joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430cb0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 8], 0
je 0x430cce
test byte [edi + 4], 8
je 0x430e16
lea eax, [ebp - 0xc]
mov byte [edi + 8], 0
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x430cf5
call esi
test eax, eax
jne 0x430e16
mov eax, dword [edi + 0x50]
test eax, eax
je 0x430d01
cmp dword [eax], 0
jne 0x430d0e
mov ecx, dword [ebp - 0xc]
xor eax, eax
or eax, ebx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x18], eax
push dword [edi + 0x10]
lea ecx, [ebp - 0x290]
call fcn.00436c60
lea ecx, [ebp - 4]
push ecx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
mov ecx, dword [ebp - 0x28c]
lea edx, [ebp - 0x288]
mov dword [ebp - 8], eax
cmp ecx, edx
je 0x430d48
push ecx
call fcn.0046fd72
mov eax, dword [ebp - 8]
add esp, 4
cmp eax, 0xffffffff
jne 0x430d5a
call esi
test eax, eax
jne 0x430e16
mov eax, dword [ebp - 8]
push dword [edi + 0x54]
mov dword [edi + 0x20], eax
lea ecx, [ebp - 0x290]
mov eax, dword [ebp - 4]
mov dword [edi + 0x24], eax
call fcn.00436c60
lea ecx, [ebp - 0x30]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
mov ecx, dword [ebp - 0x28c]
mov esi, eax
lea eax, [ebp - 0x288]
cmp ecx, eax
je 0x430d9b
push ecx
call fcn.0046fd72
add esp, 4
test esi, esi
je 0x430e12
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00438810
push dword [ebp - 0x18]
mov dword [edi + 0x30], eax
push dword [ebp - 0x1c]
mov dword [edi + 0x34], edx
call fcn.00438810
push dword [ebp - 0x20]
mov dword [edi + 0x38], eax
push dword [ebp - 0x24]
mov dword [edi + 0x3c], edx
call fcn.00438810
mov esi, dword [ebp - 0x30]
add esp, 0x18
mov ecx, esi
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], edx
call fcn.00430e20
mov ecx, eax
mov dword [edi + 0x28], eax
shr ecx, 5
and cl, 1
mov byte [edi + 0x4c], cl
cmp esi, 0xffffffff
jne 0x430e04
mov dword [edi + 0x48], 0
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test al, 0x40
mov eax, 0
setne al
inc eax
mov dword [edi + 0x48], eax
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4310f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x264
push ebx
push ecx
lea ecx, [esp + 0xc]
call fcn.00436c60
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0xc]
cmp eax, ecx
je 0x431127
push eax
call fcn.0046fd72
add esp, 4
cmp ebx, 0xffffffff
jne 0x431133
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test bl, 0x10
mov eax, 0
pop ebx
setne al
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x431670
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x260
push ebx
push esi
push ecx
lea ecx, [esp + 0xc]
mov esi, edx
call fcn.00436c60
push esi
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0xc]
sete bl
cmp eax, ecx
je 0x4316ae
push eax
call fcn.0046fd72
add esp, 4
test bl, bl
je 0x4316c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432530
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
lea eax, [ebx + 4]
mov byte [ebx + 0xc], 0
push eax
push str.SeManageVolumePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebx
push 0x28
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 3
push dword [ebx]
call edi
mov esi, dword [ebp - 4]
mov eax, esi
call fcn.00470760
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push esi
mov esi, dword [ebp - 8]
push esi
push 3
push dword [ebx]
call edi
test eax, eax
je 0x4325d4
xor edx, edx
cmp dword [esi], edx
jbe 0x4325d4
mov ecx, dword [ebx + 8]
lea eax, [esi + 4]
cmp dword [eax + 4], ecx
jne 0x4325cc
mov ecx, dword [eax]
cmp ecx, dword [ebx + 4]
jne 0x4325c9
mov ecx, dword [eax + 8]
cmp ecx, 2
je 0x4325c4
cmp ecx, 1
je 0x4325c4
xor cl, cl
jmp 0x4325c6
mov cl, 1
mov byte [ebx + 0xc], cl
mov ecx, dword [ebx + 8]
inc edx
add eax, 0xc
cmp edx, dword [esi]
jb 0x4325a7
mov eax, ebx
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x432a10
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x3c
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x30]
movaps xmmword [ebp - 0x30], xmm0
push eax
movaps xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x1c]
mov esi, 1
test ecx, ecx
cmovne esi, ecx
call fcn.00432a70
cmp esi, dword [0x4e4950]
cmovl esi, dword [0x4e4950]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4374e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4b3d58
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00436f60
push dword [ebp + 0xc]
mov edx, esi
mov ecx, edi
call fcn.004371e0
mov ebx, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [eax + 0x18], 1
mov esi, dword [ebx]
test ecx, ecx
jne 0x437535
mov eax, dword [0x4e44d8]
test eax, eax
cmovne ecx, eax
xor edx, edx
lea eax, [esi + 4]
push eax
test ecx, ecx
mov eax, 0x10000
cmovle eax, edx
push eax
push esi
push 0x437be0
push ecx
push edx
call fcn.004993b2
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4375a6
mov ecx, 0x4e7150
mov dword [ebp - 0x14], 0x4e7150
call fcn.00432b80
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x437595
push 0
push 0x4c7819
push 0x4c7819
push str.thread__threadHandle___NULL
call fcn.0042d730
add esp, 0x10
mov ecx, 0x4e7150
mov dword [ebp - 4], 0xffffffff
call fcn.00432b90
cmp dword [esi], 0
jne 0x437705
mov edi, dword [ebx]
mov ecx, 0x4e44e0
call fcn.00432d30
mov eax, dword [0x4e44dc]
test eax, eax
jne 0x4375da
mov ecx, 0x4e44e0
mov dword [ebp - 4], 1
call fcn.00432ee0
jmp 0x4376e3
mov ebx, dword [eax]
mov esi, ebx
mov ecx, dword [ebx + 4]
mov eax, ecx
cmp byte [eax + 0xd], 0
jne 0x437611
nop dword [eax]
mov edx, dword [eax + 0x10]
cmp edx, edi
jae 0x4375fc
mov eax, dword [eax + 8]
jmp 0x43760b
cmp byte [esi + 0xd], 0
je 0x437607
cmp edi, edx
cmovb esi, eax
mov ebx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x4375f0
cmp byte [esi + 0xd], 0
jne 0x437619
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x437634
nop
cmp edi, dword [ecx + 0x10]
jae 0x43762b
mov esi, ecx
mov ecx, dword [ecx]
jmp 0x43762e
mov ecx, dword [ecx + 8]
cmp byte [ecx + 0xd], 0
je 0x437620
mov eax, ebx
cmp ebx, esi
je 0x437680
nop word [eax + eax]
mov ecx, dword [eax + 8]
cmp byte [ecx + 0xd], 0
je 0x437666
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x437662
cmp eax, dword [ecx + 8]
jne 0x437662
mov eax, ecx
mov ecx, dword [ecx + 4]
cmp byte [ecx + 0xd], 0
je 0x437652
mov eax, ecx
jmp 0x43767c
mov eax, ecx
mov edx, dword [eax]
cmp byte [edx + 0xd], 0
jne 0x43767c
mov ecx, dword [edx]
mov eax, edx
mov edx, ecx
cmp byte [ecx + 0xd], 0
je 0x437670
cmp eax, esi
jne 0x437640
mov ecx, dword [0x4e44dc]
lea eax, [ebp + 0x14]
push esi
push ebx
push eax
call fcn.0043b7c0
mov esi, dword [0x4e44dc]
cmp dword [esi + 4], 0
jne 0x4376cf
mov eax, dword [esi]
mov ecx, esi
push eax
push dword [eax]
lea eax, [ebp + 0x14]
push eax
call fcn.0043b7c0
push dword [esi]
call fcn.0049732e
add esp, 4
push dword [0x4e44dc]
call fcn.0049732e
add esp, 4
mov dword [0x4e44dc], 0
mov ecx, 0x4e44e0
mov dword [ebp - 4], 2
call fcn.00432ee0
mov ebx, dword [ebp + 8]
push edi
call fcn.0049732e
add esp, 4
mov dword [ebx], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437880
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b1f88
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi]
not eax
cmp eax, 0xffffffff
jne 0x4378ea
mov ecx, 0x4e7150
mov dword [ebp - 0x14], 0x4e7150
call fcn.00432b80
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x4378e0
push 0
push 0x4c7819
push 0x4c7819
push str.Blizzard::Thread::TLSSlotIsAllocated_slot_
call fcn.0042d730
add esp, 0x10
mov ecx, 0x4e7150
call fcn.00432b90
mov eax, dword [esi]
not eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437910
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4b41b0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov eax, dword [esi]
not eax
cmp eax, 0xffffffff
jne 0x437985
mov ecx, 0x4e7150
mov dword [ebp - 0x14], 0x4e7150
call fcn.00432b80
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x437974
push 0
push 0x4c7819
push 0x4c7819
push str.Blizzard::Thread::TLSSlotIsAllocated_slot_
call fcn.0042d730
add esp, 0x10
mov ecx, 0x4e7150
mov dword [ebp - 4], 0xffffffff
call fcn.00432b90
mov eax, dword [esi]
push edi
not eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [esi + 4], 0
je 0x437a39
test edi, edi
je 0x437a39
call fcn.00436f60
mov ecx, 0x4e5444
call fcn.00437880
test eax, eax
je 0x4379c4
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x4379c0
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x437a39
mov esi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0x4e44fc
mov dword [ebp - 0x10], 0x4e44fc
mov ebx, eax
call fcn.00432d30
mov dword [ebp - 4], 1
mov edx, dword [0x4e4414]
cmp edx, 0x10
jl 0x437a09
push ecx
mov ecx, str.__ran_out_of_non_Core_TLS_entries_
call fcn.0042d9f0
add esp, 4
mov dword [ebp - 4], 2
jmp 0x437a2f
lea eax, [edx + edx*2]
inc edx
mov dword [0x4e4414], edx
mov dword [eax*4 + 0x4e4418], ebx
mov dword [eax*4 + 0x4e441c], edi
mov dword [eax*4 + 0x4e4420], esi
mov dword [ebp - 4], 3
mov ecx, 0x4e44fc
call fcn.00432ee0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437a50
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b2168
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.00436f60
mov eax, dword [esi]
not eax
cmp eax, 0xffffffff
je 0x437ac9
mov ecx, 0x4e7150
mov dword [ebp - 0x14], 0x4e7150
call fcn.00432b80
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
cmp eax, 1
jne 0x437ab8
push 0
push 0x4c7819
push 0x4c7819
push str._System_Thread::TLSSlotIsAllocated_slot_
call fcn.0042d730
add esp, 0x10
mov ecx, 0x4e7150
mov dword [ebp - 4], 0xffffffff
call fcn.00432b90
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
not eax
mov dword [esi], eax
not eax
cmp eax, 0xffffffff
jne 0x437afa
push ecx
mov ecx, str.__failed_to_allocate_TLS_
call fcn.0042d9f0
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x4e44fc
mov dword [esi + 4], edi
call fcn.00432d30
mov eax, dword [0x4e7138]
mov dword [eax*4 + 0x4e6f38], esi
inc eax
mov dword [0x4e7138], eax
mov ecx, 0x4e44fc
mov dword [ebp - 4], 1
call fcn.00432ee0
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x438ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov al, byte [ecx]
mov edx, 0x1000193
test al, al
je 0x438cc4
nop dword [eax + eax]
movzx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx]
test al, al
jne 0x438cb0
test edx, edx
mov eax, 1
cmovne eax, edx
ret

Function at 0x438cd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, 0x1000193
mov al, byte [ecx]
test al, al
je 0x438cf5
movzx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx]
test al, al
jne 0x438ce1
test edx, edx
mov ecx, 1
cmovne ecx, edx
mov edx, dword [ebp + 0xc]
mov eax, ecx
and eax, 0x3f
mov dword [edx], eax
cmp dword [eax*8 + 0x4e4210], 0
je 0x438d2c
cmp dword [eax*8 + 0x4e4210], ecx
je 0x438d32
inc eax
and eax, 0x3f
mov dword [edx], eax
cmp dword [eax*8 + 0x4e4210], 0
jne 0x438d13
xor al, al
pop ebp
ret 8
mov al, 1
pop ebp
ret 8
Function at 0x4391f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc04
push ebx
push esi
push edi
call fcn.0043b9d0
mov eax, dword [0x4e7210]
cmp dword [eax + 8], 0
jne 0x439218
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x439324
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop dword [eax + eax]
push 0x400
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00487c20
mov ecx, dword [esi + 8]
add esp, 0xc
lea eax, [ecx + 0x38]
push eax
push dword [ecx + 0x10]
lea eax, [esp + 0x418]
push dword [ecx + 0x14]
push dword [ecx + 4]
push dword [ecx]
push str.threadHandle_08X__threadId_d__threadFunc_08X__threadParam_08X__name__s_
push eax
call fcn.0043a9e0
mov ecx, eax
add esp, 0x1c
test ecx, ecx
jne 0x439277
mov byte [esp + 0x10], al
jmp 0x43929a
lea eax, [esp + 0x10]
nop dword [eax + eax]
mov dl, byte [ecx]
lea ecx, [ecx + 1]
test dl, dl
je 0x439297
mov byte [eax], dl
inc eax
lea edx, [esp + 0x40f]
cmp eax, edx
jb 0x439280
mov byte [eax], 0
push 0x4e2b38
push 0x4e1dc0
call fcn.0048753a
lea ecx, [esp + 0x18]
push ecx
push dword [esi + 8]
push eax
lea eax, [esp + 0x824]
push str.Leaked__s__08X__s_n
push eax
call fcn.0043a9e0
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x439312
push 2
call fcn.00490575
add esp, 4
push eax
push edi
call fcn.00498999
add esp, 8
test edi, edi
je 0x439312
push edi
lea ecx, [esp + 0x414]
call fcn.00436c60
push dword [eax + 4]
call ebx
mov eax, dword [esp + 0x414]
lea ecx, [esp + 0x418]
cmp eax, ecx
je 0x439312
push eax
call fcn.0046fd72
add esp, 4
mov eax, dword [0x4e7210]
mov esi, dword [esi]
mov eax, dword [eax + 4]
cmp esi, eax
jne 0x439230
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439330
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc04
push ebx
push esi
push edi
call fcn.0043bb10
mov eax, dword [0x4e7218]
cmp dword [eax + 8], 0
jne 0x439358
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x439454
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop dword [eax + eax]
push 0x400
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00487c20
mov eax, dword [esi + 8]
add esp, 0xc
push dword [eax + 0x54]
lea eax, [esp + 0x414]
push str.__s_
push eax
call fcn.0043a9e0
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x4393ab
mov byte [esp + 0x10], al
jmp 0x4393ca
lea eax, [esp + 0x10]
nop
mov dl, byte [ecx]
lea ecx, [ecx + 1]
test dl, dl
je 0x4393c7
mov byte [eax], dl
inc eax
lea edx, [esp + 0x40f]
cmp eax, edx
jb 0x4393b0
mov byte [eax], 0
push 0x4e2b38
push 0x4e1d94
call fcn.0048753a
lea ecx, [esp + 0x18]
push ecx
push dword [esi + 8]
push eax
lea eax, [esp + 0x824]
push str.Leaked__s__08X__s_n
push eax
call fcn.0043a9e0
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x439442
push 2
call fcn.00490575
add esp, 4
push eax
push edi
call fcn.00498999
add esp, 8
test edi, edi
je 0x439442
push edi
lea ecx, [esp + 0x414]
call fcn.00436c60
push dword [eax + 4]
call ebx
mov eax, dword [esp + 0x414]
lea ecx, [esp + 0x418]
cmp eax, ecx
je 0x439442
push eax
call fcn.0046fd72
add esp, 4
mov eax, dword [0x4e7218]
mov esi, dword [esi]
mov eax, dword [eax + 4]
cmp esi, eax
jne 0x439370
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b492a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.0046d7a4
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x452fad
push eax
push esi
call fcn.0046daea
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
lea ecx, [ebp - 0x1c]
call fcn.00401f20
push 0x4ddb68
lea eax, [ebp - 0x1c]
push eax
call fcn.0048762e
int3
Function at 0x4597e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b25c0
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0046fd13
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0046d9e3
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x459960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x811c9dc5
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
sub edi, ecx
xor esi, esi
and edi, 0xfffffffe
lea edx, [edi + ecx]
cmp ecx, edx
cmova edi, ebx
test edi, edi
je 0x459999
movzx edx, byte [ecx]
lea ecx, [ecx + 1]
xor edx, eax
inc esi
imul eax, edx, 0x1000193
cmp esi, edi
jne 0x459986
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x459a90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x811c9dc5
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
sub edi, edx
xor esi, esi
cmp edx, dword [ebp + 0xc]
cmova edi, ebx
test edi, edi
je 0x459ac4
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc esi
imul eax, ecx, 0x1000193
cmp esi, edi
jne 0x459ab1
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45d700
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x45d91d
cmp eax, 0x7c
je 0x45d91d
cmp eax, 0x29
jne 0x45d73c
cmp dword [esi + 0x10], 0
jne 0x45d91d
test dword [esi + 0x50], 0x10000000
je 0x45d934
cmp eax, 0x2e
jne 0x45d750
push 5
lea ecx, [esi + 0x24]
call fcn.0045d5f0
jmp 0x45d901
cmp eax, 0x5c
jne 0x45d7b5
mov ecx, esi
call fcn.0045d6a0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x45d782
cmp byte [esi + 0x48], 0x62
jne 0x45d782
push 4
lea ecx, [esi + 0x24]
call fcn.0045d5f0
mov ecx, esi
call fcn.0045d6a0
jmp 0x45d90f
test eax, eax
je 0x45d7a9
cmp byte [esi + 0x48], 0x42
jne 0x45d7a9
push 4
lea ecx, [esi + 0x24]
call fcn.0045d5f0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0045d6a0
jmp 0x45d90f
mov ecx, esi
call fcn.0045f0c0
jmp 0x45d908
cmp eax, 0x5b
jne 0x45d868
mov ecx, esi
call fcn.0045d6a0
lea ecx, [esi + 0x24]
call fcn.00461730
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x45d7e6
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0045d6a0
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x45d852
cmp eax, 0x5d
jne 0x45d852
test dword [esi + 0x2c], 0x100
mov bl, al
je 0x45d810
mov eax, dword [esi + 0x30]
push 0x5d
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov bl, al
mov edi, dword [esi + 0x28]
mov ecx, dword [edi + 0x18]
test ecx, ecx
jne 0x45d836
push 0x20
call fcn.0046fd13
xorps xmm0, xmm0
mov dword [ebp - 4], eax
add esp, 4
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [edi + 0x18], eax
movzx edx, bl
mov eax, edx
and edx, 7
shr eax, 3
add ecx, eax
movzx eax, byte [ecx]
bts eax, edx
mov byte [ecx], al
mov ecx, esi
call fcn.0045d6a0
mov ecx, esi
call fcn.00461190
cmp dword [esi + 0x4c], 0x5d
jne 0x45d92d
jmp 0x45d901
cmp eax, 0x28
jne 0x45d894
mov ecx, esi
call fcn.0045d6a0
mov ecx, esi
call fcn.0045f250
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x45d934
mov ecx, esi
call fcn.0045d6a0
test bl, bl
je 0x45d90f
jmp 0x45d908
cmp eax, 0x5e
jne 0x45d8ac
push 2
lea ecx, [esi + 0x24]
call fcn.0045d5f0
mov ecx, esi
call fcn.0045d6a0
jmp 0x45d90f
cmp eax, 0x24
jne 0x45d8c4
push 3
lea ecx, [esi + 0x24]
call fcn.0045d5f0
mov ecx, esi
call fcn.0045d6a0
jmp 0x45d90f
cmp eax, 0x2a
je 0x45d926
cmp eax, 0x2b
je 0x45d926
cmp eax, 0x3f
je 0x45d926
cmp eax, 0x7b
je 0x45d926
cmp eax, 0x7d
jne 0x45d8e6
test dword [esi + 0x50], 0x10000000
je 0x45d93b
cmp eax, 0x5d
jne 0x45d8f4
test dword [esi + 0x50], 0x10000000
je 0x45d92d
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0045f4b0
mov ecx, esi
call fcn.0045d6a0
mov ecx, esi
call fcn.0045f350
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x45d717
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
call fcn.0045bec0
push 4
call fcn.0045bec0
push 5
call fcn.0045bec0
push 6
call fcn.0045bec0
int3
Function at 0x45e400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push ebx
push esi
push edi
lea edi, [eax + 8]
mov dword [ebp - 8], ecx
lea esi, [edi + 4]
xor ebx, ebx
cmp esi, edi
sbb ecx, ecx
and ecx, 0xfffffffc
add ecx, 4
cmp edi, esi
ja 0x45e443
mov esi, ecx
nop dword [eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, edx
inc ebx
imul edx, ecx, 0x1000193
cmp ebx, esi
jne 0x45e430
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx + 0x18]
and ecx, edx
mov edx, dword [ebx + 0xc]
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x45e47c
cmp ecx, eax
jne 0x45e474
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x45e484
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x45e484
cmp ecx, eax
jne 0x45e484
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.00459900
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8