joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a40f
Capabilities:
Delete file

Disassembly:
push 0x24
mov eax, 0x49964c
call fcn.00481e05
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.00404b1b
push esi
lea eax, [ebp - 0x10]
xor edi, edi
push 0x4a322c
push eax
mov dword [ebp - 4], edi
call fcn.0040a607
add esp, 0xc
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x2c], 3
call fcn.00404b49
mov dword [ebp - 0x28], eax
mov ecx, 0x4a3234
mov eax, 0x414
mov dword [ebp - 0x24], ecx
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x1e], edi
mov dword [ebp - 0x1a], edi
mov dword [ebp - 0x16], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea ecx, [ebp - 0x10]
call fcn.00404b2f
call fcn.00481dd3
ret

Function at 0x40a483
Capabilities:
Create directory
Get common file path

Disassembly:
push 4
mov eax, 0x49966f
call fcn.00481e05
mov esi, ecx
lea ecx, [ebp - 0x10]
call fcn.00404b1b
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x10]
push 0x4a3238
push eax
call fcn.0040a607
add esp, 0xc
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x10]
call fcn.00404b49
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.00404b2f
mov eax, esi
call fcn.00481dd3
ret

Function at 0x40ade1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40ae3a
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40ae2b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40ae27
cmp esi, ecx
jae 0x40ae2b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x40ae17
cmp esi, ecx
jb 0x40ae2f
xor eax, eax
jmp 0x40ae39
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40d68a
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, ecx
push esi
push edi
push 0
push 0
push eax
mov dword [ebp - 4], eax
call ebx
xor ecx, ecx
mov edi, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047ac3c
pop ecx
push edi
mov esi, eax
push esi
push dword [ebp - 4]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
push esi
setne bl
call fcn.0047de81
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414324
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x4b8744]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10c], ecx
inc edi
call fcn.004149f8
push 0xf0
mov esi, eax
push 0x66
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41446b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41446b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41446b
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x41446a
mov ebx, dword [esi + 4]
mov ecx, 0x403
mov dword [ebp - 0x110], eax
movzx eax, word [esi + 2]
add esi, 8
cmp cx, ax
jne 0x4143f4
push esi
lea ecx, [ebp - 0x108]
call fcn.0040ef80
lea ecx, [ebp - 0x108]
call fcn.00404b49
push eax
mov eax, dword [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x10c]
push 0x143
movzx eax, ax
push eax
lea ecx, [ecx + 4]
call fcn.0041495d
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
lea ecx, [ebp - 0x108]
call fcn.0040501c
jmp 0x414460
mov ecx, 0x1234
cmp cx, ax
jne 0x414460
or dword [ebp - 0x130], 0xffffffff
lea ecx, [ebp - 0x108]
push esi
mov dword [ebp - 0x134], 1
call fcn.0040ef80
mov ecx, eax
call fcn.00404b49
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x12c], eax
call fcn.0040501c
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x10c]
push 0x40b
movzx eax, ax
push eax
lea ecx, [ecx + 4]
call fcn.0041495d
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, ebx
test edi, edi
jne 0x414381
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0047b6bc
mov esp, ebp
pop ebp
ret 4

Function at 0x4178fa
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x47b579
mov eax, dword [0x4bd060]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0x47b595
call fcn.0047b652
test eax, eax
je 0x47b5d3
mov eax, dword [0x4bd060]
cmp eax, 1
jne 0x47b5b0
push 0xd
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x47b5d3
jmp 0x47b622
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x47b622
push 0x40
mov eax, 0x1000
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x47b5e5
push ebx
push ebx
push ebx
push 0xc0000017
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [esi]
push dword [0x4bd060]
call edi
mov edi, eax
test edi, edi
je 0x47b606
push 0x8000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x47b622
lea edi, [esi + 0xff0]
push esi
push dword [0x4bd060]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x47b60c
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x41cbc1
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4b8744]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.0041cd0b
mov eax, dword [ebp + 8]
xor esi, esi
push 0xf0000000
inc esi
mov dword [edi + 0xc], eax
push esi
xor ebx, ebx
mov dword [edi], vtable.Decryptor_struct__bool___cdecl_SearchOffers_class_Json::Value_const___struct_HWND_____struct_SearchPayload__::_33::DLL_DATA_.0
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push ebx
lea eax, [ebp - 0x30]
mov dword [edi + 4], ebx
push eax
mov byte [edi + 8], bl
mov dword [edi + 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x41ccf1
push 0x18
pop eax
push eax
mov ecx, edi
mov dword [ebp - 0x28], 0x208
mov dword [ebp - 0x24], 0x6603
mov dword [ebp - 0x20], eax
call fcn.0041ce9a
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0047b870
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
push 0x24
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x41cce7
push ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push eax
push 4
push dword [ebp - 0x2c]
call esi
test eax, eax
je 0x41ccde
push ebx
mov ecx, edi
call fcn.00412ce8
push eax
push 1
push dword [ebp - 0x2c]
call esi
test eax, eax
je 0x41ccde
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffe0
pop ecx
sub ecx, eax
test eax, eax
cmovns ecx, eax
add ecx, 3
and ecx, 0xfffffffc
push ecx
mov dword [edi + 0x10], ecx
call fcn.0047ac3c
pop ecx
push dword [edi + 0x10]
mov esi, eax
mov ecx, edi
mov dword [edi + 4], esi
call fcn.0041cea1
push eax
push esi
call fcn.0047b870
mov eax, dword [edi + 0x10]
add esp, 0xc
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
push dword [edi + 4]
push ebx
push 1
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
setne al
mov byte [edi + 8], al
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047b6bc
mov esp, ebp
pop ebp
ret 8
Function at 0x41cf20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 8]
xor ecx, ecx
push eax
mov eax, dword [ebp + 0x18]
inc ecx
or eax, ecx
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
push eax
push ebx
mov dword [ebp - 4], ebx
call fcn.00404b49
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41cfb3
push esi
cmp dword [ebp + 0x14], ebx
je 0x41cf88
push dword [ebp + 0x14]
lea ecx, [ebp - 0x14]
call fcn.0041cb7e
push ebx
push ebx
lea ecx, [ebp - 0xc]
xor esi, esi
push ecx
inc esi
mov ecx, eax
push ebx
mov dword [ebp - 4], esi
call fcn.00404b49
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41cf88
mov byte [ebp + 0x1b], bl
jmp 0x41cf91
xor eax, eax
xor esi, esi
inc eax
inc esi
mov byte [ebp + 0x1b], al
test byte [ebp - 4], 1
je 0x41cf9f
lea ecx, [ebp - 0x14]
call fcn.0040e39e
cmp byte [ebp + 0x1b], 0
push dword [ebp - 8]
movzx ebx, bl
cmovne ebx, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fd5f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
lea edx, [ebp - 1]
push edi
push 1
mov eax, dword [esi + 0x640]
dec eax
cmp dword [esi + 0x644], eax
jne 0x41fd86
mov byte [ebp - 1], 0x86
call fcn.0041fca4
jmp 0x41fdad
mov byte [ebp - 1], 6
mov byte [ebp - 2], 0x80
call fcn.0041fca4
mov eax, dword [esi + 0x640]
lea edx, [ebp - 2]
dec eax
mov ecx, esi
push 1
mov dword [esi + 0x644], eax
call fcn.0041fca4
pop ecx
xor edi, edi
pop ecx
cmp dword [esi + 0x640], edi
jbe 0x41fdd8
mov eax, dword [esi + 0x648]
lea edx, [edi + esi]
mov ecx, dword [esi + 0x640]
xor eax, edi
inc edi
mov al, byte [eax + esi]
mov byte [edx + ecx], al
cmp edi, dword [esi + 0x640]
jb 0x41fdb8
mov eax, dword [esi + 0x640]
pop edi
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420562
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
or edi, 0xffffffff
add dword [esi + 0x20], 1
adc dword [esi + 0x24], ebx
cmp dword [esi + 0x28], 0xb
je 0x420679
mov eax, dword [esi + 0x28]
mov ecx, str.PRAGMA_database_list
dec eax
je 0x420738
sub eax, 6
je 0x420715
dec eax
je 0x420682
dec eax
jne 0x420760
lea ebx, [esi + 0x1c]
cmp dword [ebx], eax
jne 0x420635
xor edi, edi
mov dword [ebp - 8], 0x4a3288
push edi
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push ecx
push dword [esi + 4]
call fcn.0045cd12
push dword [ebp + 8]
call fcn.0043d714
add esp, 0x18
jmp 0x420611
push 1
push dword [ebp + 8]
call fcn.0043db7d
push eax
push eax
push dword [ebp - 8]
push edi
push str._z_sSELECT_pti.name_FROM___w_.sqlite_master_AS_sm_JOIN_pragma_table_info_sm.name__Q__AS_pti_WHERE_sm.typetable
call fcn.00424635
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x42078c
push dword [ebp + 8]
mov dword [ebp - 8], str._UNION
call fcn.0043d714
pop ecx
cmp eax, 0x64
je 0x4205da
push dword [ebp + 8]
call fcn.0043cf54
push 0
push ebx
push 0xffffffffffffffff
push edi
push dword [esi + 4]
call fcn.0045cd12
push edi
call fcn.00422f62
add esp, 0x1c
push 0xb
xor edi, edi
pop ebx
push dword [esi + 0x1c]
call fcn.0043d714
pop ecx
cmp eax, 0x64
jne 0x420777
push edi
push dword [esi + 0x1c]
call fcn.0043db7d
pop ecx
pop ecx
mov dword [esi + 0x18], eax
cmp dword [esi + 8], 0
je 0x420679
push dword [esi + 8]
push dword [esi + 0x18]
push dword [esi + 0x10]
call fcn.00425245
add esp, 0xc
test eax, eax
jne 0x420579
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [esi + 0x1c]
cmp dword [ebx], 0
jne 0x42070e
xor edi, edi
mov dword [ebp - 8], 0x4a3288
push edi
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ecx
push dword [esi + 4]
call fcn.0045cd12
push dword [ebp - 4]
call fcn.0043d714
add esp, 0x18
jmp 0x4206ea
push 1
push dword [ebp - 4]
call fcn.0043db7d
push eax
push dword [ebp - 8]
push edi
push str._z_sSELECT_name_FROM___w_.sqlite_master_WHERE_typetable
call fcn.00424635
mov edi, eax
add esp, 0x18
test edi, edi
je 0x42078c
push dword [ebp - 4]
mov dword [ebp - 8], str._UNION
call fcn.0043d714
pop ecx
cmp eax, 0x64
je 0x4206b4
push dword [ebp - 4]
call fcn.0043cf54
push 0
push ebx
push 0xffffffffffffffff
push edi
push dword [esi + 4]
call fcn.0045cd12
push edi
call fcn.00422f62
add esp, 0x1c
push 9
jmp 0x420637
lea eax, [esi + 0x1c]
cmp dword [eax], 0
jne 0x42072e
push 0
push eax
push 0xffffffffffffffff
push ecx
push dword [esi + 4]
call fcn.0045cd12
add esp, 0x14
xor edi, edi
inc edi
push 8
jmp 0x420639
mov ecx, dword [esi + 0x2c]
cmp ecx, 0x7c
jl 0x42074d
and dword [esi + 0x18], 0
mov dword [esi + 0x28], 7
jmp 0x42075d
mov eax, dword [ecx*4 + 0x4a5b10]
mov dword [esi + 0x18], eax
lea eax, [ecx + 1]
mov dword [esi + 0x2c], eax
or edi, 0xffffffff
test edi, edi
jns 0x42063a
cmp dword [esi + 0x18], 0
je 0x420579
jmp 0x42065a
push dword [esi + 0x1c]
call fcn.0043cf54
and dword [esi + 0x1c], 0
pop ecx
mov dword [esi + 0x28], ebx
jmp 0x420579
push 7
pop eax
jmp 0x42067b
Function at 0x428658
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x42868a
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
inc esi
xor eax, eax
cmp esi, dword [ecx + 4]
cmovge esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x428672
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439f41
Capabilities:
Terminate process

Disassembly:
push esi
push edx
push 0x35
pop edx
mov esi, ecx
call fcn.00439d7e
mov eax, dword [esi + 0xc]
pop ecx
mov byte [eax + 0x13], 0
mov eax, dword [esi + 0xc]
pop esi
and dword [eax + 0x1c], 0
ret
Function at 0x4442a5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424913

Function at 0x4475a5
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 4], ebx
push edi
mov ecx, dword [ebx]
mov dword [ebp - 8], ecx
test edx, edx
je 0x44768a
test dword [edx + 4], 0x200
movzx eax, byte [edx]
jne 0x447687
cmp eax, 0x25
je 0x44767c
cmp eax, 0x9c
je 0x44767c
cmp eax, 0x5e
je 0x4476c9
cmp eax, 0x9d
jne 0x447600
cmp byte [edx + 0x26], 0x5e
je 0x4476c9
cmp eax, 0x9a
je 0x44761a
cmp eax, 0x98
je 0x44761a
cmp eax, 0x9d
je 0x44761a
cmp eax, 0x3d
jne 0x447623
cmp dword [edx + 0x2c], esi
jne 0x4476a3
test dword [edx + 4], 0x100
je 0x447687
mov eax, dword [edx + 0xc]
test eax, eax
je 0x447640
test dword [eax + 4], 0x100
je 0x447640
mov edx, eax
jmp 0x44767f
mov ecx, dword [edx + 0x14]
mov ebx, dword [edx + 0x10]
test ecx, ecx
je 0x447678
test dword [edx + 4], 0x800
jne 0x447678
mov edx, esi
cmp dword [ecx], edx
jle 0x447678
lea edi, [ecx + 8]
mov eax, dword [edi]
test dword [eax + 4], 0x100
jne 0x447671
inc edx
add edi, 0x18
cmp edx, dword [ecx]
jl 0x44765c
jmp 0x447678
imul eax, edx, 0x18
mov ebx, dword [eax + ecx + 8]
mov edx, ebx
jmp 0x44767f
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x4475c2
mov ebx, dword [ebp - 4]
mov edx, esi
mov ecx, ebx
call fcn.00452ad2
xor ecx, ecx
test eax, eax
pop edi
cmovne esi, ecx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsx edi, word [edx + 0x20]
test edi, edi
js 0x447687
mov eax, dword [edx + 0x2c]
add edi, edi
mov ecx, dword [ebp - 8]
push esi
mov eax, dword [eax + 4]
mov dl, byte [ecx + 0x42]
push dword [eax + edi*8 + 8]
call fcn.00452b8c
pop ecx
pop ecx
mov esi, eax
jmp 0x447687
mov eax, dword [ebp - 8]
push dword [edx + 8]
mov ebx, dword [ebp - 4]
mov ecx, ebx
push esi
mov dl, byte [eax + 0x42]
call fcn.00452a46
pop ecx
pop ecx
mov esi, eax
jmp 0x44768a

Function at 0x448e9e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push 0
push 0x38
pop edx
call fcn.00439d92
push edi
push 0x25
pop edx
mov ecx, ebx
call fcn.00439d7e
add esp, 0xc
mov ecx, ebx
mov esi, eax
push dword [ebp + 8]
push 0
push edi
push 0x60
pop edx
call fcn.00439d0e
add esp, 0xc
mov edx, 0x80
mov ecx, ebx
call fcn.0043a22b
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.0043a243
Function at 0x44ddb5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], edi
cmp dword [esi + 0x24], 0
mov ebx, dword [esi]
jne 0x44ded5
push 0x20
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.0047b750
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
add esp, 0xc
mov dword [ebp - 0x2c], esi
call fcn.0044d8fa
test eax, eax
jne 0x44ded5
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x2c]
call fcn.0044d8fa
test eax, eax
jne 0x44ded5
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x2c]
call fcn.0044d8fa
test eax, eax
jne 0x44ded5
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44de49
cmp byte [eax], 0x61
jne 0x44de2e
mov eax, dword [eax + 8]
jmp 0x44de30
xor eax, eax
push 0
push 0
push eax
mov edx, edi
mov ecx, esi
call fcn.0044e34f
add esp, 0xc
test eax, eax
jne 0x44ded5
mov ecx, esi
call fcn.0045eb3f
push 4
pop edx
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.0044c05d
mov edx, dword [ebp + 0x10]
mov edi, eax
push edi
mov ecx, esi
call fcn.0044b0a0
mov edx, dword [ebp + 0x14]
pop ecx
lea ecx, [edi + 1]
push ecx
mov ecx, esi
call fcn.0044b0a0
mov edx, dword [ebp + 0x18]
lea eax, [edi + 2]
pop ecx
push eax
mov ecx, esi
call fcn.0044b0a0
cmp dword [ebp - 8], 0
pop ecx
je 0x44ded5
mov esi, dword [ebp + 8]
lea eax, [edi + 3]
push 0xfffffffffffffff8
push esi
push eax
movsx eax, byte [esi]
mov edx, 0xa2
sub edi, eax
add edi, 3
push edi
mov edi, dword [ebp - 8]
mov ecx, edi
push 0
call fcn.00439e58
movzx edx, byte [esi]
add esp, 0x14
mov ecx, edi
call fcn.0043a22b
xor eax, eax
mov edx, 0x97
cmp dword [ebp - 0xc], 0x18
sete al
push eax
call fcn.00439d7e
pop ecx
mov edx, dword [ebp + 0x10]
mov ecx, ebx
call fcn.004480e2
mov edx, dword [ebp + 0x14]
mov ecx, ebx
call fcn.004480e2
mov edx, dword [ebp + 0x18]
mov ecx, ebx
call fcn.004480e2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45eb4e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
cmp dword [edi + 0xc], 0
jne 0x45ec4f
call fcn.0044a2be
cmp dword [edi + 0x38], 0
je 0x45ec4f
inc dword [ebx + 0x2c]
mov ecx, ebx
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], eax
mov dword [edi + 0xc], eax
call fcn.0045eb3f
mov ecx, dword [edi + 0x38]
lea edx, [ebp - 0xc]
mov esi, eax
mov dword [ebp - 8], esi
call fcn.00448cdc
push dword [ebp - 4]
test eax, eax
je 0x45ebe1
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
push esi
push 0x38
pop edx
call fcn.00439d92
pop ecx
pop ecx
test esi, esi
jne 0x45ebc0
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00439da7
jmp 0x45ec0c
js 0x45ec0c
mov eax, esi
cdq
push edx
push eax
call fcn.00426177
pop ecx
pop ecx
cmp word [edi + 6], ax
jle 0x45ec0c
or dword [edi + 8], 0x4000
mov word [edi + 6], ax
jmp 0x45ec0c
mov edx, dword [edi + 0x38]
mov ecx, ebx
call fcn.0044b0a0
pop ecx
push dword [ebp - 4]
mov ecx, esi
push 0x11
pop edx
call fcn.00439d7e
pop ecx
push dword [ebp + 8]
mov ecx, esi
push dword [ebp - 4]
push 0x16
pop edx
call fcn.00439d92
pop ecx
pop ecx
cmp dword [edi + 0x3c], 0
je 0x45ec4f
inc dword [ebx + 0x2c]
mov ecx, ebx
mov esi, dword [ebx + 0x2c]
mov dword [edi + 0x10], esi
inc dword [ebx + 0x2c]
mov edx, dword [edi + 0x3c]
push esi
call fcn.0044b0a0
pop ecx
mov ecx, dword [ebp - 8]
push esi
push 0x11
pop edx
call fcn.00439d7e
pop ecx
mov ecx, dword [ebp - 8]
lea eax, [esi + 1]
push esi
push eax
push dword [ebp - 4]
mov edx, 0x93
call fcn.00439d0e
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45ec56
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
mov edx, dword [edi + 0x30]
test edx, edx
je 0x45ec73
push esi
call fcn.0045ec56
pop ecx
jmp 0x45ec75
xor eax, eax
test eax, eax
jne 0x45ec91
mov ecx, dword [edi]
cmp esi, dword [ecx]
jge 0x45ec91
imul edx, esi, 0x18
mov edx, dword [edx + ecx + 8]
mov ecx, ebx
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.004475a5
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x463dee
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [ebx + 0xc], 0
mov edi, ecx
jne 0x463e44
and dword [ebp + 8], 0
lea eax, [ebp + 8]
mov edx, esi
shl edx, 4
add edx, dword [ebx + 4]
push eax
movzx eax, byte [edx + 0xd]
push eax
call fcn.00404b49
movzx eax, byte [eax + 0x42]
push eax
call fcn.00404b49
mov edx, dword [edx + 4]
mov ecx, eax
call fcn.00439a79
mov edx, dword [ebp + 8]
add esp, 0xc
test edx, edx
je 0x463e44
push 0xfffffffffffffff5
mov ecx, edi
call fcn.0043a4c3
pop ecx
mov eax, dword [ebx + 4]
add esi, esi
cmp byte [eax + esi*8 + 0xd], 0x45
jne 0x463e5e
push dword [ebp + 0xc]
mov ecx, edi
push 0x48
pop edx
call fcn.00439d7e
pop ecx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x474d56
Capabilities:
Accept command line arguments
Create process on windows
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x278
mov eax, dword [0x4b8744]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push edi
push 6
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.00474b1c
test eax, eax
setne al
mov byte [0x4be240], al
test al, al
jne 0x474df9
push 0x104
lea eax, [esp + 0x74]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x70]
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x1c], 0x100
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], str.runas
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp + 0x2c], eax
lea edi, [esp + 0x38]
push 7
pop ecx
xor eax, eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 5
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
neg eax
sbb al, al
inc al
je 0x474e5e
lea eax, [esp + 0x70]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x474e5e
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 8
push eax
mov dword [esp + 0x18], 0x8ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.004740d7
test eax, eax
je 0x474e58
jmp 0x474e46
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x474e30
call dword [sym.imp.WS2_32.dll_WSACleanup]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0x27c]
xor eax, eax
pop edi
pop ebx
xor ecx, esp
call fcn.0047b6bc
mov esp, ebp
pop ebp
ret 0x10