joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e70c
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, eax
mov edi, edx
or eax, 0xffffffff
test edx, edx
je 0x44e8b1
mov esi, dword [edx]
jmp 0x44e732
cmp al, 0x25
jne 0x44e731
add esi, 3
jmp 0x44e732
inc esi
mov al, byte [esi]
lea edx, [eax - 0x41]
cmp dl, 0x19
jbe 0x44e728
lea edx, [eax - 0x61]
cmp dl, 0x19
jbe 0x44e728
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x44e728
cmp al, 0x2d
je 0x44e731
cmp al, 0x2e
je 0x44e731
cmp al, 0x5f
je 0x44e731
cmp al, 0x7e
je 0x44e731
cmp al, 0x25
jne 0x44e796
mov dl, byte [esi + 1]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x44e77b
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44e77b
sub edx, 0x41
cmp dl, 5
ja 0x44e796
mov dl, byte [esi + 2]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x44e72c
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44e72c
sub edx, 0x41
cmp dl, 5
jbe 0x44e72c
cmp al, 0x24
je 0x44e728
cmp al, 0x21
je 0x44e728
cmp al, 0x26
je 0x44e731
cmp al, 0x28
je 0x44e731
cmp al, 0x29
je 0x44e731
cmp al, 0x2a
je 0x44e731
cmp al, 0x2b
je 0x44e731
cmp al, 0x2c
je 0x44e731
cmp al, 0x3b
je 0x44e731
cmp al, 0x3d
je 0x44e731
cmp al, 0x27
je 0x44e731
cmp al, 0x3a
je 0x44e731
cmp al, 0x40
je 0x44e731
cmp al, 0x2f
je 0x44e731
cmp al, 0x3f
je 0x44e731
test ebx, ebx
je 0x44e8ad
test byte [ebx + 0x24], 1
je 0x44e8b9
cmp al, 0x7d
je 0x44e728
cmp al, 0x7b
je 0x44e728
cmp al, 0x7c
je 0x44e731
cmp al, 0x5c
je 0x44e731
cmp al, 0x5e
je 0x44e731
cmp al, 0x5b
je 0x44e731
cmp al, 0x5d
je 0x44e731
cmp al, 0x60
je 0x44e731
jmp 0x44e8b9
mov dword [esp], eax
call dword [sym.evasi0n_gui.exe_xmlFree]
test byte [ebx + 0x24], 2
mov eax, dword [edi]
je 0x44e86d
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrndup
jmp 0x44e885
mov dword [esp + 8], 0
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlURIUnescapeString
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x44e898
mov dword [esp], eax
call dword [sym.evasi0n_gui.exe_xmlFree]
mov eax, dword [edi]
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrndup
mov dword [ebx + 0x28], eax
mov dword [edi], esi
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x44e84a
jmp 0x44e853
Function at 0x44e8c2
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, eax
mov edi, edx
or eax, 0xffffffff
test edx, edx
je 0x44ea3a
mov esi, dword [edx]
jmp 0x44e8e8
cmp al, 0x25
jne 0x44e8e7
add esi, 3
jmp 0x44e8e8
inc esi
mov al, byte [esi]
lea edx, [eax - 0x41]
cmp dl, 0x19
jbe 0x44e8de
lea edx, [eax - 0x61]
cmp dl, 0x19
jbe 0x44e8de
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x44e8de
cmp al, 0x2d
je 0x44e8e7
cmp al, 0x2e
je 0x44e8e7
cmp al, 0x5f
je 0x44e8e7
cmp al, 0x7e
je 0x44e8e7
cmp al, 0x25
jne 0x44e94c
mov dl, byte [esi + 1]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x44e931
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44e931
sub edx, 0x41
cmp dl, 5
ja 0x44e94c
mov dl, byte [esi + 2]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x44e8e2
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44e8e2
sub edx, 0x41
cmp dl, 5
jbe 0x44e8e2
cmp al, 0x24
je 0x44e8de
cmp al, 0x21
je 0x44e8de
cmp al, 0x26
je 0x44e8e7
cmp al, 0x28
je 0x44e8e7
cmp al, 0x29
je 0x44e8e7
cmp al, 0x2a
je 0x44e8e7
cmp al, 0x2b
je 0x44e8e7
cmp al, 0x2c
je 0x44e8e7
cmp al, 0x3b
je 0x44e8e7
cmp al, 0x3d
je 0x44e8e7
cmp al, 0x27
je 0x44e8e7
cmp al, 0x3a
je 0x44e8e7
cmp al, 0x40
je 0x44e8e7
cmp al, 0x2f
je 0x44e8e7
cmp al, 0x3f
je 0x44e8e7
cmp al, 0x5b
je 0x44e8e7
cmp al, 0x5d
je 0x44e8e7
test ebx, ebx
je 0x44ea36
test byte [ebx + 0x24], 1
je 0x44ea42
cmp al, 0x7d
je 0x44e8de
cmp al, 0x7b
je 0x44e8de
cmp al, 0x7c
je 0x44e8e7
cmp al, 0x5c
je 0x44e8e7
cmp al, 0x5e
je 0x44e8e7
cmp al, 0x60
je 0x44e8e7
jmp 0x44ea42
mov dword [esp], eax
call dword [sym.evasi0n_gui.exe_xmlFree]
test byte [ebx + 0x24], 2
mov eax, dword [edi]
je 0x44ea1b
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrndup
jmp 0x44ea33
mov dword [esp + 8], 0
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlURIUnescapeString
mov dword [ebx + 0x20], eax
mov dword [edi], esi
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x44e9f8
jmp 0x44ea01
Function at 0x44ef0d
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
leave
jmp fcn.0044ea4b

Function at 0x46fcfc
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, eax
jmp 0x46feea
cmp dword [ebx + 0x24], 0
jne 0x46fd48
mov dword [esp], 0xfde8
call dword [sym.evasi0n_gui.exe_xmlMallocAtomic]
mov dword [ebx + 0x24], eax
test eax, eax
jne 0x46fd38
mov eax, str.allocating_input
call fcn.0046fccc
jmp 0x46fdd2
mov dword [ebx + 0x34], 0xfde8
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov esi, dword [ebx + 0x30]
mov edi, dword [ebx + 0x24]
lea eax, [edi + 0x1000]
cmp esi, eax
jbe 0x46fd78
mov eax, dword [ebx + 0x2c]
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_memmove
sub edi, esi
add dword [ebx + 0x30], edi
add dword [ebx + 0x28], edi
add dword [ebx + 0x2c], edi
mov esi, dword [ebx + 0x24]
mov eax, dword [ebx + 0x34]
mov edi, dword [ebx + 0x2c]
lea ecx, [esi + eax]
lea edx, [edi + 0x1000]
cmp ecx, edx
jae 0x46fdfe
mov edx, dword [ebx + 0x28]
mov ecx, dword [ebx + 0x30]
mov dword [ebp - 0x12c], ecx
shl eax, 1
mov dword [ebx + 0x34], eax
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x130], edx
call dword [sym.evasi0n_gui.exe_xmlRealloc]
mov dword [ebx + 0x24], eax
test eax, eax
mov edx, dword [ebp - 0x130]
jne 0x46fde1
mov eax, str.allocating_input_buffer
call fcn.0046fccc
mov dword [esp], esi
call dword [sym.evasi0n_gui.exe_xmlFree]
mov dword [ebx + 0x38], 0xffffffff
or esi, 0xffffffff
jmp 0x46fef6
sub edi, esi
lea edi, [eax + edi]
mov dword [ebx + 0x2c], edi
sub edx, esi
lea edx, [eax + edx]
mov dword [ebx + 0x28], edx
mov edx, dword [ebp - 0x12c]
sub edx, esi
add eax, edx
mov dword [ebx + 0x30], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000
mov eax, dword [ebx + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
mov esi, eax
mov dword [ebx + 0x38], eax
cmp eax, 0
jle 0x46fe35
add dword [ebx + 0x2c], eax
jmp 0x46fef6
je 0x46fef6
cmp eax, 0xffffffff
jne 0x46fe8e
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2734
jg 0x46fe5a
cmp eax, 0x2733
jge 0x46fe8e
cmp eax, 0xb
jne 0x46fe70
jmp 0x46fe8e
cmp eax, 0x2746
je 0x46fef4
cmp eax, 0x274a
je 0x46fef4
mov dword [esp + 8], str.recv_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00449dd2
jmp 0x46fef6
mov dword [ebp - 0x20], 0x3c
mov dword [ebp - 0x1c], 0
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], 1
lea edx, [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea ecx, [ebp - 0x124]
mov dword [esp + 4], ecx
inc eax
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
jg 0x46feea
call sub.msvcrt.dll__errno
cmp dword [eax], 4
jne 0x46fef4
test byte [ebx + 0x18], 2
jne 0x46fd0f
xor esi, esi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x470134
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov esi, eax
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
mov ebx, eax
cmp eax, 0xffffffff
jne 0x470189
mov dword [esp + 8], str.socket_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00449dd2
jmp 0x470346
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x20]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x8004667e
mov dword [esp], ebx
call sub.WS2_32.dll_ioctlsocket
sub esp, 0xc
inc eax
setne al
movzx eax, al
dec eax
mov dword [ebp - 0x1c], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WS2_32.dll_connect
sub esp, 0xc
inc eax
jne 0x4701eb
call sub.WS2_32.dll_WSAGetLastError
sub eax, 0x2733
cmp eax, 1
jbe 0x4701eb
mov dword [esp + 8], str.error_connecting_to_HTTP_server
jmp 0x470326
mov dword [ebp - 0x2c], 0x3c
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], 1
lea eax, [ebp - 0x2c]
mov dword [esp + 0x10], eax
lea esi, [ebp - 0x234]
mov dword [esp + 0xc], esi
lea edi, [ebp - 0x130]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
lea eax, [ebx + 1]
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
cmp eax, 0xffffffff
je 0x470260
test eax, eax
jne 0x47026d
mov dword [esp + 8], str.Connect_attempt_timed_out
jmp 0x470326
mov dword [esp + 8], str.Connect_failed
jmp 0x470326
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.WS2_32.dll___WSAFDIsSet
push edi
push edi
test eax, eax
jne 0x470295
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WS2_32.dll___WSAFDIsSet
push ecx
push ecx
test eax, eax
je 0x47031e
mov dword [ebp - 0x24], 4
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1007
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call sub.WS2_32.dll_getsockopt
sub esp, 0x14
test eax, eax
jns 0x4702e7
mov dword [esp + 8], str.getsockopt_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00449dd2
jmp 0x470343
cmp dword [ebp - 0x1c], 0
je 0x470346
mov dword [esp + 8], str.Error_connecting_to_remote_host
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00449dd2
mov dword [esp], ebx
call sub.WS2_32.dll_closesocket
push edx
call sub.msvcrt.dll__errno
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
jmp 0x470343
mov dword [esp + 8], str.select_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00449dd2
mov dword [esp], ebx
call sub.WS2_32.dll_closesocket
push eax
or ebx, 0xffffffff
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x470350
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, eax
mov dword [ebp - 0x3c], edx
lea esi, [ebp - 0x2c]
mov ecx, 4
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esp], ebx
call sub.WS2_32.dll_gethostbyname
push ecx
mov ebx, eax
xor edx, edx
test eax, eax
jne 0x4703f2
mov dword [esp + 8], str.Failed_to_resolve_host
jmp 0x4703a0
cmp word [ebx + 8], 2
jne 0x47040d
mov cx, word [ebx + 0xa]
cmp cx, 4
jbe 0x4703b6
mov dword [esp + 8], str.address_size_mismatch_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00449dd2
jmp 0x47040d
movsx ecx, cx
mov edi, dword [ebp - 0x4c]
rep movsb byte es:[edi], byte [esi]
mov word [ebp - 0x2c], 2
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov dword [ebp - 0x40], edx
call sub.WS2_32.dll_htons
push edx
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x2c]
call fcn.00470134
mov edx, dword [ebp - 0x40]
add edx, 4
cmp eax, 0xffffffff
je 0x4703ff
jmp 0x470410
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
movzx eax, word [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax + edx]
test esi, esi
jne 0x470387
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x470418
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, eax
mov esi, edx
mov dword [ebp - 0x12c], ecx
test edx, edx
je 0x470512
test byte [eax + 0x18], 1
je 0x470512
xor edi, edi
jmp 0x470504
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x12c]
sub eax, edi
mov dword [esp + 8], eax
lea eax, [esi + edi]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
jle 0x47047b
add edi, eax
jmp 0x470504
inc eax
jne 0x4704b6
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0xb
je 0x4704b6
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x4704b6
mov dword [esp + 8], str.send_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00449dd2
test edi, edi
jne 0x470519
jmp 0x470516
mov dword [ebp - 0x20], 0x3c
mov dword [ebp - 0x1c], 0
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], 1
lea edx, [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
lea edx, [ebp - 0x124]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
inc eax
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
cmp edi, dword [ebp - 0x12c]
jl 0x470447
jmp 0x470519
xor edi, edi
jmp 0x470519
or edi, 0xffffffff
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x470725
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
cmp dword [0x6f6730], 0
jne 0x4707b3
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov dword [esp], 0x101
call sub.WS2_32.dll_WSAStartup
push edx
push edx
test eax, eax
jne 0x4707b3
cmp dword [0x6f6728], 0
jne 0x4707a9
mov dword [0x6f672c], 0x50
mov dword [esp], 0x689063
call sub.msvcrt.dll_getenv
test eax, eax
je 0x470781
cmp byte [eax], 0x2a
jne 0x470781
cmp byte [eax + 1], 0
je 0x4707a9
mov dword [esp], str.http_proxy
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x4707a1
mov dword [esp], str.HTTP_PROXY
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4707a9
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlNanoHTTPScanProxy
mov dword [0x6f6730], 1
leave
ret
Function at 0x4714fc
Capabilities:
Receive data
Receive data on socket
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, eax
or eax, 0xffffffff
test ebx, ebx
je 0x471710
cmp dword [ebx + 0x2c], 0xffffffff
je 0x471710
lea eax, [ebx + 0x3c]
mov dword [ebp - 0x20], eax
cmp dword [ebx + 0x2c], 0xffffffff
je 0x47170d
mov eax, dword [ebx + 0x440]
cmp eax, 0x400
ja 0x47170d
mov edx, dword [ebx + 0x444]
cmp edx, 0x400
ja 0x47170d
cmp eax, edx
jg 0x47170d
test eax, eax
je 0x471589
sub edx, eax
mov dword [esp + 8], edx
add eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov eax, dword [ebx + 0x440]
sub dword [ebx + 0x444], eax
mov dword [ebx + 0x440], 0
xor eax, eax
mov edx, 0x400
sub edx, dword [ebx + 0x444]
je 0x47160b
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x440]
lea eax, [ebx + eax + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
test eax, eax
jns 0x4715f8
mov dword [esp + 8], str.recv_failed
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00449dd2
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push eax
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x47170d
mov edx, dword [ebx + 0x444]
add edx, eax
mov dword [ebx + 0x444], edx
mov byte [ebx + edx + 0x3c], 0
mov edx, dword [ebx + 0x444]
or eax, edx
je 0x47170d
mov eax, dword [ebx + 0x440]
lea ecx, [ebx + eax + 0x3c]
lea esi, [ebx + edx + 0x3c]
mov edi, edx
jmp 0x471700
mov eax, esi
sub eax, ecx
cmp eax, 2
jle 0x4716eb
mov al, byte [ecx]
mov byte [ebp - 0x29], al
mov dl, al
sub edx, 0x30
cmp dl, 9
ja 0x4716eb
mov dl, byte [ecx + 1]
lea eax, [edx - 0x30]
cmp al, 9
ja 0x4716eb
lea eax, [ecx + 2]
mov dword [ebp - 0x24], eax
mov al, byte [ecx + 2]
mov byte [ebp - 0x19], al
sub eax, 0x30
cmp al, 9
ja 0x4716eb
mov eax, dword [ebp - 0x24]
cmp byte [eax + 1], 0x2d
je 0x4716eb
movsx edx, dl
movsx eax, byte [ebp - 0x29]
sub eax, 0x30
imul eax, eax, 0xa
lea eax, [edx + eax - 0x30]
movsx edx, byte [ebp - 0x19]
imul eax, eax, 0xa
lea eax, [edx + eax - 0x30]
test eax, eax
je 0x4716eb
mov dword [ebp - 0x20], eax
add ecx, 3
lea edx, [ebx + 0x3c]
mov edi, ecx
sub edi, edx
mov dword [ebx + 0x448], edi
jmp 0x4716ae
inc ecx
cmp ecx, esi
jae 0x4716b7
cmp byte [ecx], 0xa
jne 0x4716ad
mov dword [ebp - 0x20], eax
xor eax, eax
cmp byte [ecx], 0xa
sete al
mov esi, eax
add ecx, esi
xor eax, eax
cmp byte [ecx], 0xd
sete al
mov esi, eax
add ecx, esi
sub ecx, edx
mov dword [ebx + 0x440], ecx
mov ecx, 0x64
mov eax, dword [ebp - 0x20]
cdq
idiv ecx
jmp 0x471710
cmp ecx, esi
jae 0x4716f5
cmp byte [ecx], 0xa
lea ecx, [ecx + 1]
jne 0x4716e7
jmp 0x471700
mov dword [ebx + 0x440], edi
jmp 0x471522
cmp ecx, esi
jb 0x47162e
jmp 0x471522
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x471b06
Capabilities:
Initialize winsock library
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
cmp dword [0x6f6748], 0
jne 0x471bcf
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov dword [esp], 0x101
call sub.WS2_32.dll_WSAStartup
push edx
push edx
test eax, eax
jne 0x471bcf
mov dword [0x6f6738], 0x15
mov dword [esp], str.no_proxy
call sub.msvcrt.dll_getenv
test eax, eax
je 0x471b61
cmp byte [eax], 0x2a
jne 0x471b61
cmp byte [eax + 1], 0
je 0x471bcf
mov dword [esp], str.ftp_proxy
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x471b81
mov dword [esp], str.FTP_PROXY
call sub.msvcrt.dll_getenv
test eax, eax
je 0x471b89
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlNanoFTPScanProxy
mov dword [esp], str.ftp_proxy_user
call sub.msvcrt.dll_getenv
test eax, eax
je 0x471ba7
mov dword [esp], eax
call dword [sym.evasi0n_gui.exe_xmlMemStrdup]
mov dword [0x6f673c], eax
mov dword [esp], str.ftp_proxy_password
call sub.msvcrt.dll_getenv
test eax, eax
je 0x471bc5
mov dword [esp], eax
call dword [sym.evasi0n_gui.exe_xmlMemStrdup]
mov dword [0x6f6740], eax
mov dword [0x6f6748], 1
leave
ret

Function at 0x471d14
Capabilities:
Receive data
Receive data on socket
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
leave
jmp fcn.004714fc

Function at 0x471d23
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x130
mov esi, dword [ebp + 8]
or ebx, 0xffffffff
test esi, esi
je 0x471dc3
mov eax, dword [esi + 0x2c]
cmp eax, 0xffffffff
je 0x471dc3
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], 1
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea edx, [ebp - 0x114]
mov dword [esp + 4], edx
inc eax
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
cmp eax, 0xffffffff
je 0x471d9c
xor ebx, ebx
test eax, eax
je 0x471dc3
jmp 0x471dba
mov dword [esp + 8], str.select
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00449dd2
jmp 0x471dc3
mov eax, esi
call fcn.004714fc
mov ebx, eax
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret

Function at 0x471dcc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov edx, dword [ebp + 8]
or ebx, 0xffffffff
test edx, edx
je 0x471e67
cmp dword [edx + 0x2c], 0xffffffff
je 0x471e67
mov dword [esp + 8], str.QUIT_r_n
mov dword [esp + 4], 0xc8
lea esi, [ebp - 0xe0]
mov dword [esp], esi
mov dword [ebp - 0xec], edx
call fcn.00597e90
xor eax, eax
mov ecx, ebx
mov edi, esi
repne scasb al, byte es:[edi]
mov ebx, ecx
not ebx
dec ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov edx, dword [ebp - 0xec]
mov eax, dword [edx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov ebx, eax
test eax, eax
jns 0x471e65
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00449dd2
jmp 0x471e67
xor ebx, ebx
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4724dd
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1bc
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
test ebx, ebx
je 0x4725a6
cmp dword [ebx + 0x2c], 0xffffffff
je 0x4725a6
xor eax, eax
test edx, edx
je 0x4725a6
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.CWD__s_r_n
mov dword [esp + 4], 0x190
lea esi, [ebp - 0x1a8]
mov dword [esp], esi
call fcn.00597e90
mov byte [ebp - 0x19], 0
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
jns 0x47258c
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
mov dword [esp], 9
mov dword [ebp - 0x1ac], eax
call fcn.00449dd2
mov eax, dword [ebp - 0x1ac]
jmp 0x4725a6
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
mov edx, eax
or eax, 0xffffffff
cmp edx, 4
je 0x4725a6
xor eax, eax
cmp edx, 2
sete al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4725ae
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1bc
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
or esi, 0xffffffff
test ebx, ebx
je 0x472689
test eax, eax
je 0x472686
cmp dword [ebx + 0x2c], 0xffffffff
sete byte [ebp - 0x1a9]
je 0x472686
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.DELE__s_r_n
mov dword [esp + 4], 0x190
lea edx, [ebp - 0x1a8]
mov dword [esp], edx
mov dword [ebp - 0x1b0], edx
call fcn.00597e90
mov byte [ebp - 0x19], 0
mov edx, dword [ebp - 0x1b0]
mov ecx, esi
mov edi, edx
mov al, byte [ebp - 0x1a9]
repne scasb al, byte es:[edi]
mov esi, ecx
not esi
dec esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov esi, eax
test eax, eax
jns 0x472669
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00449dd2
jmp 0x472689
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
or esi, 0xffffffff
cmp eax, 4
je 0x472689
cmp eax, 2
sete al
movzx eax, al
mov esi, eax
jmp 0x472689
or esi, 0xffffffff
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x472a12
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x230
mov ebx, dword [ebp + 8]
or esi, 0xffffffff
test ebx, ebx
je 0x472b00
cmp dword [ebx + 0x2c], 0xffffffff
je 0x472b00
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push edx
mov dword [ebx + 0x30], 0xffffffff
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0xc], 0
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], 1
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x218]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
lea edx, [ebp - 0x114]
mov dword [esp + 4], edx
inc eax
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
cmp eax, 0
jge 0x472ac2
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push eax
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x472b00
jne 0x472adb
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push esi
mov dword [ebx + 0x2c], 0xffffffff
xor esi, esi
jmp 0x472b00
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
xor esi, esi
cmp eax, 2
je 0x472b00
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push ecx
mov dword [ebx + 0x2c], 0xffffffff
or esi, 0xffffffff
mov eax, esi
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret