joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486d20
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
mov ecx, dword [ebx + 0xd14]
mov edx, dword [ecx + 0x144]
xor eax, eax
cmp dword [edx + 0x24], eax
mov dword [esp], eax
jle 0x486e39
push ebp
push esi
mov dword [esp + 0xc], eax
push edi
mov eax, dword [esp + 0xc]
push eax
mov esi, ebx
call fcn.00485e20
mov edx, dword [ebx + 0xd14]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea ebp, [ebx + ecx*4]
mov ecx, dword [edx + 0x144]
mov edx, dword [esp + 0x10]
lea esi, [ecx + edx + 0x28]
mov edx, dword [ebp + 0xd8]
mov edi, eax
call fcn.00489b50
cmp byte [ebp + 0xd0], 0
je 0x486e11
mov eax, dword [ebp + 0xd4]
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x34]
cmp eax, 0x3c
je 0x486de2
cmp eax, 0x3d
je 0x486de2
cmp eax, 0x3e
je 0x486de2
cmp eax, 0x3f
je 0x486de2
cmp eax, 0x40
je 0x486de2
cmp eax, 0x41
je 0x486de2
cmp eax, 0x42
je 0x486de2
cmp eax, 0x43
je 0x486de2
cmp eax, 0x44
je 0x486de2
cmp eax, 0x45
je 0x486de2
cmp eax, 0x46
je 0x486de2
cmp eax, 0x47
je 0x486de2
cmp eax, 0x48
je 0x486de2
cmp eax, 0x49
je 0x486de2
cmp eax, 0x4a
jne 0x486de6
xor eax, eax
jmp 0x486e06
cmp eax, 0x30
jne 0x486dfc
cmp ecx, 0xffffffff
je 0x486dfc
lea ecx, [ecx + ecx*8]
mov eax, dword [ecx*4 + 0x950014]
jmp 0x486e06
lea edx, [eax + eax*8]
mov eax, dword [edx*4 + 0x950014]
mov dword [esi + 0x28], eax
mov byte [esi + 0x49], 1
mov byte [esi + 0x48], 0
mov eax, dword [esp + 0xc]
mov ecx, dword [ebx + 0xd14]
mov edx, dword [ecx + 0x144]
add dword [esp + 0x10], 0x50
add eax, 1
cmp eax, dword [edx + 0x24]
mov dword [esp + 0xc], eax
jl 0x486d44
pop edi
pop esi
pop ebp
mov eax, dword [ebx + 0xd14]
mov eax, dword [eax + 0x15c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x774]
mov byte [edx + 0x55], 0
mov ecx, dword [eax + 0x20]
mov edx, dword [0x6aa230]
lea ecx, [ecx + edx + 0xa]
mov edx, dword [eax]
mov byte [eax + 0x2c], 0
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0x320]
mov edx, dword [ecx]
mov eax, dword [eax + 4]
mov edx, dword [edx + 0x20]
push eax
call edx
add esp, 8
ret
Function at 0x48aad0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, ecx
cmp byte [ebx + 0x1b0], 0
je 0x48aae0
xor al, al
pop ebx
ret
cmp eax, 0x17
push esi
push edi
jne 0x48ab44
mov edi, dword [ebx + 0x150]
cmp byte [edi + 0x8c4], 0
jne 0x48ac12
mov esi, dword [edi + 0x878]
test esi, esi
je 0x48ab0d
call fcn.005d5cb0
test al, al
jne 0x48ab1a
cmp dword [edi + 0x8c0], 1
je 0x48ac12
mov ebx, dword [ebx + 0x150]
mov eax, dword [ebx + 0x82c]
test eax, eax
je 0x48ab34
cmp dword [eax + 0x2c], 0
jg 0x48ac42
cmp dword [eax + 0x24], 0x2a
jge 0x48ac42
pop edi
pop esi
mov al, 1
pop ebx
ret
cmp eax, 2
jne 0x48ab88
mov edi, dword [ebx + 0x150]
call fcn.00455c90
test al, al
jne 0x48ac12
mov ebx, dword [ebx + 0x150]
mov eax, dword [ebx + 0x82c]
test eax, eax
je 0x48ab76
cmp dword [eax + 0x2c], 0
jg 0x48ac42
mov ecx, eax
cmp dword [ecx + 0x24], 0x23
jge 0x48ac42
pop edi
pop esi
mov al, 1
pop ebx
ret
cmp eax, 3
jne 0x48abc8
mov edi, dword [ebx + 0x150]
call fcn.00455c90
test al, al
jne 0x48ac12
mov ebx, dword [ebx + 0x150]
mov eax, dword [ebx + 0x82c]
test eax, eax
je 0x48abb6
cmp dword [eax + 0x2c], 0
jg 0x48ac42
mov edx, eax
cmp dword [edx + 0x24], 0x23
jge 0x48ac42
pop edi
pop esi
mov al, 1
pop ebx
ret
cmp eax, 6
jne 0x48abef
mov ebx, dword [ebx + 0x150]
mov eax, dword [ebx + 0x82c]
test eax, eax
je 0x48abe3
cmp dword [eax + 0x2c], 0
jg 0x48ac42
cmp dword [eax + 0x24], 0x1e
jg 0x48ac42
pop edi
pop esi
mov al, 1
pop ebx
ret
cmp eax, 5
jne 0x48ac18
mov ebx, dword [ebx + 0x150]
mov eax, dword [ebx + 0x82c]
test eax, eax
je 0x48ac0a
cmp dword [eax + 0x2c], 0
jg 0x48ac42
mov ecx, eax
cmp dword [ecx + 0x24], 0x1e
jg 0x48ac42
pop edi
pop esi
mov al, 1
pop ebx
ret
jmp fcn.007bcf55
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x48d4b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x647abb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x40]
push edi
call fcn.005396f0
xor ebx, ebx
mov dword [esp + 0x38], ebx
fldz
mov eax, dword [esp + 0x44]
mov dword [edi + 0x88], vtable.Sexy::ButtonListener.0
fst dword [edi + 0x90]
fld dword [0x679744]
lea ebp, [edi + 0x88]
fstp dword [edi + 0x94]
push 0x12
fld dword [0x67953c]
push str.DisplayPartnerLogo
fstp dword [edi + 0x98]
lea ecx, [esp + 0x1c]
mov dword [edi], 0x66dd90
fst dword [edi + 0x9c]
mov dword [ebp], method.Sexy::ButtonListener.virtual_0
fstp dword [edi + 0xb0]
mov dword [edi + 0xc4], eax
mov dword [edi + 0xa4], ebx
mov byte [edi + 0xac], bl
mov byte [edi + 0xa0], bl
mov byte [edi + 0xad], bl
mov byte [edi + 0xa1], bl
mov byte [edi + 0xae], bl
mov byte [edi + 0xaf], 1
mov dword [edi + 0xa8], ebx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00404330
mov byte [esp + 0x38], 1
mov eax, dword [edi + 0xc4]
push ebx
lea ecx, [esp + 0x18]
call fcn.00552840
mov byte [esp + 0x38], bl
cmp dword [esp + 0x2c], 0x10
mov byte [edi + 0xc0], al
jb 0x48d5b3
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0061c19a
add esp, 4
push 0x208
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xbc], ebx
mov dword [edi + 0xb8], ebx
mov byte [edi + 0xc1], bl
call fcn.0061c130
mov esi, eax
add esp, 4
mov dword [esp + 0x44], esi
cmp esi, ebx
mov byte [esp + 0x38], 2
je 0x48d5f2
mov eax, ebp
call fcn.0053c9e0
mov esi, eax
jmp 0x48d5f4
xor esi, esi
mov edx, 0xb8
push 0x21
lea ecx, [edx + 0x22]
lea eax, [esp + 0x18]
mov dword [edi + 0x8c], esi
call fcn.005643d0
mov edx, dword [eax]
mov dword [esi + 0x120], edx
mov ecx, dword [eax + 4]
mov dword [esi + 0x124], ecx
mov edx, dword [eax + 8]
mov dword [esi + 0x128], edx
mov eax, dword [eax + 0xc]
mov dword [esi + 0x12c], eax
push 0xf
mov edx, 0x5a
mov ecx, 0xfa
lea eax, [esp + 0x18]
call fcn.005643d0
mov ecx, dword [edi + 0x8c]
mov edx, dword [eax]
mov dword [ecx + 0x130], edx
mov edx, dword [eax + 4]
mov dword [ecx + 0x134], edx
mov edx, dword [eax + 8]
add ecx, 0x130
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [edi + 0x8c]
mov dword [ecx + 0x140], ebx
mov edx, dword [edi + 0x8c]
mov ecx, dword [esp + 0x30]
mov byte [edx + 0x56], 1
mov eax, dword [edi + 0x8c]
mov byte [eax + 0x54], bl
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 8
Function at 0x522580
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x6c], eax
mov eax, 0x28
mov dword [edi + 0x1c], esi
call fcn.005af400
jmp 0x7988cc

Function at 0x524a70
Capabilities:
Parse credit card information

Disassembly:
push ecx
push esi
mov esi, eax
mov edx, dword [esi + 0x28]
cmp edx, 0x3b
jne 0x524a8d
fld dword [0x6795cc]
fstp dword [esi + 0x34]
call fcn.0052f050
pop esi
pop ecx
ret
cmp edx, 0x25
jne 0x524abf
mov eax, dword [esi]
call fcn.004537d0
test al, al
je 0x524aae
fld dword [0x679670]
fstp dword [esi + 0x34]
call fcn.0052f050
pop esi
pop ecx
ret
fld dword [0x67966c]
fstp dword [esi + 0x34]
call fcn.0052f050
pop esi
pop ecx
ret
mov ecx, dword [esi + 0x24]
cmp ecx, 0x18
jne 0x524ae3
mov eax, dword [esi]
call fcn.004537d0
test al, al
je 0x524ae3
fld dword [0x679668]
fstp dword [esi + 0x34]
call fcn.0052f050
pop esi
pop ecx
ret
cmp edx, 0x5b
jne 0x524af9
fld dword [0x679664]
fstp dword [esi + 0x34]
call fcn.0052f050
pop esi
pop ecx
ret
cmp ecx, 0x13
jne 0x524b0f
fld dword [0x664a5c]
fstp dword [esi + 0x34]
call fcn.0052f050
pop esi
pop ecx
ret
jmp loc.007bc5cf

Function at 0x525480
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [edi + 0xec], 0
push ebx
push esi
jne 0x525722
mov eax, dword [edi + 0x28]
cmp eax, 1
je 0x525722
cmp eax, 2
je 0x525722
cmp eax, 3
je 0x525722
cmp dword [edi + 0xb4], 0
jg 0x525722
cmp dword [edi + 0xb0], 0
jg 0x525722
cmp eax, 0x14
jl 0x525722
cmp eax, 0x1c
jg 0x525722
cmp dword [edi + 0x64], 8
je 0x525722
jmp 0x79a89c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x525be0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [edi]
sub esp, 8
cmp dword [eax + 0x7f8], 0x2c
push esi
jne 0x525c2f
fld dword [0x67a130]
fcomp dword [edi + 0x2c]
fnstsw ax
test ah, 0x41
jne 0x525c2f
fld dword [edi + 0x84]
fsub qword [0x679a68]
fstp dword [esp + 8]
fld dword [esp + 8]
fst dword [edi + 0x84]
fcomp dword [0x679f64]
fnstsw ax
test ah, 5
jp 0x525c2f
push 0
mov eax, edi
call fcn.00525b60
cmp dword [edi + 0x28], 0x4a
jne 0x525c6a
mov ecx, dword [edi]
mov edx, dword [ecx + 0x820]
mov eax, dword [edi + 0x118]
mov ecx, dword [edx + 8]
and eax, 0xffff
lea edx, [eax + eax*4]
mov eax, dword [ecx]
shl edx, 5
cmp dword [eax + edx + 0x5c], 0
jle 0x525c6a
xor esi, esi
mov eax, edi
mov dword [edi + 0x28], 0x4b
call fcn.0052f2e0
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x525cd1
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x525cad
cmp eax, 0x3e
je 0x525cad
cmp eax, 0x3f
je 0x525cad
cmp eax, 0x40
je 0x525cad
cmp eax, 0x41
je 0x525cad
cmp eax, 0x42
je 0x525cad
cmp eax, 0x43
je 0x525cad
cmp eax, 0x44
je 0x525cad
cmp eax, 0x45
je 0x525cad
cmp eax, 0x46
jne 0x525cd1
cmp dword [edi + 0x28], 0x49
jne 0x525cd1
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 0x160]
push edx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x525cd1
push 0
mov eax, edi
call fcn.00525b60
pop esi
add esp, 8
ret
Function at 0x528050
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x28]
cmp eax, 0x13
push edi
jne 0x5280d0
cmp dword [esi + 0x68], 0
jne 0x52822d
mov ecx, esi
mov dword [esi + 0x28], 0
call fcn.005346a0
test eax, eax
jne 0x52822d
lea edi, [esi + 0xf4]
lea ebx, [eax + 3]
lea esp, [esp]
mov eax, dword [edi]
mov ecx, dword [esi + 4]
and eax, 0xffff
imul eax, eax, 0x20c
add eax, dword [ecx + 0x90]
mov dword [eax + 0xf0], 0
mov dword [edi], 0
call fcn.00524a70
add edi, 4
sub ebx, 1
jne 0x528090
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
jmp fcn.00524a70
cmp eax, 0x11
jne 0x528105
cmp dword [esi + 0x68], 0
jne 0x5281d5
fld dword [0x679508]
push ecx
fstp dword [esp]
push 0
push 3
push str.anim_jump
mov edi, esi
mov dword [esi + 0x28], 0x12
call fcn.00528b00
jmp 0x5281d5
cmp eax, 0x12
jne 0x52822d
mov edx, dword [esi]
mov eax, dword [edx + 0x820]
mov ecx, dword [eax + 8]
mov eax, dword [esi + 0x118]
and eax, 0xffff
lea edx, [eax + eax*4]
mov eax, dword [ecx]
shl edx, 5
fld dword [eax + edx + 4]
fld qword [0x679368]
fmul st(1), st(0)
fxch st(1)
call fcn.006397d0
mov edi, eax
mov ecx, esi
mov dword [esp + 0x10], edi
call fcn.005346a0
cmp eax, 1
je 0x528183
cmp eax, 3
je 0x528183
fstp st(0)
push 1
fld dword [0x6795c4]
sub esp, 8
fstp dword [esp + 4]
mov eax, edi
fld dword [0x679a04]
mov ecx, 0x32
xor edx, edx
fstp dword [esp]
call fcn.00511bf0
add esp, 0xc
jmp 0x5281cf
fidivr dword [esp + 0x10]
fstp dword [esp + 0x10]
fldz
fld dword [esp + 0x10]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jp 0x5281a6
fstp st(0)
fld dword [0x6796f4]
jmp 0x5281c7
fld1
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x5281bb
fstp st(0)
fld dword [0x6795c4]
jmp 0x5281c7
fmul qword [0x679358]
fadd qword [0x679290]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
fstp dword [esi + 0x84]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 4]
mov eax, dword [edx + ecx*4 + 0x624]
cmp eax, 0x1f4
lea ecx, [edx + ecx*4 + 0x624]
jge 0x5281f5
mov eax, 0x1f4
mov dword [ecx], eax
fld dword [esi + 0x2c]
mov eax, dword [esi + 0x1c]
fadd qword [0x679358]
mov ecx, dword [esi + 4]
fild dword [ecx + eax*4 + 0x60c]
fcompp
fnstsw ax
test ah, 0x41
jne 0x52822d
mov ecx, esi
call fcn.005346a0
test eax, eax
jne 0x52822d
push 6
mov eax, 8
call fcn.005317c0
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x528ca0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x51], 0
jne 0x528ebb
mov eax, dword [edi + 0x114]
test eax, eax
jle 0x528d14
add eax, 0xffffffff
mov dword [edi + 0x114], eax
jne 0x528d14
mov eax, edi
call fcn.0052df90
cmp eax, 0xc
jne 0x528d0a
cmp byte [edi + 0xba], 0
je 0x528d0a
fld dword [0x679b54]
fcomp dword [edi + 0x2c]
fnstsw ax
test ah, 0x41
jne 0x528d0a
fld dword [0x679638]
push ecx
fstp dword [esp]
push 0x14
push 3
push str.anim_point
mov dword [edi + 0x28], 0x2a
call fcn.00528b00
jmp 0x528d14
mov dword [edi + 0x114], 1
mov ecx, dword [edi + 0x28]
cmp ecx, 0x28
jne 0x528d5c
cmp byte [edi + 0xba], 0
je 0x528ebb
cmp dword [edi + 0x68], 0
jne 0x528ebb
fld dword [0x679638]
push ecx
fstp dword [esp]
push 0x14
push 3
push str.anim_point
mov dword [edi + 0x28], 0x29
call fcn.00528b00
mov eax, edi
pop edi
pop esi
pop ebx
jmp fcn.00524a70
cmp ecx, 0x29
je 0x528e63
cmp ecx, 0x2a
je 0x528e63
cmp ecx, 0x2b
mov esi, 0x2c
jne 0x528d99
cmp dword [edi + 0x68], 0
jne 0x528ebb
fldz
push ecx
fstp dword [esp]
mov dword [edi + 0x28], esi
push 0x14
push 0
push str.anim_walk
call fcn.00528b00
mov eax, edi
call fcn.0052dfe0
cmp eax, dword [edi + 0x28]
je 0x528e3a
cmp eax, esi
jne 0x528dc1
fldz
push ecx
fstp dword [esp]
mov dword [edi + 0x28], esi
push 0xa
push 0
push str.anim_walk
jmp 0x528e35
cmp eax, 0x2d
jne 0x528e0b
jmp 0x7bc371
cmp eax, 0x2e
je 0x528e1f
cmp eax, 0x2f
je 0x528e1f
cmp eax, 0x30
je 0x528e1f
cmp eax, 0x31
jne 0x528e3a
jmp 0x7bc4b5
call fcn.00528b00
cmp byte [edi + 0xba], 0
je 0x528ebb
cmp dword [edi + 0x114], 0
jne 0x528ebb
call fcn.00528a50
test al, al
je 0x528ebb
mov dword [edi + 0x114], 0x64
pop edi
pop esi
pop ebx
ret
mov edx, dword [edi]
mov eax, dword [edx + 0x820]
mov edx, dword [eax + 8]
mov eax, dword [edi + 0x118]
mov edx, dword [edx]
and eax, 0xffff
lea eax, [eax + eax*4]
shl eax, 5
cmp dword [edx + eax + 0x5c], 0
jle 0x528ebb
cmp ecx, 0x29
jne 0x528ea6
mov ebx, dword [edi + 4]
call fcn.00408b60
cmp eax, 0xf
jg 0x528ea6
jmp 0x7bc89c
mov esi, edi
call fcn.00528970
mov dword [edi + 0x28], 0x2b
mov dword [edi + 0x68], 0xa
pop edi
pop esi
pop ebx
ret

Function at 0x529ef0
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x24
push ebp
push esi
mov esi, dword [ebx + 0x24]
cmp esi, 0xc
push edi
je 0x52a45e
jmp loc.007bc1f4
pop edi
pop esi
pop ebp
add esp, 0x24
ret 4

Function at 0x52a8e0
Capabilities:
Parse credit card information

Disassembly:
cmp byte [eax + 0xb8], 0
jne 0x52a928
cmp byte [eax + 0xba], 0
je 0x52a928
cmp byte [eax + 0xec], 0
jne 0x52a928
mov ecx, dword [eax + 0x28]
cmp ecx, 1
je 0x52a928
cmp ecx, 2
je 0x52a928
cmp ecx, 3
je 0x52a928
test ecx, ecx
jne 0x52a928
cmp dword [eax + 0x68], ecx
jne 0x52a928
mov dword [eax + 0x28], 0x5b
mov byte [eax + 0xbc], cl
jmp fcn.00524a70
ret

Function at 0x52ad30
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 8
push esi
mov esi, eax
mov eax, dword [esi + 0x24]
cmp eax, 0x14
je 0x52ae37
cmp eax, 0x19
je 0x52ae37
cmp dword [esi + 0x28], 0xe
je 0x52ae37
cmp dword [esi + 0x64], 0xa
je 0x52ae37
call fcn.0052aa40
jmp 0x79bf35
pop esi
add esp, 8
ret
Function at 0x52ae60
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
jmp 0x79b19d

Function at 0x52b110
Capabilities:
Check http status code

Disassembly:
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x64], 6
push edi
jne 0x52b120
call fcn.0052b010
cmp dword [esi + 0x64], 0xa
jne 0x52b12d
mov eax, esi
call fcn.005291e0
mov eax, dword [esi + 0x64]
cmp eax, 2
je 0x52b143
cmp eax, 1
je 0x52b143
cmp byte [esi + 0xbd], 0
je 0x52b14a
mov edi, esi
call fcn.005295f0
mov eax, dword [esi + 0x64]
cmp eax, 4
je 0x52b157
cmp eax, 5
jne 0x52b15e
mov ecx, esi
call fcn.005296e0
cmp dword [esi + 0x64], 7
jne 0x52b169
call fcn.00529770
cmp dword [esi + 0x64], 8
jne 0x52b174
call fcn.00534730
jmp 0x7b89ee
Function at 0x52e4c0
Capabilities:
Check http status code

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp]
cmp dword [eax + 0x768], 0
push esi
push edi
je 0x52e4fc
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x11
je 0x52e4f5
cmp ecx, 0x21
je 0x52e4f5
test ecx, ecx
jne 0x52e4fc
mov eax, dword [eax + 0x82c]
cmp dword [eax + 0x24], 5
jne 0x52e4fc
cmp dword [esp + 0x2c], 2
jne 0x52e578
mov esi, dword [esp + 0x28]
mov edx, dword [esi + 0x24]
cmp edx, 0x11
jne 0x52e51a
mov eax, dword [esi + 0x3c]
cmp eax, 5
je 0x52e578
cmp eax, 6
je 0x52e578
cmp eax, 7
je 0x52e578
cmp byte [esi + 0x142], 0
jne 0x52e578
cmp dword [esi + 0x134], 2
je 0x52e578
cmp byte [esi + 0x141], 0
jne 0x52e578
cmp edx, 0x13
jo 0x52e578
cmp byte [ebp + 0xbd], 0
jne 0x52e561
mov eax, dword [esi + 0x28]
test eax, eax
mov ecx, dword [esi + 0x1c]
jl 0x52e561
test ecx, ecx
jl 0x52e561
lea eax, [eax + eax*2 + 0x2d]
lea ecx, [ecx + eax*2]
mov eax, dword [ebp + 4]
cmp dword [eax + ecx*4], 3
je 0x52e578
mov eax, dword [ebp + 0x28]
cmp eax, 0x20
jne 0x52e584
cmp edx, 4
jne 0x52e578
cmp dword [esi + 0x3c], 0
je 0x52e770
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
jmp 0x7b4ef0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret 8

Function at 0x52edb0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [esp + 0x10]
call fcn.00532140
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], 0
jmp 0x52ede0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
lea esi, [esp + 0xc]
call fcn.0041c950
test al, al
je 0x52ee7c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov esi, dword [esp + 0xc]
cmp edx, dword [esi + 0x1c]
jne 0x52ede0
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.00467ef0
mov ecx, dword [esp + 0x10]
cmp edi, ecx
jge 0x52ee24
mov edx, dword [esp + 0x18]
lea eax, [ebx + edi]
add edx, ecx
jmp 0x52ee2f
mov eax, dword [esp + 0x18]
add eax, ecx
mov ecx, edi
lea edx, [ebx + edi]
cmp eax, ecx
jg 0x52ee37
sub eax, ecx
jmp 0x52ee43
cmp eax, edx
jg 0x52ee3f
sub eax, ecx
jmp 0x52ee43
sub edx, ecx
mov eax, edx
cmp eax, 0x14
jl 0x52ede0
mov ecx, dword [ebp + 8]
push 1
push esi
call fcn.0052e4c0
test al, al
je 0x52ede0
mov eax, dword [esi + 0x24]
cmp eax, 0x15
je 0x52ede0
cmp eax, 0x2e
je 0x52ede0
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x28]
mov edi, dword [ebp + 8]
push 1
push ecx
push edx
call fcn.0052e920
jmp 0x52ee7f
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x52eee6
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x52eec2
cmp eax, 0x3e
je 0x52eec2
cmp eax, 0x3f
je 0x52eec2
cmp eax, 0x40
je 0x52eec2
cmp eax, 0x41
je 0x52eec2
cmp eax, 0x42
je 0x52eec2
cmp eax, 0x43
je 0x52eec2
cmp eax, 0x44
je 0x52eec2
cmp eax, 0x45
je 0x52eec2
cmp eax, 0x46
jne 0x52eee6
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x160]
push ecx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x52eee6
mov edx, dword [edi + 4]
mov ecx, dword [edx + 0x160]
push ecx
call fcn.0042ba30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x530bc0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, eax
mov eax, ecx
and eax, 8
push edi
jne 0x530be1
cmp dword [esi + 0x54], eax
mov dword [esi + 0x58], 0x19
jge 0x530be1
mov dword [esi + 0x54], eax
test eax, eax
jne 0x530c55
test cl, 2
jne 0x530c55
mov eax, dword [esi + 0xd8]
cmp eax, 1
mov dword [esi + 0x5c], 0xc
je 0x530c01
cmp eax, 3
jne 0x530c55
mov eax, dword [esi]
cmp byte [eax + 0x8c5], 0
jne 0x530c55
fldz
mov ecx, dword [0x6a9f00]
mov edi, dword [eax + 0x784]
fst dword [esp + 0x10]
fcomp dword [ecx + 0x95c]
fnstsw ax
test ah, 0x44
jnp 0x530c41
fld dword [ecx + 0x95c]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0x14]
add esp, 4
fld dword [esp + 0x10]
push ecx
mov eax, 0x2e
fstp dword [esp]
mov ecx, edi
call fcn.00515020
mov ebp, dword [esi + 0xe0]
mov edi, dword [esi + 0xdc]
mov eax, 0x55555556
imul ebp
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jge 0x530c7a
mov ebx, 2
jmp 0x530c93
lea edx, [ebp + ebp]
mov eax, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add eax, edx
xor ebx, ebx
cmp edi, eax
setl bl
mov edx, dword [esp + 0x18]
cmp edi, edx
mov eax, edi
jl 0x530c9f
mov eax, edx
sub edx, eax
sub dword [esi + 0xdc], eax
mov edi, dword [esi + 0xdc]
mov dword [esp + 0x18], edx
jne 0x530cca
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call fcn.00530a00
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, ecx
jge 0x530cd5
mov ebp, 2
jmp 0x530cee
add ebp, ebp
mov eax, 0x55555556
imul ebp
mov eax, edx
shr eax, 0x1f
xor ecx, ecx
add eax, edx
cmp edi, eax
setl cl
mov ebp, ecx
cmp ebx, ebp
je 0x530e17
mov edx, dword [esi]
mov ecx, dword [esi + 0x118]
test ecx, ecx
mov eax, dword [edx + 0x820]
mov edx, dword [eax + 8]
jne 0x530d0f
xor edi, edi
jmp 0x530d35
movzx eax, cx
jmp 0x7994bf
jmp 0x7b1c65
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x530e30
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x24
push ebx
push esi
mov ebx, eax
push edi
mov edi, dword [ebx + 0xc4]
test edi, edi
je 0x530fce
lea esi, [esp + 0x14]
mov ecx, ebx
call fcn.0052d9e0
fld dword [ebx + 0x2c]
fadd dword [esp + 0x24]
or esi, 0xffffffff
jmp loc.007b17cb
Function at 0x53fd20
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x59], 0
je 0x53fd49
mov eax, dword [esi + 0x10]
cmp byte [eax + 0x84], 0
je 0x53fd49
mov ecx, dword [esi + 0x104]
mov edx, dword [ecx]
jmp 0x79826b
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
mov ecx, esi
call edx
pop esi
ret 0x10

Function at 0x543900
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x699fe8]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x6a9f30], 0
jne 0x54397d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0061d4e6
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x6a9f30], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x6a9f34], eax
mov eax, dword [eax]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0061efd1
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
mov edx, dword [0x6a9f34]
mov eax, dword [edx]
xor ecx, esp
call fcn.0061efd1
add esp, 0x104
ret

Function at 0x543aa0
Capabilities:
Read file on windows

Disassembly:
call fcn.00543900
test eax, eax
je 0x543abd
mov eax, dword [0x6a9f34]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
push esi
push edi
push 1
push ebx
call eax
ret
mov ecx, dword [esi + 8]
push ecx
push edi
push 1
push ebx
call fcn.0061d24e
add esp, 0x10
ret