joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dd90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x42ddb5
lea esi, [ebx + 0xc]
mov byte [ebx + 8], 1
push esi
push 0
mov ecx, esi
call fcn.00431020
jmp 0x42ddba
mov esi, 0xc
lea ecx, [edi + 0x64]
mov dword [ebp - 8], esi
lea edx, [edi + 0x54]
cmp edx, ecx
je 0x42ddd1
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
cmp edi, ecx
je 0x42dddf
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
push ecx
push dword [edi + 0x7c]
lea ecx, [edi + 8]
call fcn.0042e360
lea ecx, [edi + 0x18]
push ecx
push dword [edi + 0x7c]
call fcn.00430cf0
push dword [edi + 0x6c]
test ebx, ebx
mov byte [edi + 0x88], 0
mov ecx, edi
mov dword [edi + 0x8c], 0x989680
setne al
mov dword [edi + 0x90], 0x3e8
mov byte [edi + 0x79], al
mov byte [edi + 0x78], 0
call fcn.0042f850
test al, al
jne 0x42de35
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test ebx, ebx
je 0x42dfce
mov eax, dword [ebp - 8]
mov ecx, eax
push eax
push dword [edi + 0x7c]
call fcn.00431020
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp dword [edi + 0x7c], ecx
jbe 0x42df0f
xor ebx, ebx
mov dword [ebp - 4], ecx
mov edi, edi
mov eax, dword [esi]
and ecx, 0x1f
add eax, 0x10
mov edx, 1
invalid
Function at 0x42f070
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x42f28b
cmp eax, 0x7c
je 0x42f28b
cmp eax, 0x29
jne 0x42f0b1
cmp dword [esi + 0x10], 0
jne 0x42f28b
cmp eax, eax
jne 0x42f0b1
test dword [esi + 0x50], 0x10000000
je 0x42f298
jmp 0x42f244
cmp eax, 0x2e
jne 0x42f110
push 5
lea ecx, [esi + 0x24]
call fcn.0042ca00
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x42f104
cmp word [eax], 0x5c
jne 0x42f0ff
lea ecx, [eax + 2]
cmp ecx, edx
je 0x42f0ff
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x42f0eb
movzx edi, word [ecx]
cmp edi, 0x28
je 0x42f0fd
cmp edi, 0x29
je 0x42f0fd
test dl, 0x10
jne 0x42f0ff
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x42f0fd
cmp edx, 0x7d
jne 0x42f0ff
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.0042ca70
jmp 0x42f276
cmp eax, 0x5c
jne 0x42f16f
mov ecx, esi
call fcn.0042f020
test byte [esi + 0x50], 0x80
je 0x42f163
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x42f141
push 4
lea ecx, [esi + 0x24]
call fcn.0042ca00
mov ecx, esi
call fcn.0042f020
jmp 0x42f27d
cmp eax, 0x42
jne 0x42f163
push 4
lea ecx, [esi + 0x24]
call fcn.0042ca00
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0042f020
jmp 0x42f27d
mov ecx, esi
call fcn.00431f70
jmp 0x42f276
cmp eax, 0x5b
jne 0x42f1d0
mov ecx, esi
call fcn.0042f020
lea ecx, [esi + 0x24]
call fcn.004353a0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x42f19c
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0042f020
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x42f1ba
cmp eax, 0x5d
jne 0x42f1ba
push eax
lea ecx, [esi + 0x24]
call fcn.00435430
mov ecx, esi
call fcn.0042f020
mov ecx, esi
call fcn.00434f60
cmp dword [esi + 0x4c], 0x5d
jne 0x42f29f
jmp 0x42f26f
cmp eax, 0x28
jne 0x42f200
mov ecx, esi
call fcn.0042f020
mov ecx, esi
call fcn.00432100
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x42f298
mov ecx, esi
call fcn.0042f020
test bl, bl
je 0x42f27d
jmp 0x42f276
cmp eax, 0x5e
jne 0x42f218
push 2
lea ecx, [esi + 0x24]
call fcn.0042ca00
mov ecx, esi
call fcn.0042f020
jmp 0x42f27d
cmp eax, 0x24
jne 0x42f230
push 3
lea ecx, [esi + 0x24]
call fcn.0042ca00
mov ecx, esi
call fcn.0042f020
jmp 0x42f27d
cmp eax, 0x2a
je 0x42f291
cmp eax, 0x2b
je 0x42f291
cmp eax, 0x3f
je 0x42f291
cmp eax, 0x7b
je 0x42f291
cmp eax, 0x7d
jne 0x42f254
test dword [esi + 0x50], 0x10000000
je 0x42f2a6
jmp 0x42f262
cmp eax, 0x5d
jne 0x42f262
test dword [esi + 0x50], 0x10000000
je 0x42f29f
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00432360
mov ecx, esi
call fcn.0042f020
mov ecx, esi
call fcn.00432200
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x42f083
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.0042b020
push 5
call fcn.0042b020
push 4
call fcn.0042b020
push 6
call fcn.0042b020
int3
Function at 0x44b3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a218c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x48], edi
cmp byte [edi + 0x648], 0
mov esi, dword [ebx + 0xc]
mov edx, dword [ebx + 0x10]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edx
je 0x44b415
push edx
push esi
push dword [ebx + 8]
call fcn.00441cc0
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebx + 8]
lea eax, [ecx - 0x7d1]
cmp eax, 0x3e9
ja 0x44efd9
jmp dword [eax*4 + 0x44f008]
mov eax, dword [edi]
push edx
push esi
push ecx
mov eax, dword [eax + 0xec]
mov ecx, edi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc

Function at 0x451e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a21f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5f300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov eax, dword [esi + 0x48]
mov dword [ebp - 0x14], vtable.Scintilla::FontAlias.0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
test al, 1
je 0x451f2b
mov edx, dword [edi]
push dword [esi + 0x34]
test al, 4
je 0x451ef9
push dword [esi + 0x30]
fld dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push ecx
fstp dword [esp]
push eax
mov eax, dword [ebp + 0x10]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0xc], eax
mov ecx, edi
call dword [edx + 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0xc], eax
mov ecx, edi
call dword [edx + 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test al, 4
je 0x451f66
push dword [esi + 0x30]
fld dword [ebp + 8]
lea eax, [ebp - 0x14]
push dword [ebp + 0x24]
mov edx, dword [edi]
push dword [ebp + 0x20]
push ecx
fstp dword [esp]
push eax
mov eax, dword [ebp + 0x10]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0xc], eax
mov ecx, edi
call dword [edx + 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4521c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a22a5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.Scintilla::EditView.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 1
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
lea ebx, [edi + 0x34]
mov dword [ebp - 0x10], ebx
lea ecx, [ebx + 8]
mov dword [ebx], vtable.Scintilla::LineLayoutCache.0
mov dword [ebx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 4
push ecx
push 0
mov dword [ebx + 0x18], 0xffffffff
mov dword [ebx + 0x1c], 0
mov byte [ebx + 0x14], 0
call fcn.00465d00
lea esi, [edi + 0x54]
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push esi
mov byte [ebp - 4], 6
mov ecx, esi
push 0x400
mov dword [esi + 0xc], 1
call fcn.00465b60
mov byte [esi + 0x10], 1
mov byte [ebp - 4], 7
mov dword [edi + 0x14], 2
mov word [edi + 0x18], 0x100
mov byte [edi + 0x1a], 1
mov dword [edi + 0x1c], 1
mov dword [edi + 0x20], 0
mov word [edi + 0x24], 0x101
mov byte [edi + 0x26], 0
cmp dword [ebx + 4], 1
mov byte [ebx + 0x14], 0
je 0x452313
mov dword [ebx + 4], 1
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 8]
mov dword [ebp - 0x10], eax
cmp esi, eax
je 0x45230d
mov ecx, dword [esi]
test ecx, ecx
je 0x452303
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp - 0x10]
add esi, 4
cmp esi, eax
jne 0x4522f4
mov esi, dword [ebx + 8]
mov dword [ebx + 0xc], esi
lea esi, [edi + 0x54]
mov ecx, esi
call fcn.004652c0
push esi
push 0x400
mov ecx, esi
call fcn.00465b60
mov dword [edi + 0x68], 4
mov eax, edi
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477a50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3258
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov esi, ecx
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [esi + 0x1c]
cmp dword [esi + 0xc], ecx
push dword [esi + 0x30]
sbb eax, eax
neg eax
inc eax
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.00475ef0
mov ecx, esi
mov dword [esi + 0x30], 9
call fcn.004761d0
mov ecx, esi
call fcn.004761d0
xor edi, edi
mov byte [ebp - 0x2c], 0
mov ebx, 0xf
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edi
cmp byte [esi + 0x2d], 0
jne 0x477b41
lea ecx, [ecx]
mov edx, dword [esi + 0x38]
cmp edx, 0x20
je 0x477b41
cmp edx, 9
jl 0x477ae2
cmp edx, 0xd
jle 0x477b41
mov ecx, edx
call fcn.00478380
test al, al
jne 0x477b41
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
add esp, 4
mov byte [ebp - 0x30], al
cmp edi, ebx
jae 0x477b19
lea ecx, [edi + 1]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x2c]
cmp ebx, 0x10
jb 0x477b0f
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + edi], al
mov byte [ecx + edi + 1], 0
jmp 0x477b2c
push dword [ebp - 0x30]
mov byte [ebp - 0x34], 0
push dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0042a1d0
mov ecx, esi
call fcn.004761d0
cmp byte [esi + 0x2d], 0
jne 0x477b41
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x477ad0
cmp dword [esi + 0x38], 0x3e
jne 0x477b5d
cmp dword [esi + 0x40], 0x3e
jne 0x477b5d
mov ecx, esi
call fcn.004761d0
mov ecx, esi
call fcn.004761d0
jmp 0x477b64
mov dword [esi + 0x30], 0xb
lea ecx, [ebp - 0x2c]
call fcn.00478400
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
test al, al
je 0x477b8d
lea eax, [ebp - 0x2c]
cmp ebx, 0x10
jb 0x477b80
mov eax, edi
mov ecx, dword [ebp - 0x38]
push eax
call fcn.00475500
test al, al
je 0x477b94
mov dword [esi + 0x30], 0xb
mov ecx, dword [esi + 0x1c]
cmp dword [esi + 0xc], ecx
push dword [esi + 0x30]
sbb eax, eax
neg eax
inc eax
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.00475ef0
mov dword [esi + 0x30], 0
cmp ebx, 0x10
jb 0x477be5
lea ecx, [ebx + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x477bdb
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x477bdb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.0059e222
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
ret
Function at 0x477e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3258
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x5f300c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov byte [eax], 1
mov ecx, dword [esi + 0x1c]
cmp dword [esi + 0xc], ecx
push dword [esi + 0x30]
sbb eax, eax
neg eax
inc eax
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.00475ef0
xor edi, edi
mov dword [esi + 0x30], 2
mov ebx, 0xf
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], edi
cmp byte [esi + 0x2d], 0
jne 0x477f03
mov edx, dword [esi + 0x38]
cmp edx, 0x20
je 0x477f03
cmp edx, 9
jl 0x477ea4
cmp edx, 0xd
jle 0x477f03
mov ecx, edx
call fcn.00478380
test al, al
jne 0x477f03
push edx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
add esp, 4
mov byte [ebp - 0x30], al
cmp edi, ebx
jae 0x477edb
lea ecx, [edi + 1]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x2c]
cmp ebx, 0x10
jb 0x477ed1
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + edi], al
mov byte [ecx + edi + 1], 0
jmp 0x477eee
push dword [ebp - 0x30]
mov byte [ebp - 0x34], 0
push dword [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0042a1d0
mov ecx, esi
call fcn.004761d0
cmp byte [esi + 0x2d], 0
jne 0x477f03
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
jmp 0x477e92
lea ecx, [ebp - 0x2c]
call fcn.00478400
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
test al, al
jne 0x477f1e
mov dword [esi + 0x30], 0xb
jmp 0x477f62
lea eax, [ebp - 0x2c]
cmp ebx, 0x10
jb 0x477f28
mov eax, edi
mov ecx, dword [ebp - 0x38]
push eax
call fcn.00475500
test al, al
je 0x477f62
mov dword [esi + 0x30], 1
lea ecx, [ebp - 0x2c]
cmp ebx, 0x10
jb 0x477f46
mov ecx, edi
mov edx, dword [ebp - 0x1c]
push 3
push 0x5b39d8
call fcn.00436600
add esp, 8
test al, al
jne 0x477f62
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0
mov ecx, dword [esi + 0x1c]
cmp dword [esi + 0xc], ecx
push dword [esi + 0x30]
sbb eax, eax
neg eax
inc eax
sub ecx, eax
push ecx
mov ecx, dword [esi]
call fcn.00475ef0
mov dword [esi + 0x30], 0
cmp ebx, 0x10
jb 0x477fb3
lea ecx, [ebx + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x477fa9
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x477fa9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.0059e222
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0059df64
mov esp, ebp
pop ebp
ret
Function at 0x479170
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
cmp esi, 0x80
jge 0x47918d
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x47918d
xor al, al
pop esi
ret
cmp esi, 0x2a
je 0x4791e7
cmp esi, 0x2f
je 0x4791e7
cmp esi, 0x2d
je 0x4791e7
cmp esi, 0x2b
je 0x4791e7
cmp esi, 0x28
je 0x4791e7
cmp esi, 0x29
je 0x4791e7
cmp esi, 0x3d
je 0x4791e7
cmp esi, 0x5e
je 0x4791e7
cmp esi, 0x5b
je 0x4791e7
cmp esi, 0x5d
je 0x4791e7
cmp esi, 0x3c
je 0x4791e7
cmp esi, 0x26
je 0x4791e7
cmp esi, 0x3e
je 0x4791e7
cmp esi, 0x2c
je 0x4791e7
cmp esi, 0x7c
je 0x4791e7
cmp esi, 0x7e
je 0x4791e7
cmp esi, 0x25
je 0x4791e7
cmp esi, 0x3a
jne 0x479189
mov al, 1
pop esi
ret

Function at 0x47d0b0
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov bl, cl
movsx eax, bl
test bl, bl
js 0x47d0cc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x47d0cc
xor al, al
pop ebx
ret
cmp bl, 0x2b
je 0x47d11c
cmp bl, 0x2d
je 0x47d11c
cmp bl, 0x2a
je 0x47d11c
cmp bl, 0x2f
je 0x47d11c
cmp bl, 0x26
je 0x47d11c
cmp bl, 0x5e
je 0x47d11c
cmp bl, 0x3d
je 0x47d11c
cmp bl, 0x3c
je 0x47d11c
cmp bl, 0x3e
je 0x47d11c
cmp bl, 0x28
je 0x47d11c
cmp bl, 0x29
je 0x47d11c
cmp bl, 0x5b
je 0x47d11c
cmp bl, 0x5d
je 0x47d11c
cmp bl, 0x2c
je 0x47d11c
cmp bl, 0x3f
je 0x47d11c
cmp bl, 0x3a
jne 0x47d0c8
mov al, 1
pop ebx
ret

Function at 0x48b680
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a3ba5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebp - 4], 0
mov al, byte [ebp + 0x10]
push fcn.00475190
push 0x48bcf0
mov byte [ebx + 0x14], al
mov eax, dword [ebp + 0x14]
push 4
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x1c]
push 0x410
push eax
mov dword [ebx], vtable.LexerBasic.0
call fcn.0059e7e7
lea edi, [ebx + 0x105c]
lea ecx, [edi + 4]
mov dword [ebp + 0x10], edi
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
push 0
mov byte [ebp - 4], 3
push 0x5adadd
mov word [edi], 0x100
mov byte [edi + 2], 0
call fcn.0040af10
push 0
push 0x5adadd
lea ecx, [edi + 0x1c]
call fcn.0040af10
mov word [edi + 0x34], 0x100
push dword [ebp + 0x18]
lea ecx, [ebx + 0x1094]
mov byte [ebp - 4], 4
call fcn.0048b470
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a0380
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov bl, cl
movsx eax, bl
test bl, bl
js 0x4a039c
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x4a039c
xor al, al
pop ebx
ret
cmp bl, 0x2a
je 0x4a03f6
cmp bl, 0x2f
je 0x4a03f6
cmp bl, 0x2d
je 0x4a03f6
cmp bl, 0x2b
je 0x4a03f6
cmp bl, 0x28
je 0x4a03f6
cmp bl, 0x29
je 0x4a03f6
cmp bl, 0x3d
je 0x4a03f6
cmp bl, 0x5e
je 0x4a03f6
cmp bl, 0x5b
je 0x4a03f6
cmp bl, 0x5d
je 0x4a03f6
cmp bl, 0x3c
je 0x4a03f6
cmp bl, 0x26
je 0x4a03f6
cmp bl, 0x3e
je 0x4a03f6
cmp bl, 0x2c
je 0x4a03f6
cmp bl, 0x7c
je 0x4a03f6
cmp bl, 0x7e
je 0x4a03f6
cmp bl, 0x25
je 0x4a03f6
cmp bl, 0x3a
jne 0x4a0398
mov al, 1
pop ebx
ret
Function at 0x4a21a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a44eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 0x5db40c
mov dword [ebx + 8], 0x4f
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebx], vtable.LexerD.0
mov byte [ebx + 0x14], 1
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov byte [ebx + 0x24], 0
mov dword [ebx + 0x28], 0xffffffff
mov dword [ebx + 0x428], 0
mov dword [ebx + 0x42c], 0
mov dword [ebx + 0x430], 0
mov byte [ebx + 0x434], 0
mov dword [ebx + 0x438], 0xffffffff
mov dword [ebx + 0x838], 0
mov dword [ebx + 0x83c], 0
mov dword [ebx + 0x840], 0
mov byte [ebx + 0x844], 0
mov dword [ebx + 0x848], 0xffffffff
mov dword [ebx + 0xc48], 0
mov dword [ebx + 0xc4c], 0
mov dword [ebx + 0xc50], 0
mov byte [ebx + 0xc54], 0
mov dword [ebx + 0xc58], 0xffffffff
mov dword [ebx + 0x1058], 0
mov dword [ebx + 0x105c], 0
mov dword [ebx + 0x1060], 0
mov byte [ebx + 0x1064], 0
mov dword [ebx + 0x1068], 0xffffffff
mov dword [ebx + 0x1468], 0
mov dword [ebx + 0x146c], 0
mov dword [ebx + 0x1470], 0
mov byte [ebx + 0x1474], 0
mov dword [ebx + 0x1478], 0xffffffff
mov dword [ebx + 0x1878], 0
mov dword [ebx + 0x187c], 0
mov dword [ebx + 0x1880], 0
mov byte [ebx + 0x1884], 0
mov dword [ebx + 0x1888], 0xffffffff
lea edi, [ebx + 0x1c88]
lea ecx, [edi + 8]
mov dword [ebp - 0x14], edi
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x20], 0
push 0
mov byte [ebp - 4], 9
push 0x5adadd
mov dword [edi], 0x1000100
mov byte [edi + 4], 1
call fcn.0040af10
push 0
push 0x5adadd
lea ecx, [edi + 0x20]
call fcn.0040af10
mov word [edi + 0x38], 0x100
mov dword [edi + 0x3c], 0xffffffff
mov byte [edi + 0x40], 0
lea ecx, [ebx + 0x1ccc]
mov byte [ebp - 4], 0xa
call fcn.004a1ed0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b2610
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a48af
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5f300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov cl, byte [ebp + 8]
mov edx, str.literatehaskell
movzx eax, cl
neg eax
sbb eax, eax
and eax, 0x28
add eax, 0x44
test cl, cl
jne 0x4b2657
mov edx, str.haskell
mov dword [esi + 4], edx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 0
mov dword [esi], vtable.LexerHaskell.0
mov byte [esi + 0x14], cl
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x430], 0
mov dword [esi + 0x434], 0
mov dword [esi + 0x438], 0
mov byte [esi + 0x43c], 0
mov dword [esi + 0x440], 0xffffffff
mov dword [esi + 0x840], 0
mov dword [esi + 0x844], 0
mov dword [esi + 0x848], 0
mov byte [esi + 0x84c], 0
mov dword [esi + 0x850], 0xffffffff
mov byte [ebp - 4], 3
lea ecx, [esi + 0xc5c]
mov dword [esi + 0xc50], 0x1000101
mov dword [esi + 0xc54], 1
mov word [esi + 0xc58], 0
call fcn.004b2280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4b72f0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
cmp esi, 0x7f
ja 0x4b730a
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x4b730a
xor al, al
pop esi
ret
cmp esi, 0x25
je 0x4b7382
cmp esi, 0x5e
je 0x4b7382
cmp esi, 0x26
je 0x4b7382
cmp esi, 0x2a
je 0x4b7382
cmp esi, 0x28
je 0x4b7382
cmp esi, 0x29
je 0x4b7382
cmp esi, 0x2d
je 0x4b7382
cmp esi, 0x2b
je 0x4b7382
cmp esi, 0x3d
je 0x4b7382
cmp esi, 0x7c
je 0x4b7382
cmp esi, 0x7b
je 0x4b7382
cmp esi, 0x7d
je 0x4b7382
cmp esi, 0x5b
je 0x4b7382
cmp esi, 0x5d
je 0x4b7382
cmp esi, 0x3a
je 0x4b7382
cmp esi, 0x3b
je 0x4b7382
cmp esi, 0x3c
je 0x4b7382
cmp esi, 0x3e
je 0x4b7382
cmp esi, 0x2c
je 0x4b7382
cmp esi, 0x2f
je 0x4b7382
cmp esi, 0x3f
je 0x4b7382
cmp esi, 0x21
je 0x4b7382
cmp esi, 0x2e
je 0x4b7382
cmp esi, 0x7e
jne 0x4b7306
mov al, 1
pop esi
ret