joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a004]
jne 0x40100a
repz ret
jmp fcn.00401a91

Function at 0x405ebb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040408b
and dword [ebp - 0x14], 0
cmp dword [0x42c6fc], 0
mov dword [ebp - 0x18], eax
jne 0x405f6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406016
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406016
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c6fc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c700], eax
call edi
push eax
call esi
push 0x42805c
push ebx
mov dword [0x42c704], eax
call edi
push eax
call esi
mov dword [0x42c70c], eax
test eax, eax
je 0x405f6e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c708], eax
mov eax, dword [0x42c708]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405fc7
cmp dword [0x42c70c], ecx
je 0x405fc7
push eax
call esi
push dword [0x42c70c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405fc7
test ebx, ebx
je 0x405fc7
call edi
test eax, eax
je 0x405fbe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405fbe
test byte [ebp - 8], 1
jne 0x405fc7
or dword [ebp + 0x10], 0x200000
jmp 0x405ffa
mov eax, dword [0x42c700]
cmp eax, dword [ebp - 0x18]
je 0x405ffa
push eax
call esi
test eax, eax
je 0x405ffa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405ffa
mov eax, dword [0x42c704]
cmp eax, dword [ebp - 0x18]
je 0x405ffa
push eax
call esi
test eax, eax
je 0x405ffa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c6fc]
call esi
test eax, eax
je 0x406016
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406018
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x4264f0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x42e0dc]
push ebx
push esi
mov esi, dword [0x42ddfc]
mov ebx, eax
cmp eax, 0x5dd
jne 0x426512
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x42b1c0]
call fcn.004263e0
cmp dword [0x42e0dc], 0x2f
jne 0x42652d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.00426420
add esp, 4
cmp dword [0x42e0dc], 0x568
pop esi
pop ebx
jne 0x42655a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x40d120
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
lea esi, [ebp + 0xac]
mov ebx, eax
call fcn.0041de80
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov edi, eax
mov eax, dword [esp + 0x24]
push eax
push ecx
push edi
mov eax, ebx
mov ecx, esi
mov byte [edi + 0x144], 1
call fcn.0045db60
jmp 0x7b6053

Function at 0x40e020
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x28]
cmp ebp, 0x16
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, eax
ja 0x40e511
jmp 0x7c51b0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 0xc
Function at 0x419ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push ebp
mov ebp, dword [esp + 0x74]
push esi
push edi
mov edi, dword [esp + 0x78]
jmp 0x7bc8b5

Function at 0x41bee0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [edi + 0x8c]
mov eax, dword [esi + 0x7f8]
cmp eax, 0x33
jl 0x41bef7
cmp eax, 0x3c
jle 0x41bf07
test eax, eax
jne 0x41bf0e
mov eax, dword [esi + 0x82c]
cmp dword [eax + 0x24], 0x23
jne 0x41bf0e
mov eax, 1
pop esi
ret
cmp dword [esi + 0x768], 0
je 0x41bf39
mov eax, dword [esi + 0x7f8]
cmp eax, 0x1e
je 0x41bf32
test eax, eax
jne 0x41bf39
mov ecx, dword [esi + 0x82c]
cmp dword [ecx + 0x24], 0xf
jne 0x41bf39
mov eax, 3
pop esi
ret
mov ecx, esi
call fcn.00453a00
test al, al
jne 0x41c000
mov eax, edi
call fcn.0041be50
test al, al
je 0x41bf5a
mov eax, 0xe
pop esi
ret
mov eax, dword [esi + 0x7f8]
cmp eax, 0x2a
jne 0x41bf6c
mov eax, 6
pop esi
ret
cmp eax, 0x14
je 0x41c000
cmp eax, 0x18
je 0x41c000
cmp eax, 0x17
jne 0x41bf8a
mov eax, 2
pop esi
ret
cmp eax, 0x3d
je 0x41bf32
cmp eax, 0x3e
je 0x41bf32
cmp eax, 0x3f
je 0x41bf32
cmp eax, 0x40
je 0x41bf32
cmp eax, 0x41
je 0x41bff9
cmp eax, 0x42
je 0x41bff9
cmp eax, 0x43
je 0x41bff9
cmp eax, 0x44
je 0x41bf65
cmp eax, 0x45
jne 0x41bfbe
mov eax, 8
pop esi
ret
cmp eax, 0x46
jne 0x41bfca
mov eax, 9
pop esi
ret
mov eax, esi
call fcn.00453870
test al, al
jne 0x41bf32
mov eax, esi
mov edx, dword [eax + 0x82c]
mov esi, dword [edx + 0x214]
jmp 0x7ba361
mov eax, 4
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x425550
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [ecx]
cmp dword [esi + 0x768], 0
je 0x425594
mov eax, dword [esi + 0x7f8]
cmp eax, 0x11
je 0x425581
cmp eax, 0x21
je 0x425581
test eax, eax
jne 0x425594
mov eax, dword [esi + 0x82c]
cmp dword [eax + 0x24], 5
jne 0x425594
cmp ebx, 2
jle 0x425683
pop esi
mov eax, 7
pop ebp
ret 4
mov eax, esi
call fcn.004537d0
test al, al
je 0x42560d
mov esi, dword [esi + 0x7f8]
cmp esi, 0x3d
mov ecx, 6
je 0x4255c3
cmp esi, 0x3e
je 0x4255c3
cmp esi, 0x3f
je 0x4255c3
cmp esi, 0x40
je 0x4255c3
cmp esi, 0x41
jne 0x4255c8
mov ecx, 4
cmp esi, 0x42
je 0x4255dc
cmp esi, 0x43
je 0x4255dc
cmp esi, 0x44
je 0x4255dc
cmp esi, 0x46
jne 0x4255e1
mov ecx, 5
jmp 0x7c3441
cmp dword [esi + 0x768], 0
je 0x425673
mov eax, dword [esi + 0x7f8]
cmp eax, 0x24
je 0x42562b
cmp eax, 0x28
je 0x42562b
cmp eax, 0x16
jne 0x425673
mov eax, edi
mov edx, ebx
call fcn.004249f0
cmp eax, 0xffffffff
je 0x425651
cmp eax, ebp
je 0x425651
cmp ebp, 0x10
je 0x425651
cmp ebp, 0x1e
je 0x425651
pop esi
mov eax, 6
pop ebp
ret 4
cmp dword [esi + 0x7f8], 0x24
jne 0x425683
cmp ebx, 4
je 0x425664
cmp ebx, 6
jne 0x425683
cmp edi, 1
jne 0x425683
pop esi
mov eax, 1
pop ebp
ret 4
mov ecx, esi
call fcn.004539d0
test al, al
je 0x425683
cmp ebx, 8
jge 0x425669
pop esi
xor eax, eax
pop ebp
ret 4
Function at 0x42a040
Capabilities:
Parse credit card information

Disassembly:
cmp eax, 0x3c
jne 0x42a048
xor eax, eax
ret
cmp eax, 0x3d
jne 0x42a053
mov eax, 2
ret
cmp eax, 0x3e
jne 0x42a05e
mov eax, 3
ret
cmp eax, 0x3f
jne 0x42a069
mov eax, 4
ret
cmp eax, 0x40
jne 0x42a074
mov eax, 0x15
ret
cmp eax, 0x41
jne 0x42a07f
mov eax, 0x11
ret
cmp eax, 0x42
jne 0x42a08a
mov eax, 0x14
ret
cmp eax, 0x43
jne 0x42a095
mov eax, 7
ret
cmp eax, 0x44
jne 0x42a0a0
mov eax, 0x10
ret
cmp eax, 0x45
jne 0x42a0ab
mov eax, 6
ret
cmp eax, 0x46
jne 0x42a0b6
mov eax, 0xc
ret
cmp eax, 0x47
jne 0x42a0c1
mov eax, 0x12
ret
cmp eax, 0x48
jne 0x42a0cc
mov eax, 8
ret
cmp eax, 0x49
jne 0x42a0d7
mov eax, 0x17
ret
cmp eax, 0x4a
jne 0x42a0e1
mov eax, 0x18
jmp 0x7a10ee
Function at 0x42b290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
push 0x20
push str._ADVICE_I_ZOMBIE_EAT_ALL_BRAINS_
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00404330
mov eax, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov edi, dword [eax + 4]
cmp byte [edi + 0x55e0], 0
jne 0x42b30d
push esi
mov esi, dword [edi + 0x140]
mov ecx, 7
lea edx, [esp + 8]
mov byte [edi + 0x55e0], 1
call fcn.00459010
mov dword [edi + 0x55ec], 0x38
pop esi
cmp dword [esp + 0x1c], 0x10
pop edi
jb 0x42b322
mov ecx, dword [esp + 4]
push ecx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4

Function at 0x42d830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
mov eax, esi
call fcn.0042d7e0
mov edi, dword [esi]
call fcn.0044f380
mov esi, dword [esi]
mov eax, dword [esi + 0x82c]
lea ecx, [esp + 0xc]
push 0x2b
mov dword [esi + 0x7f8], 0x2b
push ecx
mov ecx, dword [eax + 0x20]
call fcn.004568d0
add esp, 8
lea eax, [esp + 0xc]
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0054b260
mov eax, esi
call fcn.0044f890
cmp dword [esp + 0x24], 0x10
jb 0x42d8ac
mov edx, dword [esp + 0x10]
push edx
call fcn.0061c19a
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret

Function at 0x42dae0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x64aba6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
push edi
push ebp
call fcn.005396f0
xor ebx, ebx
mov dword [esp + 0x84], ebx
fldz
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x90]
mov dword [ebp + 0x88], vtable.Sexy::ButtonListener.0
fst dword [ebp + 0x1dc]
lea edi, [ebp + 0x88]
fstp dword [ebp + 0x1e0]
push 0x19
mov dword [ebp + 0x1c8], ecx
mov esi, 0xf
push str.DelayLoad_ChallengeScreen
lea ecx, [esp + 0x2c]
mov dword [ebp], 0x657a18
mov dword [edi], method.Sexy::ButtonListener.virtual_0
mov dword [ebp + 0x1c0], eax
mov byte [ebp + 0x41], bl
mov byte [ebp + 0x1cc], bl
mov dword [ebp + 0x1d0], ebx
mov dword [ebp + 0x1d8], 0xffffffff
mov dword [ebp + 0x1d4], ebx
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00404330
mov byte [esp + 0x84], 1
mov edx, dword [0x6a9f38]
mov ecx, dword [edx + 0x634]
lea eax, [esp + 0x24]
call fcn.00513140
mov byte [esp + 0x84], bl
cmp dword [esp + 0x3c], 0x10
jb 0x42dbcf
mov eax, dword [esp + 0x28]
push eax
call fcn.0061c19a
add esp, 4
push 0xe
push str._BACK_TO_MENU_
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
call fcn.00404330
mov byte [esp + 0x84], 2
mov eax, dword [0x6a7780]
push eax
push ebx
lea ecx, [esp + 0x2c]
push ecx
push edi
mov edi, dword [0x6a75e4]
push 0x64
mov ebx, eax
jmp 0x7a33ae
Function at 0x42e920
Capabilities:
Packed with generic packer

Disassembly:
push 0xffffffffffffffff
push 0x64dba3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac
push ebx
push ebp
mov ebp, dword [esp + 0xc8]
push esi
mov esi, dword [esp + 0xd0]
push edi
mov edi, dword [esp + 0xcc]
jmp 0x7a348f
Function at 0x44d140
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
jmp 0x7ab0b8

Function at 0x44f380
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [edi + 0x774]
test eax, eax
push esi
je 0x44f3b6
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [edi]
mov eax, dword [edi + 0x774]
mov edx, dword [edx + 0x88]
push eax
mov ecx, edi
call edx
mov dword [edi + 0x774], 0
mov esi, dword [edi + 0x768]
test esi, esi
je 0x44f3f6
call fcn.00408a70
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0x10]
push edx
call eax
mov edx, dword [edi]
mov eax, dword [edi + 0x768]
mov edx, dword [edx + 0x88]
push eax
mov ecx, edi
call edx
mov dword [edi + 0x768], 0
xor eax, eax
mov ecx, edi
pop esi
jmp fcn.005548c0

Function at 0x44f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f21b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
push 0x6bb0
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f635
push eax
mov ecx, edi
call fcn.00407b50
jmp 0x44f637
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x768], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x768]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
ret
Function at 0x44f8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f1fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
mov eax, dword [edi + 0x770]
test eax, eax
je 0x44f929
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [edi]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x88]
push eax
mov ecx, edi
call edx
push 0x130
mov dword [edi + 0x7fc], 1
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f959
push edi
push eax
call fcn.00448cb0
jmp 0x44f95b
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x770], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x770]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x770]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
ret

Function at 0x44fa20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0x9c
mov dword [esi + 0x7fc], 5
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fa6b
mov ecx, dword [esp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00405780
jmp 0x44fa6d
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x778], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x778]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x778]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x778]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x44fb30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push pe_nt_image_headers32
mov dword [esi + 0x7fc], 6
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fb76
push eax
mov ecx, esi
call fcn.00433a70
jmp 0x44fb78
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x77c], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x77c]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x77c]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x77c]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x44fc30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64ba3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push 0x1e4
mov dword [esi + 0x7fc], 7
call fcn.0061c130
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0xc], 0
je 0x44fc7a
mov ecx, dword [esp + 0x14]
push ecx
push esi
push eax
call fcn.0042dae0
jmp 0x44fc7c
xor eax, eax
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x780], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x780]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x780]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x780]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x44fdc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64997b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push 0x19e8
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44fdfd
push eax
call fcn.00483380
jmp 0x44fdff
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esi + 0xc4]
push ecx
mov ecx, dword [esi + 0xc0]
push ecx
mov dword [esi + 0x774], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [esi + 0x320]
mov eax, dword [ecx]
mov edx, dword [esi + 0x774]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [esi + 0x320]
mov edx, dword [ecx]
mov eax, dword [esi + 0x774]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x452310
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
mov ebx, dword [esi + 0x7f8]
test ebx, ebx
push edi
mov byte [esp + 0x13], 0
mov ebp, 1
jne 0x452391
mov eax, dword [esi + 0x768]
mov ecx, dword [eax + 0x5550]
cmp ecx, 0x32
mov edx, dword [esi + 0x82c]
jne 0x452363
mov dword [edx + 0x24], ebp
mov eax, dword [esi + 0x82c]
add dword [eax + 0x2c], ebp
mov eax, dword [esi + 0x82c]
cmp dword [eax + 0x2c], ebp
jne 0x452369
mov edx, eax
mov dword [edx + 0x33c], ebp
jmp 0x452369
jmp 0x7a4067
mov eax, dword [esi + 0x82c]
test eax, eax
je 0x45237d
cmp dword [eax + 0x2c], 0
jg 0x4524cd
cmp ecx, 0x22
jne 0x4524cd
mov dword [eax + 0x340], ebp
jmp 0x4524cd
cmp ebx, ebp
jl 0x45240c
cmp ebx, 0xf
jg 0x45240c
mov edi, dword [esi + 0x768]
call fcn.00413920
test al, al
je 0x4524cd
mov eax, ebx
mov ecx, esi
call fcn.00454120
test al, al
sete bl
mov eax, edi
mov byte [esp + 0x13], bl
call fcn.00413320
test bl, bl
je 0x4524cd
mov edi, dword [esi + 0x82c]
test edi, edi
je 0x4524cd
cmp dword [edi + 0x2c], 0
jle 0x4524cd
push 0
mov ebx, esi
call fcn.00455ba0
cmp eax, 8
je 0x4524cd
cmp eax, 9
je 0x4524cd
mov dword [edi + 0x334], ebp
jmp 0x4524cd
cmp ebx, 0x33
jl 0x452416
cmp ebx, 0x3c
jle 0x452420
cmp ebx, 0x3d
jl 0x452486
cmp ebx, 0x46
jg 0x452486
mov eax, ebx
mov ecx, esi
call fcn.00454120
mov ecx, dword [esi + 0x82c]
test al, al
sete al
add dword [ecx + ebx*4 + 0x2c], ebp
mov edx, dword [esi + 0x82c]
test edx, edx
lea ebx, [ecx + ebx*4 + 0x2c]
mov byte [esp + 0x13], al
je 0x452450
cmp dword [edx + 0x2c], 0
jg 0x452467
mov ecx, dword [esi + 0x7f8]
cmp ecx, 0x35
je 0x452460
cmp ecx, 0x3f
jne 0x452467
mov byte [esp + 0x13], 0
jmp 0x4524cd
test al, al
je 0x4524cd
mov ecx, esi
call fcn.004538f0
test al, al
je 0x45247e
mov dword [edx + 0x32c], ebp
jmp 0x4524cd
mov dword [edx + 0x330], ebp
jmp 0x4524cd
mov eax, ebx
mov ecx, esi
call fcn.00454120
mov edx, dword [esi + 0x82c]
test al, al
sete al
add dword [edx + ebx*4 + 0x2c], ebp
test al, al
lea ebx, [edx + ebx*4 + 0x2c]
mov byte [esp + 0x13], al
je 0x4524cd
mov edi, dword [esi + 0x82c]
test edi, edi
je 0x4524cd
cmp dword [edi + 0x2c], 0
jle 0x4524cd
push ebp
mov ebx, esi
call fcn.00455ba0
cmp eax, 0x11
jg 0x4524cd
mov dword [edi + 0x328], ebp
mov esi, dword [esi + 0x82c]
test esi, esi
je 0x4524dd
push esi
call fcn.004695f0
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x453ac0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [eax + 0x82c]
test eax, eax
mov ecx, dword [eax + 0x24]
je 0x453ad3
cmp dword [eax + 0x2c], 0
ja 0x453b0b
cmp ecx, 0x32
jg 0x453b0b
lea eax, [ecx - 1]
cdq
mov ecx, 0xa
idiv ecx
lea ecx, [edx + 1]
cmp ecx, 0xa
lea eax, [ecx + eax*8]
jl 0x453af3
sub eax, 2
jmp 0x453afb
cmp ecx, 5
jl 0x453afb
sub eax, 1
cmp eax, 0x28
jle 0x453b06
mov eax, 0x28
ret
cmp eax, 0x31
jle 0x453b10
jmp 0x7af71f
ret
Function at 0x45ed00
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
push 0
mov eax, ebp
call fcn.0045eb10
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x2c]
mov ecx, ebp
call fcn.00467f90
mov edx, dword [ebp + 4]
lea esi, [esp + 0x40]
mov dword [esp + 0x40], 0
call fcn.0041c8f0
test al, al
je 0x45ee8a
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebp + 0x1c]
cmp dword [ebx + 0x24], 0x19
jne 0x45ed53
xor eax, eax
cmp dword [ebp + 0x24], 0x2a
jne 0x45ed6c
cmp eax, 0xffffffff
jl 0x45ee76
cmp eax, 1
jle 0x45ed74
jmp 0x45ee76
test eax, eax
jne 0x45ee76
mov ecx, ebp
call fcn.0045ebd0
cmp byte [ebx + 0xbe], al
jne 0x45ee76
mov eax, dword [esp + 0x14]
push eax
mov esi, ebx
call fcn.00531a80
test al, al
je 0x45ee76
lea edi, [esp + 0x18]
call fcn.005320b0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jge 0x45edbe
mov eax, dword [esp + 0x30]
add eax, edx
mov edx, dword [esp + 0x20]
add edx, ecx
jmp 0x45edcc
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
add eax, ecx
mov ecx, edx
add edx, esi
cmp eax, ecx
jg 0x45edd4
sub eax, ecx
jmp 0x45ede0
cmp eax, edx
jg 0x45eddc
sub eax, ecx
jmp 0x45ede0
sub edx, ecx
mov eax, edx
test eax, eax
jle 0x45ee76
mov eax, dword [ebx + 0x24]
cmp eax, 0xc
mov edi, 0x14
je 0x45edfa
cmp eax, 0x16
jne 0x45ee1b
test byte [esp + 0x44], 0x20
je 0x45ee1b
cmp dword [ebp + 0x24], 0x2e
mov edi, 0x708
jne 0x45ee15
mov esi, ebp
call fcn.0045ec00
jmp 0x45ee1b
push ebp
call fcn.004679b0
jmp 0x7c1601
mov edx, dword [ebp + 4]
lea esi, [esp + 0x40]
call fcn.0041c8f0
test al, al
jne 0x45ed41
jmp 0x7b960f