joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037bd0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, edx
push ebx
push esi
mov dword [ebp - 8], eax
mov esi, dword [eax]
mov ebx, esi
push edi
mov edi, ecx
mov dword [ebp - 4], esi
mov al, byte [esi]
cmp al, 0x5b
jne 0x10037c80
mov al, byte [esi + 1]
inc esi
cmp al, 0x5d
je 0x10037c0c
lea esp, [esp]
test al, al
je 0x10037c6f
mov al, byte [esi + 1]
inc esi
cmp al, 0x5d
jne 0x10037c00
inc esi
test edi, edi
je 0x10037dbe
mov eax, dword [edi + 8]
test eax, eax
je 0x10037c26
push eax
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
mov eax, dword [edi + 0xc]
mov dword [edi + 8], 0
test eax, eax
je 0x10037c3e
push eax
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
cmp esi, ebx
je 0x10037db7
mov eax, esi
sub eax, ebx
test byte [edi + 0x24], 2
je 0x10037d9a
push eax
push ebx
call sym.dspconv.dll_xmlStrndup
add esp, 8
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x5d
je 0x10037c0c
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 0x30
jl 0x10037ce0
cmp al, 0x39
jg 0x10037ce0
lea ecx, [ebp - 4]
call fcn.10037b30
test eax, eax
jne 0x10037ce0
mov eax, dword [ebp - 4]
cmp byte [eax], 0x2e
jne 0x10037ce0
inc eax
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.10037b30
test eax, eax
jne 0x10037ce0
mov eax, dword [ebp - 4]
cmp byte [eax], 0x2e
jne 0x10037ce0
lea ecx, [ebp - 4]
call fcn.10037b30
test eax, eax
jne 0x10037ce0
mov eax, dword [ebp - 4]
cmp byte [eax], 0x2e
jne 0x10037ce0
lea ecx, [ebp - 4]
call fcn.10037b30
test eax, eax
jne 0x10037ce0
mov esi, dword [ebp - 4]
jmp 0x10037c0d
mov al, byte [esi]
cmp al, 0x61
jl 0x10037cee
cmp al, 0x7a
jle 0x10037d88
cmp al, 0x41
jl 0x10037cfa
cmp al, 0x5a
jle 0x10037d88
cmp al, 0x30
jl 0x10037d06
cmp al, 0x39
jle 0x10037d88
cmp al, 0x2d
je 0x10037d88
cmp al, 0x2e
je 0x10037d88
cmp al, 0x5f
je 0x10037d88
cmp al, 0x7e
je 0x10037d88
cmp al, 0x25
jne 0x10037d5c
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10037d27
cmp cl, 0x39
jle 0x10037d3b
cmp cl, 0x61
jl 0x10037d31
cmp cl, 0x66
jle 0x10037d3b
cmp cl, 0x41
jl 0x10037d5c
cmp cl, 0x46
jg 0x10037d5c
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10037d48
cmp cl, 0x39
jle 0x10037d88
cmp cl, 0x61
jl 0x10037d52
cmp cl, 0x66
jle 0x10037d88
cmp cl, 0x41
jl 0x10037d5c
cmp cl, 0x46
jle 0x10037d88
cmp al, 0x21
je 0x10037d88
cmp al, 0x24
je 0x10037d88
cmp al, 0x26
je 0x10037d88
cmp al, 0x28
je 0x10037d88
cmp al, 0x29
je 0x10037d88
cmp al, 0x2a
je 0x10037d88
cmp al, 0x2b
je 0x10037d88
cmp al, 0x2c
je 0x10037d88
cmp al, 0x3b
je 0x10037d88
cmp al, 0x3d
jne 0x10037c0d
cmp al, 0x25
jne 0x10037d94
add esi, 3
jmp 0x10037ce0
inc esi
jmp 0x10037ce0
push 0
push eax
push ebx
call sym.dspconv.dll_xmlURIUnescapeString
add esp, 0xc
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037e30
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
mov al, byte [esi]
cmp al, 0x61
jl 0x10037e47
cmp al, 0x7a
jle 0x10037f01
cmp al, 0x41
jl 0x10037e53
cmp al, 0x5a
jle 0x10037f01
cmp al, 0x30
jl 0x10037e5f
cmp al, 0x39
jle 0x10037f01
cmp al, 0x2d
je 0x10037f01
cmp al, 0x2e
je 0x10037f01
cmp al, 0x5f
je 0x10037f01
cmp al, 0x7e
je 0x10037f01
cmp al, 0x25
jne 0x10037ec5
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10037e90
cmp cl, 0x39
jle 0x10037ea4
cmp cl, 0x61
jl 0x10037e9a
cmp cl, 0x66
jle 0x10037ea4
cmp cl, 0x41
jl 0x10037ec5
cmp cl, 0x46
jg 0x10037ec5
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10037eb1
cmp cl, 0x39
jle 0x10037f01
cmp cl, 0x61
jl 0x10037ebb
cmp cl, 0x66
jle 0x10037f01
cmp cl, 0x41
jl 0x10037ec5
cmp cl, 0x46
jle 0x10037f01
cmp al, 0x21
je 0x10037f01
cmp al, 0x24
je 0x10037f01
cmp al, 0x26
je 0x10037f01
cmp al, 0x28
je 0x10037f01
cmp al, 0x29
je 0x10037f01
cmp al, 0x2a
je 0x10037f01
cmp al, 0x2b
je 0x10037f01
cmp al, 0x2c
je 0x10037f01
cmp al, 0x3b
je 0x10037f01
cmp al, 0x3d
je 0x10037f01
cmp al, 0x3a
je 0x10037f01
cmp al, 0x40
je 0x10037f01
xor eax, eax
cmp dword [ebp + 8], eax
pop edi
sete al
pop esi
pop ebp
ret
mov al, byte [esi]
cmp al, 0x61
jl 0x10037f0f
cmp al, 0x7a
jle 0x10037fb1
cmp al, 0x41
jl 0x10037f1b
cmp al, 0x5a
jle 0x10037fb1
cmp al, 0x30
jl 0x10037f27
cmp al, 0x39
jle 0x10037fb1
cmp al, 0x2d
je 0x10037fb1
cmp al, 0x2e
je 0x10037fb1
cmp al, 0x5f
je 0x10037fb1
cmp al, 0x7e
je 0x10037fb1
cmp al, 0x25
jne 0x10037f81
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x10037f4c
cmp cl, 0x39
jle 0x10037f60
cmp cl, 0x61
jl 0x10037f56
cmp cl, 0x66
jle 0x10037f60
cmp cl, 0x41
jl 0x10037f81
cmp cl, 0x46
jg 0x10037f81
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x10037f6d
cmp cl, 0x39
jle 0x10037fb1
cmp cl, 0x61
jl 0x10037f77
cmp cl, 0x66
jle 0x10037fb1
cmp cl, 0x41
jl 0x10037f81
cmp cl, 0x46
jle 0x10037fb1
cmp al, 0x21
je 0x10037fb1
cmp al, 0x24
je 0x10037fb1
cmp al, 0x26
je 0x10037fb1
cmp al, 0x28
je 0x10037fb1
cmp al, 0x29
je 0x10037fb1
cmp al, 0x2a
je 0x10037fb1
cmp al, 0x2b
je 0x10037fb1
cmp al, 0x2c
je 0x10037fb1
cmp al, 0x3b
je 0x10037fb1
cmp al, 0x3d
je 0x10037fb1
cmp al, 0x3a
je 0x10037fb1
cmp al, 0x40
jne 0x10037fc7
cmp al, dl
je 0x10037fc7
cmp al, 0x25
jne 0x10037fc1
add esi, 3
jmp 0x10037f01
inc esi
jmp 0x10037f01
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x100382c0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
mov esi, dword [ebx]
mov dword [ebp - 4], esi
mov al, byte [esi]
cmp al, 0x2f
jne 0x10038325
lea edx, [ebp - 4]
cmp byte [esi + 1], al
jne 0x10038311
add esi, 2
mov dword [ebp - 4], esi
call fcn.10037dd0
test eax, eax
jne 0x1003841b
lea edx, [ebp - 4]
mov ecx, edi
call fcn.10037fd0
test eax, eax
jne 0x1003841b
mov eax, dword [ebp - 4]
pop edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10038070
test eax, eax
je 0x10038414
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 0x61
jl 0x10038331
cmp al, 0x7a
jle 0x10038406
cmp al, 0x41
jl 0x1003833d
cmp al, 0x5a
jle 0x10038406
cmp al, 0x30
jl 0x10038349
cmp al, 0x39
jle 0x10038406
cmp al, 0x2d
je 0x10038406
cmp al, 0x2e
je 0x10038406
cmp al, 0x5f
je 0x10038406
cmp al, 0x7e
je 0x10038406
cmp al, 0x25
jne 0x100383af
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x1003837a
cmp cl, 0x39
jle 0x1003838e
cmp cl, 0x61
jl 0x10038384
cmp cl, 0x66
jle 0x1003838e
cmp cl, 0x41
jl 0x100383af
cmp cl, 0x46
jg 0x100383af
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x1003839b
cmp cl, 0x39
jle 0x10038406
cmp cl, 0x61
jl 0x100383a5
cmp cl, 0x66
jle 0x10038406
cmp cl, 0x41
jl 0x100383af
cmp cl, 0x46
jle 0x10038406
cmp al, 0x21
je 0x10038406
cmp al, 0x24
je 0x10038406
cmp al, 0x26
je 0x10038406
cmp al, 0x28
je 0x10038406
cmp al, 0x29
je 0x10038406
cmp al, 0x2a
je 0x10038406
cmp al, 0x2b
je 0x10038406
cmp al, 0x2c
je 0x10038406
cmp al, 0x3b
je 0x10038406
cmp al, 0x3d
je 0x10038406
cmp al, 0x3a
je 0x10038406
cmp al, 0x40
je 0x10038406
test edi, edi
je 0x10038417
mov eax, dword [edi + 0x18]
test eax, eax
je 0x100383f4
push eax
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
mov dword [edi + 0x18], 0
xor eax, eax
pop edi
mov dword [ebx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
mov ecx, edi
call fcn.10038140
test eax, eax
jne 0x1003841b
mov esi, dword [ebp - 4]
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038430
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
push edi
mov dword [ebp - 4], esi
mov edi, ecx
mov al, byte [esi]
cmp al, 0x2f
jne 0x10038489
lea edx, [ebp - 4]
cmp byte [esi + 1], al
jne 0x10038476
add esi, 2
mov dword [ebp - 4], esi
call fcn.10037dd0
test eax, eax
jne 0x100385bf
lea edx, [ebp - 4]
mov ecx, edi
call fcn.10037fd0
test eax, eax
je 0x1003856f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.10038070
test eax, eax
je 0x1003856f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp al, 0x61
jl 0x10038495
cmp al, 0x7a
jle 0x10038561
cmp al, 0x41
jl 0x100384a1
cmp al, 0x5a
jle 0x10038561
cmp al, 0x30
jl 0x100384ad
cmp al, 0x39
jle 0x10038561
cmp al, 0x2d
je 0x10038561
cmp al, 0x2e
je 0x10038561
cmp al, 0x5f
je 0x10038561
cmp al, 0x7e
je 0x10038561
cmp al, 0x25
jne 0x10038513
mov cl, byte [esi + 1]
cmp cl, 0x30
jl 0x100384de
cmp cl, 0x39
jle 0x100384f2
cmp cl, 0x61
jl 0x100384e8
cmp cl, 0x66
jle 0x100384f2
cmp cl, 0x41
jl 0x10038513
cmp cl, 0x46
jg 0x10038513
mov cl, byte [esi + 2]
cmp cl, 0x30
jl 0x100384ff
cmp cl, 0x39
jle 0x10038561
cmp cl, 0x61
jl 0x10038509
cmp cl, 0x66
jle 0x10038561
cmp cl, 0x41
jl 0x10038513
cmp cl, 0x46
jle 0x10038561
cmp al, 0x21
je 0x10038561
cmp al, 0x24
je 0x10038561
cmp al, 0x26
je 0x10038561
cmp al, 0x28
je 0x10038561
cmp al, 0x29
je 0x10038561
cmp al, 0x2a
je 0x10038561
cmp al, 0x2b
je 0x10038561
cmp al, 0x2c
je 0x10038561
cmp al, 0x3b
je 0x10038561
cmp al, 0x3d
je 0x10038561
cmp al, 0x3a
je 0x10038561
cmp al, 0x40
je 0x10038561
test edi, edi
je 0x10038572
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10038558
push eax
call dword [sym.dspconv.dll_xmlFree]
add esp, 4
mov dword [edi + 0x18], 0
jmp 0x10038572
lea edx, [ebp - 4]
mov ecx, edi
call fcn.10038200
test eax, eax
jne 0x100385bf
mov esi, dword [ebp - 4]
cmp byte [esi], 0x3f
jne 0x1003858c
inc esi
lea edx, [ebp - 4]
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.10037820
test eax, eax
jne 0x100385bf
mov esi, dword [ebp - 4]
cmp byte [esi], 0x23
jne 0x100385a6
inc esi
lea edx, [ebp - 4]
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.100376c0
test eax, eax
jne 0x100385bf
mov esi, dword [ebp - 4]
cmp byte [esi], 0
je 0x100385bd
mov ecx, edi
call fcn.10039490
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003aae0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, edx
test edi, edi
jle 0x1003ab1f
test ecx, ecx
je 0x1003ab1f
push esi
xor esi, esi
xor edx, edx
test edi, edi
jle 0x1003ab0c
movzx eax, byte [edx + ecx]
inc edx
add eax, esi
imul esi, eax, 0x401
mov eax, esi
shr eax, 6
xor esi, eax
cmp edx, edi
jl 0x1003aaf4
lea ecx, [esi + esi*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
pop esi
imul eax, eax, 0x8001
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x1003ab30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
xor edi, edi
test edx, edx
jle 0x1003ab58
lea ecx, [ecx]
movzx eax, byte [edi + ecx]
inc edi
add eax, esi
imul esi, eax, 0x401
mov eax, esi
shr eax, 6
xor esi, eax
cmp edi, edx
jl 0x1003ab40
lea eax, [esi + 0x3a]
xor edx, edx
mov esi, dword [ebp + 0xc]
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor ecx, eax
test esi, esi
jle 0x1003ab8c
mov edi, dword [ebp + 8]
movzx eax, byte [edx + edi]
inc edx
add eax, ecx
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor ecx, eax
cmp edx, esi
jl 0x1003ab74
lea ecx, [ecx + ecx*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
pop edi
imul eax, eax, 0x8001
pop esi
pop ebp
ret
Function at 0x1003e1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
xor eax, eax
test edi, edi
je 0x1003e220
mov bl, byte [edi]
movzx esi, bl
mov eax, esi
shl eax, 4
sub eax, esi
add eax, eax
test bl, bl
je 0x1003e220
mov edx, eax
lea edi, [edi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [edi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x1003e204
mov esi, dword [ebp + 8]
test esi, esi
je 0x1003e24c
mov bl, byte [esi]
test bl, bl
je 0x1003e24c
lea ecx, [ecx]
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x1003e230
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003e27c
mov bl, byte [esi]
test bl, bl
je 0x1003e27c
lea esp, [esp]
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x1003e260
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
pop esi
pop ebx
div dword [ecx + 4]
mov eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x1003e290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x1003e2e9
mov cl, byte [ebx]
movzx esi, cl
mov eax, esi
mov byte [ebp + 0xb], cl
shl eax, 4
sub eax, esi
add eax, eax
test cl, cl
je 0x1003e2d6
mov edx, eax
mov ecx, eax
shr ecx, 3
inc ebx
shl edx, 5
add edx, ecx
movsx ecx, byte [ebp + 0xb]
add edx, ecx
mov cl, byte [ebx]
xor eax, edx
mov byte [ebp + 0xb], cl
test cl, cl
jne 0x1003e2b8
mov ecx, eax
mov edx, eax
shr ecx, 3
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
jmp 0x1003e2f5
movzx ecx, byte [edi]
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
test edi, edi
je 0x1003e31c
mov bl, byte [edi]
test bl, bl
je 0x1003e31c
nop
mov edx, eax
lea edi, [edi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [edi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x1003e300
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003e35d
mov bl, byte [esi]
test bl, bl
je 0x1003e34c
lea esp, [esp]
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x1003e330
mov ecx, eax
mov edx, eax
shr ecx, 3
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1003e38c
mov bl, byte [esi]
test bl, bl
je 0x1003e38c
lea ebx, [ebx]
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x1003e370
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1003e3cd
mov bl, byte [esi]
test bl, bl
je 0x1003e3bc
lea esp, [esp]
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x1003e3a0
mov ecx, eax
mov edx, eax
shr ecx, 3
shl edx, 5
add ecx, 0x3a
add ecx, edx
xor eax, ecx
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x1003e3fc
mov bl, byte [esi]
test bl, bl
je 0x1003e3fc
lea ebx, [ebx]
mov edx, eax
lea esi, [esi + 1]
mov ecx, eax
shl edx, 5
shr ecx, 3
add edx, ecx
movsx ecx, bl
mov bl, byte [esi]
add edx, ecx
xor eax, edx
test bl, bl
jne 0x1003e3e0
mov ecx, dword [ebp - 4]
xor edx, edx
pop edi
pop esi
pop ebx
div dword [ecx + 4]
mov eax, edx
mov esp, ebp
pop ebp
ret

Function at 0x100480f0
Capabilities:
Query environment variable

Disassembly:
cmp dword [0x1007bf64], 0
je 0x100480fd
or eax, 0xffffffff
ret
push 4
mov dword [0x1007bf64], 1
call dword [sym.imp.MSVCR120.dll_malloc]
push str.XML_MEM_BREAKPOINT
mov dword [0x1007bf6c], eax
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 8
test eax, eax
je 0x1004813a
push 0x1007bf78
push 0x100702c8
push eax
call dword [sym.imp.MSVCR120.dll_sscanf]
add esp, 0xc
push str.XML_MEM_TRACE
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
test eax, eax
je 0x10048160
push 0x1007bf68
push 0x100702dc
push eax
call dword [sym.imp.MSVCR120.dll_sscanf]
add esp, 0xc
xor eax, eax
ret
Function at 0x1004a490
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1004a49b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1004a4b0
Function at 0x1004b500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov edi, edi
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x1004b58c
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call sub.MSVCR120.dll_memcpy
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1004b55f
sub eax, esi
jmp 0x1004b561
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x1004b550
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x1004b57f
sub eax, esi
jmp 0x1004b581
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x1004b570
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x1004b6c0
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x1004b5b9
xor eax, eax
jmp 0x1004b60c
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x1004b5d6
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.1004f700
jmp 0x1004b5ee
cmp eax, 2
jne 0x1004b5f4
mov edx, dword [ebx]
test edx, edx
jne 0x1004b5e5
xor eax, eax
jmp 0x1004b5f1
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.1004a4b0
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call sub.MSVCR120.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x1004b634
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x1004b648
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x1004b510
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x1004b6c0
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x1004b690
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x1004b6c0
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10053560
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x14], eax
push ebx
mov ebx, edx
test eax, eax
je 0x100536a1
test ebx, ebx
js 0x100536a1
cmp dword [ebp + 8], 0
je 0x100536a1
push esi
xor esi, esi
mov dword [ebp - 0x10], 0
push edi
mov dword [ebp - 0xc], esi
xor edi, edi
jmp 0x100535a0
mov esi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 3], 0
mov byte [ebp - 4], 0
nop
cmp edi, ebx
jge 0x100535c2
mov cl, byte [edi + esi]
inc edi
mov byte [ebp + eax - 4], cl
inc eax
cmp eax, 3
jl 0x100535b0
mov esi, dword [ebp - 0xc]
test eax, eax
jle 0x10053686
movzx edx, byte [ebp - 4]
movzx esi, byte [ebp - 3]
mov ecx, edx
shr ecx, 2
and edx, 3
shl edx, 4
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 8], cl
mov ecx, esi
shr ecx, 4
and esi, 0xf
or ecx, edx
shl esi, 2
movzx edx, byte [ebp - 2]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 7], cl
mov ecx, edx
shr ecx, 6
and edx, 0x3f
or ecx, esi
mov ch, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp - 6], ch
mov byte [ebp - 5], cl
cmp eax, 3
jge 0x10053639
cmp eax, 2
movzx ecx, ch
mov eax, 0x3d
mov byte [ebp - 5], 0x3d
cmovl ecx, eax
mov byte [ebp - 6], cl
cmp dword [ebp - 0x10], 0x48
jl 0x10053664
push 0x100716d0
push 2
push dword [ebp - 0x14]
call sym.dspconv.dll_xmlOutputBufferWrite
add esp, 0xc
cmp eax, 0xffffffff
je 0x10053697
mov esi, dword [ebp - 0xc]
add esi, eax
mov dword [ebp - 0x10], 0
jmp 0x10053667
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 0x14]
call sym.dspconv.dll_xmlOutputBufferWrite
add esp, 0xc
cmp eax, 0xffffffff
je 0x10053697
add esi, eax
add dword [ebp - 0x10], 4
mov dword [ebp - 0xc], esi
cmp edi, ebx
jl 0x100535a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10058f70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10058f86
xor al, al
jmp 0x10058ff0
push 0x1c
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x14
push edx
push 0
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
mov edx, dword [ebp + 8]
add edx, 8
push edx
push 0
mov eax, dword [ebp + 8]
add eax, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10058fe6
mov dword [ebp - 8], 1
jmp 0x10058fed
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 4
Function at 0x1005f300
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1005f33b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], eax
jmp 0x1005f345
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x1005f365
xor edx, edx
mov eax, dword [ebp - 0xc]
mov cl, 0x20
call fcn.100614d0
xor ecx, ecx
add eax, dword [ebp - 8]
adc edx, ecx
jmp 0x1005f36b
or eax, 0xffffffff
or edx, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x1005f9b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1005f9fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1005fa10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1005fa5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc