joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411d54
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
call fcn.00411c73
push edi
push 0x80
push 4
push edi
push 3
push 0xc0000000
push dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 8], esi
cmp esi, edi
je 0x411ec1
cmp esi, 0xffffffff
je 0x411ec1
mov eax, dword [ebp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push esi
call ebx
cmp eax, 0xffffffff
je 0x411ec1
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp + 0x14], edi
je 0x411eb3
xor eax, eax
inc eax
push eax
mov esi, 0x2000000
push esi
mov dword [ebp - 4], eax
call fcn.00452b24
pop ecx
pop ecx
mov dword [ebp + 8], eax
cmp eax, edi
je 0x411ec1
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x14], eax
ja 0x411e9f
jae 0x411e93
cmp dword [ebp - 4], edi
jbe 0x411e9f
push esi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00452e00
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
add esp, 0xc
or ecx, eax
mov dword [ebp - 0x10], eax
jne 0x411e28
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x18]
or ecx, eax
mov dword [ebp - 0x1c], edi
je 0x411e37
mov eax, dword [ebp - 0x18]
jmp 0x411e39
xor eax, eax
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 8]
call ebx
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x14]
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], ecx
jne 0x411e5c
cmp eax, esi
jbe 0x411e64
push edi
lea eax, [ebp - 4]
push eax
push esi
jmp 0x411e70
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x18]
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
add dword [ebp - 0x18], eax
adc dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x10]
jb 0x411e00
ja 0x411e9f
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x18], eax
jb 0x411e00
push dword [ebp + 8]
call fcn.00452756
pop ecx
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x411ec3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4125a7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00411c73
mov edi, eax
cmp edi, 1
jge 0x4125c9
xor eax, eax
jmp 0x412686
lea ecx, [edi + 0x100]
mov eax, 0x1000
cmp ecx, eax
jle 0x4125da
mov eax, ecx
push esi
push 1
push eax
call fcn.00452b24
pop ecx
pop ecx
push ebx
push 0x80
push 3
push ebx
push 3
push SQLAllocEnv
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x412617
cmp esi, ebx
je 0x412613
push esi
call fcn.00452756
pop ecx
xor eax, eax
jmp 0x412685
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 8]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41265e
mov byte [esi + edi], bl
xor eax, eax
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
jle 0x412659
mov cl, byte [eax + esi]
cmp cl, 0xd
je 0x41264f
cmp cl, 0xa
jne 0x412653
inc dword [ebp - 4]
inc eax
inc eax
cmp eax, dword [ebp - 8]
jl 0x412642
inc dword [ebp - 4]
jne 0x412669
cmp edi, ebx
jle 0x412669
mov dword [ebp - 4], 1
cmp dword [ebp + 8], ebx
je 0x412677
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x412682
push esi
call fcn.00452756
pop ecx
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x412983
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
mov eax, dword [ebp + 0x1c0]
push ebx
push esi
mov esi, dword [ebp + 0x1c8]
push edi
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x1c4]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x1cc]
push 7
xor ebx, ebx
mov dword [ebp - 0x60], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x7c]
mov dword [ebp - 0x80], ebx
rep stosd dword es:[edi], eax
mov edi, 0x103
push edi
lea eax, [ebp + 0xb1]
push ebx
push eax
mov dword [ebp - 0x54], ebx
mov byte [ebp + 0xb0], bl
call fcn.00452e00
push 0xff
lea eax, [ebp - 0x4f]
push ebx
push eax
mov byte [ebp - 0x50], bl
call fcn.00452e00
add esp, 0x18
cmp esi, ebx
je 0x412a94
cmp byte [esi], bl
je 0x412a94
push esi
lea eax, [ebp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov al, byte [ebp + 0xb0]
cmp al, bl
je 0x412a63
cmp al, 0x22
je 0x412a40
cmp al, 0x20
je 0x412a40
cmp al, 9
je 0x412a40
cmp al, 0xa
jne 0x412a63
lea eax, [ebp + 0xb1]
push eax
call esi
inc eax
push eax
lea eax, [ebp + 0xb1]
push eax
lea eax, [ebp + 0xb0]
push eax
call fcn.00452ea0
add esp, 0xc
jmp 0x412a26
lea eax, [ebp + 0xb0]
push eax
call esi
jmp 0x412a8d
lea esi, [ebp + eax + 0xb0]
mov cl, byte [esi]
cmp cl, 0x22
je 0x412a8b
cmp cl, 0x20
je 0x412a8b
cmp cl, 9
je 0x412a8b
cmp cl, 0xa
jne 0x412aa2
mov byte [esi], bl
dec eax
cmp eax, ebx
jg 0x412a6e
jmp 0x412aa2
lea eax, [ebp + 0xb0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [ebp - 0x60]
cmp esi, ebx
jne 0x412ab0
xor eax, eax
jmp 0x412b5b
lea eax, [ebp - 0x54]
push eax
mov byte [esi], bl
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x412aa9
push 0x20
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00452e00
add esp, 0xc
push dword [ebp - 0x5c]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x467af8
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [ebp - 0x58]
cmp edi, ebx
je 0x412b02
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x412b02
mov dword [ebp - 0x80], edi
jmp 0x412b0b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0xb0]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x6c], 0x4105e4
mov dword [ebp - 0x70], 5
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov edi, eax
cmp edi, ebx
je 0x412b50
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
mov ecx, dword [ebp + 0x1b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
add ebp, 0x1b8
leave
ret 0x10
Function at 0x412b75
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1a8]
mov esi, 0x103
xor ebx, ebx
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x6b]
push ebx
push eax
mov dword [ebp - 0x80], edi
mov byte [ebp - 0x6c], bl
call fcn.00452e00
push esi
lea eax, [ebp + 0x99]
push ebx
push eax
mov byte [ebp + 0x98], bl
call fcn.00452e00
add esp, 0x18
push 0x467b20
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
push 0x184
push dword [ebp - 0x7c]
push edi
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
mov dword [ebp - 0x70], 0x41
mov dword [ebp - 0x78], 0x1a
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push str._c:_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x74], eax
cmp eax, 3
je 0x412c55
cmp eax, 6
je 0x412c55
cmp eax, 4
je 0x412c55
cmp dword [ebp + 0x1b0], ebx
jne 0x412ce8
cmp eax, 2
je 0x412c55
cmp eax, 5
jne 0x412ce8
lea eax, [ebp + 0x98]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00411795
cmp byte [ebp + 0x98], bl
je 0x412c99
push 0x467b14
push ebx
lea eax, [ebp + 0x98]
push eax
call fcn.00449673
push 0x467b10
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp + 0x98], bl
jne 0x412cb1
cmp dword [ebp - 0x74], 5
jne 0x412cb1
push str.___CD_ROM_
lea eax, [ebp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 0x98]
push eax
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push str._c:_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0x180
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
call esi
push eax
call edi
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
inc dword [ebp - 0x70]
dec dword [ebp - 0x78]
jne 0x412c0a
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
add ebp, 0x1a0
leave
ret 0xc
Function at 0x412f18
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
cmp eax, ebx
je 0x413094
cmp byte [eax], bl
je 0x413094
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x413094
cmp byte [edi], bl
je 0x413094
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call esi
push edi
mov dword [ebp - 0xc], eax
call esi
cmp dword [ebp - 0xc], eax
jle 0x412f6b
push dword [ebp + 8]
jmp 0x412f6c
push edi
call esi
push eax
push edi
push dword [ebp + 8]
call fcn.004549c0
add esp, 0xc
test eax, eax
jne 0x412f85
inc eax
jmp 0x413096
push dword [ebp + 8]
call fcn.00411c73
push edi
mov dword [ebp - 4], eax
call fcn.00411c73
cmp dword [ebp - 4], eax
jne 0x413094
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 8]
cmp dword [ebp - 0xc], ebx
je 0x412fb3
mov eax, dword [ebp + 0xc]
push ebx
push 0x80
push 3
push ebx
push 3
push SQLAllocEnv
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x413044
mov eax, dword [ebp - 4]
mov ecx, 0x1000
add eax, ecx
cmp dword [ebp - 0xc], ebx
jne 0x41300a
cmp eax, ecx
ja 0x412fe6
mov eax, ecx
push 1
push eax
call fcn.00452b24
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x413039
push ebx
push ebx
push ebx
push esi
call edi
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10]
jmp 0x413032
cmp eax, ecx
ja 0x413010
mov eax, ecx
push 1
push eax
call fcn.00452b24
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x413039
push ebx
push ebx
push ebx
push esi
call edi
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, ebx
je 0x413044
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x412fa8
mov esi, dword [ebp - 0x10]
cmp esi, ebx
je 0x413075
cmp dword [ebp - 8], ebx
je 0x413075
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call fcn.00453201
add esp, 0xc
test eax, eax
jne 0x413075
xor edi, edi
inc edi
jmp 0x413077
xor edi, edi
cmp esi, ebx
je 0x413082
push esi
call fcn.00452756
pop ecx
cmp dword [ebp - 8], ebx
je 0x413090
push dword [ebp - 8]
call fcn.00452756
pop ecx
mov eax, edi
jmp 0x413096
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x413f55
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x98]
xor ebx, ebx
mov esi, 0x103
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x77]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x78], bl
call fcn.00452e00
add esp, 0xc
cmp edi, ebx
je 0x41406f
cmp byte [edi], bl
je 0x41406f
cmp dword [ebp - 0x80], ebx
je 0x41406f
cmp dword [ebp + 0xa4], 1
jb 0x41406f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cmp eax, esi
jle 0x413fd3
mov eax, esi
jmp 0x413fdb
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x78]
push eax
call fcn.00410517
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
lea eax, [ebp - 0x78]
push eax
call fcn.00413e0e
mov edi, eax
cmp edi, 0xffffffff
je 0x41406a
cmp edi, ebx
je 0x41406a
cmp dword [ebp + 0x9c], ebx
jge 0x414022
push 2
push ebx
push ebx
jmp 0x414043
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
push edi
call esi
cmp eax, dword [ebp + 0x9c]
jae 0x41403a
push ebx
push edi
call esi
jmp 0x414040
mov eax, dword [ebp + 0x9c]
push ebx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0xa4]
push ebx
lea ecx, [ebp - 0x7c]
push ecx
push eax
push dword [ebp - 0x80]
mov dword [ebp - 0x7c], eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7c]
jmp 0x414071
xor eax, eax
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
add ebp, 0x90
leave
ret 0x10
Function at 0x41408b
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3e0]
xor ebx, ebx
push 0x13c
lea eax, [ebp - 0x74]
push ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.00452e00
mov esi, 0x103
push esi
lea eax, [ebp + 0xc9]
push ebx
push eax
mov byte [ebp + 0xc8], bl
call fcn.00452e00
push esi
lea eax, [ebp + 0x2d1]
push ebx
push eax
mov byte [ebp + 0x2d0], bl
call fcn.00452e00
push esi
lea eax, [ebp + 0x1cd]
push ebx
push eax
mov byte [ebp + 0x1cc], bl
call fcn.00452e00
add esp, 0x30
cmp edi, ebx
je 0x414290
cmp byte [edi], bl
je 0x414290
push 0x2a
push edi
call fcn.00452d30
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
test eax, eax
jne 0x41415a
push 0x3f
push edi
call fcn.00452d30
pop ecx
pop ecx
test eax, eax
jne 0x41415a
push eax
push edi
call fcn.00411143
test eax, eax
jne 0x41415a
push edi
call ebx
cmp byte [eax + edi - 1], 0x5c
je 0x41415a
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x414292
and dword [ebp - 0x7c], 0
push edi
call ebx
inc eax
cmp eax, esi
jle 0x41416a
mov eax, esi
jmp 0x41416e
push edi
call ebx
inc eax
push eax
push edi
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
lea eax, [ebp + 0x1cc]
push eax
call fcn.00411143
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x4141b5
lea eax, [ebp + 0x1cc]
push eax
call ebx
lea ecx, [ebp + 0x1cc]
cmp byte [eax + ecx - 1], 0x5c
jne 0x4141b5
push str..
mov eax, ecx
push eax
call edi
push 3
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x1cc]
push eax
call fcn.00411eca
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x80], eax
cmp eax, 0xffffffff
je 0x414279
lea esi, [ebp + 0x2d0]
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 0x2d0]
push eax
call ebx
cmp byte [eax + esi - 1], 0x5c
je 0x41421f
push 0x4648e0
lea eax, [ebp + 0x2d0]
push eax
call edi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x2d0]
push eax
call edi
push 0
lea eax, [ebp + 0x2d0]
push eax
call fcn.00411143
test eax, eax
jne 0x414264
inc dword [ebp - 0x7c]
push 0x80
lea eax, [ebp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp + 0x2d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x414287
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4141ed
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x7c]
jmp 0x414292
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp + 0x3d4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
add ebp, 0x3d8
leave
ret 4
Function at 0x4146d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4146fb
mov eax, reloc.ODBC32.dll_SQLAllocConnect
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414739
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
xor eax, eax
leave
ret
Function at 0x4195b6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push 0x98
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00452e00
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x24], 6
jne 0x419608
xor eax, eax
inc eax
cmp dword [ebp - 0x20], 0
je 0x419603
cmp dword [ebp - 0x20], eax
jne 0x419608
cmp byte [ebp + 0x72], al
jne 0x41960a
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.00452dee
add ebp, 0x78
leave
ret

Function at 0x419691
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0xff
push ebx
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.00452e00
push ebx
lea eax, [ebp - 0x103]
push 0
push eax
mov byte [ebp - 0x104], 0
call fcn.00452e00
add esp, 0x18
test esi, esi
jne 0x4196f9
xor eax, eax
jmp 0x419810
cmp al, 0x20
je 0x4196f8
cmp al, 9
je 0x4196f8
cmp al, 0xd
je 0x4196f8
cmp al, 0xa
jne 0x4196ff
inc esi
mov al, byte [esi]
test al, al
jne 0x4196e8
mov al, byte [esi]
push edi
mov edi, esi
cmp al, 0x22
je 0x41970c
cmp al, 0x27
jne 0x419728
inc esi
mov edi, esi
jmp 0x419737
cmp al, 0x20
je 0x41973d
cmp al, 9
je 0x41973d
cmp al, 0xd
je 0x41973d
cmp al, 0xa
je 0x41973d
cmp al, 0x23
je 0x41973d
inc edi
mov al, byte [edi]
test al, al
jne 0x419711
jmp 0x41973d
cmp al, 0x22
je 0x41973d
cmp al, 0x27
je 0x41973d
inc edi
mov al, byte [edi]
test al, al
jne 0x41972e
mov eax, edi
sub eax, esi
inc eax
cmp eax, ebx
jle 0x419748
mov eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push eax
push esi
lea eax, [ebp - 0x204]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
lea ecx, [eax + 1]
mov eax, 0xff
cmp ecx, eax
jg 0x419772
push edi
call esi
inc eax
push eax
push edi
lea eax, [ebp - 0x104]
push eax
call ebx
pop edi
mov al, byte [ebp - 0x104]
test al, al
je 0x4197bb
cmp al, 0x22
je 0x419798
cmp al, 0x27
je 0x419798
cmp al, 0x20
je 0x419798
cmp al, 9
jne 0x4197bb
lea eax, [ebp - 0x103]
push eax
call esi
inc eax
push eax
lea eax, [ebp - 0x103]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00452ea0
add esp, 0xc
jmp 0x41977e
lea eax, [ebp - 0x104]
push eax
call esi
dec eax
xor esi, esi
jmp 0x4197ea
lea ecx, [ebp + eax - 0x104]
mov dl, byte [ecx]
cmp dl, 0x22
je 0x4197e6
cmp dl, 0x27
je 0x4197e6
cmp dl, 0x20
je 0x4197e6
cmp dl, 9
jne 0x4197ee
mov byte [ecx], 0
dec eax
cmp eax, esi
jg 0x4197c9
push 1
push esi
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
leave
ret
Function at 0x41981e
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x419849
push 0x46741c
push edi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x41984b
xor eax, eax
test eax, eax
jne 0x41988c
test edi, edi
je 0x419862
push 0x467418
push edi
call fcn.004526d0
pop ecx
pop ecx
jmp 0x419864
xor eax, eax
test eax, eax
jne 0x41988c
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
call esi
test al, 0x10
jne 0x419885
push edi
call esi
cmp eax, 0xffffffff
je 0x419885
xor eax, eax
inc eax
jmp 0x41990c
xor eax, eax
jmp 0x41990c
and dword [ebp - 0x144], 0
push 0x13c
lea eax, [ebp - 0x140]
push 0
push eax
call fcn.00452e00
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4198fd
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x466c80
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
je 0x4198e8
push 0x467414
lea eax, [ebp - 0x118]
push eax
call edi
test eax, eax
jne 0x4198fd
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4198c4
or esi, 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp esi, 0xffffffff
setne al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00452dee
leave
ret

Function at 0x41991a
Capabilities:
Parse credit card information

Disassembly:
mov al, byte [esp + 4]
cmp al, 0x29
jne 0x419926
push 9
pop eax
ret
cmp al, 0x41
jl 0x419932
cmp al, 0x5a
jle 0x4199b9
cmp al, 0x61
jl 0x41993a
cmp al, 0x7a
jle 0x4199b9
cmp al, 0x3f
je 0x4199b9
cmp al, 0x82
jb 0x419946
cmp al, 0xfd
jbe 0x4199b9
cmp al, 0x5f
je 0x4199b5
cmp al, 0x23
je 0x4199b5
cmp al, 0x60
je 0x4199b5
cmp al, 0x21
je 0x4199b5
cmp al, 0x5e
je 0x4199b1
cmp al, 0x25
je 0x4199ad
cmp al, 0x2a
je 0x4199ad
cmp al, 0x2f
je 0x4199ad
cmp al, 0x2b
je 0x4199a9
cmp al, 0x2d
je 0x4199a9
cmp al, 0x26
je 0x4199a5
cmp al, 0x7c
je 0x4199a5
cmp al, 0x7e
je 0x4199a5
cmp al, 0x3d
je 0x4199a1
cmp al, 0x24
je 0x4199a1
cmp al, 0x3e
je 0x4199a1
cmp al, 0x3c
je 0x4199a1
cmp al, 0x7b
je 0x4199a1
cmp al, 0x7d
je 0x4199a1
cmp al, 0x3a
je 0x41999d
cmp al, 0x3b
je 0x41999d
xor eax, eax
ret
xor eax, eax
inc eax
ret
push 2
pop eax
ret
push 3
pop eax
ret
push 4
pop eax
ret
push 5
pop eax
ret
push 6
pop eax
ret
push 7
pop eax
ret
push 8
pop eax
ret