joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5bcd50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5bcf1e
sub esp, 0x38
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call fcn.005bd870
movzx eax, byte [esp + 0xc]
test al, al
je 0x5bcde1
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
test ecx, ecx
je 0x5bcde1
cmp ecx, 1
je 0x5bcdd4
movzx ebx, byte [edx]
test bl, bl
jne 0x5bcdc6
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x5bcde1
cmp bl, 0xff
jne 0x5bcdd4
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x5bcde1
cmp ecx, 8
jg 0x5bcdea
mov ebx, dword [esp + 0x40]
xor eax, eax
jmp 0x5bce01
mov byte [esp + 0x44], 0
add esp, 0x38
ret
jg 0x5bcde1
mov byte [esp + 0x44], 1
add esp, 0x38
ret
movzx esi, byte [edx + eax]
or esi, ebp
mov dword [ebx], esi
mov dword [ebx + 4], edi
inc eax
cmp eax, ecx
jge 0x5bce25
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
cmp eax, ecx
jb 0x5bcdf5
jmp 0x5bcf18
mov dword [esp + 0x14], ecx
shl ecx, 3
lea edx, [ecx - 0x40]
neg edx
mov byte [esp + 0x13], dl
cmp dl, 0x20
sbb ebp, ebp
mov dword [esp + 0x28], ebp
add ecx, 0xffffffe0
mov esi, ecx
neg ecx
mov byte [esp + 0x12], cl
cmp cl, 0x20
sbb edi, edi
mov dword [esp + 0x24], edi
xchg esi, eax
cmp al, 0x20
xchg esi, eax
sbb eax, eax
mov dword [esp + 0x20], eax
cmp cl, 0x20
sbb edi, edi
xchg edi, eax
mov byte [esp + 0x11], al
xchg edi, eax
shr dl, 5
movzx edx, dl
cmp edx, 1
sbb edx, edx
mov dword [esp + 0x1c], edx
movzx edx, byte [esp + 0x13]
cmp dl, 0x20
sbb edi, edi
xchg edi, eax
mov byte [esp + 0x13], al
xchg edi, eax
mov edi, dword [ebx]
mov dword [esp + 0x18], edi
mov ebx, dword [ebx + 4]
shl edi, cl
mov ecx, edx
shl ebx, cl
and ebx, ebp
mov ecx, esi
mov ebp, dword [esp + 0x18]
shr ebp, cl
and ebp, eax
or ebp, ebx
mov ebx, dword [esp + 0x24]
and ebx, edi
or ebp, ebx
mov ebx, dword [esp + 0x40]
mov dword [ebx + 4], ebp
mov ecx, edx
mov edi, dword [esp + 0x18]
shl edi, cl
mov ebx, dword [esp + 0x28]
and edi, ebx
movzx eax, byte [esp + 0x11]
not eax
movzx ebx, byte [esp + 0x12]
or eax, ebx
mov ecx, esi
mov ebx, ebp
shl ebp, cl
mov ecx, edx
shr edi, cl
mov esi, dword [esp + 0x28]
and edi, esi
mov esi, dword [esp + 0x20]
and ebp, esi
or edi, ebp
mov ecx, eax
mov ebp, ebx
sar ebx, cl
mov eax, dword [esp + 0x1c]
xor eax, 0xffffffff
and eax, ebx
or eax, edi
mov ebx, dword [esp + 0x40]
mov dword [ebx], eax
movzx ecx, byte [esp + 0x13]
not ecx
or ecx, edx
sar ebp, cl
mov dword [ebx + 4], ebp
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x5bcdea
call fcn.00464430
nop
call fcn.00462fa0
jmp fcn.005bcd50
Function at 0x5c7e70
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5c805d
sub esp, 0x14
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
movzx ebx, byte [eax]
add ebx, ecx
adc edx, 0
movzx ecx, byte [eax + 2]
mov ebp, ecx
shl ecx, 0x10
shr ebp, 0x10
add ecx, ebx
adc edx, ebp
movzx ebx, byte [eax + 3]
mov ebp, ebx
shl ebx, 0x18
shr ebp, 8
add ebx, ecx
adc edx, ebp
movzx ecx, byte [eax + 4]
add ebx, 0
adc ecx, edx
movzx edx, byte [eax + 5]
shl edx, 8
add ebx, 0
adc edx, ecx
movzx ecx, byte [eax + 6]
shl ecx, 0x10
add ebx, 0
adc ecx, edx
movzx edx, byte [eax + 7]
shl edx, 0x18
add ebx, 0
adc edx, ecx
movzx ecx, byte [eax + 9]
mov ebp, ecx
shl ecx, 8
shr ebp, 0x18
movzx esi, byte [eax + 8]
add esi, ecx
adc ebp, 0
movzx ecx, byte [eax + 0xa]
mov edi, ecx
shl ecx, 0x10
shr edi, 0x10
add ecx, esi
adc ebp, edi
movzx esi, byte [eax + 0xb]
mov edi, esi
shl esi, 0x18
shr edi, 8
add esi, ecx
adc ebp, edi
movzx ecx, byte [eax + 0xc]
add esi, 0
adc ecx, ebp
movzx ebp, byte [eax + 0xd]
shl ebp, 8
add esi, 0
adc ebp, ecx
movzx ecx, byte [eax + 0xe]
shl ecx, 0x10
add esi, 0
adc ecx, ebp
movzx ebp, byte [eax + 0xf]
shl ebp, 0x18
add esi, 0
mov dword [esp + 4], esi
adc ebp, ecx
mov dword [esp + 0x10], ebp
movzx ecx, byte [eax + 0x11]
mov edi, ecx
shl ecx, 8
shr edi, 0x18
movzx ebp, byte [eax + 0x10]
add ebp, ecx
adc edi, 0
movzx ecx, byte [eax + 0x12]
mov dword [esp + 0xc], ecx
shl ecx, 0x10
mov esi, dword [esp + 0xc]
shr esi, 0x10
add ecx, ebp
adc edi, esi
movzx ebp, byte [eax + 0x13]
mov esi, ebp
shl ebp, 0x18
shr esi, 8
add ebp, ecx
adc edi, esi
movzx ecx, byte [eax + 0x14]
add ebp, 0
adc ecx, edi
movzx esi, byte [eax + 0x15]
shl esi, 8
add ebp, 0
adc esi, ecx
movzx ecx, byte [eax + 0x16]
shl ecx, 0x10
add ebp, 0
adc ecx, esi
movzx esi, byte [eax + 0x17]
shl esi, 0x18
add ebp, 0
mov dword [esp], ebp
adc esi, ecx
mov dword [esp + 8], esi
movzx ecx, byte [eax + 0x19]
mov edi, ecx
shl ecx, 8
shr edi, 0x18
movzx esi, byte [eax + 0x18]
add esi, ecx
adc edi, 0
movzx ecx, byte [eax + 0x1a]
mov dword [esp + 0xc], ecx
shl ecx, 0x10
mov ebp, dword [esp + 0xc]
shr ebp, 0x10
add ecx, esi
adc edi, ebp
movzx ebp, byte [eax + 0x1b]
mov esi, ebp
shl ebp, 0x18
shr esi, 8
add ebp, ecx
adc edi, esi
movzx ecx, byte [eax + 0x1c]
add ebp, 0
adc ecx, edi
movzx esi, byte [eax + 0x1d]
shl esi, 8
add ebp, 0
adc esi, ecx
movzx ecx, byte [eax + 0x1e]
shl ecx, 0x10
add ebp, 0
adc ecx, esi
movzx eax, byte [eax + 0x1f]
shl eax, 0x18
add ebp, 0
adc eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], edx
mov edx, dword [esp + 4]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x10]
mov dword [ecx + 0xc], edx
mov edx, dword [esp]
mov dword [ecx + 0x10], edx
mov edx, dword [esp + 8]
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x1c], eax
add esp, 0x14
ret
call fcn.00462fa0
jmp fcn.005c7e70
Function at 0x5ca2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ca481
sub esp, 0x34
lea eax, [0x750e80]
mov dword [esp], eax
call fcn.0040bcc0
mov eax, dword [esp + 4]
mov dword [esp + 0x30], eax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x5ca2ff
mov eax, edx
mov ecx, ebp
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x3c]
cmp ebp, ecx
jle 0x5ca428
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x50]
mov dword [esp + 8], ebp
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], esi
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x20]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
mov dword [esp + 0xc], 4
call ecx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x48]
mov dword [esp], edx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
call ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 0x14]
mov esi, dword [esp + 0x48]
mov dword [esp], esi
call ebp
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor esi, esi
jmp 0x5ca453
mov edx, dword [esp + 0x30]
movzx esi, byte [edx + 3]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 3], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ca2f7
movzx esi, byte [edx + 2]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 2], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ca2f7
movzx esi, byte [edx + 1]
lea edi, [esi + 1]
xchg edi, eax
mov byte [edx + 1], al
xchg edi, eax
xchg esi, eax
cmp al, 0xff
xchg esi, eax
jne 0x5ca2f7
movzx esi, byte [edx]
inc esi
xchg esi, eax
mov byte [edx], al
xchg esi, eax
jmp 0x5ca2f7
add esp, 0x34
ret
xchg edi, eax
mov byte [esp + 0x1f], al
xchg edi, eax
movzx edi, byte [ebx + esi]
xchg edi, eax
mov byte [esp + 0x1e], al
xchg edi, eax
movzx edi, byte [esp + 0x1f]
movzx ebx, byte [esp + 0x1e]
xor edi, ebx
xchg edi, eax
mov byte [ecx + ebp], al
xchg edi, eax
inc esi
inc ebp
mov ebx, dword [esp + 0x2c]
cmp esi, edx
jge 0x5ca3d2
cmp eax, ebp
jle 0x5ca3d2
jbe 0x5ca477
movzx edi, byte [ebp + ecx]
cmp esi, edx
jb 0x5ca42c
mov eax, esi
mov ecx, edx
call fcn.00464430
mov ecx, eax
mov eax, ebp
call fcn.00464430
nop
call fcn.00462fa0
jmp fcn.005ca2c0
Function at 0x5cd220
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5cd393
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x5cd253
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x5cd253
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x5cd259
mov byte [esp + 0xc], 0
ret
mov ecx, dword [esp + 8]
cmp ecx, 3
je 0x5cd267
cmp ecx, 4
jne 0x5cd298
cmp al, 0x2c
ja 0x5cd280
lea edx, [eax - 0x21]
cmp dl, 1
jbe 0x5cd292
cmp al, 0x24
je 0x5cd292
cmp al, 0x26
jae 0x5cd292
jmp 0x5cd298
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5cd292
cmp al, 0x5b
je 0x5cd292
cmp al, 0x5d
jne 0x5cd298
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
ja 0x5cd2cf
cmp al, 0x26
ja 0x5cd2b1
cmp al, 0x24
je 0x5cd2ee
cmp al, 0x26
je 0x5cd2ee
jmp 0x5cd375
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5cd2ee
lea edx, [eax - 0x2d]
cmp dl, 1
jbe 0x5cd36f
cmp al, 0x2f
je 0x5cd2ee
jmp 0x5cd375
cmp al, 0x3d
ja 0x5cd2e6
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5cd2ee
cmp al, 0x3d
je 0x5cd2ee
jmp 0x5cd375
lea edx, [eax - 0x3f]
cmp dl, 1
ja 0x5cd365
cmp ecx, 2
jg 0x5cd329
cmp ecx, 1
je 0x5cd31e
cmp ecx, 2
jne 0x5cd375
cmp al, 0x2f
je 0x5cd30c
cmp al, 0x3b
je 0x5cd30c
cmp al, 0x2c
jne 0x5cd313
mov eax, 1
jmp 0x5cd319
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x5cd34f
cmp al, 0x40
je 0x5cd33d
cmp al, 0x2f
je 0x5cd33d
cmp al, 0x3f
jne 0x5cd344
mov eax, 1
jmp 0x5cd34a
cmp al, 0x3a
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 6
je 0x5cd35f
cmp ecx, 7
jne 0x5cd375
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x5f
je 0x5cd36f
cmp al, 0x7e
jne 0x5cd375
mov byte [esp + 0xc], 0
ret
cmp ecx, 7
jne 0x5cd38d
cmp al, 0x21
je 0x5cd387
add eax, 0xffffffd8
cmp al, 2
ja 0x5cd38d
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
call fcn.00462fa0
jmp fcn.005cd220
Function at 0x5d7320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5d7472
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.005bd870
movzx eax, byte [esp + 0xc]
test al, al
jne 0x5d738a
lea eax, [0x769820]
mov dword [esp], eax
call fcn.0040bcc0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x7cf220]
mov dword [eax], ecx
lea ecx, [0x844124]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5d745e
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.005bdf50
movzx eax, byte [esp + 0x10]
test al, al
je 0x5d742b
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test eax, eax
je 0x5d738a
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
add esp, 0x28
ret
lea eax, [0x769820]
mov dword [esp], eax
call fcn.0040bcc0
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x7cea5d]
mov dword [eax], ecx
lea ecx, [0x844124]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.00462fa0
jmp fcn.005d7320
Function at 0x5e2700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e292f
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00464655
lea ecx, [0x5e2940]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005d4840
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x5e2825
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x5e27fc
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.005d4840
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x5e2882
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x5e2857
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x5e28a7
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x5e292b
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x5e292b
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x78b600]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.004093b0
mov eax, dword [esp + 8]
lea ecx, [0x844660]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.00462fa0
jmp fcn.005e2700
Function at 0x65ed90
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x65ee99
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.00464648
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x88]
xor eax, eax
jmp 0x65ee42
mov dword [esp + 0x1c], eax
mov dword [esp + 0x80], ecx
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005d2ec0
mov eax, dword [esp + 0x80]
lea ecx, [eax + 0xc]
mov eax, dword [esp + 0x1c]
inc eax
mov edx, dword [esp + 0x8c]
cmp edx, eax
jg 0x65ee08
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.005d3090
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
call fcn.00462fa0
jmp fcn.0065ed90
Function at 0x65eeb0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x65f059
sub esp, 0x84
lea eax, [0x758ec0]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.0044b030
mov eax, dword [esp + 0xc]
mov dword [esp + 0x80], eax
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.00464649
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x65ef7d
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x7c], eax
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.004d4b90
mov eax, dword [esp + 0x7c]
add eax, 0xc
mov ecx, dword [esp + 0x1c]
inc ecx
mov edx, dword [esp + 0x8c]
cmp edx, ecx
jg 0x65ef49
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.004d4d60
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x24
jl 0x65efbe
mov ecx, 0x24
mov edx, dword [esp + 0x80]
cmp eax, edx
je 0x65efd9
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00464d50
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 8], eax
call fcn.0065ed90
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp ecx, 0x14
jl 0x65f010
mov ecx, 0x14
mov edx, dword [esp + 0x80]
lea ebx, [edx + 0x10]
cmp eax, ebx
je 0x65f035
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.00464d50
mov edx, dword [esp + 0x80]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], 0x24
mov dword [esp + 0x9c], 0x24
add esp, 0x84
ret
call fcn.00462fa0
jmp fcn.0065eeb0
Function at 0x6a47b0
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6a49d0
sub esp, 0x20
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
lea eax, [0x7b9280]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0xb
call fcn.004cd720
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x6a48f6
movzx ebx, byte [ecx + eax - 1]
cmp bl, 0x2e
ja 0x6a4885
cmp bl, 0x2a
ja 0x6a4846
cmp bl, 0x26
ja 0x6a4836
cmp bl, 0x21
je 0x6a48e4
cmp bl, 0x25
jb 0x6a48e0
jmp 0x6a48c4
cmp bl, 0x28
je 0x6a48ac
cmp bl, 0x2a
jne 0x6a48e0
jmp 0x6a48c4
cmp bl, 0x2c
ja 0x6a4852
cmp bl, 0x2b
je 0x6a4857
jmp 0x6a48c4
cmp bl, 0x2d
jne 0x6a485f
lea edx, [ecx - 1]
jmp 0x6a4999
cmp ecx, 1
je 0x6a487c
movzx eax, byte [ecx + eax - 2]
cmp al, 0x30
jb 0x6a487c
cmp al, 0x39
ja 0x6a487c
mov byte [esp + 0x34], 1
add esp, 0x20
ret
mov byte [esp + 0x34], 0
add esp, 0x20
ret
cmp bl, 0x5e
ja 0x6a48b5
cmp bl, 0x3f
ja 0x6a48a0
lea ebp, [ebx - 0x3a]
xchg ebp, eax
cmp al, 1
xchg ebp, eax
jbe 0x6a48cd
cmp bl, 0x3c
jb 0x6a48e0
jmp 0x6a48c4
cmp bl, 0x5b
je 0x6a48ac
cmp bl, 0x5e
jne 0x6a48e0
jmp 0x6a48c4
mov byte [esp + 0x34], 0
add esp, 0x20
ret
cmp bl, 0x7c
ja 0x6a48d6
cmp bl, 0x7b
je 0x6a48cd
cmp bl, 0x7c
jne 0x6a48e0
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov byte [esp + 0x34], 0
add esp, 0x20
ret
cmp bl, 0x7d
je 0x6a48ed
cmp bl, 0x7e
je 0x6a48e4
mov ebx, ecx
jmp 0x6a4905
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov byte [esp + 0x34], 0
add esp, 0x20
ret
movzx eax, byte [esp + 0x30]
mov byte [esp + 0x34], al
add esp, 0x20
ret
mov ecx, ebp
test ecx, ecx
jle 0x6a4937
lea ebp, [ecx - 1]
cmp ebx, ebp
jbe 0x6a498e
movzx esi, byte [ecx + eax - 1]
cmp esi, 0x24
je 0x6a4903
lea edi, [esi - 0x30]
cmp edi, 9
jbe 0x6a4903
lea edi, [esi - 0x41]
cmp edi, 0x19
jbe 0x6a4903
cmp esi, 0x5f
je 0x6a4903
add esi, 0xffffff9f
cmp esi, 0x19
jbe 0x6a4903
cmp ecx, ebx
ja 0x6a4985
mov ebp, dword [0xa837d4]
lea esi, [0x75d2a0]
mov dword [esp], esi
mov dword [esp + 4], ebp
sub edx, ecx
neg edx
sar edx, 0x1f
and edx, ecx
add eax, edx
mov dword [esp + 8], eax
sub ebx, ecx
mov dword [esp + 0xc], ebx
call fcn.00410370
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
test al, al
je 0x6a497c
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov byte [esp + 0x34], 1
add esp, 0x20
ret
mov eax, ecx
mov ecx, ebx
call fcn.00464490
mov eax, ebp
mov ecx, ebx
call fcn.00464430
mov edx, ebp
test edx, edx
jle 0x6a49ac
lea ebp, [edx - 1]
cmp ecx, ebp
jbe 0x6a49c8
lea esi, [edx + eax - 1]
cmp byte [esi], bl
je 0x6a4997
sub ecx, edx
test ecx, 1
je 0x6a49bf
mov byte [esp + 0x34], 0
add esp, 0x20
ret
mov byte [esp + 0x34], 1
add esp, 0x20
ret
mov eax, ebp
call fcn.00464430
nop
call fcn.00462fa0
jmp fcn.006a47b0
Function at 0x6df340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6df4dd
sub esp, 0x64
mov eax, 0
mov dword [esp + 0x60], eax
mov byte [esp + 0x2f], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov eax, dword [esp + 0x68]
test byte [eax], al
mov dword [esp], eax
call fcn.0046dc50
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
lea eax, [0x6df4f0]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 0x60], ecx
mov byte [esp + 0x2f], 1
mov eax, dword [eax + 8]
lea ecx, [0x75d160]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], eax
call fcn.00410370
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
xor edx, edx
jmp 0x6df402
mov ebx, dword [esp + 0x38]
lea ecx, [ebx + 0x1c]
mov ebx, dword [esp + 0x30]
lea edx, [ebx + 1]
mov eax, dword [esp + 0x34]
cmp edx, eax
jge 0x6df4ad
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ecx
lea edi, [esp + 0x44]
mov esi, ecx
call fcn.00464b2a
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov ebx, dword [esp + 0x50]
mov ebp, dword [esp + 0x54]
mov esi, ebp
mov ebp, dword [esp + 0x74]
mov dword [esp], ebp
mov ebp, dword [esp + 0x78]
mov dword [esp + 4], ebp
mov ebp, dword [esp + 0x7c]
mov dword [esp + 8], ebp
mov ebp, dword [esp + 0x80]
mov dword [esp + 0xc], ebp
mov ebp, dword [esp + 0x84]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
call fcn.006e8870
movzx eax, byte [esp + 0x28]
test al, al
je 0x6df3f0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov byte [esp + 0x2f], 0
mov edx, dword [esp + 0x60]
mov eax, dword [edx]
call eax
add esp, 0x64
ret
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov byte [esp + 0x2f], 0
mov edx, dword [esp + 0x60]
mov eax, dword [edx]
call eax
add esp, 0x64
ret
call fcn.00462fa0
jmp fcn.006df340