test bl, bl
jne 0x44ff56
mov dword [esi + 0xc], 1
pop edi
pop ebx
pop esi
leave
ret
stc
pop eax
jne 0x40b449
jmp 0x44ff40
mov bl, 1
jmp 0x40b466
cmp dword [edx + 4], 0x12
ja 0x40b449
cmp dword [edx + 4], 0xa
seta bl
jmp 0x45a7b8
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov dword [esi + 0xc], 2
jmp 0x45a7e2
fiadd word [eax]
add byte [eax], al

Function at 0x40ec40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xfc
mov eax, dword fs:[0x2c]
mov dword [esp + 0x18], ecx
push ebx
push esi
mov ecx, dword [eax]
mov eax, dword [0x4d2580]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x8c], ecx
cmp eax, dword [ecx + 4]
jg 0x40fe3a
mov ebx, dword [ebp + 0x10]
xor esi, esi
xor al, al
mov word [esp + 0x54], 1
push 8
mov byte [esp + 0x1f], al
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x34], esi
mov word [esp + 0x38], 1
call fcn.0042de85
mov ecx, dword [edi]
mov edx, eax
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x50], edx
mov dword [esp + 0x4c], 1
mov dword [edx], 0x14
add byte [eax], al
add byte [ecx + 0x758b0472], cl
or bh, al
inc esp
and al, 0x14
pop ss
add byte [eax], al
add byte [ebx + 0x48b0446], cl
mov byte [ebx + 0x49c4700d], cl
add byte [ecx + 0xf70244c], cl
mov edi, 0x44890a40
and al, 0x58
push 0x4d2580
call fcn.0042f482
add esp, 4
cmp dword [0x4d2580], 0xffffffff
jne 0x40ec76
push 0x44247b
call fcn.0042f2fd
add esp, 4
push 0x4d2580
call fcn.0042f45f
add esp, 4
jmp 0x40ec76
Function at 0x4108d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb edx, dword [edi + 4]
add ch, bl
add ebp, ebx
push ebp
clc
mov eax, dword [ebx + 0xc]
cmp eax, 3
jne 0x410d36
fstp st(2)
fstp st(0)
fld qword [ebx]
fcompp
fnstsw ax
test ah, 0x41
je 0x410b4f
dec eax
cmp eax, 9
ja case.0x410d40.3
jmp dword [eax*4 + 0x411240]
fstp st(2)
fstp st(0)
fild dword [ebx]
jmp 0x420a3a
add byte [eax], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], ebp
invalid
insb byte es:[edi], dx

Function at 0x41ae34
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
movzx eax, ax
xor edx, edx
movzx eax, byte [eax + 0x4c2140]
lea ecx, [ebx + eax*2]
call fcn.00436b38
mov esi, eax
mov edx, esi
movzx eax, word [esi]
cmp eax, 0x87
je 0x457d67
cmp eax, 0x83
je 0x457e2c
cmp eax, 0x84
je 0x457e2c
cmp eax, 0x88
je 0x457e2c
cmp eax, 0x89
je 0x457e2c
cmp eax, 0x85
je 0x457e13
cmp eax, 0x86
je 0x457e13
cmp eax, 0x8a
je 0x457e13
cmp eax, 0x8b
je 0x457e13
cmp eax, 0x7d
je 0x41aeb8
cmp eax, 0x81
je 0x41aebf
cmp eax, 0x82
je 0x41aebf
cmp eax, 0x55
je 0x457ddf
cmp eax, 0x56
je 0x457ddf
cmp eax, 0x5e
je 0x457ddf
cmp eax, 0x1b
je 0x457e48
cmp eax, 0x1c
je 0x457e48
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 1
jmp 0x4720ea
mov eax, dword [ebp + 0xc]
push dword [ebp + 0x10]
inc eax
push eax
jmp fcn.004720fa
add esi, 4
movzx eax, word [esi]
mov ecx, eax
cmp eax, 0x76
jne 0x457d7a
lea esi, [edx + 0xc]
movzx ecx, word [esi]
movzx eax, cx
mov edx, 0x8d
cmp ax, dx
jb 0x457da1
add edx, 4
cmp ax, dx
jbe 0x41aeb1
mov eax, 0x9d
cmp cx, ax
je 0x41aeb1
mov edx, dword [ebp - 4]
mov ecx, esi
push 1
push dword [ebp + 0xc]
push edi
call fcn.00471f8e
add esp, 0xc
test eax, eax
je 0x41aeb1
push 0x77
pop ecx
movzx eax, word [esi + 2]
lea esi, [esi + eax*2]
cmp word [esi], cx
je 0x457dbf
lea ecx, [esi + 4]
xor edx, edx
call fcn.00473b06
mov esi, eax
movzx eax, word [esi]
jmp 0x471ff4
cmp word [esi + 2], 0xc
jne 0x41aeb1
mov eax, dword [ebp - 4]
test dword [edi + 0x50], eax
jne 0x41aeb1
cmp dword [ebp + 0xc], 0
jg 0x41aeb1
cmp dword [edi + 0x70], 0
jne 0x41aeb1
cmp dword [ebp + 0x10], 0
jmp 0x4720ba
add dword [eax], eax
movzx ecx, word [esi + 4]
xor edx, edx
inc edx
cmp ecx, 0x20
jae 0x457e21
shl edx, cl
push dword [ebp + 0x10]
or edx, dword [ebp - 4]
push dword [ebp + 0xc]
jmp 0x457e35
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov edx, dword [ebp - 4]
push edi
mov ecx, esi
call fcn.0047201a
movzx eax, word [ebx + 2]
push 0x77
lea ebx, [ebx + eax*2]
pop eax
cmp word [ebx], ax
je 0x41adf3
invalid
cwde
das
cld
invalid
xor eax, eax
inc eax
jmp 0x472112
rol byte [ecx + 0x5ddd004c], 0xf8
add al, 0x8b
enter 0xffffffffffffcf33, 0xffffffffffffff81
loope 0x4720c0
invalid

Function at 0x41ba5a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
sub eax, edx
and eax, 0xfffffffe
push eax
push edx
push ecx
call fcn.0043d583
mov edx, dword [ebp - 0x28]
add esp, 0xc
mov ecx, dword [ebp - 0xb0]
sub edx, ecx
sar edx, 1
neg edx
mov dword [ebp - 0x28], ecx
lea esi, [esi + edx*2]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
Function at 0x41c391
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x84], ecx
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], ecx

Function at 0x41c3a6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x68], ecx
xor ecx, ecx
mov dword [ebp - 0xa4], ecx
mov ecx, 0x81
cmp ebx, ecx
mov ecx, dword [ebp - 0x9c]
jb 0x45a638
cmp dword [ebp - 0x34], 0xfffffffe
je 0x45a5f1
test ecx, ecx
jns 0x45a619
test eax, eax
js 0x41b9d3
jmp 0x475e32
test ecx, ecx
js 0x45a60c
mov ebx, dword [ebp - 0xe4]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0xa4], ecx
jmp 0x45a610
or dword [ebp - 0x34], 0xffffffff
or dword [ebp - 0x68], 0xffffffff
jmp 0x475dee
add dword [eax], eax
test eax, eax
jns 0x45a650
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xb8], eax
mov eax, ecx
or eax, edi
mov dword [ebp - 0xa0], eax
jmp 0x475e0d
aad 0xb7
add dword [eax], eax
cmp ebx, 0x7d
jne 0x41b9d3
test eax, eax
js 0x41b9d3
test ecx, ecx
jmp 0x475e27
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x54], eax
jmp 0x475430
call 0x8373c835
call 0x8367c83d
call 0x485bc84f
je 0x475452
dec eax
add al, 0x98
add byte [eax], al

Function at 0x41cdcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [edi + 4], eax
cmp edx, 0x21
je 0x41cddf
cmp edx, 0x2e
je 0x41cdda
cmp edx, 0x3b
je 0x41cdd5
cmp edx, 0x48
je 0x41cdd0
cmp word [ebp + 0xe], 0x55
jne 0x41cd9d
movzx eax, word [esi]
add esi, ecx
mov dword [edi], eax
movzx ebx, word [edi]
mov edx, dword [ebp - 0x18]
movzx eax, bx
cmp ax, word [ebp - 4]
ja 0x45cf97
je 0x45cff5
cmp ax, word [ebp - 8]
jb 0x41cde4
cmp eax, 0xd
ja 0x45ceac
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x41cd78
mov eax, dword [ebp - 0x14]
jmp 0x41cd9b
mov eax, dword [ebp - 0x10]
jmp 0x41cd9b
mov eax, dword [ebp - 4]
jmp 0x41cd9b
mov eax, dword [ebp - 0xc]
jmp 0x41cd9b
xor eax, eax
jmp 0x41cdc7
cmp eax, 0xe
invalid
xchg byte [edi], ch
invalid
Function at 0x442811
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sti
inc dword [ebp - 0x557af02e]
cli
sti
inc dword [ebp - 0x5d7af025]
cli
sti
call dword [esi + 0x68]
xchg esi, eax
add byte [eax], al
add cl, ch
inc ebx
push ds
add al, 0
mov eax, dword [ecx + 4]
push 0x7f
pop ecx
cmp word [eax + 8], cx
jne 0x442a07
mov eax, dword [ebp - 0x1c]
dec eax
dec edi
cmp dword [ebp - 0x64], 0
mov dword [ebp - 0x1c], eax
jne 0x442851
mov ebx, dword [ebp - 0x24]
jmp 0x442870
cmp byte [ebp - 0x5b], 0
mov eax, dword [ebp - 0x2c]
je 0x44285d
mov eax, dword [eax + 4]
mov ebx, dword [eax]
lea ecx, [ebp - 0x64]
call fcn.00444445
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
js 0x44287c
cmp edi, ebx
je case.default.0x40232b
push esi
push 0xb3
jmp 0x4846ca
movsx eax, word [eax + 0xa]
push eax
push 0x72
jmp 0x442a47
mov ecx, 0x4d1430
call 0x4b53e9
jmp 0x444404
jne 0x444426
push dword [ebp - 4]
push dword [ebp - 8]
push ecx
push eax
push dword [ebp + 0xc]
push edi
push esi
push ebx
call 0x4d6b84
jmp fcn.0044941e
cld
push dword [ebp - 8]
push ecx
push eax
push dword [ebp + 0xc]
push edi
push esi
push ebx
call 0x4d76eb
jmp fcn.0044943c
inc ebp
or bh, bh
push ecx
or byte [ebx - 0x97a5b8b], cl

Function at 0x444445
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push dword [ebp - 8]
push ecx
push eax
push dword [ebp + 0xc]
push edi
push esi
push ebx
call 0x4d77e9
jmp fcn.0044945a

Function at 0x4444ad
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push dword [ebp + 0x20]
push dword [ebp - 4]
push dword [ebp - 8]
push ecx
push eax
push ecx
push edi
push esi
push ebx

Function at 0x4444bc
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
call 0x4d7aa8
jmp fcn.004494c6

Function at 0x444589
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push esi
push ecx
call 0x4d7eca
cmp dword [ecx], ecx
add cl, ch
add byte [eax], dl
invalid
Function at 0x4446b0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
test cl, 4
je 0x4446e3
cmp dword [ebp - 0x28], 0
jne 0x405c4f
push 0
push esi
push ebx
call fcn.0040ad55
cmp byte [ebx + 0x198], 0
jne 0x4447d2
cmp dword [ebx + 0x50], 0xffffffff
jne 0x4447f4
cmp dword [ebx + 0x54], 0xffffffff
jne 0x444802
cmp dword [esi], 0
je 0x405c80
push edi
push 0xffffffffffffffeb
push dword [esi]
add byte [eax], al
add byte [edx], al
je 0x405c37
push eax
push dword [ebx + 0x88]
lea eax, [ebx + 0x6c]
push dword [ebx + 0x84]
push dword [ebx + 0x80]
push dword [ebx + 0x7c]
push eax
push esi
push ebx
call 0x4d67da
mov ecx, dword [ebp + 0x28]
jmp 0x449716
cmp dword [ebp + 0x18], 0xffffffff
je 0x4446f3
cmp dword [ebp + 0x1c], 0xffffffff
invalid

Function at 0x444c5b
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pop edi
pop esi
pop ebp
ret
xor edx, edx
inc edx
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
xor eax, eax
inc eax
jmp 0x44ad74
shl byte [eax], 0xfc
inc dword [ebx + 0x1c760cfe]
cmp esi, 0xd
je 0x444c8b
cmp esi, 0x85
je 0x444c80
lea eax, [esi - 0x2028]
cmp eax, 1
ja 0x406d1f
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x444c4f
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp ecx, eax
jae 0x444c47
cmp word [ecx + 2], di
je 0x444c4a
jmp 0x444c47
cmp ecx, edx
jl 0x44a1c6
cmp edi, dword [esi + 0x7c]
jae 0x44a9d7
movzx eax, word [edi]
mov ecx, 0xff
cmp ax, cx
ja case.0x408896.157
mov ecx, eax
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 1
add dword [edi], ecx
test byte [edx], dl
sti
invalid
mov ecx, dword [ebp - 0xc]
add edi, 2
inc edx
mov dword [ebp - 8], edi
cmp edx, ecx
jle 0x44ad7c
jmp 0x49437a
Function at 0x444e2c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 0x1c]
mov dx, word [ebx + eax*2]
mov ecx, dword [esp + 0x24]
call fcn.0044b719
pop ecx
test eax, eax
je 0x444e32
inc esi
mov eax, dword [esp + 0x34]
inc eax
mov dword [esp + 0x34], eax
cmp eax, edi
jl 0x444e1b
xor ebx, ebx
mov dword [esp + 0x14], esi
jmp 0x44b5dc
mov dword [ebp - 0x1c], 1
cmp edi, dword [esi + 0x7c]
jae 0x44b639
cmp dword [ebp - 0x28], 0
movzx edx, word [edi]
mov ecx, edx
je 0x44b5e9
mov eax, edx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x44b5e9
movzx ecx, word [edi + 2]
and edx, 0x3ff
and ecx, 0x3ff
loope 0x44b5d3
add eax, dword [eax]
invalid
shl edx, 0xa
or ecx, edx
mov dword [ebp - 0x1c], 2
add ecx, 0x10000
cmp ecx, 0x24
je 0x44b614
cmp ecx, 0x40
je 0x44b614
cmp ecx, 0x60
je 0x44b614
cmp ecx, 0xa0
jb 0x44b608
cmp ecx, 0xd7ff
jbe 0x44b614
cmp ecx, 0xe000
jae 0x44b614
xor eax, eax
jmp 0x44b619
mov eax, 1
cmp eax, dword [ebp - 0x3c]
je 0x44b65e
mov eax, dword [ebp - 0x1c]
lea edi, [edi + eax*2]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x14]
jl 0x44b59e
jmp 0x44b65e
cmp dword [esi + 0x8c], 0
je 0x44b65e
cmp edi, dword [esi + 0x88]
jbe 0x44b65e
mov dword [esi + 0x68], 1
cmp dword [esi + 0x8c], 1
jg 0x44e351

Function at 0x445528
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esp, 4
mov dword [eax], 1
mov dword [edi + 0xc], eax
or al, 0x8b
inc edi
add al, 0x40
add eax, ebx
jne 0x445543
mov eax, 8
jmp 0x445549
add eax, 7
and eax, 0xfffffff8
xor ecx, ecx
mov dword [edi + 8], eax
mov edx, 2
add bh, dh
loop 0x445565
nop
sal edi, 0xd9
or ecx, eax
push ecx
call fcn.00464769
mov esi, eax
add esp, 4
mov eax, dword [edi + 4]

Function at 0x44556a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add bh, dh
loop 0x445565
nop
sal edi, 0xd9
les eax, [ebx + ecx*4]
inc edi
add al, 0x8d
lea eax, [eax*2 + 2]
Function at 0x445e69
Capabilities:
Delete registry key
Delete registry value
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [ebp - 8]
mov edx, ecx
and edx, 0x7f
test esi, esi
je fcn.004084d5
cmp word [ebp - 0x14], 0x7f
jbe fcn.004084d5
jge 0x445e57
jg 0x445e7c
xchg byte [ebx + 0x26], ah
cld
dec dword [ebx - 0x163e1383]
pop es
mov edi, dword [ebp - 0x14]
shr ecx, 7
movzx eax, byte [ecx + 0x4bff40]
dec dword [ebx]
shl eax, 7
add eax, edx
movzx eax, word [eax*2 + 0x4b1c40]
invalid
invalid

Function at 0x445fd5
Capabilities:
Delete registry key
Delete registry value
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add byte [ecx], bh
jne 0x445fe9
jae 0x408500
clc
mov eax, dword [ebp - 4]
jmp 0x44d958
cld
js 0x44605b
invalid
add byte [ecx], bh
push ebp
int3

Function at 0x446260
Capabilities:
Encrypt data using speck

Disassembly:
add byte [ebx - 0x7c3dd439], cl
loopne 0x40874e
cmp eax, 0x7d0
jge 0x40856b
cmp dword [ebp - 0x3c], 0
je 0x446257
mov eax, 2
lea ecx, [eax + edx]
cmp ecx, dword [ebp - 0x28]
jbe 0x40856b
cmp ecx, edi
jae case.0x4462b9.996
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp bx, si
mov ebx, dword [ebp - 0x110]
jne 0x44625e
add eax, dword [eax]
xor eax, eax
jmp 0x44ddc4
movzx eax, word [ecx]
mov dword [ebp - 0x28], ecx
mov edx, eax
add ecx, 2
cmp ax, word [ebp - 0x1c]
je fcn.004087a8
cmp dx, si
je fcn.004087a8
cmp ecx, edi
jb 0x44625e
jmp 0x44de25
and byte [eax], al
add byte [edi], cl
sub ah, 0xb1
sti
inc dword [ecx + 0x200af9]
add byte [edi], cl
xchg byte [ebx], al
mov cl, 0xfb
inc dword [ecx + 0x202ff9]
add byte [edi], cl
test esp, edx
mov cl, 0xfb
invalid
add byte [edi], cl
xor byte [eax - 0x7e000450], 0xf9
sub dword [eax], esp
add byte [eax], al
jbe case.0x408896.157
jmp 0x456115
push ds

Function at 0x4463aa
Capabilities:
Query or enumerate registry key

Disassembly:
mov edx, dword [ebp - 0xec]
lea ecx, [edx + edx]
sub eax, ecx
mov ecx, dword [ebp + 0x10]
Function at 0x4463b8
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, dword [ebp - 4]
cmp dword [ebp - 0x48], 0
jne 0x446410
test esi, esi
jne 0x446423
mov ebx, dword [ebp - 0x118]
test ebx, ebx
jne 0x446433
or eax, 0xffffffff
mov edx, dword [ebp - 0x20]
loopne 0x408766
ror byte [edi], cl
test byte [ecx - 2], ch
invalid
invalid
test byte [edx], 0x20
je fcn.00408651
jmp 0x446467
cmp ecx, eax
ja 0x4463e2
mov ax, word [ecx]
cmp ax, word [ebp - 0xd4]
cmp eax, dword [ebp - 0xd4]
jne 0x4463e2
cmp edx, 1
je 0x4087b7
mov ax, word [ecx + 2]
cmp ax, word [ebp - 0xd2]
je 0x4087b7
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp - 4]
jmp 0x48bb49
push dword [ebp - 0xfc]
call 0x44e9d2
add esp, 4
cmp esi, 0xfffffff4
je 0x4087cc
mov eax, esi
jmp 0x44de80
mov ecx, dword [ebp + 0x1c]
cmp ecx, 1
jle 0x44645d
mov edx, dword [ebp + 8]
sub edi, edx
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp + 0x18]
sub esi, edx
sar esi, 1
sar edi, 1
mov dword [eax], esi
mov dword [eax + 4], edi
cmp ecx, 2
jle 0x44645d
sub ebx, edx
sar ebx, 1
mov dword [eax + 8], ebx
mov eax, 0xfffffff4
jmp 0x44e040
mov edx, dword [edx + 0x18]
mov ecx, dword [ebp - 0x54]
mov dword [edx], ecx
jmp 0x44dec1
inc esi
inc esp
test byte [ecx + eax], 4
jne case.0x408896.157
jmp 0x456169
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 1
jne case.0x408896.157
jmp 0x4561ab
stosd dword es:[edi], eax
add al, byte [eax]
add bh, al
inc esi
push 1
adc byte [ebp - 0x33740fbb], cl
pushfd
ret
dec esp
and al, 0x20

Function at 0x4466d3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
add bh, al
inc ebp
fadd qword [eax]
add byte [eax], al
add byte [ebx - 0x33ba383d], cl
add byte [eax], al
add byte [eax], al

Function at 0x4466eb
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, ebx
mov dword [ebp - 0x34], 0
sub eax, dword [esi + 0x74]
sar eax, 1
mov dword [ebp - 0x1c], eax
in al, 0x8b
xchg byte [eax + eax + 0x45890000], dl
invalid
inc edx
test dword [ebx], esp
idiv bh
dec dword [edi]
mov bh, 0x53
add al, 0x89
push ebp
loopne 0x44704d
invalid