joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428153
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push esi
push dword [0x52e728]
call dword [sym.imp.USER32.dll_KillTimer]
cmp esi, 0x123b
jne 0x42819d
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
and dword [ebp - 4], 0
push ecx
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 1
push eax
push 8
pop edx
call fcn.00427e6a
pop ecx
pop ecx
jmp 0x428348
cmp esi, 0x1234
jne 0x4281b2
xor ecx, ecx
inc ecx
call fcn.004275eb
jmp 0x428348
cmp esi, 0x1236
jne 0x4281e1
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 1
push eax
push 8
pop edx
call fcn.004279f3
jmp 0x428196
cmp esi, 0x1239
jne 0x428210
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 1
push eax
push 8
pop edx
call fcn.00427ac0
jmp 0x428196
cmp esi, 0x1235
jne 0x428242
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 1
push eax
push 8
pop edx
call fcn.00427926
jmp 0x428196
cmp esi, 0x123d
jne 0x428274
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 1
push eax
push 8
pop edx
call fcn.00427b8d
jmp 0x428196
cmp esi, 0x123f
jne 0x4282a6
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 1
push eax
push 8
pop edx
call fcn.00427c33
jmp 0x428196
cmp esi, 0x1240
jne 0x4282d8
and dword [ebp - 0xc], 0
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push ecx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
lea eax, [ebp - 4]
mov dword [ebp - 0x10], 1
push eax
push 8
pop edx
call fcn.00427cd9
jmp 0x428196
cmp esi, 0x123a
jne 0x4282e7
call fcn.00418fa7
jmp 0x428348
cmp esi, 0x123c
jne 0x428302
push 0xffffffffffffffff
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
jmp 0x428348
cmp esi, 0x123e
jne 0x428311
call fcn.004280c4
jmp 0x428348
cmp esi, 0x1241
jne 0x42833b
call fcn.00408f54
xor ecx, ecx
call fcn.00408db8
cmp byte [0x51e6c9], 0
je 0x428348
push str.K7RTScan:_Decoy_Re_Init_Done__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x428348
cmp esi, 0x1242
jne 0x428348
call fcn.004228dc
xor eax, eax
pop esi
leave
ret
Function at 0x429169
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, str.wndClassK7SentryMngr
push esi
push eax
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x429217
push ebx
xor ebx, ebx
lea eax, [ebp - 0xc]
push 0xc
push ebx
push eax
mov dword [0x52e728], ebx
call fcn.0049ef70
add esp, 0xc
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push 0x52e720
push ebx
push ebx
lea eax, [ebp - 0x20]
push 0x4290c1
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x52e71c], eax
pop ebx
test eax, eax
je 0x429217
push 2
mov ecx, 0x52a250
call fcn.0040f79d
jmp 0x429202
push 1
push 0x14
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [0x52e728]
test eax, eax
je 0x4291f8
cmp eax, 0xffffffff
jne 0x429219
mov eax, dword [0x52e724]
mov dword [esi], eax
xor eax, eax
pop esi
leave
ret
Function at 0x4296c6
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x124], edi
mov esi, ebx
inc edx
movzx ecx, byte [edx - 1]
movzx eax, byte [edx]
lea edx, [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x104], ecx
inc esi
cmp esi, 0x10
jb 0x4296e9
push 0x40
pop eax
cmp esi, eax
jae 0x429771
sub eax, esi
lea ebx, [ebp + esi*4 - 0x10c]
mov dword [ebp - 0x108], eax
mov edi, eax
mov ecx, dword [ebx - 0x34]
mov esi, ecx
mov edx, dword [ebx]
mov eax, ecx
rol esi, 0xe
lea ebx, [ebx + 4]
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub edi, 1
jne 0x42972f
mov edi, dword [ebp - 0x124]
xor ebx, ebx
mov eax, dword [edi + 0x50]
mov edx, dword [edi + 0x64]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], eax
mov eax, dword [edi + 0x54]
mov dword [ebp - 0x10c], eax
mov eax, dword [edi + 0x58]
mov dword [ebp - 0x110], eax
mov eax, dword [edi + 0x5c]
mov dword [ebp - 0x120], eax
mov eax, dword [edi + 0x60]
mov ecx, eax
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x68]
mov dword [ebp - 0x118], eax
mov eax, dword [edi + 0x6c]
mov edi, dword [ebp - 0x128]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x108], eax
jmp 0x4297cf
mov edx, dword [ebp - 0x114]
and edx, dword [ebp - 0x11c]
mov esi, ecx
mov eax, ecx
ror esi, 0xb
rol eax, 7
xor esi, eax
mov eax, ecx
ror eax, 6
not ecx
and ecx, dword [ebp - 0x118]
xor esi, eax
xor ecx, edx
mov eax, edi
rol eax, 0xa
mov edx, edi
ror edx, 0xd
add esi, ecx
add esi, dword [ebx + 0x5001e0]
xor edx, eax
add esi, dword [ebp + ebx - 0x104]
mov eax, edi
add esi, dword [ebp - 0x108]
add ebx, 4
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x10c]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 0x110]
xor ecx, eax
mov eax, dword [ebp - 0x118]
add edx, ecx
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x118], ecx
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 0x114], eax
add ecx, esi
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], edi
lea edi, [edx + esi]
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], eax
cmp ebx, 0x100
jb 0x4297c9
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x10c]
add eax, edi
mov edi, dword [ebp - 0x124]
add dword [edi + 0x60], ecx
add dword [edi + 0x54], edx
mov ecx, dword [ebp - 0x114]
add dword [edi + 0x64], ecx
mov edx, dword [ebp - 0x110]
add dword [edi + 0x58], edx
mov ecx, dword [ebp - 0x118]
add dword [edi + 0x68], ecx
mov ecx, dword [ebp - 0x108]
add dword [edi + 0x6c], ecx
mov edx, dword [ebp - 0x120]
add dword [edi + 0x5c], edx
mov ecx, dword [ebp - 4]
mov dword [edi + 0x50], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0049d307
leave
ret
Function at 0x431bc7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x431bfb
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
cmp eax, dword [ecx + 4]
cmovl esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x431be1
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
leave
ret
Function at 0x44350b
Capabilities:
Terminate process

Disassembly:
push esi
push edx
push 0x35
pop edx
mov esi, ecx
call fcn.00443369
mov eax, dword [esi + 0xc]
pop ecx
mov byte [eax + 0x13], 0
mov eax, dword [esi + 0xc]
pop esi
and dword [eax + 0x1c], 0
ret
Function at 0x44d81d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042dbba

Function at 0x450b59
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
xor esi, esi
mov dword [ebp - 4], ebx
push edi
mov ecx, dword [ebx]
mov dword [ebp - 8], ecx
test edx, edx
je 0x450c26
test dword [edx + 4], 0x200
mov al, byte [edx]
jne 0x450c23
cmp al, 0x25
je 0x450c18
cmp al, 0x9c
je 0x450c18
cmp al, 0x5e
je 0x450c60
cmp al, 0x9d
jne 0x450bab
cmp byte [edx + 0x26], 0x5e
je 0x450c60
cmp al, 0x9a
je 0x450bbb
cmp al, 0x98
je 0x450bbb
cmp al, 0x9d
je 0x450bbb
cmp al, 0x3d
jne 0x450bc2
mov eax, dword [edx + 0x2c]
test eax, eax
jne 0x450c3d
test dword [edx + 4], 0x100
je 0x450c23
mov eax, dword [edx + 0xc]
test eax, eax
je 0x450bdf
test dword [eax + 4], 0x100
je 0x450bdf
mov edx, eax
jmp 0x450c1b
mov eax, dword [edx + 0x14]
mov ebx, dword [edx + 0x10]
test eax, eax
je 0x450c14
test dword [edx + 4], 0x800
jne 0x450c14
mov edi, dword [eax]
mov ecx, esi
test edi, edi
jle 0x450c14
add eax, 8
mov edx, dword [eax]
test dword [edx + 4], 0x100
jne 0x450c12
inc ecx
add eax, 0x18
cmp ecx, edi
jl 0x450bfd
jmp 0x450c14
mov ebx, edx
mov edx, ebx
jmp 0x450c1b
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x450b76
mov ebx, dword [ebp - 4]
mov edx, esi
mov ecx, ebx
call fcn.0045c10c
xor ecx, ecx
test eax, eax
pop edi
cmovne esi, ecx
mov eax, esi
pop esi
pop ebx
leave
ret
movsx edx, word [edx + 0x20]
test edx, edx
js 0x450c23
mov eax, dword [eax + 4]
add edx, edx
mov ecx, dword [ebp - 8]
push esi
push dword [eax + edx*8 + 8]
mov dl, byte [ecx + 0x42]
call fcn.0045c1c9
pop ecx
pop ecx
mov esi, eax
jmp 0x450c23
mov eax, dword [ebp - 8]
push dword [edx + 8]
mov ebx, dword [ebp - 4]
mov ecx, ebx
push esi
mov dl, byte [eax + 0x42]
call fcn.0045c082
pop ecx
pop ecx
mov esi, eax
jmp 0x450c26

Function at 0x452407
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push 0
push 0x38
pop edx
call fcn.0044337d
push edi
push 0x25
pop edx
mov ecx, ebx
call fcn.00443369
add esp, 0xc
mov ecx, ebx
mov esi, eax
push dword [ebp + 8]
push 0
push edi
push 0x63
pop edx
call fcn.004432f9
add esp, 0xc
mov edx, 0x80
mov ecx, ebx
call fcn.004437ff
mov edx, esi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00443817
Function at 0x4573ba
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], edi
cmp dword [esi + 0x24], 0
mov ebx, dword [esi]
jne 0x4574d8
push 0x20
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.0049ef70
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
add esp, 0xc
mov dword [ebp - 0x2c], esi
call fcn.00456ef5
test eax, eax
jne 0x4574d8
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x2c]
call fcn.00456ef5
test eax, eax
jne 0x4574d8
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x2c]
call fcn.00456ef5
test eax, eax
jne 0x4574d8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x45744e
cmp byte [eax], 0x61
jne 0x457433
mov eax, dword [eax + 8]
jmp 0x457435
xor eax, eax
push 0
push 0
push eax
mov edx, edi
mov ecx, esi
call fcn.00457946
add esp, 0xc
test eax, eax
jne 0x4574d8
mov ecx, esi
call fcn.00468189
push 4
pop edx
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.0045560c
mov edx, dword [ebp + 0x10]
mov edi, eax
push edi
mov ecx, esi
call fcn.004546c5
mov edx, dword [ebp + 0x14]
pop ecx
lea ecx, [edi + 1]
push ecx
mov ecx, esi
call fcn.004546c5
mov edx, dword [ebp + 0x18]
lea eax, [edi + 2]
pop ecx
push eax
mov ecx, esi
call fcn.004546c5
cmp dword [ebp - 8], 0
pop ecx
je 0x4574d8
mov esi, dword [ebp + 8]
lea eax, [edi + 3]
push 0xfffffffffffffffc
push esi
push eax
movsx eax, byte [esi]
sub edi, eax
add edi, 3
push edi
mov edi, dword [ebp - 8]
mov ecx, edi
push 0
push 0x45
pop edx
call fcn.00443422
movzx edx, byte [esi]
add esp, 0x14
mov ecx, edi
call fcn.004437ff
xor eax, eax
mov edx, 0x99
cmp dword [ebp - 0xc], 0x18
sete al
push eax
call fcn.00443369
pop ecx
mov edx, dword [ebp + 0x10]
mov ecx, ebx
call fcn.00451658
mov edx, dword [ebp + 0x14]
mov ecx, ebx
call fcn.00451658
mov edx, dword [ebp + 0x18]
mov ecx, ebx
call fcn.00451658
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45b7ec
Capabilities:
Terminate process

Disassembly:
push esi
push 0
push 0
push str.COMMIT
push 0x16
pop edx
mov esi, ecx
call fcn.00457946
add esp, 0xc
test eax, eax
jne 0x45b81e
mov ecx, esi
call fcn.00468189
test eax, eax
je 0x45b81e
xor edx, edx
mov ecx, eax
inc edx
push edx
call fcn.00443369
pop ecx
pop esi
ret

Function at 0x45c69f
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
or dword [esp + 0x44], 0xffffffff
lea eax, [esp + 0x6c]
push ebx
xor ebx, ebx
mov dword [esp + 0x30], edx
push esi
push edi
push 8
mov edi, ecx
mov dword [esp + 0x24], ebx
push ebx
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x68], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x4c], ebx
call fcn.0049ef70
mov eax, dword [edi]
add esp, 0xc
mov dword [esp + 0x24], eax
cmp dword [edi + 0x24], ebx
jne 0x45ce36
cmp byte [eax + 0x45], bl
jne 0x45ce36
mov edx, dword [esp + 0x38]
mov ecx, edi
call fcn.0045c551
mov esi, eax
mov dword [esp + 0x64], esi
test esi, esi
je 0x45ce36
push ebx
push ebx
push 0x6d
mov edx, esi
mov ecx, edi
call fcn.0046cebe
mov ebx, eax
add esp, 0xc
mov eax, dword [esi + 0xc]
mov dword [esp + 0x54], eax
xor eax, eax
inc eax
mov dword [esp + 0x6c], ebx
test ebx, ebx
jne 0x45c762
push ebx
push ebx
mov edx, esi
mov ecx, edi
call fcn.0045fe07
pop ecx
pop ecx
test eax, eax
jne 0x45c75f
and dword [esp + 0x10], eax
jmp 0x45c766
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
mov edx, esi
mov ecx, edi
call fcn.004599ee
test eax, eax
jne 0x45ce36
test ebx, ebx
mov edx, esi
mov ecx, edi
setne al
push eax
call fcn.0045c58e
pop ecx
test eax, eax
jne 0x45ce36
mov ebx, dword [esp + 0x24]
mov ecx, ebx
mov edx, dword [esi + 0x48]
call fcn.00465f4c
mov ecx, eax
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x10]
add ecx, ecx
push dword [eax + ecx*8]
mov ecx, edi
push 0
push dword [esi]
push 9
pop edx
call fcn.00457946
xor ecx, ecx
mov dword [esp + 0x38], eax
inc ecx
add esp, 0xc
cmp eax, ecx
je 0x45ce36
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, dword [edi + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x44], edx
mov dword [ecx + 0x38], eax
inc dword [edi + 0x28]
mov eax, dword [esi + 8]
mov ecx, dword [edi + 0x28]
test eax, eax
je 0x45c7fc
inc ecx
inc edx
mov dword [edi + 0x28], ecx
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x45c7ec
mov dword [esp + 0x44], edx
cmp dword [esp + 0x54], 0
je 0x45c813
push dword [esi]
lea edx, [esp + 0x7c]
invalid
Function at 0x468198
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
cmp dword [edi + 0xc], 0
jne 0x468299
call fcn.00453870
cmp dword [edi + 0x38], 0
je 0x468299
inc dword [ebx + 0x2c]
mov ecx, ebx
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], eax
mov dword [edi + 0xc], eax
call fcn.00468189
mov ecx, dword [edi + 0x38]
lea edx, [ebp - 0xc]
mov esi, eax
mov dword [ebp - 8], esi
call fcn.00452250
push dword [ebp - 4]
test eax, eax
je 0x46822b
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
push esi
push 0x38
pop edx
call fcn.0044337d
pop ecx
pop ecx
test esi, esi
jne 0x46820a
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00443392
jmp 0x468256
js 0x468256
mov eax, esi
cdq
push edx
push eax
call fcn.0042f48c
pop ecx
pop ecx
cmp word [edi + 6], ax
jle 0x468256
or dword [edi + 8], 0x4000
mov word [edi + 6], ax
jmp 0x468256
mov edx, dword [edi + 0x38]
mov ecx, ebx
call fcn.004546c5
pop ecx
push dword [ebp - 4]
mov ecx, esi
push 0x11
pop edx
call fcn.00443369
pop ecx
push dword [ebp + 8]
mov ecx, esi
push dword [ebp - 4]
push 0x16
pop edx
call fcn.0044337d
pop ecx
pop ecx
cmp dword [edi + 0x3c], 0
je 0x468299
inc dword [ebx + 0x2c]
mov ecx, ebx
mov esi, dword [ebx + 0x2c]
mov dword [edi + 0x10], esi
inc dword [ebx + 0x2c]
mov edx, dword [edi + 0x3c]
push esi
call fcn.004546c5
pop ecx
mov ecx, dword [ebp - 8]
push esi
push 0x11
pop edx
call fcn.00443369
pop ecx
mov ecx, dword [ebp - 8]
lea eax, [esi + 1]
push esi
push eax
push dword [ebp - 4]
mov edx, 0x95
call fcn.004432f9
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46829e
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
mov edx, dword [edi + 0x30]
test edx, edx
je 0x4682bb
push esi
call fcn.0046829e
pop ecx
jmp 0x4682bd
xor eax, eax
test eax, eax
jne 0x4682d9
mov ecx, dword [edi]
cmp esi, dword [ecx]
jge 0x4682d9
imul edx, esi, 0x18
mov edx, dword [edx + ecx + 8]
mov ecx, ebx
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00450b59
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46d44f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [ebx + 0xc], 0
mov edi, ecx
jne 0x46d4a9
and dword [ebp + 8], 0
call fcn.00446456
mov edx, esi
shl edx, 4
add edx, dword [ebx + 4]
mov al, byte [eax + 0x42]
mov byte [ebp - 4], al
lea eax, [ebp + 8]
push eax
movzx eax, byte [edx + 0xd]
push eax
push dword [ebp - 4]
call fcn.00446456
mov edx, dword [edx + 4]
mov ecx, eax
call fcn.00443065
mov edx, dword [ebp + 8]
add esp, 0xc
test edx, edx
je 0x46d4a9
push 0xfffffffffffffff9
mov ecx, edi
call fcn.00443a8c
pop ecx
mov eax, dword [ebx + 4]
add esi, esi
cmp byte [eax + esi*8 + 0xd], 0x45
jne 0x46d4c3
push dword [ebp + 0xc]
mov ecx, edi
push 0x4a
pop edx
call fcn.00443369
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47ebf7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x47ec02
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x47ecbe
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
sub edi, 1
jne 0x47ec17
pop edi
test esi, esi
je 0x47ecda
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
inc edx
sub esi, 1
jne 0x47ecc2
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x47ece1
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x505db0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x505db0]
mov dword [edi + 8], ecx
pop edi
pop esi
ret

Function at 0x47f4d8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov ecx, ebx
imul ecx, dword [ebp + 8]
cmp byte [edi], 0
je 0x47f511
push 0
lea edx, [ebp + 8]
push edx
push ecx
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47f50c
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x47f53b
mov edx, dword [edi + 0x1c]
push esi
mov esi, dword [edi + 0x18]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ecx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.0049f810
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop esi
xor edx, edx
pop edi
div ebx
pop ebx
leave
ret
Function at 0x480aad
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x480adf
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x480adf
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [ebx]
test al, al
je 0x480b7e
push esi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x480af6
cmp al, 0x5c
jne 0x480af8
mov esi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x480aee
cmp esi, ebx
je 0x480b33
sub esi, ebx
lea eax, [ebp - 0x20c]
push esi
push ebx
push eax
call fcn.0049f810
add esp, 0xc
cmp esi, 0x104
jae 0x480b8c
lea edx, [ebp - 0x20c]
mov byte [ebp + esi - 0x20c], 0
mov ecx, edi
call fcn.00480aad
mov byte [ebp - 0x108], 0
pop esi
test edi, edi
je 0x480b4e
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004c99d0
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.004c99e0
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x480b7e
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
call fcn.0049d83b
int3