joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6620
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcc8
mov eax, 0x5ca709
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
call fcn.004d08c0
mov dword [ebp - 0x28], 1
mov word [ebp - 0x14], 8
test byte [ebp + 0x15], 4
je 0x4c6889
push esi
push edi
lea edi, [ebp - 0x130]
mov esi, 0x5ca3fd
mov ecx, 0x41
lea eax, [ebp - 0x234]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov word [ebp - 0x14], 8
push esi
push edi
lea edi, [ebp - 0x234]
mov esi, 0x5ca501
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [ebp - 0x338]
mov esi, 0x5ca605
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebp - 0x28], 0x65
push eax
push edi
call fcn.004c65dc
add esp, 8
mov dword [ebp - 0x28], 0x66
test byte [0x516435], 4
je 0x4c66de
lea edx, [ebp - 0x234]
push edx
push 0x5e87ce
push 0x516438
call fcn.00451598
add esp, 0xc
mov dword [ebp - 0x28], 0x67
mov dword [ebp - 0x28], 0x68
push ebx
push esi
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push 0x5e87d7
lea ecx, [ebp - 0x130]
push ecx
call fcn.004d26c8
add esp, 0x14
lea eax, [ebp - 0x130]
push eax
lea edx, [ebp - 0x338]
push edx
call fcn.00475e50
add esp, 8
mov dword [ebp - 0x28], 0x69
push ebx
push esi
call fcn.0044cf4c
add esp, 8
mov dword [ebp - 0x28], 0x6b
push 0x2100
lea ecx, [ebp - 0x234]
push ecx
call fcn.00405b9c
add esp, 8
test eax, eax
jne 0x4c6779
test byte [0x516435], 4
je 0x4c6889
lea eax, [ebp - 0x234]
push eax
push 0x5e87e7
push 0x516438
call fcn.00451598
add esp, 0xc
jmp 0x4c6889
mov dword [ebp - 0x28], 0xc9
push pe_nt_image_headers32
lea edx, [ebp - 0x338]
push edx
call fcn.00405b9c
add esp, 8
test eax, eax
je 0x4c67c3
test byte [0x516435], 4
je 0x4c6889
lea ecx, [ebp - 0x338]
push ecx
push 0x5e87f7
push 0x516438
call fcn.00451598
add esp, 0xc
jmp 0x4c6889
lea eax, [ebp - 0x338]
push eax
lea edx, [ebp - 0x234]
push edx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x4c6826
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x338]
push ecx
lea eax, [ebp - 0x234]
push eax
push 0x5e8808
lea edx, [ebp - 0x130]
push edx
call fcn.004d26c8
add esp, 0x14
test byte [0x516435], 4
je 0x4c6889
lea ecx, [ebp - 0x130]
push ecx
push 0x5e8816
push 0x516438
call fcn.00451598
add esp, 0xc
jmp 0x4c6889
push 0xb
lea eax, [ebp - 0x234]
push eax
call fcn.00403da4
add esp, 8
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x4c684b
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00403e78
pop ecx
test byte [0x516435], 4
je 0x4c686d
lea eax, [ebp - 0x338]
push eax
push 0x5e8826
push 0x516438
call fcn.00451598
add esp, 0xc
mov edx, dword [ebp + 0x20]
push edx
lea edx, [ebp - 0x338]
mov ecx, dword [ebp + 0x1c]
push ecx
mov eax, dword [ebp + 0x18]
push eax
push edi
push edx
call fcn.004c91dc
add esp, 0x14
push ebx
push 0x5e8834
push 0x400
call fcn.00451678
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4c68dc
mov esp, ebp
mov edi, dword [ebp - 0x344]
mov esi, dword [ebp - 0x340]
mov ebx, dword [ebp - 0x33c]
pop ebp
ret
Function at 0x4c7c78
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0046ff90
pop ecx
test eax, eax
je 0x4c7c92
mov eax, 1
pop ebx
pop ebp
ret
mov byte [0x5caaf0], bl
xor edx, edx
mov dword [0x5caaf4], edx
xor ecx, ecx
mov dword [0x5caaf8], ecx
mov eax, dword [0x5caaec]
push eax
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4c7ce5
push 5
mov edx, dword [0x5caaec]
push edx
call sub.USER32.dll_ShowWindow
push 0
push 0x12c
push 0x7c6
mov ecx, dword [0x5caaec]
push ecx
call sub.USER32.dll_SetTimer
mov eax, 1
pop ebx
pop ebp
ret
push 0
mov edx, dword [0x516868]
push 0
push edx
push 0x5caafc
call fcn.0040d780
add esp, 0x10
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x4c889c
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4c88b7
push 0
call fcn.004c7d64
pop ecx
push edi
call fcn.00475ce4
pop ecx
push edi
push 0x5e8bb6
mov edx, dword [ebp + 0x10]
push edx
call fcn.004d26c8
add esp, 0xc
push 0
push esi
call sub.USER32.dll_ShowWindow
xor ebx, ebx
push 0
push 0
push ebx
push esi
call sub.USER32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4c8905
push 1
push edi
push ebx
call fcn.004527cc
add esp, 0xc
push 0
push 0
call fcn.004013d8
add esp, 8
jmp 0x4c88da
push 0x1c0001
push 0xd
push pe_nt_image_headers32
push esi
call sub.USER32.dll_SendMessageA
push 0x1c0001
push 0xd
push 0x102
push esi
call sub.USER32.dll_SendMessageA
push 0xc01c0001
push 0xd
push 0x101
push esi
call sub.USER32.dll_SendMessageA
push 1
push 1
push 0x111
push esi
call sub.USER32.dll_SendMessageA
push 2
call fcn.004d9f54
pop ecx
push esi
call fcn.004c87dc
pop ecx
push esi
call sub.USER32.dll_IsWindow
test eax, eax
je 0x4c8982
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4c896f
call fcn.004c7da4
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4c897e
push 0
call fcn.004c8118
pop ecx
xor eax, eax
jmp 0x4c8987
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c9294
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov eax, dword [ebp + 8]
push eax
call sub.USER32.dll_GetParent
mov ebx, eax
test ebx, ebx
jne 0x4c92b2
xor eax, eax
jmp 0x4c935c
push 0x40
lea edx, [ebp - 0x40]
push edx
push ebx
call sub.USER32.dll_GetClassNameA
test eax, eax
je 0x4c932c
lea eax, [ebp - 0x40]
mov edx, 0x5e8c0f
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4c932c
test cl, cl
je 0x4c92e6
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4c932c
add eax, 2
add edx, 2
test cl, cl
jne 0x4c92ca
jne 0x4c932c
push 0x5e8c24
push 0x5e8c18
call sub.USER32.dll_FindWindowA
mov esi, eax
push esi
call sub.USER32.dll_GetParent
cmp ebx, eax
jne 0x4c930a
mov eax, 1
jmp 0x4c935c
push 0x5e8c39
push 0x5e8c2d
call sub.USER32.dll_FindWindowA
mov esi, eax
push esi
call sub.USER32.dll_GetParent
cmp ebx, eax
jne 0x4c932c
mov eax, 1
jmp 0x4c935c
mov byte [ebp - 0x40], 0
push 0x3f
lea edx, [ebp - 0x40]
push edx
push ebx
call sub.USER32.dll_GetWindowTextA
push 0xb
push 0x5e8c4e
lea ecx, [ebp - 0x40]
push ecx
call fcn.004ce208
add esp, 0xc
test eax, eax
jne 0x4c935a
mov eax, 1
jmp 0x4c935c
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d41ec
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
dec eax
je 0x4d4208
call fcn.004d482c
jmp 0x4d4277
lea edx, [ebp - 0x108]
push edx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
jne 0x4d4224
call fcn.004d482c
jmp 0x4d4277
cmp dword [0x62bc34], 1
je 0x4d4275
movsx ecx, byte [ebp - 0x108]
push ecx
call fcn.004d82e0
pop ecx
cmp al, 0x41
jl 0x4d4275
cmp al, 0x5a
jg 0x4d4275
cmp byte [ebp - 0x107], 0x3a
jne 0x4d4275
mov byte [ebp - 4], 0x3d
mov byte [ebp - 3], al
lea eax, [ebp - 0x108]
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x4d4275
call fcn.004d482c
jmp 0x4d4277
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4d42bc
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4d4302
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.dll_GetCurrentDirectoryA
test eax, eax
je 0x4d42f0
cmp eax, dword [ebp + 0x10]
jle 0x4d438b
call fcn.004d9328
mov dword [eax], 8
xor eax, eax
jmp 0x4d43f8
cmp dword [0x62bc34], 1
jne 0x4d4347
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x4d438b
xor eax, eax
jmp 0x4d43f8
call sub.KERNEL32.dll_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x4d4387
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.dll_GetFullPathNameA
jmp 0x4d438b
xor eax, eax
jmp 0x4d43f8
lea edx, [ebp - 0x10c]
push edx
call fcn.004cdfec
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x4d43ac
call fcn.004d9328
mov dword [eax], 0x22
xor eax, eax
jmp 0x4d43f8
test edi, edi
jne 0x4d43cf
mov edx, dword [ebp + 0x10]
push edx
call fcn.004d8bf8
pop ecx
mov edi, eax
test eax, eax
jne 0x4d43cf
call fcn.004d9328
mov dword [eax], 8
xor eax, eax
jmp 0x4d43f8
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d4ac8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004d4400
test byte [ebp + 0xd], 0xc0
jne 0x4d4aec
mov eax, dword [0x5ea76c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4d4af9
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4d4b26
je 0x4d4b38
sub ecx, 0x100
je 0x4d4b46
sub ecx, 0x100
je 0x4d4b4d
sub ecx, 0x100
je 0x4d4b3f
jmp 0x4d4b54
sub ecx, 0x600
je 0x4d4b4d
sub ecx, 0x100
je 0x4d4b38
jmp 0x4d4b54
mov edi, 1
jmp 0x4d4b59
mov edi, 2
jmp 0x4d4b59
mov edi, 4
jmp 0x4d4b59
mov edi, 5
jmp 0x4d4b59
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4d4b80
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5ead44]
test al, 0x80
je 0x4d4b79
mov ebx, 0x80
jmp 0x4d4b92
mov ebx, 1
jmp 0x4d4b92
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4d4b92
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4d4ba4
je 0x4d4bad
dec eax
je 0x4d4bb6
jmp 0x4d4bbf
mov dword [ebp - 4], 0x80000000
jmp 0x4d4bce
mov dword [ebp - 4], 0x40000000
jmp 0x4d4bce
mov dword [ebp - 4], 0xc0000000
jmp 0x4d4bce
push 1
call fcn.004d47c0
pop ecx
mov ebx, eax
jmp 0x4d4cba
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4d4bea
sub eax, 0x10
je 0x4d4bf1
sub eax, 0x10
je 0x4d4bfa
sub eax, 0x10
je 0x4d4c03
jmp 0x4d4c03
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4d4c0a
mov dword [ebp - 8], 1
jmp 0x4d4c0a
mov dword [ebp - 8], 2
jmp 0x4d4c0a
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4d4c73
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4d4c68
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x4d4c68
add ebx, 0xffffffb2
push ebx
call fcn.004d47c0
pop ecx
mov ebx, eax
jmp 0x4d4cba
mov edi, esi
push edi
call fcn.004d4a2c
pop ecx
test eax, eax
je 0x4d4c87
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4d4c93
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004d4500
add esp, 8
mov ebx, eax
inc eax
jne 0x4d4cba
push 4
call fcn.004d47c0
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.004d4434
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d8ef8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x4d9390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x5eb75c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4d9448
cmp byte [0x4dd062], 0
je 0x4d9402
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.004d8288
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d93eb
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.004d8288
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d93eb
lea ebx, [ebp - 0x54]
jmp 0x4d93ec
inc ebx
call fcn.004d9348
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x4d9469
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5eb760
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004cdfec
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5eb763
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x4d9469
cmp dword [0x5eb75c], 0xffffffff
je 0x4d9469
mov eax, dword [0x5eb75c]
test eax, eax
je 0x4d9469
cmp byte [eax], 0
je 0x4d9469
push esi
push eax
call fcn.004d94f8
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d9ab8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x62bcc4], 0
jne 0x4d9b39
cmp dword [0x62bce0], 0
jne 0x4d9ae8
call sub.KERNEL32.dll_GetEnvironmentStrings
mov dword [0x62bce0], eax
test eax, eax
jne 0x4d9ae8
push 0x5eb880
call fcn.004d9480
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x62bce0]
jmp 0x4d9afc
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004cdfec
pop ecx
mov edi, eax
test eax, eax
jne 0x4d9af4
lea edi, [ebp + 1]
push edi
call fcn.004d8bf8
pop ecx
mov ebx, eax
mov dword [0x62bcc8], ebx
test ebx, ebx
jne 0x4d9b26
xor eax, eax
jmp 0x4d9bfc
push edi
mov edx, dword [0x62bce0]
push edx
push ebx
call fcn.004cddfc
add esp, 0xc
jmp 0x4d9b59
xor esi, esi
mov ebx, dword [0x62bcc4]
jmp 0x4d9b53
push eax
call fcn.004cdfec
pop ecx
test eax, eax
jne 0x4d9b4f
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4d9b43
lea ebx, [esi + 4]
push 4
mov dword [0x62bccc], ebx
inc ebx
push ebx
call fcn.004d82fc
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4d9b7c
xor eax, eax
jmp 0x4d9bfc
cmp dword [0x62bcc4], 0
jne 0x4d9bad
xor esi, esi
mov ebx, dword [0x62bcc8]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4d9b9e
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004cdfec
pop ecx
mov edi, eax
test eax, eax
jne 0x4d9b94
jmp 0x4d9bde
xor esi, esi
mov ebx, dword [0x62bcc4]
mov eax, dword [esp]
mov edi, eax
jmp 0x4d9bd8
push eax
call fcn.004cdfec
pop ecx
test eax, eax
je 0x4d9bcd
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4d9bd1
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4d9bbc
mov eax, dword [0x62bcc4]
test eax, eax
je 0x4d9bee
push eax
call fcn.004d8ae4
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x62bcc4], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4db014
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x4db03a
test esi, esi
je 0x4db03a
call fcn.004d9328
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x4db0a6
call fcn.004dadf0
mov ebx, eax
test eax, eax
jne 0x4db055
call fcn.004d9328
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x4db0a6
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push 0x4daf84
push esi
mov ecx, dword [ebp + 0x14]
push ecx
call sub.KERNEL32.dll_CreateThread
test eax, eax
jne 0x4db09a
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x718
jne 0x4db093
push 0x59
call fcn.004d47c0
pop ecx
jmp 0x4db0a6
call fcn.004d482c
jmp 0x4db0a6
mov dword [ebx + 8], eax
test edi, edi
je 0x4db0a6
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x440e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x48]
sub esp, 0x4c
mov ecx, ebx
mov dword [esp], 0x48de32
call fcn.00402720
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [esp], ebx
lea ecx, [eax + 0x34]
call fcn.0045be20
sub esp, 4
cmp eax, edx
mov ecx, 0x48dc60
je 0x440e4a
mov ecx, dword [eax + 0x28]
mov dword [esp], ecx
lea ecx, [ebp - 0x30]
call fcn.00402720
mov ecx, dword [ebp - 0x2c]
sub esp, 4
mov esi, dword [ebp - 0x30]
test ecx, ecx
je 0x440fa0
add ecx, esi
mov edx, esi
xor eax, eax
lea esi, [esi]
mov edi, eax
add edx, 1
shl edi, 5
add eax, edi
movzx edi, byte [edx - 1]
and eax, 0x3ffffff
xor eax, edi
cmp edx, ecx
jne 0x440e70
cmp eax, 0xa74526
je 0x440ef2
jbe 0x440ee4
cmp eax, 0x2bb6a6c
je 0x440ef2
cmp eax, 0x2c726b2
je 0x440ef2
cmp eax, 0x2348aed
je 0x440ef2
cmp eax, 0xb66a0f
setne al
mov edi, eax
mov dword [esp], 0x48de3f
call fcn.0045cc90
lea ecx, [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x48de3f
call fcn.0045b2a0
sub esp, 0xc
test eax, eax
sete al
and edi, eax
jmp 0x440ef7
cmp eax, 0xcb462
je 0x440ef2
cmp eax, 0x1accd8
jne 0x440ea7
mov edi, 1
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x440f06
mov dword [esp], esi
call fcn.00418b30
mov eax, dword [ebp - 0x48]
lea esi, [ebp - 0x40]
cmp eax, esi
je 0x440f18
mov dword [esp], eax
call fcn.00418b30
mov eax, edi
test al, al
jne 0x440f30
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, ebx
mov dword [esp], 0x48de45
call fcn.00402720
mov eax, dword [ebp + 8]
sub esp, 4
mov dword [esp], ebx
lea ecx, [eax + 0x30]
call fcn.0045be20
sub esp, 4
cmp eax, edx
mov ecx, 0x48dc60
je 0x440f5e
mov ecx, dword [eax + 0x28]
mov dword [esp], ecx
lea ecx, [ebp - 0x30]
call fcn.00402720
mov eax, dword [ebp - 0x48]
sub esp, 4
cmp eax, esi
je 0x440f7b
mov dword [esp], eax
call fcn.00418b30
mov eax, dword [ebp - 0x30]
lea ebx, [ebp - 0x28]
cmp eax, ebx
je 0x440f1e
mov dword [esp], eax
call fcn.00418b30
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 1
jmp 0x440eb1
Function at 0x461db0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [ecx + 0x9c0]
push ebp
push edi
push esi
push ebx
cmp eax, 0x26f
lea edx, [eax + 1]
ja 0x461e00
mov eax, dword [ecx + eax*4]
mov dword [ecx + 0x9c0], edx
pop ebx
pop esi
mov edx, eax
shr edx, 0xb
xor edx, eax
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor edx, eax
mov eax, edx
shl eax, 0xf
and eax, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop edi
pop ebp
ret
lea edi, [ecx + 0x38c]
mov eax, ecx
mov edx, ecx
lea esi, [esi]
mov esi, dword [edx]
mov ebx, dword [edx + 4]
and esi, 0x80000000
and ebx, 0x7fffffff
or esi, ebx
mov ebx, esi
shr ebx, 1
xor ebx, dword [edx + 0x634]
mov ebp, ebx
xor ebp, 0x9908b0df
and esi, 1
cmovne ebx, ebp
add edx, 4
mov dword [edx - 4], ebx
cmp edi, edx
jne 0x461e10
lea esi, [ecx + 0x630]
nop
lea esi, [esi]
mov ebx, dword [eax + 0x38c]
mov edx, dword [eax + 0x390]
and ebx, 0x80000000
and edx, 0x7fffffff
or ebx, edx
mov edx, ebx
shr edx, 1
xor edx, dword [eax]
mov edi, edx
xor edi, 0x9908b0df
and ebx, 1
cmovne edx, edi
add eax, 4
mov dword [eax + 0x388], edx
cmp esi, eax
jne 0x461e50
mov edx, dword [ecx + 0x9bc]
mov eax, dword [ecx]
and edx, 0x80000000
and eax, 0x7fffffff
or edx, eax
mov eax, edx
shr eax, 1
xor eax, dword [ecx + 0x630]
mov ebx, eax
xor ebx, 0x9908b0df
and edx, 1
mov edx, 1
cmovne eax, ebx
mov dword [ecx + 0x9bc], eax
xor eax, eax
jmp 0x461dc4
Function at 0x46e3d0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x5c
mov eax, dword [ecx + 4]
mov dword [ebp - 0x48], 9
mov dword [ebp - 0x44], 0xffffffff
mov edi, dword [ecx + 0x20]
mov edx, dword [eax - 4]
sub eax, 4
cmp edi, dword [ecx + 0x24]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
je 0x46e4f5
mov dword [edi], 9
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x30], 0xb
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x10], eax
mov ecx, dword [ebp - 0x1c]
mov dword [edi + 0x14], ecx
je 0x46e4b0
mov eax, dword [ebp - 0x4c]
add eax, 0x18
mov dword [ebx + 0x20], eax
sub eax, dword [ebx + 0x1c]
sar eax, 3
imul eax, eax, 0xaaaaaaab
cmp eax, 0x186a0
ja 0x46e515
sub eax, 1
cmp dword [ebp - 0x30], 0xb
mov esi, eax
je 0x46e4a2
cmp dword [ebp - 0x48], 0xb
je 0x46e490
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebp - 0x48]
call fcn.00402520
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebp - 0x30]
call fcn.00402520
jmp 0x46e47f
mov edx, edi
mov dword [edi + 0x10], 0
mov esi, dword [ebp - 0x28]
mov eax, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov dword [edx + 8], esi
mov dword [edx + 0xc], edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov dword [edx + 0x14], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x4c], eax
jmp 0x46e454
lea eax, [ebp - 0x30]
lea ecx, [ecx + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call fcn.00464d70
sub esp, 8
mov eax, dword [ebx + 0x20]
jmp 0x46e45d
mov dword [esp + 4], 0x48e418
mov dword [esp], 9
call fcn.0047a770
cmp dword [ebp - 0x30], 0xb
mov ebx, eax
jne 0x46e539
lea ecx, [ebp - 0x30]
call fcn.00402520
cmp dword [ebp - 0x48], 0xb
jne 0x46e547
lea ecx, [ebp - 0x48]
call fcn.00402520
mov dword [esp], ebx
call fcn.00418e58
nop