joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416788
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov eax, dword [0x6f60f4]
test eax, eax
je 0x4167bf
cmp dword [ebp + 8], 0
je 0x4167a7
mov eax, dword [ebp + 8]
mov dword [eax], 0x6f60f8
cmp dword [ebp + 0xc], 0
je 0x416931
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x6f6102
jmp 0x416931
call sub.KERNEL32.dll_GetUserDefaultLangID
mov word [ebp - 0x12], ax
movzx eax, word [ebp - 0x12]
mov dword [esp + 0xc], 9
lea edx, [ebp - 0x2b]
mov dword [esp + 8], edx
mov dword [esp + 4], 0x59
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
lea eax, [ebp - 0x2b]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x18]
add eax, edx
mov byte [eax], 0x5f
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x2b]
add edx, eax
movzx eax, word [ebp - 0x12]
mov dword [esp + 0xc], 9
mov dword [esp + 8], edx
mov dword [esp + 4], 0x5a
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
add dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x41689b
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
add eax, edx
mov al, byte [eax]
cmp al, 0x60
jle 0x416864
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
add eax, edx
mov al, byte [eax]
cmp al, 0x7a
jle 0x416880
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
add eax, edx
mov al, byte [eax]
cmp al, 0x40
jle 0x4168ad
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
add eax, edx
mov al, byte [eax]
cmp al, 0x5a
jg 0x4168ad
lea edx, [ebp - 0x2b]
mov eax, dword [ebp - 0x10]
add eax, edx
mov al, byte [eax]
mov edx, dword [ebp - 0xc]
add edx, 0x6f60f8
mov byte [edx], al
inc dword [ebp - 0xc]
inc dword [ebp - 0x10]
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2b]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
cmp ebx, eax
jb 0x416848
cmp dword [ebp - 0xc], 0
jle 0x4168ea
mov eax, dword [ebp - 0xc]
add eax, 0x6f60f8
mov byte [eax], 0
mov dword [esp + 8], 0xa
lea eax, [ebp - 0x2b]
mov dword [esp + 4], eax
mov dword [esp], 0x6f6102
call sub.msvcrt.dll_strncpy
mov byte [0x6f610b], 0
mov dword [0x6f60f4], 1
mov eax, dword [0x6f60f4]
test eax, eax
jne 0x416913
mov word [0x6f60f8], 0x6e65
mov byte [0x6f60fa], 0
mov word [0x6f6102], 0x6e65
mov byte [0x6f6104], 0
cmp dword [ebp + 8], 0
je 0x416922
mov eax, dword [ebp + 8]
mov dword [eax], 0x6f60f8
cmp dword [ebp + 0xc], 0
je 0x416931
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x6f6102
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x416952
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6f60e0]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x416990
call fcn.00416f6c
mov dword [ebp - 0xc], eax
mov eax, dword [0x6f60e0]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x416995
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6f60e4]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4169d3
call fcn.00416f6c
mov dword [ebp - 0xc], eax
mov eax, dword [0x6f60e4]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_TlsSetValue
sub esp, 8
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x416fe1
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
jmp 0x417021
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
movzx eax, al
xor eax, dword [ebp - 8]
and eax, 0xff
mov eax, dword [eax*4 + 0x5f42a0]
mov edx, dword [ebp - 8]
shr edx, 8
xor eax, edx
mov dword [ebp - 8], eax
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x416ff7
mov eax, dword [ebp - 8]
leave
ret
Function at 0x41aa41
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, eax
or ebx, 0xffffffff
test eax, eax
je 0x41aa9e
mov dword [esp], eax
call sub.msvcrt.dll__mkdir
xor ebx, ebx
test eax, eax
je 0x41aa9e
call sub.msvcrt.dll__errno
cmp dword [eax], 0x11
je 0x41aa9e
mov dword [esp], esi
call sub.msvcrt.dll__strdup
mov dword [esp], eax
call fcn.00597ec0
mov edi, eax
or ebx, 0xffffffff
test eax, eax
je 0x41aa8b
call fcn.0041aa41
mov ebx, eax
mov dword [esp], edi
call fcn.005a0e48
test ebx, ebx
jne 0x41aa9e
mov eax, esi
call fcn.0041aa41
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret

Function at 0x41aaa8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
cmp byte [0x6f6114], 0
jne 0x41ac2f
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1c
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
sub esp, 0xc
test eax, eax
jne 0x41abdf
lea ebx, [ebp - 0x226]
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.SHELL32.DLL_SHGetPathFromIDListW
push edx
push edx
test eax, eax
je 0x41abdf
mov dword [esp], ebx
call sub.msvcrt.dll_wcslen
mov ebx, eax
xor edi, edi
test eax, eax
jle 0x41abbb
lea eax, [eax + 1]
lea eax, [eax + eax*2]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edi, eax
xor edx, edx
xor esi, esi
mov dword [ebp - 0x23c], ebx
mov cx, word [ebp + esi*2 - 0x226]
inc esi
cmp cx, 0x7ff
jbe 0x41ab76
mov ebx, ecx
shr bx, 0xc
sub ebx, 0x20
mov byte [eax + edx], bl
mov ebx, ecx
shr bx, 6
and ebx, 0x3f
add ebx, 0xffffff80
mov byte [eax + edx + 1], bl
and ecx, 0x3f
add ecx, 0xffffff80
mov byte [eax + edx + 2], cl
add edx, 3
jmp 0x41abaf
cmp cx, 0x7f
lea ebx, [edx + 1]
mov dword [ebp - 0x22c], ebx
jbe 0x41aba3
mov ebx, ecx
shr bx, 6
and ebx, 0x1f
sub ebx, 0x40
mov byte [eax + edx], bl
and ecx, 0x3f
add ecx, 0xffffff80
mov byte [eax + edx + 1], cl
add edx, 2
jmp 0x41abaf
and ecx, 0x7f
mov byte [eax + edx], cl
mov edx, dword [ebp - 0x22c]
cmp esi, dword [ebp - 0x23c]
jne 0x41ab3b
mov byte [eax + edx], 0
mov dword [esp + 4], edi
mov dword [esp], 0x6f6114
call sub.msvcrt.dll_strcpy
mov dword [esp], edi
call fcn.005a0e48
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.OLE32.dll_CoTaskMemFree
push eax
mov dword [esp + 4], 0x67634a
mov dword [esp], 0x6f6114
call fcn.005a0e90
mov dword [esp + 4], str.libimobiledevice
mov dword [esp], 0x6f6114
call fcn.005a0e90
mov edi, 0x6f6114
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub ecx, 2
jmp 0x41ac22
mov byte [ecx + 0x6f6114], 0
dec ecx
test ecx, ecx
jle 0x41ac2f
cmp byte [ecx + 0x6f6114], 0x5c
je 0x41ac1a
mov eax, 0x6f6114
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x41ac6a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, eax
mov dword [ebp - 0x24], edx
test edx, edx
je 0x41adfb
test eax, eax
sete byte [ebp - 0x20]
je 0x41adfb
call fcn.0041aaa8
mov esi, eax
or edx, 0xffffffff
mov ecx, edx
mov edi, eax
mov al, byte [ebp - 0x20]
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x1c], ecx
mov ecx, edx
mov edi, ebx
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
add edx, dword [ebp - 0x1c]
mov dword [esp], edx
call sub.msvcrt.dll_malloc
mov edi, eax
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x67634a
mov dword [esp], edi
call fcn.005a0e90
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.005a0e90
mov dword [esp + 4], 0x6762fc
mov dword [esp], edi
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x41adca
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], esi
call sub.msvcrt.dll_ftell
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_fseek
cmp dword [ebp - 0x1c], 0xffffff
jbe 0x41ad6a
mov dword [esp + 8], str.userpref_get_file_contents
mov dword [esp + 4], str._s:_file_is_too_big____16MB_._Refusing_to_read_the_contents_to_memory_
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [ebp - 0x20], 0
jmp 0x41adb7
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, eax
mov dword [ebp - 0x20], eax
xor ebx, ebx
jmp 0x41adb1
mov dword [esp + 0xc], esi
mov eax, dword [ebp - 0x1c]
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
lea eax, [edx + ebx]
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call sub.msvcrt.dll_fread
test byte [esi + 0xc], 0x20
mov edx, dword [ebp - 0x28]
jne 0x41adb7
add ebx, eax
cmp ebx, dword [ebp - 0x1c]
jae 0x41adbb
test byte [esi + 0xc], 0x10
je 0x41ad7e
xor ebx, ebx
jmp 0x41adc0
mov ebx, 1
mov dword [esp], esi
call fcn.005a0ec8
jmp 0x41adda
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
xor ebx, ebx
mov dword [esp], edi
call fcn.005a0e48
test ebx, ebx
je 0x41adfd
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov dword [edx], ecx
mov eax, dword [ebp - 0x1c]
mov dword [edx + 4], eax
mov ebx, 1
jmp 0x41adfd
xor ebx, ebx
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x41b451
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x20], ecx
or eax, 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x41b57c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041b214
mov edx, eax
xor eax, eax
test edx, edx
jne 0x41b57c
call fcn.0041ac3c
call fcn.0041aaa8
mov esi, eax
or edx, 0xffffffff
xor eax, eax
mov ecx, edx
mov edi, esi
repne scasb al, byte es:[edi]
mov ebx, ecx
not ebx
mov ecx, edx
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
lea eax, [ebx + edx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x67634a
mov dword [esp], ebx
call fcn.005a0e90
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.005a0e90
mov dword [esp + 4], str..pem
mov dword [esp], ebx
call fcn.005a0e90
mov dword [esp + 4], 0x6763cc
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x41b537
mov dword [esp + 0xc], eax
mov ecx, dword [ebp - 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call fcn.005a0ec8
jmp 0x41b572
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.could_not_open__s_for_writing:__s
mov dword [esp + 8], 0x255
mov dword [esp + 4], str.src_userpref.c
mov dword [esp], str.userpref_set_device_public_key
call fcn.004208c9
mov dword [esp], ebx
call fcn.005a0e48
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret

Function at 0x41b584
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0041b214
test eax, eax
je 0x41b616
call fcn.0041aaa8
mov esi, eax
or edx, 0xffffffff
xor eax, eax
mov ecx, edx
mov edi, esi
repne scasb al, byte es:[edi]
mov ebx, ecx
not ebx
mov ecx, edx
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
lea eax, [ebx + edx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x67634a
mov dword [esp], ebx
call fcn.005a0e90
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.005a0e90
mov dword [esp + 4], str..pem
mov dword [esp], ebx
call fcn.005a0e90
mov dword [esp], ebx
call sub.msvcrt.dll_remove
mov dword [esp], ebx
call fcn.005a0e48
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x41ff49
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
or esi, 0xffffffff
test ebx, ebx
je 0x420052
mov eax, ebx
call fcn.0041f8b4
cmp dword [ebx + 0x1c], 0
je 0x41ffba
mov dword [esp + 0xc], str.callback_already_set__removing_n
mov dword [esp + 8], 0x1a1
mov dword [esp + 4], str.src_notification_proxy.c
mov dword [esp], str.np_set_notify_callback
call fcn.004208c9
mov esi, dword [ebx]
mov dword [ebx], 0
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
push eax
push eax
mov dword [ebx + 0x1c], 0
mov dword [ebx], esi
test edi, edi
je 0x420022
mov dword [esp], 0xc
call sub.msvcrt.dll_malloc
mov esi, 0xffffff00
test eax, eax
je 0x42004b
mov dword [eax], ebx
mov dword [eax + 4], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41f930
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebx + 0x1c], eax
xor esi, esi
inc eax
jne 0x42004b
mov dword [ebx + 0x1c], 0
jmp 0x420046
mov dword [esp + 0xc], str.no_callback_set
mov dword [esp + 8], 0x1c3
mov dword [esp + 4], str.src_notification_proxy.c
mov dword [esp], str.np_set_notify_callback
call fcn.004208c9
mov esi, 0xffffff00
mov eax, ebx
call fcn.0041f8f2
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x428070
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x42808c
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x428080
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
test edi, edi
je 0x428080
mov edx, 0xaaaaaaab
mov eax, edi
mul edx
shr edx, 1
lea eax, [edx*4 + 5]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], edi
xor edx, edx
jmp 0x42818c
mov al, byte [ebx + edx + 1]
shr al, 4
mov edi, eax
and edi, 0xff
mov al, byte [ebx + edx + 1]
and eax, 0xf
shl eax, 2
mov dword [ebp - 0x48], eax
lea eax, [edx + 2]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1c], eax
jae 0x4281bc
mov al, byte [ebx + edx + 2]
shr al, 6
movzx eax, al
mov dword [ebp - 0x4c], eax
mov al, byte [ebx + edx + 2]
and eax, 0x3f
mov dword [ebp - 0x40], eax
mov al, byte [ebp - 0x38]
shr al, 2
movzx eax, al
mov al, byte [eax + 0x677fc0]
mov byte [esi + ecx], al
mov al, byte [ebp - 0x38]
and eax, 3
shl eax, 4
mov al, byte [edi + eax + 0x677e60]
mov byte [esi + ecx + 1], al
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp + 0xc]
cmp dword [edi], eax
jbe 0x4281d4
mov edi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov al, byte [edi + eax + 0x677e60]
mov byte [ebp - 0x38], al
mov byte [esi + ecx + 2], al
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp + 0xc]
cmp eax, dword [edi]
jae 0x4281d0
mov edi, dword [ebp - 0x40]
mov al, byte [edi + 0x677fc0]
mov byte [esi + ecx + 3], al
add ecx, 4
add edx, 3
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
cmp eax, edx
jbe 0x4281e0
mov al, byte [ebx + edx]
mov byte [ebp - 0x38], al
lea edi, [edx + 1]
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x40], edi
ja 0x4280d8
mov dword [ebp - 0x48], 0
xor edi, edi
lea eax, [edx + 2]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1c], eax
jb 0x428106
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x4c], 0
jmp 0x42811d
mov al, 0x3d
jmp 0x428178
mov byte [ebp - 0x38], 0x3d
mov al, byte [ebp - 0x38]
jmp 0x428161
mov eax, dword [ebp - 0x50]
mov byte [esi + ecx], 0
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x428082
Function at 0x438bf6
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x25
jne 0x438d9b
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNextChar
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParseName
mov edi, eax
test eax, eax
jne 0x438c3f
mov ecx, str.xmlParsePEReference:_no_name_n
mov edx, 0x44
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
jmp fcn.0042d18c
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3b
je 0x438c5f
xor ecx, ecx
mov edx, 0x17
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
jmp fcn.0042d009
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNextChar
inc dword [ebx + 0x1b8]
mov eax, dword [ebx]
test eax, eax
je 0x438c8c
mov eax, dword [eax + 0x60]
test eax, eax
je 0x438c8c
mov dword [esp + 4], edi
mov edx, dword [ebx + 4]
mov dword [esp], edx
call eax
mov esi, eax
test eax, eax
jne 0x438cd7
cmp dword [ebx + 0x1c], 1
je 0x438c9e
cmp dword [ebx + 0x58], 0
jne 0x438cb7
cmp dword [ebx + 0x5c], 0
jne 0x438cb7
mov dword [esp], edi
mov ecx, str.PEReference:____s__not_found_n
mov edx, 0x1a
mov eax, ebx
call fcn.0042cf44
jmp 0x438d94
mov dword [esp], edi
mov ecx, str.PEReference:____s__not_found_n
mov edx, 0x1b
mov eax, ebx
call fcn.0042e44a
mov dword [ebx + 0x64], 0
jmp 0x438d94
mov eax, dword [eax + 0x30]
sub eax, 4
cmp eax, 1
jbe 0x438cfb
mov dword [esp], edi
mov ecx, str.Internal:____s__is_not_a_parameter_entity_n
mov edx, 0x1b
mov eax, ebx
call fcn.0042e44a
jmp 0x438d94
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x28], 0x42c5e1
je 0x438d22
mov edx, esi
mov eax, ebx
call fcn.0042daa6
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPushInput
test eax, eax
jns 0x438d94
jmp 0x438d9b
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNewEntityInputStream
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPushInput
test eax, eax
js 0x438d9b
cmp dword [esi + 0x30], 5
jne 0x438d94
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x438d94
cmp byte [eax + 1], 0x3f
jne 0x438d94
cmp byte [eax + 2], 0x78
jne 0x438d94
cmp byte [eax + 3], 0x6d
jne 0x438d94
cmp byte [eax + 4], 0x6c
jne 0x438d94
mov al, byte [eax + 5]
lea edx, [eax - 9]
cmp dl, 1
jbe 0x438d7a
cmp al, 0x20
je 0x438d7a
cmp al, 0xd
jne 0x438d94
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParseTextDecl
cmp dword [ebx + 0x54], 0x20
jne 0x438d94
mov dword [ebx + 0xac], 0xffffffff
jmp 0x438d9b
mov dword [ebx + 0x5c], 1
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x446586
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
je 0x4465c7
mov ebx, dword [edx]
test ebx, ebx
je 0x4465c7
test ecx, ecx
jne 0x4465ac
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x20
mov dword [esp + 0xc], ecx
mov eax, dword [edx + 4]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fwrite
add esp, 0x14
pop ebx
leave
ret

Function at 0x449d5d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ebx, edx
shr ebx, 0x1f
jne 0x449d7d
test eax, eax
je 0x449d7d
pop eax
pop ebx
leave
jmp sym.evasi0n_gui.exe_xmlNanoFTPRead
or eax, 0xffffffff
pop ebx
pop ebx
leave
ret

Function at 0x44a5a6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44a5ea
test edx, edx
je 0x44a5ea
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ebx, eax
test eax, eax
jns 0x44a5ed
mov edx, str.fread__
xor eax, eax
call fcn.0044a067
jmp 0x44a5ed
or ebx, 0xffffffff
mov eax, ebx
add esp, 0x14
pop ebx
leave
ret

Function at 0x44ca8f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
or ebx, 0xffffffff
cmp dword [0x6f6540], 0
jne 0x44cb08
mov dword [0x6f6540], 1
call sym.evasi0n_gui.exe_xmlNewMutex
mov dword [0x6f6544], eax
mov dword [esp], str.XML_MEM_BREAKPOINT
call sub.msvcrt.dll_getenv
test eax, eax
je 0x44cade
mov dword [esp + 8], 0x6f6548
mov dword [esp + 4], 0x67e3dd
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
mov dword [esp], str.XML_MEM_TRACE
call sub.msvcrt.dll_getenv
xor ebx, ebx
test eax, eax
je 0x44cb08
mov dword [esp + 8], 0x6f654c
mov dword [esp + 4], 0x67e3ef
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
mov eax, ebx
add esp, 0x14
pop ebx
leave
ret
Function at 0x44d1d7
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, ecx
mov byte [ebp - 0xd], dl
mov ebx, dword [eax]
mov dl, byte [ebx]
lea ecx, [edx - 0x41]
cmp cl, 0x19
jbe 0x44d2de
lea ecx, [edx - 0x61]
cmp cl, 0x19
jbe 0x44d2de
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44d2de
cmp dl, 0x2d
je 0x44d2de
cmp dl, 0x2e
je 0x44d2de
cmp dl, 0x5f
je 0x44d2de
cmp dl, 0x7e
je 0x44d2de
cmp dl, 0x25
jne 0x44d286
mov cl, byte [ebx + 1]
mov byte [ebp - 0x11], cl
lea edi, [ecx - 0x61]
mov ecx, edi
cmp cl, 5
jbe 0x44d25e
mov cl, byte [ebp - 0x11]
lea edi, [ecx - 0x30]
mov ecx, edi
cmp cl, 9
jbe 0x44d25e
mov cl, byte [ebp - 0x11]
sub ecx, 0x41
cmp cl, 5
ja 0x44d286
mov cl, byte [ebx + 2]
mov byte [ebp - 0x11], cl
lea edi, [ecx - 0x61]
mov ecx, edi
cmp cl, 5
jbe 0x44d2de
mov cl, byte [ebp - 0x11]
lea edi, [ecx - 0x30]
mov ecx, edi
cmp cl, 9
jbe 0x44d2de
mov cl, byte [ebp - 0x11]
sub ecx, 0x41
cmp cl, 5
jbe 0x44d2de
cmp dl, 0x24
je 0x44d2de
cmp dl, 0x21
je 0x44d2de
cmp dl, 0x26
je 0x44d2de
cmp dl, 0x28
je 0x44d2de
cmp dl, 0x29
je 0x44d2de
cmp dl, 0x2a
je 0x44d2de
cmp dl, 0x2b
je 0x44d2de
cmp dl, 0x2c
je 0x44d2de
cmp dl, 0x3b
je 0x44d2de
cmp dl, 0x3d
je 0x44d2de
cmp dl, 0x27
je 0x44d2de
cmp dl, 0x3a
je 0x44d2de
cmp dl, 0x40
je 0x44d2de
xor eax, eax
test esi, esi
sete al
jmp 0x44d3bb
cmp dl, 0x25
jne 0x44d2dd
add ebx, 3
jmp 0x44d2de
inc ebx
mov dl, byte [ebx]
lea ecx, [edx - 0x41]
cmp cl, 0x19
jbe 0x44d3ae
lea ecx, [edx - 0x61]
cmp cl, 0x19
jbe 0x44d3ae
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44d3ae
cmp dl, 0x2d
je 0x44d3ae
cmp dl, 0x2e
je 0x44d3ae
cmp dl, 0x5f
je 0x44d3ae
cmp dl, 0x7e
je 0x44d3ae
cmp dl, 0x25
jne 0x44d36d
movzx edi, byte [ebx + 1]
lea esi, [edi - 0x61]
mov ecx, esi
cmp cl, 5
jbe 0x44d34d
lea esi, [edi - 0x30]
mov ecx, esi
cmp cl, 9
jbe 0x44d34d
lea ecx, [edi - 0x41]
cmp cl, 5
ja 0x44d36d
movzx edi, byte [ebx + 2]
lea esi, [edi - 0x61]
mov ecx, esi
cmp cl, 5
jbe 0x44d3ae
lea esi, [edi - 0x30]
mov ecx, esi
cmp cl, 9
jbe 0x44d3ae
lea ecx, [edi - 0x41]
cmp cl, 5
jbe 0x44d3ae
cmp dl, 0x24
je 0x44d3ae
cmp dl, 0x21
je 0x44d3ae
cmp dl, 0x26
je 0x44d3ae
cmp dl, 0x28
je 0x44d3ae
cmp dl, 0x29
je 0x44d3ae
cmp dl, 0x2a
je 0x44d3ae
cmp dl, 0x2b
je 0x44d3ae
cmp dl, 0x2c
je 0x44d3ae
cmp dl, 0x3b
je 0x44d3ae
cmp dl, 0x3d
je 0x44d3ae
cmp dl, 0x27
je 0x44d3ae
cmp dl, 0x3a
je 0x44d3ae
cmp dl, 0x40
jne 0x44d3b7
cmp dl, byte [ebp - 0xd]
jne 0x44d2d3
mov dword [eax], ebx
xor eax, eax
pop ebx
pop esi
pop ebx
pop esi
pop edi
leave
ret