joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c932b
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x34]
mov dword [esi + 0x14], eax
mov dword [esi], vtable.wxNodeBase.0
mov dword [esi + 8], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebp
mov eax, dword [edi]
dec eax
je 0x4440a2
dec eax
jne 0x4440a8
push 0x24
call fcn.00584773
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
test eax, eax
je 0x44409b
push eax
mov ecx, edi
call fcn.00443fe0
mov dword [esi + 4], eax
jmp 0x4440a8
xor eax, eax
mov dword [esi + 4], eax
jmp 0x4440a8
mov edx, dword [edi + 4]
mov dword [esi + 4], edx
test ebx, ebx
je 0x4440af
mov dword [ebx + 0xc], esi
mov eax, esi
test ebp, ebp
je 0x4440b8
mov dword [ebp + 0x10], esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x14
Function at 0x445fa0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5c9234
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
xor ebx, ebx
test byte [0x695b84], 1
lea edi, [ebx + 1]
jne 0x44600e
or dword [0x695b84], edi
push ebx
mov ecx, 0x695b6c
mov dword [esp + 0x74], ebx
call fcn.0043e7b0
push 0x5f2aa0
call fcn.005852be
add esp, 4
mov dword [esp + 0x70], 0xffffffff
mov ecx, 0x695b6c
mov dword [esp + 0x18], ecx
call fcn.0043e7d0
push 0xffffffffffffffff
push ebx
xor eax, eax
mov ebp, 7
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x7c], edi
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], ax
call fcn.00402610
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
test byte [0x695b98], 1
mov byte [esp + 0x70], 2
jne 0x446093
or dword [0x695b98], edi
push 0x64
mov byte [esp + 0x74], 3
call fcn.00447710
push 4
push eax
mov dword [0x695b8c], eax
mov dword [0x695b90], ebx
call fcn.00585c5e
push 0x5f2b00
mov dword [0x695b88], eax
call fcn.005852be
add esp, 0x10
mov byte [esp + 0x70], 2
mov edi, 8
cmp dword [esp + 0x2c], ebx
je 0x446171
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], edi
jae 0x4460b0
lea eax, [esp + 0x1c]
push eax
call fcn.00447840
xor edx, edx
div dword [0x695b8c]
mov ecx, dword [0x695b88]
add esp, 4
mov esi, dword [ecx + edx*4]
cmp esi, ebx
je 0x4460ff
mov edi, edi
mov edx, dword [esi + 0x14]
lea ecx, [esi + 4]
cmp edx, dword [esp + 0x2c]
jne 0x4460ef
lea eax, [esp + 0x1c]
push eax
call fcn.00420850
cmp eax, ebx
sete al
cmp al, bl
jne 0x4460f7
mov esi, dword [esi]
cmp esi, ebx
jne 0x4460d0
jmp 0x4460ff
cmp esi, ebx
jne 0x4461d9
push ebx
push ecx
mov eax, esp
lea ecx, [esp + 0x48]
mov dword [esp + 0x1c], esp
push ecx
lea ecx, [esp + 0x28]
mov dword [eax], 0x2f
call fcn.00422330
lea edx, [esp + 0x1c]
mov byte [esp + 0x70], 4
cmp edx, eax
je 0x446133
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edx
call fcn.00402610
mov eax, dword [esp + 0x5c]
push eax
mov byte [esp + 0x74], 2
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x54], edi
jb 0x446158
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00584768
add esp, 4
xor edx, edx
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], dx
cmp dword [esp + 0x2c], ebx
jne 0x4460a2
mov esi, dword [0x68a584]
mov eax, dword [esp + 0x38]
push eax
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x30], edi
jb 0x446197
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00584768
add esp, 4
xor edx, edx
mov ecx, 0x695b6c
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], dx
call fcn.0043e7e0
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00585b7b
add esp, 0x60
ret
mov esi, dword [esi + 0x28]
jmp 0x446177
Function at 0x447840
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [edx]
xor eax, eax
test cx, cx
je 0x44782d
lea ebx, [ebx]
movzx ecx, cx
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
add edx, 2
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x447810
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
mov edx, dword [esp + 4]
jmp 0x447800

Function at 0x447870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x44787e
mov ecx, eax
jmp fcn.00447870
mov eax, dword [ecx + 0x50]
test eax, eax
je 0x447889
mov eax, dword [eax + 0x54]
ret
jmp fcn.00449820

Function at 0x447c40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5c9681
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x28]
push 0x5f
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], 0
call fcn.004217c0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [eax]
mov eax, dword [eax]
mov edi, dword [esp + 0x24]
push ecx
push edx
push 0xffffffffffffffff
push eax
mov esi, 1
push edi
mov dword [esp + 0x30], esi
call fcn.00479d80
add esp, 0x14
mov dword [esp + 0x10], esi
mov byte [esp + 0x1c], 0
call fcn.00420510
mov ecx, dword [esp + 0xc]
cmp ecx, eax
je 0x447cee
mov eax, 0xffff
add word [ecx + 8], ax
jne 0x447ce9
mov eax, dword [esp + 0xc]
mov esi, eax
test eax, eax
je 0x447ce9
cmp byte [eax + 0xa], 0
je 0x447ce0
mov ecx, dword [eax]
push ecx
call fcn.005844d1
add esp, 4
push esi
call fcn.00584768
add esp, 4
call fcn.00420510
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x455210
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5cb0e6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.wxTextBuffer.0
lea ecx, [esi + 0x34]
mov dword [esp + 0x18], 1
call fcn.0041e1d0
mov eax, dword [esi + 0x30]
push eax
call fcn.00584768
xor edi, edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov ecx, dword [esi + 0x20]
push ecx
call fcn.005844d1
add esp, 8
cmp dword [esi + 0x18], 8
jb 0x455281
mov edx, dword [esi + 4]
push edx
call fcn.00584768
add esp, 4
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov word [esi + 4], ax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x456cf0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esi + 4]
call fcn.00456b20
mov edx, dword [esi + 8]
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push 1
push ecx
push edx
call fcn.0058c155
mov eax, dword [esi + 8]
push eax
call fcn.00588511
add esp, 0x14
call fcn.00420510
mov ecx, dword [esp + 8]
cmp ecx, eax
je 0x456d68
mov edx, 0xffff
add word [ecx + 8], dx
jne 0x456d63
mov eax, dword [esp + 8]
mov esi, eax
test eax, eax
je 0x456d63
cmp byte [eax + 0xa], 0
je 0x456d5a
mov eax, dword [eax]
push eax
call fcn.005844d1
add esp, 4
push esi
call fcn.00584768
add esp, 4
call fcn.00420510
pop esi
ret 4
Function at 0x456d70
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x5cb3f8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov eax, dword [esp + 0x90]
push eax
lea eax, [esp + 0x5c]
push eax
add ecx, 4
call fcn.00456a70
xor ecx, ecx
mov edi, 8
push edi
xor ebx, ebx
mov word [esp + 0x38], cx
mov esi, 7
push 0x5fec90
lea ecx, [esp + 0x3c]
mov dword [esp + 0x90], ebx
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
call fcn.00402710
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push 1
xor edx, edx
push 0x5fec8c
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
call fcn.00402710
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
push 1
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x64]
mov byte [esp + 0x94], 2
call fcn.004224a0
mov edx, dword [esp + 0x2c]
push edx
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x24], edi
jb 0x456e5e
mov eax, dword [esp + 0x10]
push eax
call fcn.00584768
add esp, 4
mov edx, dword [esp + 0x50]
xor ecx, ecx
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], cx
mov byte [esp + 0x8c], bl
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x48], edi
jb 0x456e94
mov eax, dword [esp + 0x34]
push eax
call fcn.00584768
add esp, 4
xor ecx, ecx
push 2
mov word [esp + 0x38], cx
push 0x5febc0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
call fcn.00402710
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
push 1
xor edx, edx
push 0x5fe37c
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 3
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
call fcn.00402710
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
push 1
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x64]
mov byte [esp + 0x94], 4
call fcn.004224a0
mov edx, dword [esp + 0x2c]
push edx
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x24], edi
jb 0x456f27
mov eax, dword [esp + 0x10]
push eax
call fcn.00584768
add esp, 4
mov edx, dword [esp + 0x50]
xor ecx, ecx
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], cx
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x48], edi
jb 0x456f56
mov eax, dword [esp + 0x34]
push eax
call fcn.00584768
add esp, 4
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x6c], edi
jae 0x456f64
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x74]
push ecx
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x6c], edi
jb 0x456f8b
mov edx, dword [esp + 0x58]
push edx
call fcn.00584768
add esp, 4
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.00585b7b
add esp, 0x7c
ret 4
Function at 0x45fd90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cc126
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi], vtable.wxStringTokenizer.0
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], edi
xor eax, eax
mov word [esi + 0xc], ax
mov dword [esp + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
lea ebx, [esi + 0x34]
mov byte [esp + 0x20], 1
mov dword [esi + 0x30], edi
mov dword [esp + 0x14], ebx
call fcn.00420510
mov dword [ebx], eax
mov byte [esp + 0x20], 2
call fcn.00420510
mov dword [ebx], eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
mov ecx, esi
mov byte [esp + 0x2c], 3
mov dword [esi + 0x3c], edi
call fcn.0045fb50
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
Function at 0x461650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5cc488
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa8]
xor ebx, ebx
cmp dword [esi + 0x34], ebx
jne 0x4616a0
xor eax, eax
jmp 0x461846
call fcn.0043a1a0
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x24]
xor eax, eax
push ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], ax
call fcn.00402610
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
push 2
lea edx, [esp + 0x50]
push edx
mov ecx, esi
mov dword [esp + 0xa8], ebx
call fcn.00460e50
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0xa4], 1
call fcn.00460690
add esp, 4
test al, al
je 0x46171e
push 0x60365c
lea ecx, [esp + 0x2c]
call fcn.004054f0
push str.en_US
lea ecx, [esp + 0x50]
call fcn.004053e0
call fcn.0043a340
mov ecx, dword [eax]
xor ebp, ebp
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
cmp ecx, ebx
jbe 0x4617ea
mov dword [esp + 0x18], ebx
jmp 0x461744
mov eax, dword [esp + 0x20]
mov edi, dword [eax + 8]
add edi, dword [esp + 0x18]
lea ecx, [esp + 0x4c]
lea esi, [edi + 4]
push esi
call fcn.004205f0
test eax, eax
je 0x4617e6
push ebx
push ecx
mov eax, esp
lea ecx, [esp + 0x78]
mov dword [esp + 0x2c], esp
push ecx
mov ecx, esi
mov dword [eax], 0x2d
call fcn.00422260
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa4], 2
call fcn.004205f0
mov edx, dword [esp + 0x8c]
test eax, eax
push edx
sete bl
mov byte [esp + 0xa4], 1
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x84], 8
jb 0x4617c0
mov eax, dword [esp + 0x70]
push eax
call fcn.00584768
add esp, 4
test bl, bl
je 0x4617cf
cmp dword [esp + 0x14], 0
jne 0x4617cf
mov dword [esp + 0x14], edi
add dword [esp + 0x18], 0xc4
inc ebp
xor ebx, ebx
cmp ebp, dword [esp + 0x1c]
jb 0x461740
jmp 0x4617ea
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x68]
push ecx
call fcn.005844d1
mov esi, 8
add esp, 4
cmp dword [esp + 0x60], esi
jb 0x46180f
mov edx, dword [esp + 0x4c]
push edx
call fcn.00584768
add esp, 4
mov ecx, dword [esp + 0x44]
xor eax, eax
push ecx
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], ebx
mov word [esp + 0x50], ax
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x3c], esi
jb 0x461842
mov edx, dword [esp + 0x28]
push edx
call fcn.00584768
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00585b7b
add esp, 0x90
ret
Function at 0x4628c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c8ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
xor edi, edi
xor ecx, ecx
mov dword [esp + 0xc], edi
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], edi
mov word [esp + 0x10], cx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x40], edi
cmp eax, edi
je 0x462988
cmp eax, 1
je 0x462988
push eax
call fcn.00462860
add esp, 4
cmp eax, edi
je 0x462949
add eax, 0x28
lea edx, [esp + 0x10]
cmp edx, eax
je 0x462949
push 0xffffffffffffffff
push edi
push eax
mov ecx, edx
call fcn.00402610
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov ecx, esi
mov word [esi], ax
call fcn.00402610
mov edx, dword [esp + 0x2c]
push edx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x24], 8
jb 0x4629cd
mov eax, dword [esp + 0x10]
push eax
jmp 0x4629c5
push 0xffffffffffffffff
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
push edi
lea edx, [esp + 0x18]
mov word [esi], cx
push edx
mov ecx, esi
call fcn.00402610
mov eax, dword [esp + 0x2c]
push eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x24], 8
jb 0x4629cd
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00584768
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00585b7b
add esp, 0x38
ret

Function at 0x4651d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5cc8e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x28]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
call fcn.0041de00
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.0041d2b0
mov ecx, dword [esp + 0x20]
push eax
push edi
push ecx
push esi
call fcn.004650b0
add esp, 0x10
cmp byte [esp + 0x30], 0
je 0x465271
mov esi, dword [esp + 0x28]
test esi, esi
je 0x465271
mov edx, dword [esi + 0x1c]
push edx
call fcn.005844d1
add esp, 4
cmp dword [esi + 0x14], 8
jb 0x465255
mov eax, dword [esi]
push eax
call fcn.00584768
add esp, 4
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push esi
mov word [esi], cx
call fcn.00584768
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 0x14
Function at 0x4658e0
Capabilities:
Check if file exists
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ecx]
test ecx, ecx
je 0x4658f7
mov eax, dword [esp + 4]
test eax, eax
je 0x4658f7
mov dword [esp + 4], eax
jmp fcn.00465290
xor al, al
ret 4
Function at 0x46d700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5cd3b9
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x694114]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x694114]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x88]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [ebp + 0x14], 7
mov dword [ebp + 0x10], ebx
xor eax, eax
mov word [ebp], ax
mov dword [esp + 0x20], ebp
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [esp + 0x80], ebx
mov dword [esp + 0x1c], 1
lea ecx, [ecx]
mov ecx, esi
or ecx, edi
je 0x46d87a
push ebx
push 0xa
push edi
push esi
call fcn.0058d850
mov ecx, eax
mov dword [esp + 0x14], eax
mov ebx, edx
mov dword [esp + 0x18], edx
shld edx, eax, 2
add eax, eax
add eax, eax
add ecx, eax
adc ebx, edx
shld ebx, ecx, 1
add ecx, ecx
sub esi, ecx
sbb edi, ebx
xor ebx, ebx
xor edx, edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], dx
mov dword [esp + 0x80], 1
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
add esi, 0x30
movzx eax, si
push eax
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x88], 2
call fcn.00414280
push ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x8c], 3
call fcn.00422d10
add esp, 0xc
mov byte [esp + 0x80], 4
cmp ebp, eax
je 0x46d821
push 0xffffffffffffffff
push ebx
push eax
mov ecx, ebp
call fcn.00402610
mov edx, dword [esp + 0x6c]
push edx
call fcn.005844d1
mov esi, 8
add esp, 4
cmp dword [esp + 0x64], esi
jb 0x46d846
mov eax, dword [esp + 0x50]
push eax
call fcn.00584768
add esp, 4
mov ecx, dword [esp + 0x48]
push ecx
mov byte [esp + 0x84], bl
call fcn.005844d1
add esp, 4
cmp dword [esp + 0x40], esi
jb 0x46d86d
mov edx, dword [esp + 0x2c]
push edx
call fcn.00584768
add esp, 4
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
jmp 0x46d770
cmp dword [ebp + 0x10], ebx
jne 0x46d88c
mov eax, 0x30
push eax
mov ecx, ebp
call fcn.0042c690
mov eax, ebp
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00585b7b
add esp, 0x70
ret 4
Function at 0x46e190
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov al, byte [esi]
push edi
mov edi, ecx
mov ebx, esi
test al, al
je 0x46e26c
cmp al, 0x40
je 0x46e26c
cmp al, 0x2f
je 0x46e26c
cmp al, 0x23
je 0x46e26c
cmp al, 0x3f
je 0x46e26c
cmp al, 0x61
jl 0x46e1ce
cmp al, 0x7a
jle 0x46e237
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x46e237
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x46e237
cmp al, 0x2d
je 0x46e237
cmp al, 0x2e
je 0x46e237
cmp al, 0x5f
je 0x46e237
cmp al, 0x7e
je 0x46e237
cmp al, 0x21
je 0x46e237
cmp al, 0x24
je 0x46e237
cmp al, 0x26
je 0x46e237
cmp al, 0x27
je 0x46e237
cmp al, 0x28
je 0x46e237
cmp al, 0x29
je 0x46e237
cmp al, 0x2a
je 0x46e237
cmp al, 0x2b
je 0x46e237
cmp al, 0x2c
je 0x46e237
cmp al, 0x3b
je 0x46e237
cmp al, 0x3d
je 0x46e237
cmp al, 0x3a
je 0x46e237
lea ecx, [esp + 0x14]
push ecx
lea eax, [edi + 0x98]
push eax
mov ecx, edi
call fcn.0046df50
mov esi, dword [esp + 0x14]
jmp 0x46e262
inc esi
mov byte [esp + 0xc], al
mov dword [esp + 0x14], esi
cmp al, 0x80
jae 0x46e249
movsx eax, al
jmp 0x46e256
mov edx, dword [esp + 0xc]
push edx
call fcn.00423840
add esp, 4
lea ecx, [edi + 0x98]
push eax
call fcn.00414690
mov al, byte [esi]
test al, al
jne 0x46e1a6
cmp byte [esi], 0x40
jne 0x46e282
or dword [edi + 0x108], 2
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
pop ecx
ret 4
cmp dword [edi + 0xac], 8
lea eax, [edi + 0x98]
mov dword [eax + 0x10], 0
jb 0x46e29a
mov eax, dword [eax]
pop edi
xor ecx, ecx
mov word [eax], cx
pop esi
mov eax, ebx
pop ebx
pop ecx
ret 4
Function at 0x46e2b0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
cmp byte [esi], 0x5b
push edi
mov ebp, ecx
jne 0x46e33d
lea eax, [esp + 0x18]
lea edi, [esi + 1]
push eax
mov dword [esp + 0x1c], edi
call fcn.0046dab0
add esp, 4
test al, al
je 0x46e300
mov ebx, dword [esp + 0x18]
cmp byte [ebx], 0x5d
jne 0x46e300
mov ecx, ebx
sub ecx, esi
dec ecx
push ecx
push edi
lea ecx, [ebp + 0xbc]
mov dword [ebp + 0x104], 2
call fcn.0041db40
inc ebx
jmp 0x46e371
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], edi
call fcn.0046dc10
add esp, 4
test al, al
je 0x46e36f
mov ebx, dword [esp + 0x18]
cmp byte [ebx], 0x5d
jne 0x46e36f
mov eax, ebx
sub eax, esi
dec eax
push eax
push edi
lea ecx, [ebp + 0xbc]
mov dword [ebp + 0x104], 3
call fcn.0041db40
inc ebx
jmp 0x46e371
lea ecx, [esp + 0x18]
push ecx
call fcn.0046d900
add esp, 4
test al, al
je 0x46e36f
mov ebx, dword [esp + 0x18]
mov edx, ebx
sub edx, esi
push edx
push esi
lea ecx, [ebp + 0xbc]
mov dword [ebp + 0x104], 1
call fcn.0041db40
jmp 0x46e371
mov ebx, esi
cmp dword [ebp + 0x104], 0
jne 0x46e453
cmp byte [esi], 0
mov ebx, esi
mov dword [esp + 0x18], ebx
je 0x46e453
lea ecx, [ecx]
mov al, byte [ebx]
cmp al, 0x2f
je 0x46e453
cmp al, 0x3a
je 0x46e453
cmp al, 0x23
je 0x46e453
cmp al, 0x3f
je 0x46e453
cmp al, 0x61
jl 0x46e3ba
cmp al, 0x7a
jle 0x46e41f
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x46e41f
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x46e41f
cmp al, 0x2d
je 0x46e41f
cmp al, 0x2e
je 0x46e41f
cmp al, 0x5f
je 0x46e41f
cmp al, 0x7e
je 0x46e41f
cmp al, 0x21
je 0x46e41f
cmp al, 0x24
je 0x46e41f
cmp al, 0x26
je 0x46e41f
cmp al, 0x27
je 0x46e41f
cmp al, 0x28
je 0x46e41f
cmp al, 0x29
je 0x46e41f
cmp al, 0x2a
je 0x46e41f
cmp al, 0x2b
je 0x46e41f
cmp al, 0x2c
je 0x46e41f
cmp al, 0x3b
je 0x46e41f
cmp al, 0x3d
je 0x46e41f
lea eax, [esp + 0x18]
push eax
lea ecx, [ebp + 0xbc]
push ecx
mov ecx, ebp
call fcn.0046df50
mov ebx, dword [esp + 0x18]
jmp 0x46e44a
inc ebx
mov byte [esp + 0x10], al
mov dword [esp + 0x18], ebx
cmp al, 0x80
jae 0x46e431
movsx eax, al
jmp 0x46e43e
mov edx, dword [esp + 0x10]
push edx
call fcn.00423840
add esp, 4
push eax
lea ecx, [ebp + 0xbc]
call fcn.00414690
cmp byte [ebx], 0
jne 0x46e390
or dword [ebp + 0x108], 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 4