joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x58
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x54], eax
xor al, al
cmp byte [esp + 0x5c], 2
mov dl, 0x5f
mov cl, 0x65
jne 0x10023a89
mov byte [esp + 0x25], dl
mov byte [esp + 0x30], dl
mov dl, 0x30
mov byte [esp + 0x1d], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
mov byte [esp + 0x27], cl
mov byte [esp + 0x2d], cl
mov cl, 0x31
mov byte [esp + 0x34], al
mov byte [esp + 0x37], dl
mov byte [esp + 0x38], dl
mov byte [esp + 0x3a], al
mov byte [esp + 0x41], al
mov byte [esp + 0x43], dl
mov byte [esp + 0x44], dl
mov dl, 0x32
mov byte [esp + 0x46], al
mov byte [esp + 0x4e], al
mov byte [esp + 0x50], al
mov byte [esp + 0x52], al
push 0x37
lea eax, [esp + 0x20]
mov byte [esp + 0x20], 5
mov byte [esp + 0x22], 9
mov byte [esp + 0x26], 0x59
mov byte [esp + 0x27], 0x52
mov byte [esp + 0x28], 0x42
mov byte [esp + 0x2a], 0x4e
mov byte [esp + 0x2c], 0x77
mov byte [esp + 0x2d], 0x51
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x63
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x67
mov byte [esp + 0x35], 0x45
mov byte [esp + 0x36], 0x61
mov byte [esp + 0x37], 0x74
mov byte [esp + 0x39], 3
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3d], cl
mov byte [esp + 0x3f], 0x36
mov byte [esp + 0x40], 0x35
mov byte [esp + 0x41], 0x35
mov byte [esp + 0x42], 0x33
mov byte [esp + 0x43], 0x36
mov byte [esp + 0x44], 0x34
mov byte [esp + 0x46], cl
mov byte [esp + 0x49], dl
mov byte [esp + 0x4b], 0x37
mov byte [esp + 0x4c], 0x37
mov byte [esp + 0x4d], dl
mov byte [esp + 0x4e], 0x36
mov byte [esp + 0x4f], 0x33
mov byte [esp + 0x50], 0x34
mov byte [esp + 0x51], dl
mov byte [esp + 0x53], cl
mov byte [esp + 0x55], cl
push eax
jmp 0x10023b0c
mov byte [esp + 0xe], cl
mov byte [esp + 0x12], cl
mov cl, 0x31
mov byte [esp + 0x17], cl
mov byte [esp + 0x19], cl
push 0x1b
lea ecx, [esp + 4]
mov byte [esp + 4], 5
mov byte [esp + 5], al
mov byte [esp + 6], 9
mov byte [esp + 7], al
mov byte [esp + 8], al
mov byte [esp + 9], al
mov byte [esp + 0xa], 0x5a
mov byte [esp + 0xb], 0x43
mov byte [esp + 0xc], 0x4d
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], 0x71
mov byte [esp + 0xf], 0x69
mov byte [esp + 0x10], 0x63
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x13], 0x6e
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], dl
mov byte [esp + 0x17], 0x61
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 1
mov byte [esp + 0x1c], al
mov byte [esp + 0x1e], al
push ecx
call fcn.10001270
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1002dd43
add esp, 0x58
ret 4
Function at 0x10024f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x20], eax
xor al, al
mov dl, 0x47
mov byte [esp + 1], al
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov cl, 0x5f
mov byte [esp + 0x18], al
mov byte [esp + 0x1b], al
mov byte [esp + 0x1d], al
mov byte [esp + 6], dl
mov byte [esp + 0xd], dl
mov byte [esp + 0xf], dl
mov dl, 0x74
push 0x1e
lea eax, [esp + 4]
push eax
mov byte [esp + 8], 5
mov byte [esp + 0xa], 9
mov byte [esp + 0xf], 0x58
mov byte [esp + 0x10], 0x54
mov byte [esp + 0x11], cl
mov byte [esp + 0x12], 0x46
mov byte [esp + 0x13], 0x59
mov byte [esp + 0x14], 0x5a
mov byte [esp + 0x16], cl
mov byte [esp + 0x18], 0x65
mov byte [esp + 0x19], dl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x50
mov byte [esp + 0x1c], 0x6f
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x1e], 0x6e
mov byte [esp + 0x1f], dl
mov byte [esp + 0x21], 1
mov byte [esp + 0x22], 0x31
mov byte [esp + 0x24], 0x32
call fcn.10001270
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1002dd43
add esp, 0x24
ret
Function at 0x1002cf50
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x12c
mov eax, dword [0x1007a664]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x140]
call fcn.100248e0
push eax
push str.__wndtschool_d.ini
push 0xff
lea eax, [esp + 0x44]
push 0xff
push eax
call fcn.1002f353
push 0xa0
xor esi, esi
push esi
push 0x1007e6d8
call fcn.1002e3d0
add esp, 0x20
lea ecx, [esp + 0x38]
push ecx
push 0xa0
push 0x1007e6d8
push str.dtcfg
push str.dtschool
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
push 6
mov dword [0x1007e73c], esi
call fcn.10001020
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x43a
push edi
mov ebp, eax
call ebx
push 0x43f
push edi
mov dword [esp + 0x18], eax
call ebx
push 0x442
push edi
mov dword [esp + 0x1c], eax
call ebx
push 0x447
push edi
mov dword [esp + 0x20], eax
call ebx
push 0x44a
push edi
mov dword [esp + 0x24], eax
call ebx
push 0x43b
push edi
mov dword [esp + 0x28], eax
call ebx
push 0x440
push edi
mov dword [esp + 0x2c], eax
call ebx
push 0x443
push edi
mov dword [esp + 0x30], eax
call ebx
push 0x448
push edi
mov dword [esp + 0x34], eax
call ebx
push 0x44b
push edi
mov dword [esp + 0x38], eax
call ebx
mov dword [esp + 0x34], eax
nop
push ebp
lea eax, [esi + 0x1007e6d8]
push 0
lea edx, [eax + 0x14]
push edx
push eax
mov eax, dword [esp + esi + 0x34]
push eax
call fcn.1002bd90
mov ecx, dword [esi + 0x1007e714]
mov edx, dword [esp + esi + 0x10]
push 0
push ecx
push 0xf1
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
add esi, 4
cmp esi, 0x14
jb 0x1002d050
mov eax, dword [0x1007e740]
push 0
push eax
push 0xf1
push 0x400
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1007e744
push 0x4ce
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002dd43
add esp, 0x12c
ret 4

Function at 0x1002dd43
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007a664]
jne 0x1002dd4d
repz ret
jmp fcn.100315ff
Function at 0x1003a747
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10034c11
xor ebx, ebx
cmp dword [0x1007ff30], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1003a81c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1003a787
xor eax, eax
jmp 0x1003a8e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1006f1cc
push edi
call esi
cmp eax, ebx
je 0x1003a780
push eax
call fcn.10034bae
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1007ff30], eax
call esi
push eax
call fcn.10034bae
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1007ff34], eax
call esi
push eax
call fcn.10034bae
mov dword [0x1007ff38], eax
lea eax, [ebp - 8]
push eax
call fcn.1002f088
test eax, eax
pop ecx
pop ecx
je 0x1003a7ea
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1002f3fb
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1003a81c
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10034bae
cmp eax, ebx
pop ecx
mov dword [0x1007ff40], eax
je 0x1003a81c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10034bae
pop ecx
mov dword [0x1007ff3c], eax
mov eax, dword [0x1007ff3c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1003a895
cmp dword [0x1007ff40], esi
je 0x1003a895
push eax
call fcn.10034c1a
pop ecx
call eax
cmp eax, ebx
je 0x1003a862
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1007ff40]
call fcn.10034c1a
pop ecx
call eax
test eax, eax
je 0x1003a862
test byte [ebp - 0x18], 1
jne 0x1003a895
lea eax, [ebp - 0xc]
push eax
call fcn.1002f0bf
test eax, eax
pop ecx
je 0x1003a87d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1002f3fb
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1003a88c
or dword [ebp + 0x10], 0x200000
jmp 0x1003a8c6
or dword [ebp + 0x10], 0x40000
jmp 0x1003a8c6
mov eax, dword [0x1007ff34]
cmp eax, esi
je 0x1003a8c6
push eax
call fcn.10034c1a
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1003a8c6
mov eax, dword [0x1007ff38]
cmp eax, esi
je 0x1003a8c6
push dword [ebp - 4]
push eax
call fcn.10034c1a
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1007ff30]
call fcn.10034c1a
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405bee
Capabilities:
Parse credit card information

Disassembly:
push 0x2004
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [0x244080c4]
and esp, dword [edx]
and byte [0x28292224], ah
and eax, 0x28292224
and eax, 0x29252728
sub byte [0x2c282b2c], ah
sub ch, byte [eax]
sub al, 0x2a
sub byte [edx], ch
sub byte [esi], ah
sub al, 0x2b
sub ebp, dword [eax]
and eax, 0x1d1f2022
and eax, 0x2b2c2224
sub byte [ebx + ebp], ch
sub byte [edx], ch
sub dword [esi], esp
sub al, 0x2b
sub dword [0x292a292c], ebp
sub byte es:[edi], ah
and eax, 0x29252829
sub byte [0x28232526], ah
and al, 0x2a
sub dword [esi], esp
sub ch, byte [ecx]
sub byte es:[edi], ah
and eax, 0x2a252728
sub byte [esi], ah
sub byte [esi], ah
and al, 0x25
and al, 0x22
sub byte [edi], ah
and eax, 0x2c282a2c
sub ebp, dword [ecx]
sub eax, 0x2a2b292b
daa
sub byte [edi], ah
and al, 0x27
and esp, dword es:[esi]
and eax, 0x23262723
sub byte [edi], ah
and al, 0x2a
sub byte [esi], ah
sub al, 0x2b
sub byte [edi], ch
sub eax, 0x282b2c2a
sub ebp, dword [edx]
daa
sub al, 0x2b
sub byte [eax], ch
daa
and eax, 0x28222526
daa
and eax, 0x2b252728
sub dword [edi], esp
sub al, 0x2b
sub byte [edx], ch
sub dword [esi], esp
sub ch, byte [ecx]
sub al, 0x2a
sub byte [ebx + ebp], ch
sub byte [edi], ch
sub ebp, dword cs:[edi]
sub eax, 0x292c2e2a
sub al, 0x29
sub al, 0x2b
sub byte [ecx], ch
sub byte [0x2b252728], ah
sub dword [edi], esp
das
sub ebp, dword cs:[esi]
sub eax, 0x292c2d2a
sub ebp, dword [edx]
sub ah, byte [edi]
sub eax, 0x2d2f292b
sub ch, byte [edx + ebp]
sub byte [eax], ch
daa
and eax, 0x24212324
and esp, dword [ecx]
sub ebp, dword [ecx]
daa
sub byte [edi], ah
and eax, 0x2226292a
and dword [edi], ebx
and ah, byte [ecx]
pop ds
and eax, 0x23242224
and esp, dword [ecx]
pop ds
push ds
sbb al, 0x24
and esp, dword [ecx]
sub ch, byte [eax]
sub ebp, dword es:[edx]
daa
sub al, 0x2b
sub dword [eax], ebp
and al, 0x28
daa
and eax, 0x2d242728
sub al, 0x29
sub al, 0x29
sub al, 0x2b
sub dword [ebx + ebp], ebp
sub dword [eax], ebp
daa
and eax, 0x2b26292a
sub dword [edi], esp
sub eax, 0x2f31292b
sub eax, 0x28282b2c
sub byte [eax], ch
and al, 0x2c
sub ebp, dword [eax]
xor byte [esi], ch
sub ebp, dword [edi]
sub esi, dword cs:[ecx]
xor byte [0x2e2c2f30], ch
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
das
sub al, 0x30
das
sub al, 0x2f
sub eax, 0x292c2d2a
sub ebp, dword [ecx]
daa
sub al, 0x2b
sub dword [ecx], ebp
sub byte [0x2a252829], ah
sub dword [esi], esp
sub dword es:[eax], ebp
and eax, 0x28252728
daa
and eax, 0x2e26292a
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
sub ebp, dword cs:[ebx + ebp]
sub byte [ecx], ch
sub byte [0x28252728], ah
daa
and eax, 0x28252829
daa
and al, 0x21
and byte [esi], bl
push ds
sbb eax, 0x2123241c
sub dword [eax], ebp
and eax, 0x312a2d2f
xor byte [0x302c2f30], ch
das
sub al, 0x31
xor byte [0x302d3132], ch
Function at 0x405c04
Capabilities:
Parse credit card information

Disassembly:
push 0x2004
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [0x244080c4]
and esp, dword [edx]
and byte [0x28292224], ah
and eax, 0x28292224
and eax, 0x29252728
sub byte [0x2c282b2c], ah
sub ch, byte [eax]
sub al, 0x2a
sub byte [edx], ch
sub byte [esi], ah
sub al, 0x2b
sub ebp, dword [eax]
and eax, 0x1d1f2022
and eax, 0x2b2c2224
sub byte [ebx + ebp], ch
sub byte [edx], ch
sub dword [esi], esp
sub al, 0x2b
sub dword [0x292a292c], ebp
sub byte es:[edi], ah
and eax, 0x29252829
sub byte [0x28232526], ah
and al, 0x2a
sub dword [esi], esp
sub ch, byte [ecx]
sub byte es:[edi], ah
and eax, 0x2a252728
sub byte [esi], ah
sub byte [esi], ah
and al, 0x25
and al, 0x22
sub byte [edi], ah
and eax, 0x2c282a2c
sub ebp, dword [ecx]
sub eax, 0x2a2b292b
daa
sub byte [edi], ah
and al, 0x27
and esp, dword es:[esi]
and eax, 0x23262723
sub byte [edi], ah
and al, 0x2a
sub byte [esi], ah
sub al, 0x2b
sub byte [edi], ch
sub eax, 0x282b2c2a
sub ebp, dword [edx]
daa
sub al, 0x2b
sub byte [eax], ch
daa
and eax, 0x28222526
daa
and eax, 0x2b252728
sub dword [edi], esp
sub al, 0x2b
sub byte [edx], ch
sub dword [esi], esp
sub ch, byte [ecx]
sub al, 0x2a
sub byte [ebx + ebp], ch
sub byte [edi], ch
sub ebp, dword cs:[edi]
sub eax, 0x292c2e2a
sub al, 0x29
sub al, 0x2b
sub byte [ecx], ch
sub byte [0x2b252728], ah
sub dword [edi], esp
das
sub ebp, dword cs:[esi]
sub eax, 0x292c2d2a
sub ebp, dword [edx]
sub ah, byte [edi]
sub eax, 0x2d2f292b
sub ch, byte [edx + ebp]
sub byte [eax], ch
daa
and eax, 0x24212324
and esp, dword [ecx]
sub ebp, dword [ecx]
daa
sub byte [edi], ah
and eax, 0x2226292a
and dword [edi], ebx
and ah, byte [ecx]
pop ds
and eax, 0x23242224
and esp, dword [ecx]
pop ds
push ds
sbb al, 0x24
and esp, dword [ecx]
sub ch, byte [eax]
sub ebp, dword es:[edx]
daa
sub al, 0x2b
sub dword [eax], ebp
and al, 0x28
daa
and eax, 0x2d242728
sub al, 0x29
sub al, 0x29
sub al, 0x2b
sub dword [ebx + ebp], ebp
sub dword [eax], ebp
daa
and eax, 0x2b26292a
sub dword [edi], esp
sub eax, 0x2f31292b
sub eax, 0x28282b2c
sub byte [eax], ch
and al, 0x2c
sub ebp, dword [eax]
xor byte [esi], ch
sub ebp, dword [edi]
sub esi, dword cs:[ecx]
xor byte [0x2e2c2f30], ch
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
das
sub al, 0x30
das
sub al, 0x2f
sub eax, 0x292c2d2a
sub ebp, dword [ecx]
daa
sub al, 0x2b
sub dword [ecx], ebp
sub byte [0x2a252829], ah
sub dword [esi], esp
sub dword es:[eax], ebp
and eax, 0x28252728
daa
and eax, 0x2e26292a
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
sub ebp, dword cs:[ebx + ebp]
sub byte [ecx], ch
sub byte [0x28252728], ah
daa
and eax, 0x28252829
daa
and al, 0x21
and byte [esi], bl
push ds
sbb eax, 0x2123241c
sub dword [eax], ebp
and eax, 0x312a2d2f
xor byte [0x302c2f30], ch
das
sub al, 0x31
xor byte [0x302d3132], ch
Function at 0x405c1d
Capabilities:
Parse credit card information

Disassembly:
push 0x2004
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [0x244080c4]
and esp, dword [edx]
and byte [0x28292224], ah
and eax, 0x28292224
and eax, 0x29252728
sub byte [0x2c282b2c], ah
sub ch, byte [eax]
sub al, 0x2a
sub byte [edx], ch
sub byte [esi], ah
sub al, 0x2b
sub ebp, dword [eax]
and eax, 0x1d1f2022
and eax, 0x2b2c2224
sub byte [ebx + ebp], ch
sub byte [edx], ch
sub dword [esi], esp
sub al, 0x2b
sub dword [0x292a292c], ebp
sub byte es:[edi], ah
and eax, 0x29252829
sub byte [0x28232526], ah
and al, 0x2a
sub dword [esi], esp
sub ch, byte [ecx]
sub byte es:[edi], ah
and eax, 0x2a252728
sub byte [esi], ah
sub byte [esi], ah
and al, 0x25
and al, 0x22
sub byte [edi], ah
and eax, 0x2c282a2c
sub ebp, dword [ecx]
sub eax, 0x2a2b292b
daa
sub byte [edi], ah
and al, 0x27
and esp, dword es:[esi]
and eax, 0x23262723
sub byte [edi], ah
and al, 0x2a
sub byte [esi], ah
sub al, 0x2b
sub byte [edi], ch
sub eax, 0x282b2c2a
sub ebp, dword [edx]
daa
sub al, 0x2b
sub byte [eax], ch
daa
and eax, 0x28222526
daa
and eax, 0x2b252728
sub dword [edi], esp
sub al, 0x2b
sub byte [edx], ch
sub dword [esi], esp
sub ch, byte [ecx]
sub al, 0x2a
sub byte [ebx + ebp], ch
sub byte [edi], ch
sub ebp, dword cs:[edi]
sub eax, 0x292c2e2a
sub al, 0x29
sub al, 0x2b
sub byte [ecx], ch
sub byte [0x2b252728], ah
sub dword [edi], esp
das
sub ebp, dword cs:[esi]
sub eax, 0x292c2d2a
sub ebp, dword [edx]
sub ah, byte [edi]
sub eax, 0x2d2f292b
sub ch, byte [edx + ebp]
sub byte [eax], ch
daa
and eax, 0x24212324
and esp, dword [ecx]
sub ebp, dword [ecx]
daa
sub byte [edi], ah
and eax, 0x2226292a
and dword [edi], ebx
and ah, byte [ecx]
pop ds
and eax, 0x23242224
and esp, dword [ecx]
pop ds
push ds
sbb al, 0x24
and esp, dword [ecx]
sub ch, byte [eax]
sub ebp, dword es:[edx]
daa
sub al, 0x2b
sub dword [eax], ebp
and al, 0x28
daa
and eax, 0x2d242728
sub al, 0x29
sub al, 0x29
sub al, 0x2b
sub dword [ebx + ebp], ebp
sub dword [eax], ebp
daa
and eax, 0x2b26292a
sub dword [edi], esp
sub eax, 0x2f31292b
sub eax, 0x28282b2c
sub byte [eax], ch
and al, 0x2c
sub ebp, dword [eax]
xor byte [esi], ch
sub ebp, dword [edi]
sub esi, dword cs:[ecx]
xor byte [0x2e2c2f30], ch
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
das
sub al, 0x30
das
sub al, 0x2f
sub eax, 0x292c2d2a
sub ebp, dword [ecx]
daa
sub al, 0x2b
sub dword [ecx], ebp
sub byte [0x2a252829], ah
sub dword [esi], esp
sub dword es:[eax], ebp
and eax, 0x28252728
daa
and eax, 0x2e26292a
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
sub ebp, dword cs:[ebx + ebp]
sub byte [ecx], ch
sub byte [0x28252728], ah
daa
and eax, 0x28252829
daa
and al, 0x21
and byte [esi], bl
push ds
sbb eax, 0x2123241c
sub dword [eax], ebp
and eax, 0x312a2d2f
xor byte [0x302c2f30], ch
das
sub al, 0x31
xor byte [0x302d3132], ch
Function at 0x405cf5
Capabilities:
Parse credit card information

Disassembly:
push 0x2004
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [0x244080c4]
and esp, dword [edx]
and byte [0x28292224], ah
and eax, 0x28292224
and eax, 0x29252728
sub byte [0x2c282b2c], ah
sub ch, byte [eax]
sub al, 0x2a
sub byte [edx], ch
sub byte [esi], ah
sub al, 0x2b
sub ebp, dword [eax]
and eax, 0x1d1f2022
and eax, 0x2b2c2224
sub byte [ebx + ebp], ch
sub byte [edx], ch
sub dword [esi], esp
sub al, 0x2b
sub dword [0x292a292c], ebp
sub byte es:[edi], ah
and eax, 0x29252829
sub byte [0x28232526], ah
and al, 0x2a
sub dword [esi], esp
sub ch, byte [ecx]
sub byte es:[edi], ah
and eax, 0x2a252728
sub byte [esi], ah
sub byte [esi], ah
and al, 0x25
and al, 0x22
sub byte [edi], ah
and eax, 0x2c282a2c
sub ebp, dword [ecx]
sub eax, 0x2a2b292b
daa
sub byte [edi], ah
and al, 0x27
and esp, dword es:[esi]
and eax, 0x23262723
sub byte [edi], ah
and al, 0x2a
sub byte [esi], ah
sub al, 0x2b
sub byte [edi], ch
sub eax, 0x282b2c2a
sub ebp, dword [edx]
daa
sub al, 0x2b
sub byte [eax], ch
daa
and eax, 0x28222526
daa
and eax, 0x2b252728
sub dword [edi], esp
sub al, 0x2b
sub byte [edx], ch
sub dword [esi], esp
sub ch, byte [ecx]
sub al, 0x2a
sub byte [ebx + ebp], ch
sub byte [edi], ch
sub ebp, dword cs:[edi]
sub eax, 0x292c2e2a
sub al, 0x29
sub al, 0x2b
sub byte [ecx], ch
sub byte [0x2b252728], ah
sub dword [edi], esp
das
sub ebp, dword cs:[esi]
sub eax, 0x292c2d2a
sub ebp, dword [edx]
sub ah, byte [edi]
sub eax, 0x2d2f292b
sub ch, byte [edx + ebp]
sub byte [eax], ch
daa
and eax, 0x24212324
and esp, dword [ecx]
sub ebp, dword [ecx]
daa
sub byte [edi], ah
and eax, 0x2226292a
and dword [edi], ebx
and ah, byte [ecx]
pop ds
and eax, 0x23242224
and esp, dword [ecx]
pop ds
push ds
sbb al, 0x24
and esp, dword [ecx]
sub ch, byte [eax]
sub ebp, dword es:[edx]
daa
sub al, 0x2b
sub dword [eax], ebp
and al, 0x28
daa
and eax, 0x2d242728
sub al, 0x29
sub al, 0x29
sub al, 0x2b
sub dword [ebx + ebp], ebp
sub dword [eax], ebp
daa
and eax, 0x2b26292a
sub dword [edi], esp
sub eax, 0x2f31292b
sub eax, 0x28282b2c
sub byte [eax], ch
and al, 0x2c
sub ebp, dword [eax]
xor byte [esi], ch
sub ebp, dword [edi]
sub esi, dword cs:[ecx]
xor byte [0x2e2c2f30], ch
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
das
sub al, 0x30
das
sub al, 0x2f
sub eax, 0x292c2d2a
sub ebp, dword [ecx]
daa
sub al, 0x2b
sub dword [ecx], ebp
sub byte [0x2a252829], ah
sub dword [esi], esp
sub dword es:[eax], ebp
and eax, 0x28252728
daa
and eax, 0x2e26292a
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
sub ebp, dword cs:[ebx + ebp]
sub byte [ecx], ch
sub byte [0x28252728], ah
daa
and eax, 0x28252829
daa
and al, 0x21
and byte [esi], bl
push ds
sbb eax, 0x2123241c
sub dword [eax], ebp
and eax, 0x312a2d2f
xor byte [0x302c2f30], ch
das
sub al, 0x31
xor byte [0x302d3132], ch
Function at 0x405d2c
Capabilities:
Parse credit card information

Disassembly:
push 0x2004
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [0x244080c4]
and esp, dword [edx]
and byte [0x28292224], ah
and eax, 0x28292224
and eax, 0x29252728
sub byte [0x2c282b2c], ah
sub ch, byte [eax]
sub al, 0x2a
sub byte [edx], ch
sub byte [esi], ah
sub al, 0x2b
sub ebp, dword [eax]
and eax, 0x1d1f2022
and eax, 0x2b2c2224
sub byte [ebx + ebp], ch
sub byte [edx], ch
sub dword [esi], esp
sub al, 0x2b
sub dword [0x292a292c], ebp
sub byte es:[edi], ah
and eax, 0x29252829
sub byte [0x28232526], ah
and al, 0x2a
sub dword [esi], esp
sub ch, byte [ecx]
sub byte es:[edi], ah
and eax, 0x2a252728
sub byte [esi], ah
sub byte [esi], ah
and al, 0x25
and al, 0x22
sub byte [edi], ah
and eax, 0x2c282a2c
sub ebp, dword [ecx]
sub eax, 0x2a2b292b
daa
sub byte [edi], ah
and al, 0x27
and esp, dword es:[esi]
and eax, 0x23262723
sub byte [edi], ah
and al, 0x2a
sub byte [esi], ah
sub al, 0x2b
sub byte [edi], ch
sub eax, 0x282b2c2a
sub ebp, dword [edx]
daa
sub al, 0x2b
sub byte [eax], ch
daa
and eax, 0x28222526
daa
and eax, 0x2b252728
sub dword [edi], esp
sub al, 0x2b
sub byte [edx], ch
sub dword [esi], esp
sub ch, byte [ecx]
sub al, 0x2a
sub byte [ebx + ebp], ch
sub byte [edi], ch
sub ebp, dword cs:[edi]
sub eax, 0x292c2e2a
sub al, 0x29
sub al, 0x2b
sub byte [ecx], ch
sub byte [0x2b252728], ah
sub dword [edi], esp
das
sub ebp, dword cs:[esi]
sub eax, 0x292c2d2a
sub ebp, dword [edx]
sub ah, byte [edi]
sub eax, 0x2d2f292b
sub ch, byte [edx + ebp]
sub byte [eax], ch
daa
and eax, 0x24212324
and esp, dword [ecx]
sub ebp, dword [ecx]
daa
sub byte [edi], ah
and eax, 0x2226292a
and dword [edi], ebx
and ah, byte [ecx]
pop ds
and eax, 0x23242224
and esp, dword [ecx]
pop ds
push ds
sbb al, 0x24
and esp, dword [ecx]
sub ch, byte [eax]
sub ebp, dword es:[edx]
daa
sub al, 0x2b
sub dword [eax], ebp
and al, 0x28
daa
and eax, 0x2d242728
sub al, 0x29
sub al, 0x29
sub al, 0x2b
sub dword [ebx + ebp], ebp
sub dword [eax], ebp
daa
and eax, 0x2b26292a
sub dword [edi], esp
sub eax, 0x2f31292b
sub eax, 0x28282b2c
sub byte [eax], ch
and al, 0x2c
sub ebp, dword [eax]
xor byte [esi], ch
sub ebp, dword [edi]
sub esi, dword cs:[ecx]
xor byte [0x2e2c2f30], ch
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
das
sub al, 0x30
das
sub al, 0x2f
sub eax, 0x292c2d2a
sub ebp, dword [ecx]
daa
sub al, 0x2b
sub dword [ecx], ebp
sub byte [0x2a252829], ah
sub dword [esi], esp
sub dword es:[eax], ebp
and eax, 0x28252728
daa
and eax, 0x2e26292a
sub al, 0x29
xor byte [edi], ch
sub al, 0x30
sub ebp, dword cs:[ebx + ebp]
sub byte [ecx], ch
sub byte [0x28252728], ah
daa
and eax, 0x28252829
daa
and al, 0x21
and byte [esi], bl
push ds
sbb eax, 0x2123241c
sub dword [eax], ebp
and eax, 0x312a2d2f
xor byte [0x302c2f30], ch
das
sub al, 0x31
xor byte [0x302d3132], ch
Function at 0x40611c
Capabilities:
Parse credit card information

Disassembly:
cmp byte [edx], dh
xor esi, dword [edi + esi]
cmp byte [ecx], bh
aas
inc eax
inc ecx
inc eax
inc ecx
inc edx
aas
inc eax
inc ecx
aas
inc eax
inc edx
inc ebx
inc ebp
inc ebx
inc esp
inc ebp
aas
inc eax
cmp dword [edx], edi
cmp edi, dword [edx]
cmp edi, dword [esi + edi]
aas
inc eax
aas
inc eax
cmp bh, byte [ebx]
cmp al, 0x36
aaa
cmp byte [0x302f3736], dh
aaa
das
xor byte [eax], dh
xor dh, byte [ebx]
xor esi, dword [0x35343636]
xor eax, 0x32313130
xor dh, byte [edx]
xor eax, 0x302f3636
xor byte [esi], dh
cmp byte [eax], bh
xor al, 0x36
xor dh, byte ss:[esp + esi]
xor eax, 0x39373838
cmp dword [eax], edi
cmp bh, byte [edx]
aas

Function at 0x406178
Capabilities:
Parse credit card information

Disassembly:
inc ecx
inc ecx
cmp al, 0x3e
cmp byte ss:[eax], bh
aaa
cmp dword [ecx], edi
xor dh, byte [esp + esi]
xor dword [edx], esi
xor dh, byte [ebx]
xor eax, 0x38383535
xor byte cs:[eax], dh
sub ch, byte [esp + ebp]
xor dh, byte [ebx]
xor al, 0x32
xor esi, dword [esp + ebp]
sub eax, 0x3534332e
cmp bh, byte [edi + 0x273b3a39]
daa
sub byte [ecx], ah
and ah, byte [edx]
and eax, 0x26252726
daa
and ah, byte [ebx]
and esp, dword [0x25242726]
and eax, 0x1f212020
pop ds
and byte [edi], bl
and byte [eax], ah
and dword [edx], esp
and esp, dword [ebx]
and al, 0x24
and dword [edx], esp
and ah, byte [eax]
and dword [ecx], esp
and eax, 0x25252625
sub dword es:[ecx], ebp
sub ah, byte [0x23222126]
sub ch, byte [ebx]
sub al, 0x30
xor dword [ecx], esi
xor byte [ecx], dh
xor dword [ecx], esi
xor dh, byte [edx]
das
das
xor byte [ecx], dh
xor dword [ebx], esi
xor al, 0x34
aaa
aaa
aaa
aaa
xor eax, 0x37363636