joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469150
Capabilities:
Write clipboard data

Disassembly:
sub esp, 0xc
push esi
mov esi, eax
cmp byte [esi + 0x17], 0
push edi
mov edi, ecx
jne 0x469162
mov esi, dword [esi + 0xc]
cmp byte [edi + 0x17], 0
jne 0x46916b
mov edi, dword [edi + 0xc]
mov al, byte [esi + 0x15]
test al, 0x10
je 0x4691ef
test al, 8
jne 0x4691d4
mov ecx, dword [esi + 8]
movzx edx, word [ecx]
mov eax, dword [esi + 0xc]
shr eax, 1
movzx ecx, word [ecx + eax*2 - 2]
cmp edx, 0x20
je 0x4691a4
cmp edx, 9
je 0x4691a4
cmp ecx, 0x20
je 0x4691a4
cmp ecx, 9
je 0x4691a4
cmp edx, 0x30
je 0x4691a4
cmp edx, 0x2b
jne 0x4691d4
mov ecx, dword [esi + 8]
push edi
call fcn.004697a9
test eax, eax
jne 0x4691b9
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x10
push eax
push ecx
mov eax, edi
call fcn.004696a5
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0x18
push edx
push eax
mov eax, edi
call fcn.004696c0
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
test al, 0x20
je 0x469251
test al, 8
jne 0x46922d
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
shr eax, 1
push edi
call fcn.00401200
test eax, eax
je 0x4691b1
fld qword [esi]
push 0x20
fstp qword [esp + 0xc]
mov eax, edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
call fcn.004696fe
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
fld qword [esi]
push 0x28
fstp qword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
mov eax, edi
call fcn.00469722
mov eax, 1
pop edi
pop esi
add esp, 0xc
ret
test al, 1
je 0x469263
mov ecx, esi
mov edx, edi
pop edi
pop esi
add esp, 0xc
jmp fcn.00469650
test al, 2
je 0x46927f
mov esi, dword [esi]
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
push esi
mov eax, edi
call 0x4b6435
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
shr eax, 1
push edi
call fcn.00401200
pop edi
pop esi
add esp, 0xc
ret

Function at 0x4692a0
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
dec eax
cmp eax, 4
ja case.default.0x4692b0
jmp dword [eax*4 + 0x469348]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
push edi
call fcn.0047abb0
pop esi
ret
mov eax, dword [esi + 4]
test eax, eax
je case.default.0x4692b0
mov ecx, dword [esi]
cmp word [ecx], 0x30
je 0x4692e4
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
push edi
call fcn.0047abce
pop esi
ret
push edi
or eax, 0xffffffff
call fcn.004698e9
test eax, eax
jne 0x4692f3
pop esi
ret
mov esi, dword [esi + 4]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 0x10
push ecx
push edx
mov eax, edi
call fcn.004697e2
mov eax, 1
pop esi
ret
mov eax, dword [esi]
mov ecx, edi
pop esi
jmp fcn.00469150
fld qword [esi]
sub esp, 8
fstp qword [esp]
push edi
call fcn.0047ac41
pop esi
ret
mov esi, dword [esi]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
push esi
mov eax, edi
call 0x4b64f5
pop esi
ret
mov ecx, dword [esi]
push edi
or eax, 0xffffffff
call fcn.00469942
pop esi
ret
Function at 0x469650
Capabilities:
Write clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, edx
cmp byte [esi + 0x17], 0
push edi
mov ebx, ecx
jne 0x46966a
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 0
je 0x469661
cmp byte [ebx + 0x17], 0
jne 0x469673
mov ebx, dword [ebx + 0xc]
mov eax, ebx
call fcn.00469bd6
cmp byte [esi + 0x17], 1
jne 0x4696e0
push 1
mov ecx, esi
call fcn.00469cc5
cmp dword [ebx + 8], eax
je 0x46975a
mov eax, dword [ebx + 0xc]
mov ecx, eax
push 0
shr ecx, 1
and eax, 1
push 1
add ecx, eax
push ecx
push 0
mov ecx, 0x4c2fe4
call fcn.0046cb16
test eax, eax
jne 0x46970a
push 0x4a5c64
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x4c3000
invalid

Function at 0x4697a9
Capabilities:
Write clipboard data

Disassembly:
dec ecx
add byte [ebp - 0x7b7bf040], al
add byte [eax], al
add byte [ebx + 0x57], dl

Function at 0x469be0
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
mov ebx, ecx
movzx eax, byte [ebx + 0x17]
push esi
push edi
cmp eax, 3
ja case.default.0x469bf3
jmp dword [eax*4 + 0x469d58]
mov eax, ebx
call fcn.0046a15d
cmp dword [0x4c0e70], 0
jne 0x469c81
cmp dword [ebx + 0xc], 0
jne 0x469c81
mov edi, dword [esp + 0x14]
cmp dword [0x4c449c], ebx
jne 0x469c20
test edi, edi
jne 0x469c5e
mov ecx, dword [ebx + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x469c5a
mov dword [0x4c449c], 0
test edi, edi
je 0x469c52
mov ecx, dword [ebx + 0x18]
call 0x4d1397
pop edi
pop esi
pop ebx
pop ecx
ret 4
dec eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
test edi, edi
je 0x469c72
xor edx, edx
mov word [edi], dx
mov dword [0x4c449c], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov dword [0x4c449c], ebx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [ebx + 0xc]
mov esi, dword [esp + 0x14]
mov edi, eax
shr edi, 1
test esi, esi
je 0x469ce4
test eax, eax
jne 0x469c9e
mov word [esi], ax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov ecx, dword [ebx + 8]
cmp esi, ecx
je 0x469ce4
cmp eax, 0x186a0
jae 0x469cd3
movzx eax, word [ecx]
test ax, ax
je fcn.00469cc5
add ecx, 2
mov word [esi], ax
movzx eax, word [ecx]
add esi, 2
test ax, ax
jne 0x469cb4
push eax
push ecx
push esi
call 0x4eef47
add esp, 0xc
xor edx, edx
mov word [esi + edi*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0xc]
push eax
call 0x4d2cd6
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov esi, dword [esp + 0x14]
push esi
mov ecx, 0x4c2fe4
call fcn.0046cb6c
cmp eax, 0xffffffff
jne 0x469d17
xor eax, eax
test esi, esi
je 0x469d4f
xor ecx, ecx
mov word [esi + eax*2], cx
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x469d35
xor edx, edx
mov word [eax], dx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [ebx + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x10]
push eax
push ecx
call edx
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x46a590
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
test edi, edi
jne 0x46a59f
pop edi
add esp, 0x10
ret
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ebp
push esi
push 0
push edi
call ebx
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, dword [0x4c2fa4]
je 0x46a5ca
mov esi, edi
call 0x4d4fbe
test al, al
jne 0x46a762
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
jne 0x46a5e4
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
cmp edi, esi
jne 0x46a5f2
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x10
ret
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x46a606
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x4c0d3e], 0
jne 0x46a620
push esi
call 0x4d3f41
add esp, 4
test eax, eax
jne 0x46a764
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test esi, esi
je 0x46a67d
push 0
push esi
call ebx
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x46a67d
cmp dword [0x4c2fa4], ebx
je 0x46a664
call 0x4d5046
test al, al
jne 0x46a664
mov eax, dword [0x4c2fa4]
push 1
push ebx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test ebp, ebp
je 0x46a67d
cmp ebx, ebp
je 0x46a67d
push 1
push ebp
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
mov ebx, dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esp + 0x14], 0
jmp 0x46a690
push edi
call ebx
push 1
push 0xa
mov dword [0x4bd3c0], 0
call fcn.0046adf2
add esp, 8
mov dword [0x4bd3c0], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
cmp ebp, edi
jne 0x46a6c3
mov ebp, edi
jmp 0x46a6d4
cmp ebp, esi
je 0x46a6d8
push 4
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
cmp edi, eax
jne 0x46a6d8
test ebp, ebp
jne 0x46a719
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 5
jl 0x46a690
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.00478496
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 2
call fcn.004784aa
push esi
call 0x4d4040
add esp, 0x34
mov ebp, eax
cmp byte [esp + 0x12], 0
je 0x46a734
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4c2fa4]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [esp + 0x13], 0
je 0x46a74d
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebp, ebp
je 0x46a762
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
xor eax, eax
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x10
ret
Function at 0x46aac0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11260
call 0x4fd166
movzx eax, word [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x1126c]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x11274]
cmp eax, 0x41
je 0x46aaea
cmp eax, 0x61
jne 0x46ab3f
cmp word [ecx + 2], bx
jne 0x46ab3f
cmp word [edi], bx
jne 0x46ab3f
cmp word [esi], bx
jne 0x46ab3f
cmp word [edx], bx
jne 0x46ab3f
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x46ab20
cmp byte [ebp + 0xe2], bl
jne 0x46ab20
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x46ab20
xor esi, esi
cmp byte [esp + 0x1127c], bl
je 0x46ab33
cmp esi, ebx
je 0x46ab33
mov dword [ebp + 0xc0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11260
ret
cmp ax, bx
jne 0x46ab64
cmp word [edi], bx
jne 0x46ab64
cmp word [esi], bx
jne 0x46ab64
cmp word [edx], bx
jne 0x46ab64
mov eax, ebp
call 0x4d4c16
pop esi
pop ebp
pop ebx
add esp, 0x11260
ret
push edx
push esi
push edi
push ecx
push ebp
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1030], 0x4a5c64
mov byte [esp + 0x104c], bl
mov dword [esp + 0x1050], ebx
mov dword [esp + 0x1054], ebx
mov dword [esp + 0x1058], ebx
mov dword [esp + 0x105c], ebx
mov dword [esp + 0x1060], ebx
mov dword [esp + 0x1064], ebx
mov dword [esp + 0x1070], ebx
mov dword [esp + 0x1074], ebx
call 0x4d56fc
test eax, eax
je 0x46ac75
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11278]
mov ecx, dword [esp + 0x11280]
mov edx, dword [esp + 0x11284]
mov byte [esp + 0x1038], al
mov dword [esp + 0x1048], ecx
mov dword [esp + 0x104c], edx
je 0x46ac81
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x46ac4e
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46ac75
cmp byte [ebp + 0xe2], bl
jne 0x46ac47
mov eax, dword [esp + 0x102c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x46ac47
mov ecx, dword [esp + 0x102c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x46ac75
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1060], eax
je 0x46ac67
lea esi, [esp + 0x10]
mov dword [esp + 0x1060], eax
call 0x4d5bc3
push ebx
lea ecx, [esp + 0x14]
call 0x4d5c4d
test eax, eax
jne 0x46ac91
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11260
ret
lea edx, [esp + 0x10]
push edx
push 0x46ad30
call dword [sym.imp.USER32.dll_EnumWindows]
invalid
test byte [eax + eax*2], ah
adc byte [eax], al
Function at 0x46adf2
Capabilities:
Get graphical window text

Disassembly:
or byte [eax], al
add dword [eax], eax
push ebp
mov ebp, dword [esp + 0x10010]
mov eax, dword [ebp + 4]
cmp byte [eax + 0xe3], 0
push esi
push edi
jne 0x46adc7
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46ae8e
mov ecx, dword [ebp + 4]
cmp byte [ecx + 0xe1], 0
je 0x46ade6
push 0x7fff
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x46adf6
mov edi, 0x7fff
lea esi, [esp + 0x10]
mov eax, ebx
call 0x4d5872
jl 0x46ad9e
push es
invalid
jl 0x46ad9e
push es
add byte [ebx], dh
idiv byte [ebx]
invalid
xor esi, esi
cmp eax, esi
je 0x46ae8e
mov edx, dword [ebp + 0x1018]
lea edi, [esi + 4]
cmp word [edx], si
je 0x46ae4c
mov eax, dword [ebp + 4]
cmp dword [eax + 0x20], edi
and byte [ebp + 0x26], dh
lea ecx, [esp + 0x10]
push ecx
call 0x4ad75c
add esp, 4
test eax, eax
je 0x46ae4c
mov dword [ebp + 0x1034], esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10000
ret 8
push edx
lea edx, [esp + 0x14]
push edx
call 0x4ecdbb
add esp, 8
jmp 0x46ae23
cmp dword [ebp + 0x1034], esi
jne 0x46ae8e
mov edx, dword [ebp + 0x1014]
cmp word [edx], si
je 0x46ae88
mov eax, dword [ebp + 4]
cmp dword [eax + 0x20], edi
jne 0x46ae76
lea ecx, [esp + 0x10]
push ecx
call 0x4ad7ad
add esp, 4
jmp 0x46ae84
push edx

Function at 0x46aea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10018
call 0x4fd54c
mov ecx, dword [ebp + 8]
push esi
push edi
test ecx, ecx
je 0x46aecd
push 1
push 0
push 0xffffffffffffffff
push 0
call 0x4d3b62
mov eax, 0x49eb0c
jmp 0x46aed2
mov eax, 0x49ef34
mov ecx, dword [0x4c1688]
mov esi, 1
push esi
push 0
push 0xffffffffffffffff
push eax
call 0x4d3b84
cmp dword [ebp + 0x14], 0
jne 0x46aef5
mov dword [ebp + 0x14], 0x1f4
cmp dword [ebp + 0x18], esi
jge 0x46af01
mov dword [ebp + 0x18], 0x32
cmp dword [ebp + 0xc], esi
jge 0x46af09
mov dword [ebp + 0xc], esi
test ebx, ebx
je 0x46b0ac
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]

Function at 0x46af13
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10018
call 0x4fd54c
mov ecx, dword [ebp + 8]
push esi
push edi
test ecx, ecx
je 0x46aecd
push 1
push 0
push 0xffffffffffffffff
push 0
call 0x4d3b62
mov eax, 0x49eb0c
jmp 0x46aed2
mov eax, 0x49ef34
mov ecx, dword [0x4c1688]
mov esi, 1
push esi
push 0
push 0xffffffffffffffff
push eax
call 0x4d3b84
cmp dword [ebp + 0x14], 0
jne 0x46aef5
mov dword [ebp + 0x14], 0x1f4
cmp dword [ebp + 0x18], esi
jge 0x46af01
mov dword [ebp + 0x18], 0x32
cmp dword [ebp + 0xc], esi
jge 0x46af09
mov dword [ebp + 0xc], esi
test ebx, ebx
je 0x46b0ac
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]

Function at 0x46af17
Capabilities:
Check for time delay via gettickcount

Disassembly:
xchg esp, eax
dec ecx
add byte [ebp + 0x501c2444], cl
lea eax, [esp + 0x1c]
push eax
Function at 0x46af33
Capabilities:
Check for time delay via gettickcount

Disassembly:
lea eax, [esp + 0x1c]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push ebx
call esi
test eax, eax
je 0x46b0ac
jne 0x46af36
add byte [eax], al
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esp + 0x1c]
jg 0x46b0ac
push 0x10000
mov ecx, ebx
lea edi, [esp + 0x18]
call 0x4d2770
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x46b0ac
mov edi, dword [ebp + 0xc]
xor edx, edx
dec edi
mov word [esp + 0x20], dx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
jmp 0x46af80
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46c85b
Capabilities:
Get graphical window text

Disassembly:
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x46c873
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x30
ret 8
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 8
jne 0x46c865
push 0x14
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x46c8a8
lea ecx, [esp + 0x10]
push str.Program_Manager
push ecx
call 0x4eda76
add esp, 8
test eax, eax
je 0x46c865
mov esi, dword [esp + 0x44]
cmp dword [esi + 0x1050], ebx
je 0x46c8bf
mov dword [esi + 0x1050], ebx
call 0x4d781b
mov edi, dword [esi + 0x1040]
mov edx, dword [edi + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push edx
mov edx, dword [edi]
push eax
mov eax, dword [0x4bd4c4]
push ecx
push edx
push eax
mov ecx, esi
call 0x4d741d
test eax, eax
je 0x46c8f6
push 1
mov ecx, esi
call 0x4d78ca
test eax, eax
jne 0x46c865
mov edi, dword [edi + 0x10]
cmp edi, dword [esi + 0x1040]
jne 0x46c8c5
xor eax, eax
cmp dword [esi + 0x103c], eax
jle 0x46c925
mov ecx, dword [esi + 0x1038]
cmp ebx, dword [ecx]
je 0x46c865
inc eax
add ecx, 4
invalid
invalid
invalid
Function at 0x46d300
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov eax, dword [ebp]
push esi
mov esi, dword [esp + 0x24]
mov edx, eax
mov dword [esp + 0xc], ecx
cmp byte [ecx], 0x28
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x14], 0
jne 0x46d49b
mov dl, byte [ecx + 1]
cmp dl, 0x2a
jne 0x46d34f
add ecx, 2
mov dword [esp + 0x10], ecx
jmp 0x46d49b
cmp dl, 0x3f
je 0x46d36e
inc eax
mov dword [ebp], eax
test esi, esi
jne 0x46d364
cmp eax, edi
je 0x46d66f
inc ecx
mov dword [esp + 0x10], ecx
jmp 0x46d49b
mov dl, byte [ecx + 2]
cmp dl, 0x7c
jne 0x46d38a
add ecx, 3
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 1
jmp 0x46d49b
cmp dl, 0x23
jne 0x46d3c4
add ecx, 3
mov dword [esp + 0x10], ecx
mov al, byte [ecx]
test al, al
je 0x46d666
cmp al, 0x29
je 0x46d666
inc ecx
mov dword [esp + 0x10], ecx
mov al, byte [ecx]
test al, al
jne 0x46d3a0
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
add ecx, 2
mov dword [esp + 0x10], ecx
cmp dl, 0x28
jne 0x46d417
cmp byte [ecx + 1], 0x3f
je 0x46d49b
mov al, byte [ecx]
test al, al
je 0x46d666
cmp al, 0x29
je 0x46d404
inc ecx
mov dword [esp + 0x10], ecx
mov al, byte [ecx]
test al, al
jne 0x46d3e4
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
cmp byte [ecx], 0
je 0x46d666
inc ecx
mov dword [esp + 0x10], ecx
jmp 0x46d49b
cmp byte [ecx], 0x50
jne 0x46d421
inc ecx
mov dword [esp + 0x10], ecx
mov dl, byte [ecx]
cmp dl, 0x3c
jne 0x46d435
mov bl, byte [ecx + 1]
cmp bl, 0x21
je 0x46d435
cmp bl, 0x3d
jne 0x46d43a
cmp dl, 0x27
jne 0x46d49b
inc eax
mov dword [ebp], eax
test esi, esi
jne 0x46d44a
cmp eax, edi
je 0x46d66f
movzx eax, byte [ecx]
inc ecx
mov dword [esp + 0x10], ecx
cmp eax, 0x3c
jne 0x46d45c
mov eax, 0x3e
movzx ebx, byte [ecx]
mov edx, ecx
cmp ebx, eax
je 0x46d471
inc ecx
mov dword [esp + 0x10], ecx
movzx ebx, byte [ecx]
cmp ebx, eax
jne 0x46d465
test esi, esi
je 0x46d49b
mov eax, ecx
sub eax, edx
cmp edi, eax
jne 0x46d49b
push edi
push edx
push esi
call 0x4f2c42
add esp, 0xc
test eax, eax
jne 0x46d497
mov eax, dword [ebp]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
test al, al
je 0x46d666
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x24]
jmp 0x46d4b4
Function at 0x46f6a0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xfc
mov eax, dword [esp + 0x100]
mov eax, dword [eax]
mov ecx, dword [esp + 0x104]
mov dword [esp + 0x1c], eax
shr eax, 0xb
and eax, 1
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
shr eax, 9
and eax, 1
mov dword [esp + 0xb8], eax
xor eax, 1
push ebx
mov ebx, dword [ecx]
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0xc0], eax
mov eax, 0xfffffffe
push ebp
mov ebp, dword [esp + 0x124]
xor edx, edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
push esi
push edi
mov edi, dword [ecx]
xor esi, esi
xor ecx, ecx
and eax, 1
shl eax, 8
mov dword [esp + 0x4c], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0xc0], edx
mov dword [esp + 0x70], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x5c], edx
mov dword [esp + 0xb8], edx
mov dword [esp + 0x68], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x60], edx
mov dword [esp + 0x74], eax

Function at 0x46fb59
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sub edx, ecx
cmp edi, edx
ja 0x46fb7d
cmp al, byte [ebp + 0x60]
jne 0x46fb7d
cmp ecx, 1
je 0x46fad4
mov al, byte [edi + 1]
cmp al, byte [ebp + 0x61]
je 0x46fad4

Function at 0x470468
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
inc ebp
mov eax, ebp
mov edx, 0x200b
call 0x4f00e1
add ebp, eax
mov eax, ebp
mov edx, 0x202e
call 0x4f00ef
add ebp, eax
mov byte [ebp], 2
inc ebp
mov eax, ebp
mov edx, 0x2030
call 0x4f0102
add ebp, eax
mov eax, ebp
mov edx, 0x205e
call 0x4f0110
add ebp, eax
mov byte [ebp], 2
inc ebp
mov eax, ebp
mov edx, 0x2060
pushal
and byte [eax], al
add al, ch
insb byte es:[edi], dx
cld
pop es
add byte [ebx], al
call 0x1ca48
das
add byte [eax], al
call 0x4f0131
mov edx, 0x3001

Function at 0x4704ae
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
pushal
and byte [eax], al
add al, ch
insb byte es:[edi], dx
cld
pop es
add byte [ebx], al
call 0x1ca48
das
add byte [eax], al

Function at 0x471c09
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
shr bl, 1
add eax, dword [ebx - 0x76b80037]
jl 0x471c37
adc byte [edi], cl
mov dh, 7
retf
Function at 0x471de2
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x10], edi
cmp byte [edi], 0x29
jne 0x471e0f
mov byte [ebx], 0x73
inc ebx
mov dword [esp + 0x20], 0x59
jmp 0x4719b6

Function at 0x471f0d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
lea ecx, [ecx]
inc edi
mov dword [esp + 0x10], edi
mov al, byte [edi]
test al, al
je 0x472fac
cmp al, 0x29
jne 0x471f10
test al, al
je 0x472fac
sub edi, ecx
push edi
push ecx
call dword [0x4c2fa0]
mov edi, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x472fac

Function at 0x47201d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0x20
jle 0x472212

Function at 0x472458
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x10], edi
movzx eax, byte [edi]
test byte [eax + 0x4b7658], 4
jne 0x4726ae
mov eax, dword [esp + 0x118]
mov edx, dword [esp + 0x11c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov dword [edx], 0x3f
xor eax, eax
pop ebx
add esp, 0xfc
ret

Function at 0x472595
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebx - 0x7376fe0f], al
and al, 0xcc
add byte [eax], al
add byte [ebx + 0x1e183c8], cl

Function at 0x472700
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
inc eax
mov dword [esp + 0x1c], eax
test eax, eax
jg 0x47288e
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x11c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov dword [ecx], 0xf
xor eax, eax
pop ebx
add esp, 0xfc
ret