joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405750
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push ebx
push esi
mov esi, dword [edx + 4]
mov edx, eax
shr edx, 4
xor edx, esi
and edx, 0xf0f0f0f
xor esi, edx
shl edx, 4
xor eax, edx
mov edx, eax
shr edx, 0x10
xor edx, esi
and edx, 0xffff
xor esi, edx
shl edx, 0x10
xor eax, edx
mov edx, esi
shr edx, 2
xor edx, eax
and edx, 0x33333333
xor eax, edx
add edx, edx
add edx, edx
xor esi, edx
mov edx, esi
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor eax, edx
shl edx, 8
xor esi, edx
rol esi, 1
mov edx, esi
xor edx, eax
and edx, 0xaaaaaaaa
xor esi, edx
xor edx, eax
rol edx, 1
push edi
mov ecx, 0x59bc00
mov dword [ebp - 4], edx
mov dword [ebp - 8], 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx]
add ecx, 0x10
mov edx, eax
shr edx, 0x18
mov edi, eax
shr edi, 0x10
and edi, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x554540]
or edx, dword [edi*4 + 0x554740]
mov edi, eax
shr edi, 8
and edi, 0x3f
or edx, dword [edi*4 + 0x554940]
and eax, 0x3f
or edx, dword [eax*4 + 0x554b40]
mov eax, dword [ecx - 0xc]
xor eax, esi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x554640]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x554840]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x554a40]
and eax, 0x3f
or edi, dword [eax*4 + 0x554c40]
or edi, edx
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 4]
xor edi, dword [ebp - 0xc]
mov eax, edi
ror eax, 4
xor eax, dword [ecx - 8]
mov dword [ebp - 4], edi
mov edx, eax
shr edx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x554540]
or edx, dword [ebx*4 + 0x554740]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edx, dword [ebx*4 + 0x554940]
and eax, 0x3f
or edx, dword [eax*4 + 0x554b40]
mov eax, dword [ecx - 4]
xor eax, edi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x554640]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x554840]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x554a40]
and eax, 0x3f
or edi, dword [eax*4 + 0x554c40]
or edi, edx
xor esi, edi
dec dword [ebp - 8]
jne 0x4057d3
mov ecx, dword [ebp - 4]
ror esi, 1
mov eax, esi
xor eax, ecx
and eax, 0xaaaaaaaa
xor esi, eax
xor eax, ecx
ror eax, 1
mov ecx, eax
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
shl ecx, 8
xor eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
add ecx, ecx
add ecx, ecx
xor eax, ecx
mov edx, dword [ebp + 8]
mov ecx, esi
shr ecx, 0x10
xor ecx, eax
and ecx, 0xffff
xor eax, ecx
shl ecx, 0x10
xor esi, ecx
mov ecx, esi
shr ecx, 4
xor ecx, eax
and ecx, 0xf0f0f0f
mov edi, ecx
shl edi, 4
xor edi, esi
mov dword [edx], edi
pop edi
xor ecx, eax
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push 1
mov ecx, ebx
call fcn.00405080
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
add esp, 4
test eax, eax
jle 0x41e19f
lea ebx, [eax - 1]
shr ebx, 3
lea esi, [eax + edi]
inc ebx
mov eax, esi
call fcn.00405630
movzx eax, byte [esi - 8]
movzx ecx, byte [esi - 7]
xor byte [esi], al
xor byte [esi + 1], cl
movzx edx, byte [esi - 6]
movzx eax, byte [esi - 5]
movzx ecx, byte [esi - 4]
xor byte [esi + 2], dl
xor byte [esi + 3], al
xor byte [esi + 4], cl
movzx edx, byte [esi - 3]
movzx eax, byte [esi - 2]
movzx ecx, byte [esi - 1]
xor byte [esi + 5], dl
xor byte [esi + 6], al
xor byte [esi + 7], cl
add esi, 0xfffffff8
dec ebx
jne 0x41e158
mov ebx, dword [ebp + 0xc]
mov esi, edi
mov eax, edi
call fcn.00405630
movzx edx, byte [ebx]
xor byte [edi], dl
movzx eax, byte [ebx + 1]
xor byte [edi + 1], al
movzx ecx, byte [ebx + 2]
xor byte [edi + 2], cl
movzx edx, byte [ebx + 3]
xor byte [edi + 3], dl
movzx eax, byte [ebx + 4]
xor byte [edi + 4], al
movzx ecx, byte [ebx + 5]
xor byte [edi + 5], cl
movzx edx, byte [ebx + 6]
xor byte [edi + 6], dl
movzx eax, byte [ebx + 7]
xor byte [edi + 7], al
pop esi
pop ebx
pop ebp
ret
Function at 0x440800
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5523d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x20], eax
push 0x544240
mov eax, 9
mov ecx, 0x59c290
call fcn.00403f50
add esp, 4
cmp byte [esi + 0x13], 0
jne 0x440847
mov eax, esi
call fcn.004409d0
test eax, eax
je 0x440986
cmp byte [esi + 0x23], 0
jne 0x440986
cmp byte [esi + 0x13], 0
mov eax, 9
mov ecx, 0x59c290
je 0x440925
push 0x544270
call fcn.00403f50
mov cl, byte [esi + 0x30]
mov eax, dword [esi + 0xc]
mov ebx, 1
shl ebx, cl
lea edi, [esi + 0xc]
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
test eax, eax
je 0x440895
push eax
call fcn.00495660
add esp, 4
lea ecx, [ebx*4]
push ecx
call fcn.0049574c
add esp, 4
mov dword [edi], eax
test eax, eax
je 0x44096b
xor edi, edi
test ebx, ebx
jle 0x44096b
lea ebx, [eax + 1]
lea esp, [esp]
movzx ecx, byte [esi + 0x3c]
movzx edx, word [esi + 0x38]
mov eax, edi
sar eax, cl
movzx ecx, word [esi + 0x38]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
add ebx, 4
mov byte [ebx - 5], al
movzx ecx, byte [esi + 0x3a]
movzx edx, word [esi + 0x34]
mov eax, edi
sar eax, cl
movzx ecx, word [esi + 0x34]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
mov byte [ebx - 3], al
movzx ecx, byte [esi + 0x3b]
movzx edx, word [esi + 0x36]
mov eax, edi
sar eax, cl
movzx ecx, word [esi + 0x36]
and eax, edx
imul eax, eax, 0xff
cdq
idiv ecx
inc edi
mov byte [ebx - 4], al
cmp edi, dword [ebp - 0x1c]
jl 0x4408c0
jmp 0x44096b
push 0x5442a4
call fcn.00403f50
add esp, 4
lea eax, [esi + 0xc]
lea edx, [ebp - 0x14]
push edx
add esi, 0x10
mov ecx, 0xff
push esi
push eax
mov dword [ebp - 0x14], 0x1001820
mov dword [ebp - 0xe], 0xff00ff
mov word [ebp - 0x10], cx
mov word [ebp - 0xa], 0x810
mov byte [ebp - 8], 0
mov dword [ebp - 0x18], eax
call dword [0x5542c8]
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
test eax, eax
jne 0x44099b
push 0x5442d4
mov ecx, 0x59c290
call fcn.00403f50
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493825
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
lea edx, [ecx*4]
push edx
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.004b1070
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00493825
mov esp, ebp
pop ebp
ret 8
Function at 0x442120
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7088
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5523d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
xor edi, edi
or eax, 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x64], 6
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [ebp - 4], edi
push 0x414
mov dword [esi], 0x5448ec
mov dword [esi + 0x198c], edi
mov dword [esi + 0x1990], edi
call fcn.0049381a
mov dword [esi + 0x1984], eax
add esp, 4
mov dword [esi + 0x1970], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x445ae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8018
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5523d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x64], 6
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [ebp - 4], ebx
push 0x20001
mov dword [esi], 0x544a34
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0x9c], 0x20000
call fcn.0049381a
add esp, 4
mov dword [esi + 0x84], eax
cmp eax, ebx
jne 0x445bbc
push 0x544928
lea eax, [ebx + 9]
mov ecx, 0x59c290
call fcn.00403f50
add esp, 4
mov ecx, dword [esi + 0x9c]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + ecx + 8]
push ecx
call fcn.0049381a
add esp, 4
mov dword [esi + 0x88], eax
cmp dword [esi + 0x84], ebx
jne 0x445c05
push 0x544928
mov eax, 9
mov ecx, 0x59c290
call fcn.00403f50
add esp, 4
mov eax, esi
mov byte [esi + 0xb0], bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x446d50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7fe8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x5523d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x64], 6
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [ebp - 4], ebx
push 0x20001
mov dword [esi], 0x544c54
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov byte [esi + 0xd4], bl
mov dword [esi + 0xe4], 0x20000
call fcn.0049381a
add esp, 4
mov dword [esi + 0x88], eax
cmp eax, ebx
jne 0x446e44
push 0x544ab8
lea eax, [ebx + 9]
mov ecx, 0x59c290
call fcn.00403f50
add esp, 4
mov ecx, dword [esi + 0xe4]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + ecx + 8]
push ecx
call fcn.0049381a
add esp, 4
mov dword [esi + 0x8c], eax
cmp dword [esi + 0x88], ebx
jne 0x446e8d
push 0x544ab8
mov eax, 9
mov ecx, 0x59c290
call fcn.00403f50
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4481d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7fb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5523d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
xor edi, edi
or eax, 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x64], 6
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], 2
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [ebp - 4], edi
push 0x20001
mov dword [esi], 0x544d84
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], 0x20000
mov dword [esi + 0x90], eax
mov dword [esi + 0xc8], eax
call fcn.0049381a
add esp, 4
mov dword [esi + 0xf8], eax
cmp eax, edi
jne 0x4482b2
push 0x544ca0
lea eax, [edi + 9]
mov ecx, 0x59c290
call fcn.00403f50
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4514c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f7f86
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5523d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
xor ebx, ebx
or eax, 0xffffffff
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x64], 6
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], 2
mov dword [edi + 0x74], ebx
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], ebx
mov dword [ebp - 4], ebx
push 0x10
mov dword [edi], 0x544dd4
call fcn.004940e9
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
cmp esi, ebx
je 0x451583
mov byte [ebp - 4], 2
push 0x400
mov dword [esi], 0x53c89c
call fcn.0049381a
add esp, 4
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
add eax, 0x400
mov dword [esi + 8], eax
jmp 0x451585
xor esi, esi
mov byte [ebp - 4], bl
push 0x20
mov dword [edi + 0x88], esi
call fcn.004940e9
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
cmp eax, ebx
je 0x4515af
push 0xffffffffffffffff
push ebx
mov esi, eax
call fcn.00472f90
jmp 0x4515b1
xor eax, eax
mov byte [ebp - 4], bl
push 0x4004
mov dword [edi + 0x84], eax
call fcn.0049381a
mov dword [edi + 0x8c], eax
add esp, 4
mov dword [edi + 0x80], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4746c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea edi, [esi + 4]
push edi
call dword [0x4fb3c0]
cmp dword [esi + 0x1c], 0
je 0x4746ea
xor al, al
mov byte [ebp - 1], al
push 0x54c410
lea eax, [ebp - 1]
push eax
call fcn.004987a2
mov edx, dword [0x59c1ac]
lea ecx, [ebp - 8]
push ecx
push 4
push esi
push 0x4743f0
push edx
push 0
mov dword [ebp - 8], 0
call fcn.00498702
mov ecx, dword [ebp - 8]
add esp, 0x18
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
test eax, eax
jne 0x474732
call dword [0x4fb370]
push 0x54c3dc
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 0xc], eax
call fcn.004987a2
mov ecx, dword [esi + 0x20]
sub ecx, 0
je 0x47475e
dec ecx
je 0x47475a
dec ecx
je 0x474753
xor al, al
mov byte [ebp - 1], al
push 0x54c410
lea eax, [ebp - 1]
push eax
call fcn.004987a2
mov ecx, 2
jmp 0x474763
xor ecx, ecx
jmp 0x474763
mov ecx, 0xfffffffe
push ecx
push eax
call dword [0x4fb308]
test eax, eax
jne 0x474786
call dword [0x4fb370]
push 0x54c3dc
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0xc], eax
call fcn.004987a2
mov edx, dword [esi + 0x44]
push edx
call dword [0x4fb1b8]
cmp eax, 0xffffffff
jne 0x4747ac
call dword [0x4fb370]
mov dword [ebp - 0xc], eax
push 0x54c3dc
lea eax, [ebp - 0xc]
push eax
call fcn.004987a2
push edi
mov dword [esi + 0x1c], 1
call dword [0x4fb3c4]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4782a0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [0x5ce480], edi
call fcn.004b0f5c
push eax
push edi
call fcn.004ee79a
add eax, edi
mov dword [ebp - 4], eax
mov eax, dword [0x5ce480]
movzx esi, byte [eax]
add esp, 8
test esi, esi
je 0x47843d
cmp esi, 0x20
je 0x478400
cmp esi, 0x3a
je 0x478400
cmp esi, 0x22
je 0x478400
cmp esi, 0x2a
je 0x478400
cmp esi, 0x2b
je 0x478400
cmp esi, 0x2c
je 0x478400
cmp esi, 0x3b
je 0x478400
cmp esi, 0x3c
je 0x478400
cmp esi, 0x3d
je 0x478400
cmp esi, 0x3e
je 0x478400
cmp esi, 0x3f
je 0x478400
cmp esi, 0x5b
je 0x478400
cmp esi, 0x5d
je 0x478400
cmp esi, 0x7c
je 0x478400
cmp esi, 0x2f
jne 0x478380
mov dword [0x5ce480], edi
call fcn.004b0f5c
push eax
push edi
call fcn.004ee79a
mov ecx, dword [0x5ce480]
add esp, 8
add edi, eax
mov byte [ecx], 0x2f
xor ebx, ebx
jmp 0x478400
cmp esi, 0x2e
jne 0x4783ba
test ebx, ebx
je 0x478400
cmp ebx, 9
jge 0x4783b3
mov dword [0x5ce480], edi
call fcn.004b0f5c
push eax
push edi
call fcn.004ee79a
mov edx, dword [0x5ce480]
add esp, 8
add edi, eax
mov byte [edx], 0x2e
lea ebx, [esi - 0x25]
jmp 0x478400
mov ebx, 0xc
jmp 0x478400
cmp ebx, 0xc
jge 0x478400
cmp ebx, 8
je 0x478400
call fcn.004b0f5c
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.004ee79a
add ebx, eax
mov dword [0x5ce480], edi
call fcn.004b0f5c
push eax
push edi
call fcn.004ee79a
mov edx, dword [0x5ce480]
add esp, 0x10
add edi, eax
and esi, 0xff
mov cl, byte [esi + 0x5ce4a0]
mov byte [edx], cl
mov eax, dword [ebp - 4]
mov dword [0x5ce480], eax
call fcn.004b0f5c
mov esi, dword [ebp - 4]
push eax
push esi
call fcn.004ee79a
mov ecx, dword [0x5ce480]
add esi, eax
mov dword [ebp - 4], esi
movzx esi, byte [ecx]
add esp, 8
test esi, esi
jne 0x4782d6
mov eax, dword [ebp + 8]
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], bl
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x479100
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x4000
call fcn.0049574c
mov edi, eax
add esp, 4
test edi, edi
jne 0x47911d
lea eax, [edi + 4]
pop edi
pop ebp
ret
push ebx
xor ebx, ebx
push esi
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
je 0x479136
cmp ebx, eax
jae 0x47918c
sub eax, ebx
cmp eax, 0x4000
jb 0x47913b
mov eax, 0x4000
mov ecx, dword [ebp + 8]
push ecx
push eax
push 1
push edi
call fcn.004eea28
mov esi, eax
add esp, 0x10
test esi, esi
je 0x479169
mov edx, dword [ebp + 0xc]
push edx
push esi
push 1
push edi
call fcn.004eeb9c
add esp, 0x10
cmp eax, esi
jne 0x47919c
add ebx, esi
jmp 0x479121
mov eax, dword [ebp + 8]
push eax
call fcn.004edea3
add esp, 4
test eax, eax
je 0x47918c
push edi
call fcn.00495660
add esp, 4
pop esi
pop ebx
mov eax, 0xb
pop edi
pop ebp
ret
push edi
call fcn.00495660
add esp, 4
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
ret
push edi
call fcn.00495660
add esp, 4
push 0x549494
call fcn.0049719b
add eax, 0x40
push eax
call fcn.00497350
add esp, 8
pop esi
pop ebx
mov eax, 0xa
pop edi
pop ebp
ret
Function at 0x47acf0
Capabilities:
Write file on windows

Disassembly:
push edi
push 0x50
call fcn.004eef1a
push edi
push 0x4b
call fcn.004eef1a
push edi
push 3
call fcn.004eef1a
push edi
push 4
call fcn.004eef1a
movsx eax, byte [esi + 2]
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 3]
push edi
push ecx
call fcn.004eef1a
movsx edx, byte [esi + 0x2c]
push edi
push edx
call fcn.004eef1a
movsx eax, byte [esi + 0x2d]
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 6]
add esp, 0x40
push edi
push ecx
call fcn.004eef1a
movsx edx, byte [esi + 7]
push edi
push edx
call fcn.004eef1a
movsx eax, byte [esi + 8]
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 9]
push edi
push ecx
call fcn.004eef1a
movsx edx, byte [esi + 0xa]
push edi
push edx
call fcn.004eef1a
movsx eax, byte [esi + 0xb]
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 0xc]
push edi
push ecx
call fcn.004eef1a
movsx edx, byte [esi + 0xd]
push edi
push edx
call fcn.004eef1a
movsx eax, byte [esi + 0xe]
add esp, 0x40
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 0xf]
push edi
push ecx
call fcn.004eef1a
movsx edx, byte [esi + 0x10]
push edi
push edx
call fcn.004eef1a
movsx eax, byte [esi + 0x11]
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 0x12]
push edi
push ecx
call fcn.004eef1a
movsx edx, byte [esi + 0x13]
push edi
push edx
call fcn.004eef1a
movsx eax, byte [esi + 0x14]
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 0x15]
push edi
push ecx
call fcn.004eef1a
movsx edx, byte [esi + 0x16]
add esp, 0x40
push edi
push edx
call fcn.004eef1a
movsx eax, byte [esi + 0x17]
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 0x18]
push edi
push ecx
call fcn.004eef1a
mov edx, dword [esi + 0x18]
shr edx, 8
movsx eax, dl
push edi
push eax
call fcn.004eef1a
movsx ecx, byte [esi + 0x1c]
push edi
push ecx
call fcn.004eef1a
mov edx, dword [esi + 0x1c]
shr edx, 8
movsx eax, dl
push edi
push eax
call fcn.004eef1a
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x48]
push edi
push ecx
push 1
push edx
call fcn.004eeb9c
add esp, 0x40
cmp eax, dword [esi + 0x18]
jne 0x47ae78
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x47ae75
push edi
push eax
mov eax, dword [esi + 0x3c]
push 1
push eax
call fcn.004eeb9c
add esp, 0x10
cmp eax, dword [esi + 0x1c]
jne 0x47ae78
xor eax, eax
ret
mov eax, 0xa
ret
Function at 0x47b1a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [0x5cea18]
push ebx
push edi
mov ebx, eax
mov eax, dword [0x59c214]
push esi
push 0x50
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
call fcn.004eef1a
push esi
push 0x4b
call fcn.004eef1a
push esi
push 5
call fcn.004eef1a
push esi
push 6
call fcn.004eef1a
push esi
push 0
call fcn.004eef1a
push esi
push 0
call fcn.004eef1a
push esi
push 0
call fcn.004eef1a
push esi
push 0
call fcn.004eef1a
movsx edi, byte [ebp + 8]
add esp, 0x40
push esi
push edi
call fcn.004eef1a
mov eax, dword [ebp + 8]
shr eax, 8
movsx eax, al
push esi
push eax
mov dword [ebp + 8], eax
call fcn.004eef1a
push esi
push edi
call fcn.004eef1a
mov edx, dword [ebp + 8]
push esi
push edx
call fcn.004eef1a
movsx eax, byte [ebp + 0xc]
push esi
push eax
call fcn.004eef1a
mov ecx, dword [ebp + 0xc]
shr ecx, 8
movsx edx, cl
push esi
push edx
call fcn.004eef1a
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movsx ecx, al
push esi
push ecx
call fcn.004eef1a
mov eax, dword [ebp + 0xc]
shr eax, 0x18
movsx edx, al
push esi
push edx
call fcn.004eef1a
add esp, 0x40
movsx eax, bl
push esi
push eax
call fcn.004eef1a
mov ecx, ebx
shr ecx, 8
push esi
movsx edx, cl
push edx
call fcn.004eef1a
mov eax, ebx
shr eax, 0x10
movsx ecx, al
push esi
push ecx
call fcn.004eef1a
shr ebx, 0x18
movsx edx, bl
push esi
push edx
call fcn.004eef1a
mov ebx, dword [ebp - 4]
movsx eax, bl
push esi
push eax
call fcn.004eef1a
mov ecx, ebx
shr ecx, 8
movsx edx, cl
push esi
push edx
call fcn.004eef1a
add esp, 0x30
test ebx, ebx
je 0x47b2e2
mov eax, dword [ebp - 8]
push esi
push ebx
push 1
push eax
call fcn.004eeb9c
add esp, 0x10
cmp eax, ebx
je 0x47b2e2
pop edi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret