joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4466f7
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
cmp edi, 0x88
jb 0x446707
mov dword [esi + 0x9c], 2
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
inc eax
push eax
push dword [ebp + 0x14]
movzx eax, word [ebx]
push esi
push dword [ebp + 0xc]
movzx eax, byte [eax + 0x4c2140]
push dword [ebp + 8]
lea edx, [ebx + eax*2]
call fcn.0044e337
add esp, 0x14
mov dword [ebp - 0x2c], eax
cmp eax, 0xfffffc1a
jne 0x4471a7
mov eax, dword [esi + 0x90]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x34], 1
int3
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
lea ebx, [eax + ecx*2]
mov eax, dword [esi + 0x80]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x84]
cmp dword [ebp - 8], eax
je 0x4471f6
mov dword [ebp - 8], eax
jmp 0x4466f5
cmp eax, 0xfffffc20
jne 0x4471d2
movzx eax, word [ebx + 2]
lea eax, [ebx + eax*2]
cmp dword [esi + 0x80], eax
jae 0x44e3d4
cmp word [ebx], 0x77
je 0x4471da
cmp word [eax], 0x77
je 0x4471da
jmp 0x4949a2
test eax, eax
jne 0x4089db
movzx eax, word [ebx + 2]
cmp word [ebx + eax*2], 0x77
ja 0x447171
sbb al, 0x43
jne 0x44720f
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x94], eax
jmp 0x48cce7
movzx eax, word [ebx + 2]
cmp word [ebx + eax*2], 0x77
lea ebx, [ebx + eax*2]
je 0x4471f6
add ebx, 4
mov dword [ebp - 0x30], ebx
jmp 0x44f184
cmp dword [ebp - 0x34], 0
jne 0x447204
cmp dword [ebp - 0x24], 0
or ah, cl
dec ecx
mov edi, dword [0x49c694]
push 0x130b
push esi
call edi
cmp byte [ebp + 0x10], 0
mov dword [ebx], eax
invalid

Function at 0x446837
Capabilities:
Set registry value

Disassembly:
and byte [esi], ah
dec ebp
add byte [ebx - 0x3f7afb3c], al
jg case.0x408896.157
js 0x4089db
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
lea ebx, [ecx + 8]
add eax, 0xfffffffc
mov ecx, ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
invalid
invalid

Function at 0x4469e7
Capabilities:
Set registry value

Disassembly:
add byte [ebx + 0x4d8bd455], cl
clc
mov dword [esi + 0x9c], 1
mov eax, dword [ebp + 0x18]
inc eax

Function at 0x4469f0
Capabilities:
Set registry value

Disassembly:
add byte [ebx + 0x4d8bd455], cl
clc
mov dword [esi + 0x9c], 1
mov eax, dword [ebp + 0x18]
inc eax
Function at 0x4469fb
Capabilities:
Set registry value

Disassembly:
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
or al, ch
or al, 0x7c
add byte [eax], al
add esp, 0x14
cmp eax, 1
jne 0x446a7d
mov eax, dword [esi + 0x90]
cmp eax, dword [ebp + 0xc]
jle 0x446a1f
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov ecx, 0x92
mov dword [ebp - 0x20], 1
add byte [eax], al
add byte [esi + 0x39], ah
or byte [ebp + 5], dh
lea eax, [ebx + 2]
mov ebx, eax
movzx eax, word [eax + 2]
cmp word [ebx + eax*2], 0x77
lea edx, [ebx + eax*2]
jne 0x446a54
movzx eax, word [edx + 2]
cmp word [edx + eax*2], 0x77
lea edx, [edx + eax*2]
je 0x446a46
mov eax, dword [ebp - 0x30]
mov ecx, 2
movzx eax, byte [eax + 0x4c2140]
sub ecx, eax
lea ebx, [edx + ecx*2]
mov edx, dword [ebp - 8]
push ebp
clc
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax + 0x4c2140]
jmp 0x48c78c
test eax, eax
je 0x446a8c
cmp eax, 0xfffffc20
jne 0x4089db
mov edx, dword [ebp - 8]
sal byte [eax + ecx - 0x75], 0x44
and al, 0x20

Function at 0x446ae7
Capabilities:
Set registry value

Disassembly:
inc esi
adc byte [ebx + 0x452b0c4e], cl
in al, 0x8b
add al, 0x81
mov dword [ecx + edi*4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [esi + 0x78]
dec esi
js 0x446a75
inc esi
or al, 0xd1
stc
mov dword [eax + edi*4 + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp edi, ecx
jl 0x449253
mov eax, dword [esi + 0xc]
lea edx, [eax + ecx*4]
lea ecx, [eax + edi*4]
cmp edx, ecx
jae 0x446b1b
sub ecx, edx
mov edx, dword [ebp - 8]
jmp 0x450f9d
add byte [eax], al
lea eax, [ebp - 0x30]
push eax
lea eax, [ebx + 0x20]
push eax
push edi
call 0x4d48cc
test eax, eax
js 0x4510bb
cmp dword [ebx + 0x2c], 8
jne 0x4510bb
lea eax, [ebp - 0x30]
jmp 0x4a145d

Function at 0x446d7b
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0xc8], eax
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x78]
sar eax, 1
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp + 8]
sub eax, dword [esi + 0x78]
sar eax, 1
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 8]
sub eax, dword [esi + 0x78]
sar eax, 1
mov dword [ebp - 0xbc], eax
movzx eax, word [ebx + 4]
mov dword [ebp - 0xac], eax
movzx eax, word [ebx + 6]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0xc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xb8], eax
mov eax, dword [esi + 0x94]
and eax, 0xffff
mov dword [ebp - 0xb4], eax
jne 0x446dea
mov dword [ebp - 0xb4], 0xffffffff
mov eax, dword [esi + 0xac]
mov dword [ebp - 0xb0], eax
mov eax, dword [esi + 0xb4]
add byte [eax], al
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0xd4]
push eax
call dword [0x4d2620]
add esp, 4
test eax, eax
jg case.0x408896.157
js 0x4089db
mov edx, dword [ebp - 8]
add ebx, 8
mov dword [ebp - 0x30], ebx
jmp 0x44ea97
or al, ch
xlatb
xchg dword [esi], eax
add byte [ebp - 0x74ae3fb3], cl
dec ebp
clc
Function at 0x447533
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
cmp dword [esi + 0x8c], 0
je 0x408ac3
cmp eax, dword [esi + 0x88]
jmp 0x44751a
jbe 0x408ac3
mov dword [esi + 0x68], 1
cmp dword [esi + 0x8c], 1
mov word [eax], es
add byte [eax], al
add dword [edi], ecx
invalid
invalid
outsb dx, byte [esi]
add byte [eax], al
invalid
add cl, ch
mov edi, 0x8300007e
invalid
jle 0x447588
jmp 0x44f3f8
add byte [edi], cl
test dword [esi + 0x1a], esi
cld
inc dword [ebx + 0x74005c7e]
push cs
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x7c]
jb case.0x408896.157
jmp 0x4474ff
sub ecx, eax
mov eax, dword [ebp - 8]
cmp eax, ecx
ja 0x447480
mov ax, word [eax]
cmp ax, word [esi + 0x34]
jne fcn.0044747d
cmp edx, 1
je 0x4475b8
mov eax, dword [ebp - 8]
mov ax, word [eax + 2]
cmp ax, word [esi + 0x36]
jne fcn.0044747d
mov ecx, dword [edi]
mov eax, dword [esi + 0x7c]
add ecx, ecx
sub eax, ecx
cmp dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jne 0x447480
jmp 0x48decd
add byte [0x2000000], bh
jae 0x44f408
fmul qword [0x4c33f8]
jmp 0x44f41d
cmp eax, 0x8000000
jae 0x44f417
fmul qword [0x4c33f0]
jmp 0x44f41d
fmul qword [0x4c33e8]
call fcn.004420b0
test eax, eax
jne 0x44f42b
push 0x10
pop eax
jmp 0x44f431
add eax, 0xf
and eax, 0xfffffff0
push eax
mov dword [edi + 8], eax
call fcn.0046e641
cmp dword [edi], 0
mov esi, eax
pop ecx
je 0x44f459
mov ecx, dword [edi + 4]
inc ecx
push ecx
push dword [edi]
push esi
call fcn.0046f66b
push dword [edi]
call fcn.0046e666
add esp, 0x10
mov dword [edi], esi
jmp 0x458384
Function at 0x4475ee
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov ax, word [edx]
mov ecx, edx
and ax, di
mov edi, 0xdc00
cmp ax, di
jne 0x447607
lea ecx, [edx - 2]
mov edx, ecx
cmp ecx, dword [esi + 0x88]
jae 0x447615
mov dword [esi + 0x88], edx
movzx ecx, word [edx]
mov eax, ecx
mov edi, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x447644
movzx eax, word [edx + 2]
and ecx, 0x3ff
and eax, 0x3ff
shl ecx, 0xa
or ecx, eax
enter 0xffffffffffffc181, 0
add byte [ecx], al
invalid
mov edi, ecx
cmp dword [esi + 0x58], 0
je 0x44768e
cmp edi, 0x5f
je 0x447684
mov eax, edi
and edi, 0x7f
shr eax, 7
movzx eax, byte [eax + 0x4bff40]
shl eax, 7
add eax, edi
movzx eax, word [eax*2 + 0x4b1c40]
movzx eax, byte [eax*8 + 0x4af3f1]
mov eax, dword [eax*4 + 0x4c5350]
cmp eax, 1
je 0x447684
cmp eax, 3
jne 0x4476a9
mov eax, dword [ebp - 8]
mov edi, 1
jmp 0x4476ae
cmp edi, 0x100
jae 0x4476a9
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 0x10
mov eax, dword [ebp - 8]
je 0x4476ac
mov edi, 1
jmp 0x4476ae
mov eax, dword [ebp - 8]
xor edi, edi
cmp eax, dword [esi + 0x7c]
jae 0x447869
movzx ecx, word [eax]
mov eax, ecx
mov edx, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x4476e9
mov eax, dword [ebp - 8]
and ecx, 0x3ff
shl ecx, 0xa
movzx eax, word [eax + 2]
and eax, 0x3ff
or ecx, eax
add ecx, 0x10000
mov edx, ecx
cmp dword [esi + 0x58], 0
je 0x447711
cmp edx, 0x5f
je 0x4478bb
mov eax, edx
and edx, 0x7f
cmp edx, 0x100
jae 0x447726
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 0x10
jne 0x4478bb
invalid
Function at 0x447725
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov ax, word [edx]
mov ecx, edx
and ax, di
mov edi, 0xdc00
cmp ax, di
jne 0x447607
lea ecx, [edx - 2]
mov edx, ecx
cmp ecx, dword [esi + 0x88]
jae 0x447615
mov dword [esi + 0x88], edx
movzx ecx, word [edx]
mov eax, ecx
mov edi, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x447644
movzx eax, word [edx + 2]
and ecx, 0x3ff
and eax, 0x3ff
shl ecx, 0xa
or ecx, eax
enter 0xffffffffffffc181, 0
add byte [ecx], al
invalid
mov edi, ecx
cmp dword [esi + 0x58], 0
je 0x44768e
cmp edi, 0x5f
je 0x447684
mov eax, edi
and edi, 0x7f
shr eax, 7
movzx eax, byte [eax + 0x4bff40]
shl eax, 7
add eax, edi
movzx eax, word [eax*2 + 0x4b1c40]
movzx eax, byte [eax*8 + 0x4af3f1]
mov eax, dword [eax*4 + 0x4c5350]
cmp eax, 1
je 0x447684
cmp eax, 3
jne 0x4476a9
mov eax, dword [ebp - 8]
mov edi, 1
jmp 0x4476ae
cmp edi, 0x100
jae 0x4476a9
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 0x10
mov eax, dword [ebp - 8]
je 0x4476ac
mov edi, 1
jmp 0x4476ae
mov eax, dword [ebp - 8]
xor edi, edi
cmp eax, dword [esi + 0x7c]
jae 0x447869
movzx ecx, word [eax]
mov eax, ecx
mov edx, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x4476e9
mov eax, dword [ebp - 8]
and ecx, 0x3ff
shl ecx, 0xa
movzx eax, word [eax + 2]
and eax, 0x3ff
or ecx, eax
add ecx, 0x10000
mov edx, ecx
cmp dword [esi + 0x58], 0
je 0x447711
cmp edx, 0x5f
je 0x4478bb
mov eax, edx
and edx, 0x7f
cmp edx, 0x100
jae 0x447726
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 0x10
jne 0x4478bb
invalid

Function at 0x447748
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
inc esi
js 0x4477bf
je 0x447788
xchg byte [eax + 0x77000000], cl
or al, 0x83
sar dh, 0x89
xchg byte [eax - 0x75000000], cl
inc ebp
clc
cmp dword [esi + 0x58], 0
movzx ecx, word [eax - 2]
je 0x447841
cmp ecx, 0x5f
je 0x44783a
mov eax, ecx
test eax, eax
jns 0x447780
add eax, 0x7f
sar eax, 7
movzx eax, byte [eax + 0x4bff40]
shl eax, 7
dec ebx
add cl, al
loopne 0x447794
and ecx, 0x8000007f
jns 0x44779a
add eax, 0x80c98349
dec ecx
or ecx, 0xffffff80
inc ecx
add eax, ecx
movzx eax, word [eax*2 + 0x4b1c40]
add byte [edi], cl
mov dh, 4
vpsllq xmm1, xmm1, xmmword [edx]
mov eax, dword [eax*4 + 0x4c5350]
cmp eax, 1
jp 0x4477f4
invalid
mov edx, 0xff
cmp cx, dx
ja 0x4477c0
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 0x10
mov eax, dword [ebp - 8]
je 0x4477c0
mov edi, 1
jmp 0x48e427
and al, 0x38
push eax
lea ecx, [esp + 0x4c]
call fcn.00494077
lea ecx, [esp + 0x34]

Function at 0x44781d
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
xor ecx, ecx
movzx eax, word [ebx]
add ebx, 2
mov dword [ebp - 0x30], ebx
cmp eax, 5
jne 0x4478c5
cmp ecx, edi
je case.0x408896.157
invalid
jmp 0x44f6bc
cmp eax, 1
je 0x4478bb
cmp eax, 3
invalid
invalid
Function at 0x447aee
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add byte [0x3ff], ah
or ecx, eax
add ecx, 0x10000
add dword [ebp - 8], 2
mov edx, ecx
cmp edx, 0x100

Function at 0x447b08
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
jae 0x408ac3
mov eax, dword [esi + 0x44]
test byte [ecx + eax], 1
jne case.0x408896.157
jmp 0x44f9df
dec ebp
add byte [ebx - 0x7bf00006], al
pop esi
mov dl, 0xfb
dec dword [ebx + 0x4d19440d]
add byte [ebx - 0x7bf00007], al
dec edi
mov dl, 0xfb
invalid

Function at 0x447d31
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
movzx ecx, word [eax]
add eax, 2
cmp dword [ebp - 0x28], 0
mov dword [ebp - 8], eax
je 0x447d6e
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x447d6e
mov eax, dword [ebp - 8]
and ecx, 0x3ff
shl ecx, 0xa
movzx eax, word [eax]
and eax, 0x3ff
or ecx, eax
add ecx, 0x10000
add dword [ebp - 8], 2
cmp ecx, 0x180e
ja 0x447db2
je case.0x408896.157
cmp ecx, 0xa0
ja 0x447da1
invalid
test byte [edi], ch
invalid

Function at 0x448260
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
jb 0x408ac3
cmp edi, dword [esi + 0x88]
jbe 0x408ac3
mov dword [esi + 0x68], 1
cmp dword [esi + 0x8c], 1
jg 0x44e351
jmp 0x45014a
push edi
push dword [ebp + 8]
call 0x4d4df1
jmp 0x45b124
invalid

Function at 0x448325
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0xc]
cmp dword [eax + edi*4], 0
jl 0x448337
mov ecx, dword [eax + edi*4 + 4]
sub ecx, dword [eax + edi*4]
or al, 0xb8
jmp fcn.00448341
mov ecx, dword [esi + 0x54]
neg ecx
sbb ecx, ecx
neg ecx
dec ecx

Function at 0x44853f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
dec dword [edi]
mov dh, 0x80
inc ecx
out 0x44, eax
add bh, bh
jmp dword [eax*4 + 0x44e739]
lea eax, [ecx - 0x62]
add ebx, 2
mov dword [ebp - 0x30], ebx
cmp eax, 8
jae 0x448504
mov ecx, eax
and ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x44850b
movsx edx, byte [eax + 0x4b1c2c]
movsx eax, byte [eax + 0x4b1c20]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x408afb
mov dword [ebp - 0x20], 0x7fffffff
jmp fcn.0045042a
rol byte [ebx - 0x48f09206], 0x53
add cl, byte [ecx - 0x6bf017ab]
ror byte [ecx - 0x48f02bbb], 0x43
add al, 0x89
inc ebp
loopne 0x4484dd
sal byte [ebp + 7], 0xc7
inc ebp
loopne 0x44855e
invalid
invalid
Function at 0x4488df
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x43
mov edi, ecx
mov dword [ebp - 0x30], ebx
lea eax, [edi - 0x62]
cmp eax, 0xb
ja case.default.0x448835
movzx eax, byte [eax + 0x44e755]
jmp dword [eax*4 + 0x44e74d]
lea eax, [edi - 0x62]
add ebx, 2
mov dword [ebp - 0x30], ebx
cmp eax, 8
jae 0x448854
mov ecx, eax
and ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x44885b
mov dword [ebp - 0x2c], 1
movsx ecx, byte [eax + 0x4b1c20]
movsx edi, byte [eax + 0x4b1c2c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ecx
test ecx, ecx
leave
jne 0x4488c8
mov ecx, 0x7fffffff
jmp 0x4488c5
movzx edi, word [ebx + 2]
xor eax, eax
cmp ecx, 0x69
mov dword [ebp - 0x18], edi
sete al
cmp ecx, 0x6d
mov ecx, 0
mov dword [ebp - 0x10], eax
sete cl
mov dword [ebp - 0x2c], ecx
movzx ecx, word [ebx + 4]
mov dword [ebp - 0x20], ecx
test ecx, ecx
jne 0x4488b0
mov ecx, 0x7fffffff
mov dword [ebp - 0x20], ecx
add ebx, 6
mov dword [ebp - 0x30], ebx
jmp 0x4488c8
mov eax, dword [ebp - 0x10]
mov ecx, 1
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], 1
cmp edi, 1
jl 0x448946
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x7c]
jae 0x44cdc7
invalid
movzx ecx, word [eax]
add eax, 2
mov edx, dword [ebp - 0x28]
mov dword [ebp - 8], eax
test edx, edx
je 0x44891e
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x44891e
mov eax, dword [ebp - 8]
and ecx, 0x3ff
shl ecx, 0xa
movzx eax, word [eax]
and eax, 0x3ff
or ecx, eax
add ecx, 0x10000
add dword [ebp - 8], 2
push edx
mov edx, dword [ebp - 0x24]
call 0x4e323f
add esp, 4
test eax, eax
invalid
invalid
xchg dword [esi], eax

Function at 0x448930
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
cld
dec dword [ebx - 0x76bf33bb]
inc ebp
int3

Function at 0x448bfe
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
rol bh, cl
inc ebp
aam 1
add byte [eax], al
add byte [ebx + 0x558902c3], al
in al, dx
mov ecx, ebx
jmp 0x448c74
mov dword [ebp - 0x18], 0x7fffffff
cmp dword [ebp - 0x28], 0
movzx eax, word [ebx]

Function at 0x448d0c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
shr eax, 7
movzx ecx, byte [eax + 0x4bff40]

Function at 0x448d16
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov eax, edi
shl ecx, 7
and eax, 0x7f
add ecx, eax
movzx eax, word [ecx*2 + 0x4b1c40]
invalid
invalid
Function at 0x448d7f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
mov edi, dword [ebp - 8]
sub eax, ecx
cmp edi, eax
ja 0x448d8b
push ecx
push dword [ebp - 0x34]
push edi
call fcn.00469508
add esp, 0xc
test eax, eax
jne 0x448d8b
mov ecx, dword [ebp - 0x1c]
mov eax, edi
add eax, ecx
mov dword [ebp - 8], eax
inc ebp
clc
jmp 0x448dca
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x44ca92
lea ecx, [eax + eax]
mov eax, dword [esi + 0x7c]
sub eax, ecx
cmp edi, eax
ja 0x44ca92
in al, dx
cmp al, 0
invalid
push ecx
lea eax, [ebp - 0x6c]
push eax
push edi
call 0x469541
add esp, 0xc
test eax, eax
jne 0x44ca92
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, edx
jle 0x448d62
mov edi, dword [ebp - 0x20]
jmp fcn.00448de0
cmp dword [esi + 0x8c], 0
je case.0x408896.157
cmp edi, dword [esi + 0x7c]

Function at 0x448de3
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
je 0x408b79
cmp dword [ebp - 0x10], 0
jne 0x44cddf
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp edx, dword [ebp - 0x18]
or cl, byte [edi]
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
add byte [ebx + 0x148df445], cl
add byte [ecx + 0x468be455], cl
jl 0x448d99
dec ebp
clc
mov eax, dword [ebp + 0x18]
mov edx, ebx
mov edi, dword [ebp - 8]
inc eax
push eax
push dword [ebp + 0x14]
mov ecx, edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00454a06
add esp, 0x14
test eax, eax
jne 0x4089db
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], eax
jge case.0x408896.157
mov eax, dword [ebp - 0xc]
lea ecx, [eax + eax]
mov eax, dword [esi + 0x7c]
sub eax, ecx
cmp edi, eax
ja 0x44ce36
push ecx
push dword [ebp - 0x34]
push edi
call fcn.0046d5ba
add esp, 0xc
test eax, eax
jne 0x44ce36
mov eax, dword [ebp - 0xc]
jmp 0x44ce6a
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x44ca92
lea ecx, [eax + eax]
mov eax, dword [esi + 0x7c]
sub eax, ecx
cmp edi, eax
ja 0x44ca92
push ecx
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.0046d5ec
add esp, 0xc
test eax, eax
jne 0x44ca92
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x14]
lea edi, [edi + eax*2]
mov eax, dword [ebp + 0x18]
mov edx, ebx
inc eax
mov ecx, edi
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
jne 0x44ce8c
push dword [ebp + 8]
call fcn.00454a94
add esp, 0x14
test eax, eax
je 0x44ce05
jmp 0x454c6f
add byte [eax], al
mov eax, dword [edi]
push dword [eax + 4]
call fcn.00473e8b
add esp, 4
push 8
push dword [edi]
call fcn.00473e50
add esp, 8
Function at 0x448e38
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
mov ecx, dword [ebp - 8]
sub eax, edx
cmp ecx, eax
ja fcn.00448e38
push edx
push dword [ebp - 0x34]
push ecx
call fcn.004695b0
add esp, 0xc
test eax, eax
jne 0x448e35
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
lea eax, [eax + ecx*2]
add al, 0x48
mov dword [ebp - 8], eax
jmp 0x448e5f
mov ecx, dword [ebp - 8]
test edi, edi
jle 0x448e70
mov eax, dword [esi + 0x7c]
add edi, edi
sub eax, edi
cmp ecx, eax
ja 0x448e70
push edi
lea eax, [ebp - 0x6c]
push eax
push ecx
call fcn.004695e2
add esp, 0xc
test eax, eax
jne 0x448e70
add dword [ebp - 8], edi
mov edi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
inc edx
cmp edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x1c]
jl 0x448e0a
jmp 0x448e9d
cmp dword [esi + 0x8c], 0
mov eax, dword [ebp - 8]
je 0x448ea0
cmp eax, dword [esi + 0x7c]
jb 0x448e9d
cmp eax, dword [esi + 0x88]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x2c], 0
jne 0x408b79
cmp eax, ecx
jbe 0x408992
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0x18]
mov edx, ebx
inc eax
mov ecx, edi
push eax
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00450adc
add esp, 0x14
test eax, eax
jne 0x4089db
mov ax, word [edi - 2]
add edi, 0xfffffffe
mov ecx, 0xfc00
mov dword [ebp - 8], edi
and ax, cx
mov ecx, 0xdc00
cmp ax, cx
jne 0x448efd
add edi, 0xfffffffe
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0x10]
ja 0x448eb8
jmp 0x450c95
test byte [edx + 0x50fffbbf], dh
call fcn.0045a963
jmp 0x45cced
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
add edx, 0x40
jmp fcn.0045cd07

Function at 0x448e87
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
jbe 0x448e9d
mov dword [esi + 0x68], 1
cmp dword [esi + 0x8c], 1
jg 0x44e351

Function at 0x4491b0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
and eax, 0x3ff
add ecx, 2
or edx, eax
mov dword [ebp - 8], ecx
add edx, 0x10000
cmp edi, 0x1f
jne 0x4491d6
cmp dword [ebp - 0x24], edx
je case.0x408896.157
jmp 0x408b79
mov edi, dword [ebp - 0x24]
cmp edi, 0x7f
jbe 0x449207
mov eax, edi
shr eax, 7
movzx ecx, byte [eax + 0x4bff40]
mov eax, edi
and eax, 0x7f
shl ecx, 7
add ecx, eax
invalid
mov bh, 4

Function at 0x44931f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x4b
add byte [ecx + 0x4589f455], cl
invalid
inc ebp