joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100349c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [0x1006c040]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
push edi
push str._Mod_Loader__PROFILE_READ_START
mov esi, ecx
call dword [0x1006ebd4]
add esp, 4
lea eax, [esp + 0x150]
push esi
push str._s
push eax
call fcn.10001570
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10034a2e
mov byte [0x1006eb77], 1
push str._Mod_Loader__LOAD_PROFILES_FAILED
jmp 0x10034b2e
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x10], 0x10
je 0x10034b12
mov ecx, 0x10066668
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10034a68
test dl, dl
je 0x10034a64
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10034a68
add eax, 2
add ecx, 2
test dl, dl
jne 0x10034a48
xor eax, eax
jmp 0x10034a6d
sbb eax, eax
or eax, 1
test eax, eax
je 0x10034b12
mov eax, 0x100666b8
lea ecx, [esp + 0x3c]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10034aa0
test dl, dl
je 0x10034a9c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10034aa0
add ecx, 2
add eax, 2
test dl, dl
jne 0x10034a80
xor eax, eax
jmp 0x10034aa5
sbb eax, eax
or eax, 1
test eax, eax
je 0x10034b12
push 0x48
call fcn.10036084
mov esi, eax
lea ecx, [esp + 0x40]
mov edx, esi
mov dword [esp + 0x10], esi
mov eax, ecx
add esp, 4
sub edx, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10034ac3
mov dword [esi + 0x40], 7
mov byte [esi + 0x44], 1
mov eax, dword [0x1006cc74]
test eax, eax
je 0x10034afb
mov ecx, dword [0x1006cc78]
cmp ecx, dword [0x1006cc7c]
jae 0x10034afb
mov dword [eax + ecx*4], esi
inc dword [0x1006cc78]
push esi
push str._Mod_Loader__LOADING__s
call dword [0x1006ebd4]
add esp, 8
mov ecx, esi
push esi
call fcn.10035320
lea eax, [esp + 0x10]
push eax
push edi
call ebx
test eax, eax
jne 0x10034a34
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push str._Mod_Loader__MODS_PROFILES_ARE_LOADED
call dword [0x1006ebd4]
mov ecx, dword [esp + 0x260]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10035fc1
mov esp, ebp
pop ebp
ret
Function at 0x10034b50
Capabilities:
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58c
mov eax, dword [0x1006c040]
xor eax, esp
mov dword [esp + 0x588], eax
cmp byte [0x1006eb74], 0
push ebx
push esi
push edi
jne 0x10034d2b
lea eax, [esp + 0x488]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str._Mod_Loader__SCRIPT_LOAD_START
call dword [0x1006ebd4]
mov esi, dword [0x1006cc74]
add esp, 4
mov eax, dword [0x1006cc78]
xor edi, edi
mov dword [esp + 0x14], esi
lea eax, [esi + eax*4]
mov dword [esp + 0x10], eax
cmp esi, eax
je 0x10034d1c
nop dword [eax + eax]
mov esi, dword [esi]
cmp byte [esi + 0x44], 0
je 0x10034d09
lea ecx, [esp + 0x18]
call fcn.100351f0
cmp dword [eax + 0x14], 0xf
jbe 0x10034bdd
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x178]
push str._s_s
push eax
call fcn.10001570
mov ecx, dword [esp + 0x3c]
add esp, 0x10
cmp ecx, 0xf
jbe 0x10034c2a
mov edx, dword [esp + 0x18]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10034c20
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10034d40
push ecx
push edx
call fcn.100363d3
add esp, 8
lea eax, [esp + 0x170]
push eax
lea eax, [esp + 0x27c]
push str._s.asi
push eax
call fcn.10001570
add esp, 0xc
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10034d05
nop word [eax + eax]
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x174]
push eax
lea eax, [esp + 0x388]
push str._s_s
push eax
call fcn.10001570
add esp, 0x10
lea eax, [esp + 0x380]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
lea eax, [esp + 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x5c]
push eax
test esi, esi
je 0x10034cdc
push str._Mod_Loader__LOADING_SCRIPT__s
call dword [0x1006ebd4]
add esp, 8
push str.InitializeASI
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10034cd9
call eax
inc edi
jmp 0x10034cea
push str._Mod_Loader__FAILED_TO_LOAD__s
call dword [0x1006ebd4]
add esp, 8
lea eax, [esp + 0x30]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10034c70
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
add esi, 4
mov dword [esp + 0x14], esi
cmp esi, eax
jne 0x10034bc0
push edi
push str._Mod_Loader__SCRIPT_LOAD_FINISHED___d_SCRIPTS_LOADED
call dword [0x1006ebd4]
add esp, 8
mov ecx, dword [esp + 0x594]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10035fc1
mov esp, ebp
pop ebp
ret
call fcn.10041edf
int3
Function at 0x10035320
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100565fd
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x78]
push str.profiles.ini
call fcn.10035740
mov esi, eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0
call fcn.100351f0
push esi
push eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.100359b0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x48]
cmp dword [ebp - 0x34], 0xf
lea ecx, [ebp - 0x2c]
cmova eax, dword [ebp - 0x48]
push eax
call fcn.10035740
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x100353cb
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100353c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100354d8
push ecx
push edx
call fcn.100363d3
add esp, 8
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0xf
jbe 0x100353ff
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100353f5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100354d8
push ecx
push edx
call fcn.100363d3
add esp, 8
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp ecx, 0xf
jbe 0x10035445
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003543b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100354d8
push ecx
push edx
call fcn.100363d3
add esp, 8
push 1
push str.Enabled
push ebx
lea ecx, [ebp - 0x2c]
call fcn.100348d0
cmp dword [ebp - 0x18], 0xf
mov byte [edi + 0x44], al
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
push eax
push 7
push str.Priority
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [ebp - 0x18], 0xf
mov dword [edi + 0x40], eax
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov byte [eax], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x100354ba
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100354b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100354dd
push ecx
push edx
call fcn.100363d3
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10035fc1
mov esp, ebp
pop ebp
ret 4
call fcn.10041edf
call fcn.10041edf
int3
Function at 0x100399f6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.10053f20
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10046610
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10039a38
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10039b94
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10053e70
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1006e338]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.10046820
mov ecx, dword [esi*4 + 0x1006e338]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10039b8d
cmp eax, dword [edi + ecx + 0x24]
jne 0x10039b8d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10039b8d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10046820
add esp, 0x14
test edx, edx
jl 0x10039b8d
jg 0x10039b03
test eax, eax
jb 0x10039b8d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10039b8d
jl 0x10039b1d
cmp dword [ebp - 0x1008], eax
ja 0x10039b8d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10039b3b
test ebx, ebx
je 0x10039b74
cmp ecx, edi
jae 0x10039b74
mov al, byte [ecx]
cmp al, 0xd
jne 0x10039b55
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10039b61
cmp byte [ecx + 1], 0xa
jne 0x10039b61
inc ecx
jmp 0x10039b61
movzx eax, al
movsx eax, byte [eax + 0x1006c230]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10039b3b
cmp edx, ebx
jne 0x10039b3b
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10039b92
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10035fc1
leave
ret
Function at 0x10046f91
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1006e338]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10046fd1
cmp byte [ebx], 0xa
jne 0x10046fd1
or byte [eax + edi + 0x28], 4
jmp 0x10046fd6
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x100470d4
mov al, byte [edx]
cmp al, 0x1a
je 0x100470b6
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x10047005
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1004702a
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x10047034
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x10046fe7
jmp 0x100470d4
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100470b1
cmp dword [ebp - 0xc], 0
je 0x100470b1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1006e338]
test byte [eax + edi + 0x28], 0x48
je 0x1004708b
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10047076
mov byte [esi], dl
jmp 0x10047087
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1006e338]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100470d4
cmp byte [ebp - 1], 0xa
jne 0x1004709a
cmp esi, ebx
jne 0x1004709a
mov byte [esi], 0xa
jmp 0x100470d3
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1004683e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100470d4
mov byte [esi], 0xd
jmp 0x100470d3
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1006e338]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100470d0
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100470d4
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100470dd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1006e338]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10047120
cmp word [esi], dx
jne 0x10047120
or byte [edi + eax + 0x28], 4
jmp 0x10047125
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x10047278
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x10047258
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x10047167
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1004719d
cmp eax, edx
jae 0x100471a9
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x1004713f
jmp 0x10047278
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10047254
cmp dword [ebp - 0x14], 0
je 0x10047254
mov eax, dword [ebx*4 + 0x1006e338]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x1004722c
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x100471f5
mov word [esi], cx
jmp 0x10047228
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1006e338]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x1006e338]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1006e338]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x10047278
pop ebx
cmp word [ebp - 4], bx
jne 0x1004723d
cmp esi, dword [ebp + 0xc]
jne 0x1004723d
mov word [esi], bx
jmp 0x10047275
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1004683e
add esp, 0x10
cmp word [ebp - 4], bx
je 0x10047278
push 0xd
jmp 0x10047271
mov ecx, dword [ebx*4 + 0x1006e338]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1004726f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10047278
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10049dae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10049c1f

Function at 0x1004a31c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005a448
push 0x1005a440
push str.FlsAlloc
push 0x1e
call fcn.1004a1ba
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004a350
push dword [ebp + 8]
mov ecx, esi
call dword [0x10057228]
call esi
jmp 0x1004a356
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1004a39a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1005a458
push 0x1005a450
push str.FlsGetValue
push 0x20
call fcn.1004a1ba
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004a3d1
push dword [ebp + 8]
mov ecx, esi
call dword [0x10057228]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1004befb
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004be7d
Function at 0x1004d67b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1004d718
push ebx
push esi
call fcn.1004d644
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1004d58d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1004d6c5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1004d717
push edi
push eax
call fcn.10048655
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1004d6e5
call fcn.100483d7
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1004d716
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1004d58d
add esp, 0x20
test eax, eax
jne 0x1004d704
push edi
call fcn.100483d7
jmp 0x1004d70c
push ebx
call fcn.100483d7
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10051621
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1005159d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10051799
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10051799
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10051748
jg 0x1005167a
test eax, eax
je 0x1005173e
push 1
push 0x1000
call fcn.1004a010
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100516a0
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x10051735
push 0x8000
push ebx
call fcn.100514ce
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100516cc
jg 0x100516c7
cmp ecx, 0x1000
jb 0x100516cc
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1004b1f5
add esp, 0x10
cmp eax, 0xffffffff
je 0x10051711
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100516c7
jl 0x100516f8
test ecx, ecx
jne 0x100516b9
push dword [ebp - 0xc]
push ebx
call fcn.100514ce
push esi
call fcn.100483d7
add esp, 0xc
xor edi, edi
jmp 0x100517aa
cmp byte [edi + 0x24], 0
je 0x10051728
cmp dword [edi + 0x20], 5
jne 0x10051728
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10051733
mov edi, dword [edi + 0x18]
jmp 0x10051735
xor edi, edi
push esi
call fcn.100483d7
pop ecx
jmp 0x100517aa
test ecx, ecx
jg 0x1005170a
jl 0x10051748
test eax, eax
jae 0x1005170a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004683e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1005176b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1005170a
jmp 0x100517a2
push ebx
call fcn.1004dc5f
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1005170a
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x100517aa
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100517a7
mov edi, dword [edi + 0x18]
jmp 0x100517aa
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1004683e
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10053d20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10053d4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10053d4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40c1f2
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 8]
call fcn.0040c604
lea eax, [ebp - 0x208]
push 0x208
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0040d5f1
cmp byte [ebp - 0x208], 0
lea eax, [ebp - 0x208]
je 0x40c26f
mov cl, byte [eax]
cmp cl, 0x5b
je 0x40c260
cmp cl, 0x5d
je 0x40c260
cmp cl, 0x3d
je 0x40c260
cmp cl, 0x25
je 0x40c260
cmp cl, 0x3b
je 0x40c260
cmp cl, 0x2c
je 0x40c260
cmp cl, 0x5c
je 0x40c260
cmp cl, 0x3a
je 0x40c260
cmp cl, 0x20
jne 0x40c263
mov byte [eax], 0x58
push eax
call dword [0x401270]
cmp byte [eax], 0
jne 0x40c231
lea eax, [ebp - 0x208]
push eax
call dword [fcn.00401180]
inc eax
push eax
lea eax, [ebp - 0x208]
push dword [ebp + 0xc]
push eax
call fcn.0040d3fb
leave
ret 8

Function at 0x483244
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x300bd000]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x1c], 0x3a
mov word [ebp - 0x1a], 0x5c
mov word [ebp - 0x18], 0x2f
mov word [ebp - 0x16], 0x3c
mov word [ebp - 0x14], 0x3e
mov word [ebp - 0x12], 0x22
mov word [ebp - 0x10], 0x7c
mov word [ebp - 0xe], 0x2a
mov word [ebp - 0xc], 0x3f
mov word [ebp - 0xa], 0x26
mov word [ebp - 8], 0x2c
mov word [ebp - 6], 0x25
mov dword [ebp - 0x78], 0x300032e0
mov dword [ebp - 0x74], 0x300032d8
mov dword [ebp - 0x70], 0x300032d0
mov dword [ebp - 0x6c], 0x300032c0
mov dword [ebp - 0x68], 0x300032b8
mov dword [ebp - 0x64], 0x300032ac
mov dword [ebp - 0x60], 0x300032a0
mov dword [ebp - 0x5c], 0x30003294
mov dword [ebp - 0x58], 0x30003288
mov dword [ebp - 0x54], 0x3000327c
mov dword [ebp - 0x50], 0x30003270
mov dword [ebp - 0x4c], 0x30003264
mov dword [ebp - 0x48], 0x30003258
mov dword [ebp - 0x44], 0x3000324c
mov dword [ebp - 0x40], 0x30003240
mov dword [ebp - 0x3c], 0x30003234
mov dword [ebp - 0x38], 0x30003228
mov dword [ebp - 0x34], 0x3000321c
mov dword [ebp - 0x30], 0x30003210
mov dword [ebp - 0x2c], 0x30003204
mov dword [ebp - 0x28], 0x300031f8
mov dword [ebp - 0x24], 0x300031ec
mov dword [ebp - 0x20], 0x300031e0
xor ebx, ebx
jmp 0x48336f
mov ax, word [ecx]
xor edx, edx
cmp ax, word [ebp + edx*2 - 0x1c]
jne 0x483354
push 0x5f
pop eax
inc edx
cmp edx, 0xc
jl 0x48334a
cmp ax, bx
mov word [ecx], ax
jbe 0x48336d
cmp ax, 0x20
jae 0x48336d
mov word [ecx], 0x5f
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x483345
mov esi, dword [ebp + ebx*4 - 0x78]
push esi
call 0x4adf9c
mov edi, eax
push edi
push esi
mov esi, dword [ebp + 8]
push esi
call 0x4920ba
test eax, eax
jne 0x48339e
mov di, word [esi + edi*2]
test di, di
je 0x4833a6
cmp di, 0x2e
je 0x4833a6
inc ebx
cmp ebx, 0x17
jl 0x483374
jmp 0x4833ab
mov word [esi], 0x58
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call 0x4c2567
leave
ret 4