joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ff0
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x10
lea eax, [esp]
push ebx
mov ebx, ecx
push ebp
push esi
mov ecx, dword [ebx + 4]
push edi
push eax
push ecx
mov ebp, 0x1e
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push 0
push str.Shell_TrayWnd
sub esi, edx
sub edi, ecx
call dword [sym.imp.USER32.dll_FindWindowA]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x404048
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub ebp, eax
push 0
push edi
push esi
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, edi
sub eax, ebp
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, esi
push eax
mov eax, dword [ebx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x404080
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 4]
test al, al
je 0x404097
mov eax, dword [ecx + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
mov ecx, dword [ecx + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret 4
Function at 0x407020
Capabilities:
Check if file exists
Create directory
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x2c], 0xffffffff
jne 0x407035
xor al, al
pop ebx
add esp, 0x10
ret 8
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov byte [esp + 0xf], 0
test byte [ebp], 1
je 0x407194
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ecx
mov eax, dword [eax + 4]
cmp eax, ecx
jne 0x407064
mov eax, 0x426230
push ecx
push 0x80
push 2
push ecx
push ecx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x24], eax
je 0x4071cd
mov eax, dword [ebp + 0xc]
push edi
mov edi, eax
push 0x400
shr edi, 0xa
mov ecx, edi
shl ecx, 0xa
sub eax, ecx
mov dword [esp + 0x20], eax
call fcn.00419194
mov esi, eax
add esp, 4
test esi, esi
je 0x40717b
mov edx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x2c]
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x18], 0
test edi, edi
jbe 0x40712e
mov edx, dword [ebx + 0x2c]
lea ecx, [esp + 0x24]
push 0
push ecx
push 0x400
push esi
push edx
call ebp
test eax, eax
je 0x407172
cmp dword [esp + 0x24], 0x400
jne 0x407172
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
push 0
push eax
push 0x400
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407172
cmp dword [esp + 0x14], 0x400
jne 0x407172
mov eax, dword [esp + 0x18]
inc eax
cmp eax, edi
mov dword [esp + 0x18], eax
jb 0x4070d6
mov edi, dword [esp + 0x1c]
test edi, edi
jbe 0x40716d
mov eax, dword [ebx + 0x2c]
lea edx, [esp + 0x24]
push 0
push edx
push edi
push esi
push eax
call ebp
test eax, eax
je 0x407172
cmp dword [esp + 0x24], edi
jne 0x407172
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push 0
push ecx
push edi
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407172
cmp dword [esp + 0x14], edi
jne 0x407172
mov byte [esp + 0x13], 1
push esi
call fcn.0040c880
add esp, 4
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 4]
test eax, eax
jne 0x4071a4
mov eax, 0x426230
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4071c8
mov eax, dword [esi + 4]
test eax, eax
jne 0x4071bb
mov eax, 0x426230
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4071cd
mov byte [esp + 0xf], 1
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x414b2d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.004147a8
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004147e3
test al, 0x54
push ss
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004147f3
push eax
push esi
push dword [ebp + 8]
call fcn.004147a8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
invalid
inc ebp

Function at 0x4154bf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ss
cmp dword [ebp - 0x398], 0
je 0x4156a1
cmp dword [ebp + 0xc], 1
je 0x4156a1
cmp dword [ebp + 0xc], 8
jne 0x415669
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.004147f3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004147a8
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
invalid
invalid
insb byte es:[edi], dx

Function at 0x419cbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x419cdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041f1df
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x419cfd
test byte [esp + 8], 2
je 0x419cfd
mov dword [0x42eb54], 0xd
mov dword [0x42eb58], 5
jmp 0x419cd8
xor eax, eax
ret
Function at 0x41e54d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x42d9a8
cmp edx, dword [eax]
je 0x41e56f
add eax, 8
inc ecx
cmp eax, 0x42da38
jl 0x41e560
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x42d9a8]
jne 0x41e69d
mov eax, dword [0x42eb44]
cmp eax, 1
je 0x41e677
test eax, eax
jne 0x41e5a0
cmp dword [0x42d1f4], 1
je 0x41e677
cmp edx, 0xfc
je 0x41e69d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41e5d7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041da60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00419d00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41e61a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00419d00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x426f3c
push edi
call fcn.00420030
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041da60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041da70
lea eax, [ebp - 0xa0]
push 0x426f1c
push eax
call fcn.0041da70
push dword [esi + 0x42d9ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041da70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00422043
add esp, 0x2c
pop edi
jmp 0x41e69d
lea eax, [ebp + 8]
lea esi, [esi + 0x42d9ac]
push 0
push eax
push dword [esi]
call fcn.00419d00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40cb10
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x64ee50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0xe4]
call fcn.0041e040
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0x14]
push esi
mov dword [esp + 0x18], esi
call fcn.0042ff60
mov eax, dword [ebx + 0x8c]
xor edi, edi
cmp dword [eax + 0x7f8], edi
jne 0x40ccc7
mov eax, dword [eax + 0x82c]
cmp eax, edi
je 0x40cb7f
cmp dword [eax + 0x2c], edi
jg 0x40ccc7
cmp dword [ebx + 0x5550], 1
jne 0x40ccc7
push 0x15
push str._ADVICE_CLICK_ON_SUN_
lea ecx, [esp + 0x34]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], edi
mov byte [esp + 0x38], 0
call fcn.00404330
mov dword [esp + 0x54], edi
cmp byte [ebx + 0x55a8], 0
jne 0x40ccb3
mov esi, dword [ebx + 0x140]
lea edx, [esp + 0x2c]
lea edi, [esp + 0x10]
mov byte [ebx + 0x55a8], 1
call fcn.00519520
mov byte [esp + 0x54], 1
cmp dword [esi + 0x290], 0xffffffff
je 0x40cc45
cmp dword [esi + 0x88], 0
jle 0x40cc45
mov edi, dword [esp + 0x28]
cmp edi, 0x10
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x318], 2
jae 0x40cc0a
lea ecx, [esp + 0x14]
lea edx, [esi + 0x298]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x40cc10
mov eax, dword [esi + 0x294]
mov ecx, dword [esi + 0x88]
add eax, 0x65
cmp ecx, eax
jge 0x40cc33
mov eax, ecx
cmp edi, 0x10
mov dword [esi + 0x88], eax
jb 0x40cca5
mov edx, dword [esp + 0x14]
push edx
jmp 0x40cc9d
mov edi, esi
call fcn.00458fc0
mov edi, dword [esp + 0x28]
cmp edi, 0x10
mov ecx, dword [esp + 0x14]
jae 0x40cc5d
lea ecx, [esp + 0x14]
lea edx, [esi + 4]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x40cc60
cmp edi, 0x10
mov eax, 0x2710
mov dword [esi + 0x8c], 2
mov dword [esi + 0x290], 0xffffffff
mov dword [esi + 0x88], eax
mov dword [esi + 0x84], eax
jb 0x40cca5
mov eax, dword [esp + 0x14]
push eax
call fcn.0061c19a
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [ebx + 0x55ec], 0
cmp dword [esp + 0x44], 0x10
jb 0x40ccc7
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x4c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
jmp 0x856c00

Function at 0x40db20
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp ebp, 5
ja 0x40db4e
jmp fcn.0084f040
xor al, al
pop ebp
ret 8
Function at 0x42b290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
push 0x20
push str._ADVICE_I_ZOMBIE_EAT_ALL_BRAINS_
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00404330
mov eax, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov edi, dword [eax + 4]
cmp byte [edi + 0x55e0], 0
jne 0x42b30d
push esi
mov esi, dword [edi + 0x140]
mov ecx, 7
lea edx, [esp + 8]
mov byte [edi + 0x55e0], 1
call fcn.00459010
mov dword [edi + 0x55ec], 0x38
pop esi
cmp dword [esp + 0x1c], 0x10
pop edi
jb 0x42b322
mov ecx, dword [esp + 4]
push ecx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4

Function at 0x42d830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
mov eax, esi
call fcn.0042d7e0
mov edi, dword [esi]
call fcn.0044f380
mov esi, dword [esi]
mov eax, dword [esi + 0x82c]
lea ecx, [esp + 0xc]
push 0x2b
mov dword [esi + 0x7f8], 0x2b
push ecx
mov ecx, dword [eax + 0x20]
call fcn.004568d0
add esp, 8
lea eax, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0054b260
mov eax, esi
call fcn.0044f890
cmp dword [esp + 0x24], 0x10
jb 0x42d8ac
mov edx, dword [esp + 0x10]
push edx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret

Function at 0x42dae0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x64aba6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
push edi
push ebp
call fcn.005396f0
xor ebx, ebx
mov dword [esp + 0x84], ebx
fldz
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x90]
mov dword [ebp + 0x88], vtable.Sexy::ButtonListener.0
fst dword [ebp + 0x1dc]
lea edi, [ebp + 0x88]
fstp dword [ebp + 0x1e0]
push 0x19
mov dword [ebp + 0x1c8], ecx
mov esi, 0xf
push str.DelayLoad_ChallengeScreen
lea ecx, [esp + 0x2c]
mov dword [ebp], 0x657a18
mov dword [edi], method.Sexy::ButtonListener.virtual_0
mov dword [ebp + 0x1c0], eax
mov byte [ebp + 0x41], bl
mov byte [ebp + 0x1cc], bl
mov dword [ebp + 0x1d0], ebx
mov dword [ebp + 0x1d8], 0xffffffff
mov dword [ebp + 0x1d4], ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00404330
mov byte [esp + 0x84], 1
mov edx, dword [0x6a9f38]
mov ecx, dword [edx + 0x634]
lea eax, [esp + 0x24]
call fcn.00513140
mov byte [esp + 0x84], bl
cmp dword [esp + 0x3c], 0x10
jb 0x42dbcf
mov eax, dword [esp + 0x28]
push eax
call fcn.0061c19a
add esp, 4
jmp fcn.00852000
Function at 0x44fdc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64997b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0x3ca4
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44fdfd
push eax
call fcn.00483380
jmp 0x44fdff
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x774], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x774]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x774]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x459010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e2b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push edi
lea edi, [esp + 0xc]
mov ebx, ecx
call fcn.00519520
mov dword [esp + 0x30], 0
cmp dword [esi + 0x290], 0xffffffff
je 0x4590a8
cmp dword [esi + 0x88], 0
jle 0x4590a8
mov edi, dword [esp + 0x24]
cmp edi, 0x10
mov dword [esi + 0x318], ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
jae 0x459068
lea ecx, [esp + 0x10]
lea edx, [esi + 0x298]
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x459070
mov eax, dword [esi + 0x294]
mov ecx, dword [esi + 0x88]
add eax, 0x65
cmp ecx, eax
jge 0x459093
mov eax, ecx
cmp edi, 0x10
mov dword [esi + 0x88], eax
jb 0x4591c8
push ebx
jmp 0x4591c0
mov edi, esi
call fcn.00458fc0
mov ecx, dword [esp + 0x10]
mov edi, 0x10
cmp dword [esp + 0x24], edi
jae 0x4590c2
lea ecx, [esp + 0x10]
lea edx, [esi + 4]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4590c5
cmp ebx, 6
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x290], 0xffffffff
je 0x459190
cmp ebx, 0xc
je 0x459190
cmp ebx, 0x11
je 0x459190
cmp ebx, 0xb
je 0x459190
cmp ebx, 0xa
jne 0x45911b
mov dword [esi + 0x88], 0x1f4
jmp 0x45919a
cmp ebx, 7
je 0x45910c
cmp ebx, 9
je 0x45910c
cmp ebx, 0xd
je 0x45910c
cmp ebx, 1
je 0x45910c
cmp ebx, 3
je 0x45910c
cmp ebx, 4
je 0x45910c
cmp ebx, 8
je 0x459184
cmp ebx, 2
je 0x459184
cmp ebx, 5
je 0x459184
cmp ebx, 0xe
jne 0x459159
mov dword [esi + 0x88], 0xfa
jmp 0x45919a
cmp ebx, 0xf
jne 0x459174
mov dword [esi + 0x88], 0x2ee
mov dword [esi + 0x290], 0x62
jmp 0x45919a
cmp ebx, edi
jne 0x45919a
mov dword [esi + 0x88], 0x2ee
jmp 0x45919a
mov dword [esi + 0x88], 0x2710
jmp 0x45919a
mov dword [esi + 0x88], 0x5dc
cmp dword [esi + 0x290], 0xffffffff
je 0x4591a9
push esi
call fcn.004591e0
cmp dword [esp + 0x24], edi
mov eax, dword [esi + 0x88]
mov dword [esi + 0x84], eax
jb 0x4591c8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret
Function at 0x52edb0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [esp + 0x10]
call fcn.00532140
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], 0
jmp 0x52ede0
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
lea esi, [esp + 0xc]
call fcn.0041c950
test al, al
je 0x52ee7c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov esi, dword [esp + 0xc]
cmp edx, dword [esi + 0x1c]
jne 0x52ede0
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.00467ef0
mov ecx, dword [esp + 0x10]
cmp edi, ecx
jge 0x52ee24
mov edx, dword [esp + 0x18]
lea eax, [ebx + edi]
add edx, ecx
jmp 0x52ee2f
mov eax, dword [esp + 0x18]
add eax, ecx
mov ecx, edi
lea edx, [ebx + edi]
cmp eax, ecx
jg 0x52ee37
sub eax, ecx
jmp 0x52ee43
cmp eax, edx
jg 0x52ee3f
sub eax, ecx
jmp 0x52ee43
sub edx, ecx
mov eax, edx
cmp eax, 0x14
jl 0x52ede0
mov ecx, dword [ebp + 8]
push 1
push esi
call fcn.0052e4c0
test al, al
je 0x52ede0
mov eax, dword [esi + 0x24]
jmp 0x86f800
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x768], 0
je 0x52eee6
mov eax, dword [eax + 0x7f8]
cmp eax, 0x3d
je 0x52eec2
cmp eax, 0x3e
je 0x52eec2
cmp eax, 0x3f
je 0x52eec2
cmp eax, 0x40
je 0x52eec2
cmp eax, 0x41
je 0x52eec2
cmp eax, 0x42
je 0x52eec2
cmp eax, 0x43
je 0x52eec2
cmp eax, 0x44
je 0x52eec2
cmp eax, 0x45
je 0x52eec2
cmp eax, 0x46
jne 0x52eee6
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x160]
push ecx
mov eax, edi
call fcn.0042b810
test eax, eax
je 0x52eee6
mov edx, dword [edi + 4]
mov ecx, dword [edx + 0x160]
push ecx
call fcn.0042ba30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x84265e
Capabilities:
Packed with generic packer

Disassembly:
sub dword [edi + 0x128], 1
cmp dword [edi + 0x128], 0
jg 0x84267c
mov dword [edi + 0x128], 0x9c4
cmp dword [edi + 0x128], 1
jne 0x8426a1
pushal
push 2
push 4
push dword [edi + 0xc]
mov ecx, dword [edi + 8]
add ecx, 0x28
push ecx
mov ecx, dword [edi + 4]
call fcn.0040cb10
popal
cmp dword [edi + 0x128], 0x20
jne 0x8426b8
mov dword [edi + 0xb8], 0x40
ret

Function at 0x843f30
Capabilities:
Packed with generic packer

Disassembly:
sub dword [edi + 0xdc], 1
cmp dword [edi + 0xdc], 0x1e
jne 0x843f4e
mov dword [edi + 0xb8], 0x64
cmp dword [edi + 0xdc], 0
jne 0x843f8e
mov dword [edi + 0xdc], 0x2329
pushal
push 2
cmp dword [edi + 0x54], 0
jne 0x843f79
push 6
jmp 0x843f7b
push 5
push dword [edi + 0xc]
mov ecx, dword [edi + 8]
add ecx, 0xf
push ecx
mov ecx, dword [edi + 4]
call fcn.0040cb10
popal
cmp dword [edi + 0x54], 0x19
je 0x843fc0
cmp dword [edi + 0x54], 0x14
je 0x843fc0
cmp dword [edi + 0x54], 0xf
je 0x843fc0
cmp dword [edi + 0x54], 0xa
je 0x843fc0
cmp dword [edi + 0x54], 5
jne 0x843ff6
fld dword [edi + 0xe0]
fadd dword [0x843ff7]
fstp dword [edi + 0xe0]
fld dword [edi + 0xe4]
fadd dword [0x843fff]
fstp dword [edi + 0xe4]
fld dword [edi + 0xe8]
fadd dword [0x844007]
fstp dword [edi + 0xe8]
ret

Function at 0x849341
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ecx, dword [ebp + 4]
push 2
push 6
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040cb10
popal
ret

Function at 0x849450
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov ebx, ebp
mov eax, dword [0x6a72f0]
lea esi, [ecx - 0x14]
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov edx, dword [edx + 0xd8]
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
call edx
push 0x7f
push 0
push 0
push 0x3c
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
push dword [ebp + 0x1c]
push dword [ebp + 4]
call fcn.0041d8a0
mov eax, ebp
mov esi, dword [ebp]
mov esi, dword [esi + 0x820]
mov esi, dword [esi]
push 0x30
push 0x61a80aa
sub esp, 8
fild dword [ebp + 0xc]
fadd qword [0x679338]
fstp dword [esp + 4]
fild dword [ebp + 8]
fadd qword [0x679338]
fadd qword [0x679338]
fstp dword [esp]
call fcn.00518a70
popal
ret

Function at 0x84d2e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
sub esp, 0x200
push dword [esp + 0x230]
lea esi, [esp + 0x108]
call fcn.005b0ca0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, eax
call fcn.00403e20
mov ecx, dword [esp + 0x224]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
push eax
call edx
mov ecx, dword [esp + 0x224]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
lea eax, [0x84d589]
mov ecx, edi
call fcn.00586cc0
push dword [esp + 0x22c]
push dword [esp + 0x22c]
push dword [esp + 0x224]
mov eax, edi
call fcn.00587120
add esp, 0x200
popal
ret
Function at 0x84f440
Capabilities:
Packed with generic packer

Disassembly:
pushal
sub esp, 0x200
push dword [esp + 0x230]
lea esi, [esp + 0x108]
call fcn.005b0ca0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov ecx, eax
call fcn.00403e20
mov ecx, dword [esp + 0x224]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
push eax
call edx
mov ecx, dword [esp + 0x224]
mov esi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
lea eax, [0x84f4c3]
mov ecx, edi
call fcn.00586cc0
push dword [esp + 0x22c]
push dword [esp + 0x22c]
push dword [esp + 0x224]
mov eax, edi
call fcn.00587120
add esp, 0x200
popal
ret

Function at 0x852180
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 6
push 0x852d97
mov ecx, 0x710000
call fcn.00404330
mov ebp, dword [ebp + 0x1c8]
add ebp, 0x3000
mov eax, dword [0x6a7780]
push eax
push dword [0x6a77f8]
push 0x710000
push edi
mov edi, dword [0x6a75e4]
push ebp
mov ebx, eax
call fcn.00448bc0
add esp, 0x14
mov edi, dword [0x6a75e4]
mov edi, dword [edi + 0x28]
push edi
mov edi, dword [0x6a75e4]
mov edi, dword [edi + 0x24]
push edi
push 0x237
push 0x1e0
mov ecx, eax
call fcn.00539bd0
mov dword [0x83f0cc], ecx
push ecx
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x320]
call fcn.005370a0
popal
ret

Function at 0x852210
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 6
push 0x852d90
mov ecx, 0x710100
call fcn.00404330
mov ebp, dword [ebp + 0x1c8]
add ebp, 0x2000
mov eax, dword [0x6a7780]
push eax
push dword [0x6a77f8]
push 0x710100
push edi
mov edi, dword [0x6a75e4]
push ebp
mov ebx, eax
call fcn.00448bc0
add esp, 0x14
mov edi, dword [0x6a75e4]
mov edi, dword [edi + 0x28]
push edi
mov edi, dword [0x6a75e4]
mov edi, dword [edi + 0x24]
push edi
push 0x237
push 0xf0
mov ecx, eax
call fcn.00539bd0
mov dword [0x83f0d0], ecx
push ecx
mov ecx, dword [0x6a9ec0]
mov ecx, dword [ecx + 0x320]
call fcn.005370a0
popal
ret

Function at 0x8568b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
push dword [ebx + 0x40]
push 0x8569a9
lea esi, [esp + 0x1c]
call fcn.005b0ca0
add esp, 8
sub esp, 0x10
mov eax, esp
mov dword [eax], 0xff
mov dword [eax + 4], 0xff
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0xff
push 0
mov ecx, dword [ebx + 0xc]
add ecx, 0x40
push ecx
mov ecx, dword [ebx + 8]
mov edx, esi
push edi
mov ebx, dword [0x6a74b0]
call fcn.00511ce0
add esp, 0x1c
popal
ret

Function at 0x856904
Capabilities:
Packed with generic packer

Disassembly:
pushal
push dword [ebx + 0x40]
push 0x8569a9
lea esi, [esp + 0x1c]
call fcn.005b0ca0
add esp, 8
sub esp, 0x10
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0xff
mov dword [eax + 8], 0xff
mov dword [eax + 0xc], 0xff
push 0
mov ecx, dword [ebx + 0xc]
push ecx
mov ecx, dword [ebx + 8]
mov edx, esi
push edi
mov ebx, dword [0x6a74b0]
call fcn.00511ce0
add esp, 0x1c
popal
ret