joyce8/EMBER2024-capa huggingface dataset:
Function at 0x514f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x514f61
cmp byte [ebx], 0
jne 0x514f90
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.00514610
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call fcn.00723a18
mov dword [ebp - 0x2c], eax
sar eax, 6
add eax, 1
mov edi, eax
mov dword [ebp - 0x28], eax
shl edi, 6
lea eax, [edi + 1]
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 1
mov dword [esp], eax
call fcn.00723880
mov edx, dword [ebp - 0x2c]
mov esi, eax
add edx, 1
mov dword [esp + 8], edx
mov dword [ebp - 0x2c], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00723980
mov edx, dword [ebp - 0x2c]
lea ecx, [esi + edi]
lea ebx, [esi + edx]
cmp edi, edx
jle 0x51500c
mov dword [ebp - 0x2c], esi
mov esi, ebx
mov ebx, ecx
nop
mov dword [esp], 0xffffffff
add esi, 1
call fcn.004fd690
and eax, 0x7f
mov byte [esi - 1], al
cmp ebx, esi
jne 0x514ff0
mov esi, dword [ebp - 0x2c]
xor eax, eax
nop
xor dword [eax*4 + 0x770b60], 0x634e872e
add eax, 1
cmp eax, 9
jne 0x515010
mov byte [0x770b80], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x770b40], 0x634e872e
add eax, 1
cmp eax, 5
jne 0x515030
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x24]
mov byte [0x770b50], 0
add eax, eax
mov dword [esp], eax
call fcn.00723880
mov dword [esp], 0xffffffff
mov ebx, eax
test eax, eax
je 0x515175
call fcn.004fd690
mov edx, eax
mov byte [ebx], al
movzx eax, byte [0x770b40]
xor al, byte [0x770b60]
xor al, byte [esi]
xor eax, edx
mov edx, 1
mov byte [ebx + 1], al
lea esi, [esi]
mov eax, edx
mov ecx, edx
and eax, 0x1f
and ecx, 0xf
movzx eax, byte [eax + 0x770b60]
xor al, byte [esi + edx]
xor al, byte [ebx]
xor al, byte [ecx + 0x770b40]
mov byte [ebx + edx + 1], al
add edx, 1
cmp edi, edx
jne 0x515098
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x770b60], 0x634e872e
add eax, 1
cmp eax, 9
jne 0x5150c8
mov byte [0x770b80], 0
xor eax, eax
lea esi, [esi]
xor dword [eax*4 + 0x770b40], 0x634e872e
add eax, 1
cmp eax, 5
jne 0x5150e8
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x28]
mov byte [0x770b50], 0
shl eax, 7
add eax, 1
mov dword [esp], eax
call fcn.00723880
mov dword [esp + 0xc], 0
mov edi, eax
mov eax, dword [ebp - 0x24]
mov dword [esp], ebx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
call fcn.00506550
mov dword [esp + 8], edi
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.00514610
mov dword [esp], edi
call fcn.007238f0
mov dword [esp], ebx
call fcn.007238f0
mov dword [ebp + 8], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.007238f0
call fcn.004fd690
mov byte [0], 0
ud2
Function at 0x5d08e0
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [0x905140]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], eax
mov eax, dword [0x905138]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x905134]
mov dword [ebp - 0x30], eax
mov eax, dword [0x905130]
mov dword [ebp - 0x34], eax
mov esi, dword [ebp - 0x1c]
mov edi, 4
mov eax, edi
mov ecx, esi
cpuid
mov dword [esp + 0x14], ecx
mov edi, eax
mov esi, ecx
mov dword [esp + 0x10], ebx
add esi, 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], str.CPUID_4___d:__08x__08x__08x__
mov dword [esp + 8], eax
mov dword [esp], 5
call fcn.004fc8f0
mov eax, ebx
mov edx, ebx
shr ebx, 0xc
shr eax, 0x16
and edx, 0x7ff
and ebx, 0x1ff
add eax, 1
add edx, 1
add ebx, 1
mul edx
mov ecx, edx
mul esi
imul ecx, esi
add edx, ecx
mov ecx, edx
mul ebx
imul ecx, ebx
add edx, ecx
shrd eax, edx, 0xa
shr edx, 0xa
mov ebx, eax
mov eax, edi
shr edi, 5
mov esi, edx
mov edx, edi
and eax, 0x1f
and edx, 7
mov dword [esp + 0x14], edx
mov dword [ebp - 0x24], edx
mov dword [esp + 0x10], eax
mov dword [ebp - 0x20], eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], str.size_dk__type_d__lev_d_n
mov dword [esp], 0xfffffffb
call fcn.004fc8f0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
cmp eax, 2
ja 0x5d09e0
test eax, eax
jne 0x5d0a20
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 3
jne 0x5d0a38
cmp edx, 3
je 0x5d0af0
and edi, 4
jne 0x5d0a50
cmp edx, 1
je 0x5d0ad0
cmp edx, 2
jne 0x5d0a38
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
jne 0x5d0a38
mov dword [0x905138], ebx
mov dword [0x905128], 1
jmp 0x5d0a38
cmp edx, 2
je 0x5d0ab0
cmp edx, 3
je 0x5d0a90
cmp edx, 1
je 0x5d0a70
lea esi, [esi]
nop
add dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
cmp eax, 0x15
jne 0x5d0910
jmp 0x5d09d0
cmp edx, 4
jne 0x5d0a38
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x5d0a38
mov dword [0x905130], ebx
mov dword [0x905120], 1
jmp 0x5d0a38
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x5d0a38
add dword [0x905140], ebx
mov dword [0x90512c], 2
jmp 0x5d0a38
mov edi, dword [ebp - 0x30]
test edi, edi
jne 0x5d0a38
add dword [0x905134], ebx
mov dword [0x905124], 2
jmp 0x5d0a38
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x5d0a38
add dword [0x905138], ebx
mov dword [0x905128], 2
jmp 0x5d0a38
mov esi, dword [ebp - 0x28]
test esi, esi
jne 0x5d0a38
mov dword [0x905140], ebx
mov dword [0x90512c], 1
jmp 0x5d0a38
mov edx, dword [ebp - 0x30]
test edx, edx
jne 0x5d0a38
mov dword [0x905134], ebx
mov dword [0x905124], 1
jmp 0x5d0a38
Function at 0x5dc1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x9053e8
push ebx
xor ecx, ecx
mov ebx, 0x155aa01
mov dword [esi], ebx
mov dword [esi + 4], ebx
movq mm0, qword [esi]
movq mm1, mm0
movq mm2, mm0
movq mm3, mm0
movq mm4, mm0
movq mm5, mm0
movq mm6, mm0
movq mm7, mm0
mov edx, 1
pand mm0, mm1
movd eax, mm0
cmp eax, ebx
setne ch
or cl, ch
pandn mm0, mm2
movd eax, mm0
cmp eax, 0
setne ch
or cl, ch
por mm0, mm3
movd eax, mm0
cmp eax, ebx
setne ch
or cl, ch
pxor mm0, mm4
movd eax, mm0
cmp eax, 0
setne ch
or cl, ch
pxor mm0, mm5
movd eax, mm0
cmp eax, ebx
setne ch
or cl, ch
inc edx
cmp edx, 0xf
jbe 0x5dc1f3
pop ebx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x638460
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x5c
mov byte [eax + 0x294], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0064d010
test eax, eax
jns 0x6384a8
movzx eax, byte [ebx + 0x295]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], 0
lea edi, [ebp - 0x30]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0x34
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x24]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 8
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2d1400
mov eax, dword [ebx + 0x23c]
mov dword [esp], eax
mov eax, dword [0x90b650]
mov dword [ebp - 0x3c], eax
call eax
sub esp, 0x20
test eax, eax
jne 0x638558
mov byte [ebx + 0x295], 0
test esi, esi
je 0x638496
mov dword [esp], ebx
mov dword [esp + 4], 0
call fcn.0064d230
movzx eax, byte [ebx + 0x295]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x28]
mov dword [esp], edx
mov dword [ebp - 0x40], edx
call fcn.00712020
mov edx, dword [ebp - 0x40]
mov dword [esp + 8], edx
mov dword [ebp - 0x44], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x40], eax
call fcn.00723990
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0x24]
mov dword [esp + 0x18], edi
mov edx, dword [ebp - 0x44]
mov dword [esp + 0x14], edx
mov ecx, dword [ebp - 0x40]
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x2d1400
mov eax, dword [ebx + 0x23c]
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
call eax
mov ecx, dword [ebp - 0x40]
sub esp, 0x20
test eax, eax
je 0x63863a
movsx eax, word [ecx + 8]
xor edx, edx
movzx edi, word [ecx + 0xc]
mov byte [ebx + 0x295], 1
test ax, ax
mov dword [ebx + 0x2a0], edi
cmovs eax, edx
mov dword [ebx + 0x298], eax
movsx eax, word [ecx + 0xa]
test ax, ax
cmovs eax, edx
mov dword [ebx + 0x29c], eax
test edi, edi
je 0x63863a
mov dword [ebp - 0x3c], esi
xor eax, eax
lea esi, [esi]
nop
mov edx, eax
shl edx, 4
movsx edx, word [ecx + edx + 0x1a]
lea esi, [edx + 0x63]
cmp si, 0x12a
ja 0x63862b
mov dword [ebx + eax*4 + 0x2a4], edx
add eax, 1
cmp eax, 8
je 0x638637
cmp edi, eax
jg 0x638610
mov esi, dword [ebp - 0x3c]
mov dword [esp], ecx
call fcn.00712030
jmp 0x63852a
Function at 0x6388e0
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x58]
sub esp, 0x8c
movsx esi, byte [ebp + 8]
mov dword [esp + 4], 0x7faf2c
mov dword [esp + 8], esi
mov dword [esp], ebx
call dword [0x90d244]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], ebx
call dword [0x90b630]
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x638a60
mov dword [ebp - 0x68], 0
mov ebx, eax
test byte [0x901e9b], 1
je 0x6389d0
mov byte [ebp - 0x6c], 0
mov edi, dword [0x90b650]
lea ecx, [ebp - 0x68]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2d0800
mov dword [esp], ebx
call edi
sub esp, 0x20
mov edi, eax
test eax, eax
je 0x638a88
mov dword [esp], ebx
call dword [0x90b620]
sub esp, 4
test edi, edi
setne al
or al, byte [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebp - 0x68]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0
mov edi, dword [0x90b650]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0
mov dword [ebp - 0x6c], ecx
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2d1080
mov dword [esp], ebx
call edi
mov ecx, dword [ebp - 0x6c]
sub esp, 0x20
test eax, eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x70], ecx
jne 0x638ab0
mov dword [esp + 4], str.IOCTL_STORAGE_GET_DEVICE_NUMBER_failed_n
mov dword [esp], 6
call fcn.004fc8f0
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
test eax, eax
sete byte [ebp - 0x6c]
jmp 0x63896c
mov dword [esp + 8], esi
mov dword [esp + 4], str.cannot_open__c:_for_reading_attributes_n
mov dword [esp], 6
call fcn.004fc8f0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x68]
mov dword [esp + 8], esi
mov dword [esp + 4], str.IOCTL_STORAGE_CHECK_VERIFY2_failed_for__c:___d__n
mov dword [esp + 0xc], eax
mov dword [esp], 6
call fcn.004fc8f0
jmp 0x6389b2
mov edx, dword [ebp - 0x5c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x60]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x64]
mov dword [esp + 4], str.IOCTL_STORAGE_GET_DEVICE_NUMBER:__d__d__d_n
mov dword [esp + 8], edx
mov dword [esp], 6
call fcn.004fc8f0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x70]
jmp 0x638a53
Function at 0x6aa200
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp edx, 0xe100
je 0x6aa470
jg 0x6aa2f0
cmp edx, 0x258
je 0x6aa460
jle 0x6aa278
cmp edx, 0x12c0
je 0x6aa430
jle 0x6aa258
mov eax, 0xd
cmp edx, 0x4b00
je 0x6aa252
cmp edx, 0x9600
jne 0x6aa336
mov eax, 0xe
pop ebp
ret
mov eax, 9
cmp edx, 0x708
je 0x6aa252
cmp edx, 0x960
jne 0x6aa2a2
mov eax, 0xa
pop ebp
ret
cmp edx, 0x86
je 0x6aa440
jle 0x6aa2cc
mov eax, 5
cmp edx, 0xc8
je 0x6aa252
cmp edx, 0x12c
jne 0x6aa2b7
mov eax, 6
pop ebp
ret
cmp edx, 0x4b0
mov eax, 8
mov edx, 0x28
pop ebp
cmovne eax, edx
ret
cmp edx, 0x96
mov eax, 4
mov edx, 0x28
pop ebp
cmovne eax, edx
ret
mov eax, 1
cmp edx, 0x4b
je 0x6aa252
cmp edx, 0x6e
jne 0x6aa34b
mov eax, 2
pop ebp
ret
cmp edx, 0x119400
je 0x6aa450
jle 0x6aa380
cmp edx, 0x2dc6c0
je 0x6aa410
jle 0x6aa35a
mov eax, 0x1c
cmp edx, 0x3567e0
je 0x6aa252
cmp edx, 0x3d0900
mov eax, 0x1d
mov edx, 0x28
pop ebp
cmovne eax, edx
ret
cmp edx, 0x2580
mov eax, 0xc
mov edx, 0x28
pop ebp
cmovne eax, edx
ret
xor eax, eax
cmp edx, 0x32
mov edx, 0x28
pop ebp
cmovne eax, edx
ret
mov eax, 0x19
cmp edx, 0x1e8480
je 0x6aa252
cmp edx, 0x2625a0
jne 0x6aa3ae
mov eax, 0x1a
pop ebp
ret
cmp edx, 0x7a120
je 0x6aa420
jle 0x6aa3d8
mov eax, 0x15
cmp edx, 0xe1000
je 0x6aa252
cmp edx, 0xf4240
jne 0x6aa3c3
mov eax, 0x16
pop ebp
ret
cmp edx, 0x16e360
mov eax, 0x18
mov edx, 0x28
pop ebp
cmovne eax, edx
ret
cmp edx, 0x8ca00
mov eax, 0x14
mov edx, 0x28
pop ebp
cmovne eax, edx
ret
mov eax, 0x11
cmp edx, 0x38400
je 0x6aa252
cmp edx, 0x70800
jne 0x6aa3f8
mov eax, 0x12
pop ebp
ret
cmp edx, 0x1c200
mov eax, 0x10
mov edx, 0x28
pop ebp
cmovne eax, edx
ret
mov eax, 0x1b
pop ebp
ret
mov eax, 0x13
pop ebp
ret
mov eax, 0xb
pop ebp
ret
mov eax, 3
pop ebp
ret
mov eax, 0x17
pop ebp
ret
mov eax, 7
pop ebp
ret
mov eax, 0xf
pop ebp
ret
Function at 0x6b8640
Capabilities:
Encode data using xor

Disassembly:
push ebp
pxor xmm0, xmm0
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
add esp, 0xffffff80
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
movups xmmword [edx], xmm0
movups xmmword [edx + 0x10], xmm0
movups xmmword [edx + 0x20], xmm0
movups xmmword [edx + 0x30], xmm0
movups xmmword [edx + 0x40], xmm0
test ebx, ebx
je 0x6b874b
mov dword [esp], ebx
call fcn.00723a18
cmp eax, 0xa2
jne 0x6b874b
movzx edi, word [0x8213c8]
xor esi, esi
lea esi, [esi]
movzx eax, word [ebx + esi*2]
mov dword [esp + 4], 0
mov word [esp + 0x18], di
mov word [esp + 0x1a], ax
lea eax, [esp + 0x18]
mov dword [esp], eax
mov byte [esp + 0x1c], 0
call fcn.005027d0
mov edx, esi
and edx, 0xf
xor al, byte [edx + 0x821360]
mov byte [esp + esi + 0x20], al
add esi, 1
cmp esi, 0x51
jne 0x6b8690
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x70]
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm2, xmm2
lea esi, [esi]
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax]
add eax, 0x10
punpckhbw xmm0, xmm4
punpcklbw xmm1, xmm4
movdqa xmm5, xmm0
punpckhwd xmm0, xmm2
punpcklwd xmm5, xmm2
paddd xmm0, xmm5
movdqa xmm5, xmm1
punpcklwd xmm1, xmm2
punpckhwd xmm5, xmm2
paddd xmm1, xmm5
paddd xmm0, xmm1
paddd xmm3, xmm0
cmp ecx, eax
jne 0x6b86e8
movdqa xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
cmp byte [esp + 0x70], al
je 0x6b8753
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movdqu xmm6, xmmword [esp + 0x20]
movdqu xmm7, xmmword [esp + 0x30]
movups xmmword [edx], xmm6
movdqu xmm6, xmmword [esp + 0x40]
movups xmmword [edx + 0x10], xmm7
movdqu xmm7, xmmword [esp + 0x50]
movups xmmword [edx + 0x20], xmm6
movdqu xmm6, xmmword [esp + 0x60]
movups xmmword [edx + 0x30], xmm7
movups xmmword [edx + 0x40], xmm6
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x711b40
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x711b65
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x711b70
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x711b65
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x711bb8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x711bae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x711bba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x711ba0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x73a980
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ecx + 0xa8]
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ecx + 0xa4], 0
mov eax, edi
mov byte [ebp - 0x19], al
lea eax, [ecx + 0xa0]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0xa0]
mov byte [eax], 0
mov eax, dword [ecx + 0x94]
mov edx, dword [ecx + 0x98]
cmp eax, edx
je 0x73aabb
mov dword [ebp - 0x28], edi
mov ebx, ecx
jmp 0x73aa00
mov byte [eax + esi], dl
mov eax, dword [ebx + 0xa0]
mov dword [ebx + 0xa4], edi
mov byte [eax + esi + 1], 0
mov eax, dword [ebx + 0x94]
mov edx, dword [ebx + 0x98]
cmp eax, edx
je 0x73aab8
movzx ecx, byte [ebp - 0x19]
cmp byte [eax], cl
je 0x73aa80
lea edx, [eax + 1]
mov esi, dword [ebx + 0xa4]
mov ecx, dword [ebp - 0x20]
mov dword [ebx + 0x94], edx
movzx edx, byte [eax]
mov eax, dword [ebx + 0xa0]
lea edi, [esi + 1]
cmp eax, ecx
je 0x73aa70
mov ecx, dword [ebx + 0xa8]
cmp ecx, edi
jae 0x73a9d8
mov byte [ebp - 0x1a], dl
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
mov ecx, dword [ebp - 0x24]
call fcn.00712108
mov eax, dword [ebx + 0xa0]
movzx edx, byte [ebp - 0x1a]
sub esp, 0x10
jmp 0x73a9d8
mov ecx, 0xf
jmp 0x73aa30
mov edi, dword [ebp - 0x28]
cmp edx, eax
je 0x73aabb
lea esi, [eax + 1]
mov ecx, edi
mov dword [ebx + 0x94], esi
cmp byte [eax], cl
jne 0x73aabb
cmp esi, edx
je 0x73aabb
lea edx, [eax + 2]
mov dword [ebx + 0x94], edx
cmp byte [eax + 1], 0x5d
jne 0x73aabb
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov edi, dword [ebp - 0x28]
mov eax, edi
cmp al, 0x3a
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00712078
nop
nop
nop
Function at 0x73af00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ecx + 0x94]
mov esi, dword [ecx + 0x98]
cmp eax, esi
je 0x73b0ea
lea edi, [eax + 1]
mov ebx, ecx
mov dword [ecx + 0x94], edi
movzx ecx, byte [eax]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebx + 0x9c]
mov edx, ecx
mov edi, dword [edi + 0x18]
test byte [edi + ecx*2], 8
jne 0x73afb0
cmp cl, 0x2c
je 0x73af98
test dword [ebx + 0x80], 0x120
je 0x73b0c0
cmp cl, 0x5c
jne 0x73b0de
mov edi, dword [ebp - 0x1c]
cmp esi, edi
je 0x73b0de
cmp byte [eax + 1], 0x7d
jne 0x73b0de
add eax, 2
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x84], 0xd
mov dword [ebx + 0x94], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 0x84], 0x19
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebx + 0xa0]
movsx edx, dl
mov dword [ebx + 0x84], 0x1a
mov dword [ebp - 0x24], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov eax, dword [ebx + 0xa4]
mov dword [esp], 0
mov dword [esp + 4], eax
call fcn.00712138
mov eax, dword [ebx + 0x94]
sub esp, 0x10
cmp eax, dword [ebx + 0x98]
je 0x73af8c
lea edi, [ebx + 0xa8]
mov dword [ebp - 0x1c], edi
jmp 0x73b02e
mov byte [eax + esi], dl
mov eax, dword [ebx + 0xa0]
mov dword [ebx + 0xa4], edi
mov byte [eax + esi + 1], 0
mov eax, dword [ebx + 0x94]
cmp eax, dword [ebx + 0x98]
je 0x73af8c
mov edx, dword [ebx + 0x9c]
movzx ecx, byte [eax]
mov edx, dword [edx + 0x18]
test byte [edx + ecx*2], 8
je 0x73af8c
lea edx, [eax + 1]
mov esi, dword [ebx + 0xa4]
mov ecx, dword [ebp - 0x1c]
mov dword [ebx + 0x94], edx
movzx edx, byte [eax]
mov eax, dword [ebx + 0xa0]
lea edi, [esi + 1]
cmp eax, ecx
je 0x73b0b0
mov ecx, dword [ebx + 0xa8]
cmp ecx, edi
jae 0x73b008
mov byte [ebp - 0x1d], dl
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
mov ecx, dword [ebp - 0x24]
call fcn.00712108
mov eax, dword [ebx + 0xa0]
movzx edx, byte [ebp - 0x1d]
sub esp, 0x10
jmp 0x73b008
mov ecx, 0xf
jmp 0x73b06c
cmp cl, 0x7d
jne 0x73b0de
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x84], 0xd
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 7
call fcn.00712078
mov dword [esp], 6
call fcn.00712078
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x10006660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
mov esi, edi
cmp dword [edi + 0x14], 0xf
mov ebx, dword [edi + 0x10]
jbe 0x1000667c
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1000669b
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10006687
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [eax + ecx*8 + 4]
lea eax, [eax + ecx*8]
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], eax
cmp esi, dword [ecx + 4]
je 0x100066f9
cmp dword [esi + 0x1c], 0xf
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jbe 0x100066c3
mov eax, dword [eax]
cmp dword [edi + 0x14], 0xf
mov ecx, edi
jbe 0x100066cd
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.10003080
add esp, 0x10
test al, al
jne 0x100066e9
mov eax, dword [ebp + 8]
cmp esi, dword [eax]
je 0x100066f9
mov esi, dword [esi + 4]
jmp 0x100066b5
test esi, esi
je 0x100066f9
pop edi
lea eax, [esi + 0x20]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
int3
Function at 0x1000bd40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10269840]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1000bdfc
cmp byte [esi + 0x3d], 0
je 0x1000bdfc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000bdea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000bdb1
sub eax, 1
je 0x1000bdb5
sub eax, 2
jne 0x1000bdea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101044f3
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000bdd3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000bdea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101044f3
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101044f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.101044f3
mov esp, ebp
pop ebp
ret