joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e214
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x899a6d3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e2c5
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e2ae
test esi, esi
jbe 0x41e2c5
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088dc
test eax, eax
jne 0x41e2a0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e2c5
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e27d
jmp 0x41e2c5
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e2c5
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x899a6da
ret
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x899b0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x89b3258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x89b3258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x89b20e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x899b0d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x406a1e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406a55
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a2f
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a2a
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a86
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406a68
pop edi
not eax
pop esi
ret 0xc

Function at 0x451000
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xf0a10
call 0x451009
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x45100c
mov eax, 0x50b0afc
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0x4060a0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x4060bf
xor edi, edi
mov eax, 8
call fcn.0042a440
jmp fcn.004060a0
sub esp, 0x28
cmp byte [0x76c3c3], 0
jne 0x4060cb
cmp dword [esp + 0x2c], 0
jne 0x4060df
mov eax, str.cgocall_nil
mov dword [esp], eax
call fcn.00411860
cmp dword [0x76c86c], 0
je 0x40610f
mov ecx, 0x76c86c
mov dword [esp], ecx
mov ecx, 1
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
call fcn.0042b680
cmp al, 0
jne 0x4061f5
mov eax, dword fs:[0x14]
mov eax, dword [eax + 4]
add dword [eax + 0x88], 1
adc dword [eax + 0x8c], 0
call fcn.00416bd0
mov eax, 0x764ca4
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], 0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0xffffffff
mov byte [esp + 0x10], 1
mov eax, dword fs:[0x14]
mov eax, dword [eax]
lea ecx, [esp + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword fs:[0x14]
mov eax, dword [eax + 4]
inc dword [eax + 0x90]
call fcn.00415b70
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call fcn.0042b7f0
call fcn.00415d80
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0xc]
cmp eax, ecx
jne 0x4061e6
mov eax, dword [esp + 0x1c]
cmp eax, 0x764ca4
jne 0x4061e6
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [esp + 0x20]
mov dword [eax + 0xc], ecx
call fcn.00406200
add esp, 0x28
ret
mov eax, 0x768160
mov dword [esp], eax
call fcn.00411860
jmp 0x4061c9
call fcn.00414080
jmp 0x40610f
Function at 0x40e720
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x40e73f
xor edi, edi
mov eax, 0x10
call fcn.0042a440
jmp fcn.0040e720
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
movzx eax, byte [ecx + 6]
cmp eax, 1
je 0x40e7c2
cmp eax, 2
je 0x40e76a
mov eax, str.bad_special_kind
mov dword [esp], eax
call fcn.00411860
mov eax, 1
add esp, 0x1c
ret
mov dword [esp + 0x14], ecx
mov eax, dword [ecx + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
movzx eax, byte [esp + 0x2c]
mov byte [esp + 8], al
call fcn.004251d0
mov eax, 0x7811e0
mov dword [esp], eax
call fcn.00406310
mov eax, 0x7811c0
mov dword [esp], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
call fcn.00407df0
mov eax, 0x7811e0
mov dword [esp], eax
call fcn.004064e0
mov eax, 1
add esp, 0x1c
ret
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [ecx + 8]
mov dword [esp + 4], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], ecx
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x10], eax
call fcn.0040a440
mov eax, 0x7811e0
mov dword [esp], eax
call fcn.00406310
mov eax, 0x7811a0
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00407df0
mov eax, 0x7811e0
mov dword [esp], eax
call fcn.004064e0
xor eax, eax
add esp, 0x1c
ret
Function at 0x41b4c0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x41b4df
xor edi, edi
mov eax, 4
call fcn.0042a440
jmp fcn.0041b4c0
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
movzx eax, byte [ecx]
cmp eax, 0xe9
jne 0x41b505
mov eax, dword [ecx + 1]
mov ecx, dword [edx + 4]
add eax, ecx
add eax, 5
mov dword [edx + 4], eax
add esp, 0x20
ret
movzx eax, byte [ecx]
cmp eax, 0xeb
jne 0x41b522
movsx eax, byte [ecx + 1]
mov ecx, dword [edx + 4]
add eax, ecx
add eax, 2
mov dword [edx + 4], eax
add esp, 0x20
ret
movzx eax, byte [ecx]
cmp eax, 0xcc
jne 0x41b530
add esp, 0x20
ret
mov eax, str.runtime:_pc_p__x__x__x__x__x_n
mov dword [esp], eax
mov dword [esp + 4], ecx
movzx eax, byte [ecx]
mov dword [esp + 8], eax
movzx eax, byte [ecx + 1]
mov dword [esp + 0xc], eax
movzx eax, byte [ecx + 2]
mov dword [esp + 0x10], eax
movzx eax, byte [ecx + 3]
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + 4]
mov dword [esp + 0x18], eax
call fcn.00412350
mov eax, str.runtime:_misuse_of_rewindmorestack
mov dword [esp], eax
call fcn.00411860
add esp, 0x20
ret
Function at 0x424e10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x424e2f
xor edi, edi
mov eax, 0x14
call fcn.0042a440
jmp fcn.00424e10
sub esp, 0x18
mov esi, dword [0x76c3ec]
cmp esi, 0
jne 0x424e73
mov ecx, 0xafc7c
mov dword [esp], ecx
mov ecx, 0x770090
mov dword [esp + 4], ecx
call fcn.00407860
mov esi, eax
cmp eax, 0
mov dword [0x76c3ec], eax
jne 0x424e73
mov eax, 0x767d80
mov dword [esp], eax
call fcn.00411860
mov esi, dword [0x76c3ec]
xor ebx, ebx
xor ebp, ebp
cmp ebp, dword [esp + 0x28]
jge 0x424e9b
mov edx, dword [esp + 0x24]
mov eax, dword [edx + ebp*4]
add ebx, eax
mov eax, ebx
shl eax, 0xa
add ebx, eax
mov eax, ebx
shr eax, 6
xor ebx, eax
inc ebp
cmp ebp, dword [esp + 0x28]
jl 0x424e7d
mov eax, dword [esp + 0x20]
add ebx, eax
mov eax, ebx
shl eax, 0xa
add ebx, eax
mov eax, ebx
shr eax, 6
xor ebx, eax
mov eax, ebx
shl eax, 3
add ebx, eax
mov eax, ebx
shr eax, 0xb
xor ebx, eax
mov eax, ebx
mov dword [esp + 0x10], ebx
xor edx, edx
mov dword [esp + 8], 0x2bf1f
div dword [esp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esi + edx*4]
mov eax, edx
cmp edx, 0
je 0x424efc
mov eax, dword [edx + 8]
cmp eax, dword [esp + 0x1c]
jne 0x424ef3
mov eax, dword [edx + 0x3c]
cmp eax, ebx
je 0x424fc6
mov edx, dword [edx]
mov eax, edx
cmp edx, 0
jne 0x424edf
cmp byte [esp + 0x2c], 0
jne 0x424f09
xor eax, eax
add esp, 0x18
ret
mov ecx, dword [esp + 0x28]
shl ecx, 2
add ecx, 0x4c
mov dword [esp], ecx
mov dword [esp + 4], 0
mov ecx, 0x770090
mov dword [esp + 8], ecx
call fcn.004244d0
mov edx, dword [esp + 0x28]
mov ecx, eax
mov eax, edx
shl eax, 2
add eax, 0x4c
add dword [0x76c3e8], eax
mov eax, ecx
mov dword [esp + 0xc], ecx
add eax, 0x48
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, edx
shl eax, 2
mov dword [esp + 8], eax
call fcn.0042c4a0
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0xc]
mov dword [ebp + 8], esi
mov ecx, dword [esp + 0x10]
mov dword [ebp + 0x3c], ecx
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x40], ecx
mov ecx, dword [esp + 0x28]
mov dword [ebp + 0x44], ecx
mov ebx, dword [0x76c3ec]
mov ecx, dword [ebx + edi*4]
mov dword [ebp], ecx
mov edx, dword [0x76c3ec]
mov dword [edx + edi*4], ebp
cmp esi, 0
jne 0x424fb5
mov ecx, dword [0x76c794]
mov dword [ebp + 4], ecx
mov dword [0x76c794], ebp
mov eax, ebp
add esp, 0x18
ret
mov ecx, dword [0x76c3e4]
mov dword [ebp + 4], ecx
mov dword [0x76c3e4], ebp
jmp 0x424faf
mov eax, dword [edx + 0x40]
cmp eax, dword [esp + 0x20]
jne 0x424ef3
mov eax, dword [edx + 0x44]
cmp eax, dword [esp + 0x28]
jne 0x424ef3
mov ecx, edx
mov dword [esp + 0xc], edx
add ecx, 0x48
mov dword [esp], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x28]
shl ecx, 2
mov dword [esp + 8], ecx
call fcn.00418e50
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
cmp eax, 0
jne 0x424ef3
mov eax, edx
add esp, 0x18
ret
Function at 0x429970
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x42998f
xor edi, edi
mov eax, 0xc
call fcn.0042a440
jmp fcn.00429970
sub esp, 0x2c
mov eax, dword [esp + 0x34]
cmp eax, 0
jg 0x4299aa
jne 0x4299a6
mov eax, dword [esp + 0x30]
cmp eax, 0
ja 0x4299aa
add esp, 0x2c
ret
lea eax, [esp + 4]
mov dword [esp], eax
call fcn.0040fcc0
mov eax, dword [esp + 4]
add eax, dword [esp + 0x30]
mov ecx, dword [esp + 8]
adc ecx, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov eax, 0x764ce8
mov dword [esp + 0x20], eax
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov eax, 0x76d0d0
mov dword [esp], eax
call fcn.00406310
lea eax, [esp + 0xc]
mov dword [esp], eax
call fcn.00429a80
mov eax, 0x76d0d0
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call fcn.00415450
add esp, 0x2c
ret

Function at 0x42c690
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
mov dword [esp], 0xfffffff4
mov ebp, esp
call dword [0x76c378]
mov esp, ebp
mov dword [esp], eax
mov edx, str.runtime:_signal_received_on_thread_not_created_by_Go._n
mov dword [esp + 4], edx
mov edx, dword [0x764cf4]
mov dword [esp + 8], edx
lea edx, [esp + 0x14]
mov dword [edx], 0
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
call dword [0x76c3b0]
mov esi, ebp
add esp, 0x18
ret
Function at 0x440280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x44029f
xor edi, edi
mov eax, 0x24
call fcn.0042a440
jmp fcn.00440280
sub esp, 0x58
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x54], ebx
xor ecx, ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x4c], edx
mov eax, edx
mov ebx, dword [esp + 0x18]
cmp ecx, ebx
jge 0x44039e
mov dword [esp + 0x24], eax
cmp eax, 0
je 0x4403c6
mov edx, dword [eax]
mov esi, dword [eax + 4]
mov ebp, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x28], edx
mov dword [esp], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 4], esi
mov dword [esp + 0x30], ebp
mov dword [esp + 8], ebp
mov edx, dword [esp + 0x5c]
mov ebx, dword [edx]
call ebx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
cmp edx, 0
mov dword [esp + 0x34], edx
je 0x440386
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov edx, dword [esp + 0x6c]
mov ebx, dword [edx]
call ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x58
ret
mov eax, dword [esp + 0x24]
add eax, 0xc
mov ecx, dword [esp + 0x1c]
inc ecx
mov ebx, dword [esp + 0x18]
cmp ecx, ebx
jl 0x4402ee
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov ebx, dword [0x76ccd0]
mov dword [esp + 0x78], ebx
mov ebx, dword [0x76ccd4]
mov dword [esp + 0x7c], ebx
add esp, 0x58
ret
mov dword [eax], eax
jmp 0x4402fb
Function at 0x441c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x441c2f
xor edi, edi
mov eax, 0x48
call fcn.0042a440
jmp fcn.00441c10
sub esp, 0x4c
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov ebx, dword [esp + 0x50]
mov dword [esp], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x84]
mov dword [esp + 0x1c], ebx
call fcn.00441a90
mov edx, dword [esp + 0x20]
movzx ebx, byte [esp + 0x24]
mov eax, ebx
mov ebx, dword [esp + 0x50]
mov dword [esp], ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x78]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x14], al
mov ebx, dword [esp + 0x58]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x24], ebx
lea esi, [esp + 0x68]
lea edi, [esp + 0x28]
cld
call fcn.0042c278
mov ebx, dword [esp + 0x88]
mov dword [esp + 0x38], ebx
call fcn.00446570
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x8c], edx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], eax
add esp, 0x4c
ret
Function at 0x44d710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x44d72f
xor edi, edi
mov eax, 0x2c
call fcn.0042a440
jmp fcn.0044d710
sub esp, 0x70
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0x54], ebx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x50], ebx
mov esi, dword [0x76c5a8]
xor ebx, ebx
cmp esi, ebx
mov dword [esp + 0x4c], esi
je 0x44d94b
mov eax, dword [0x76c5a8]
xor ebx, ebx
cmp eax, ebx
je 0x44d922
mov ebx, dword [esp + 0x74]
mov dword [esp], ebx
mov ebx, dword [esp + 0x78]
mov dword [esp + 4], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebp
mov edx, dword [esp + 0x50]
mov dword [esp + 0x68], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x6c], edx
mov dword [esp + 0x14], edx
lea esi, [0x631690]
lea edi, [esp + 0x18]
cld
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x84]
lea edi, [esp + 0x20]
cld
call fcn.0042c278
call fcn.0044bb00
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov dword [esp + 0x5c], ebx
cmp ecx, 0
mov dword [esp + 0x58], ecx
je 0x44d8e7
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x54], ebx
mov dword [esp], 0x614340
call fcn.00424940
mov edi, dword [esp + 4]
cmp edi, 0
je 0x44d8e0
lea esi, [0x631690]
mov eax, edi
cld
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x44], eax
mov ebp, dword [esp + 0x74]
mov dword [eax + 8], ebp
mov ebp, dword [esp + 0x78]
mov dword [eax + 0xc], ebp
mov ecx, dword [0x76c5a0]
xor ebx, ebx
cmp ecx, ebx
je 0x44d8b7
mov esi, dword [esp + 0x54]
cmp eax, 0
je 0x44d8b3
mov dword [esp + 0x60], ecx
mov dword [eax + 0x10], ecx
mov dword [esp + 0x64], esi
mov dword [eax + 0x14], esi
mov ebp, dword [esp + 0x58]
mov dword [eax + 0x18], ebp
mov ebp, dword [esp + 0x5c]
mov dword [eax + 0x1c], ebp
mov dword [esp + 0x44], eax
mov eax, dword [0x76c570]
xor ebx, ebx
cmp eax, ebx
je 0x44d891
mov dword [esp + 0x94], 0
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x98], eax
add esp, 0x70
ret
mov dword [esp], 0x611c80
mov dword [esp + 4], 0x5f0ca0
mov dword [esp + 8], 0x76c570
call fcn.00422420
mov eax, dword [esp + 0xc]
jmp 0x44d870
mov dword [eax], eax
jmp 0x44d844
mov dword [esp], 0x61aec0
mov dword [esp + 4], 0x605a60
mov dword [esp + 8], 0x76c5a0
call fcn.00422420
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xc]
jmp 0x44d83b
mov dword [edi], eax
jmp 0x44d812
mov dword [esp + 0x3c], eax
mov dword [esp], 0x602e20
call fcn.00424940
mov eax, dword [esp + 4]
mov ebp, dword [esp + 0x3c]
mov dword [eax], ebp
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
add esp, 0x70
ret
mov dword [esp], 0x61aec0
mov dword [esp + 4], 0x613580
mov dword [esp + 8], 0x76c5a8
call fcn.00422420
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0xc]
jmp 0x44d77f
mov dword [esp], 0x61aec0
mov dword [esp + 4], 0x613580
mov dword [esp + 8], 0x76c5a8
call fcn.00422420
mov esi, dword [esp + 0xc]
mov dword [esp + 0x4c], esi
jmp 0x44d76f
Function at 0x4868f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x48690f
xor edi, edi
mov eax, 0x14
call fcn.0042a440
jmp fcn.004868f0
sub esp, 0x70
mov eax, dword [esp + 0x78]
cmp eax, 0
jle 0x486a45
mov dword [esp + 0x78], eax
cmp eax, 0x41
jle 0x48692d
mov eax, 0x41
mov ebx, dword [esp + 0x74]
mov edi, dword [ebx + 0x44]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x24], eax
cmp ecx, eax
jb 0x486a50
mov esi, dword [esp + 0x7c]
mov dword [esp + 0x64], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x68], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x30], edi
cmp edi, 0
je 0x486a49
mov ecx, dword [edi]
mov ebp, dword [edi + 4]
mov dword [esp + 0x5c], ebp
mov esi, dword [edi + 8]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x4c], ecx
mov ebp, dword [esp + 0x5c]
mov dword [esp + 0x60], esi
mov dword [esp + 0x50], ebp
mov ebx, dword [esp + 0x44]
mov edi, ebp
add ebp, ebx
mov dword [esp + 0x54], esi
sub ebp, esi
cmp ebp, 0
jle 0x4869f2
mov dword [esp], 0x5ca1c0
mov ebx, dword [esp + 0x4c]
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
mov eax, ebp
cdq
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
call fcn.004276f0
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x50], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x54], ebx
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x5c]
mov ebp, dword [esp + 0x4c]
lea ebp, [ebp + ebx]
mov dword [esp], ebp
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
call fcn.0042c4a0
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x5c]
add edx, edi
mov ecx, dword [esp + 0x54]
mov esi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x30]
mov dword [ebx], esi
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x24]
cmp eax, 0
jg 0x48691f
add esp, 0x70
ret
mov dword [edi], eax
jmp 0x486980
call fcn.004116f0
ud2
Function at 0x4c2900
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx]
ja 0x4c291f
xor edi, edi
mov eax, 0xc
call fcn.0042a440
jmp fcn.004c2900
sub esp, 8
movzx ecx, byte [esp + 0xc]
cmp cl, 0x41
jb 0x4c293a
cmp cl, 0x5a
ja 0x4c293a
mov byte [esp + 0x14], 0
add esp, 8
ret
cmp cl, 0x61
jb 0x4c2944
cmp cl, 0x7a
jbe 0x4c2931
cmp cl, 0x30
jb 0x4c294e
cmp cl, 0x39
jbe 0x4c2931
cmp cl, 0x2f
ja 0x4c2a05
cmp cl, 0x2b
ja 0x4c29d9
cmp cl, 0x24
jne 0x4c29cd
mov ebx, dword [esp + 0x10]
cmp ebx, 2
jg 0x4c29b1
cmp ebx, 1
jne 0x4c2984
cmp cl, 0x3f
je 0x4c297d
mov byte [esp + 0x14], 0
add esp, 8
ret
mov byte [esp + 0x14], 1
jmp 0x4c2979
cmp ebx, 2
jne 0x4c29a8
cmp cl, 0x40
je 0x4c29a1
cmp cl, 0x2f
je 0x4c29a1
cmp cl, 0x3a
je 0x4c29a1
mov byte [esp + 0x14], 0
add esp, 8
ret
mov byte [esp + 0x14], 1
jmp 0x4c299d
mov byte [esp + 0x14], 1
add esp, 8
ret
cmp ebx, 3
jne 0x4c29bf
mov byte [esp + 0x14], 1
add esp, 8
ret
cmp ebx, 4
jne 0x4c29a8
mov byte [esp + 0x14], 0
add esp, 8
ret
cmp cl, 0x26
je 0x4c2961
cmp cl, 0x2b
je 0x4c2961
jmp 0x4c29a8
cmp cl, 0x2d
ja 0x4c29f5
cmp cl, 0x2c
je 0x4c2961
cmp cl, 0x2d
jne 0x4c29a8
mov byte [esp + 0x14], 0
add esp, 8
ret
cmp cl, 0x2e
je 0x4c29ec
cmp cl, 0x2f
je 0x4c2961
jmp 0x4c29a8
cmp cl, 0x3d
ja 0x4c2a27
cmp cl, 0x3a
je 0x4c2961
cmp cl, 0x3b
je 0x4c2961
cmp cl, 0x3d
je 0x4c2961
jmp 0x4c29a8
cmp cl, 0x40
ja 0x4c2a43
cmp cl, 0x3f
je 0x4c2961
cmp cl, 0x40
je 0x4c2961
jmp 0x4c29a8
cmp cl, 0x5f
je 0x4c29ec
cmp cl, 0x7e
je 0x4c29ec
jmp 0x4c29a8