joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5148bc
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebx
sub esp, 0x1c8
mov dword [esp], 0x68c300
call fcn.00509098
mov ebx, eax
mov ecx, dword [0x68c308]
test ecx, ecx
je 0x5148ec
test ebx, ebx
je 0x5149ec
add esp, 0x1c8
pop ebx
ret
mov dword [0x68c308], 1
mov dword [esp + 4], 0
mov dword [esp], 0x514c4c
call fcn.0050ada0
mov dword [0x68c320], 0
mov dword [0x68c328], 0
mov dword [0x68c32c], 0
call fcn.0053ea50
mov dword [0x68c330], eax
mov dword [0x68c33c], 0
mov dword [0x68c340], 0
mov dword [0x68c344], 0x625798
mov dword [0x68c324], 0x513db4
mov dword [0x68c334], 0
mov dword [0x68c338], 0
mov dword [esp], 0x68c320
call sub.USER32.dll_RegisterClassA
push edx
test ax, ax
jne 0x5149a8
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
call fcn.0057c980
call fcn.005147f4
mov dword [0x68c308], 0xffffffff
add esp, 0x1c8
pop ebx
ret
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], 0x101
call sub.WS2_32.dll_WSAStartup
sub esp, 8
test eax, eax
jne 0x514b10
mov eax, dword [esp + 0x30]
rol ax, 8
cmp ax, 0x100
ja 0x5148db
mov dword [esp], 0x276c
call fcn.0057c9c4
call sub.WS2_32.dll_WSACleanup
jmp 0x514991
mov dword [esp + 4], 0x18
mov dword [esp], 0x68c300
call fcn.00509044
mov ebx, eax
mov dword [eax + 0x14], 0
mov dword [eax], 0
call fcn.004eeae0
mov dword [ebx + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebx + 0xc], eax
test eax, eax
je 0x514991
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebx + 0x10], eax
test eax, eax
je 0x514991
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x513cd4
mov dword [esp + 4], 0x100
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebx + 4], eax
test eax, eax
je 0x514991
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.KERNEL32.dll_SetThreadPriority
sub esp, 8
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov eax, dword [ebx]
test eax, eax
je 0x514991
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5137c8
mov dword [esp], 0x513874
call fcn.0050950c
jmp 0x5148e3
mov dword [esp], eax
call fcn.0057c9c4
jmp 0x514991

Function at 0x5156b8
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x2c
call fcn.00513738
test eax, eax
je 0x5156f8
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.WS2_32.dll_setsockopt
sub esp, 0x14
add esp, 0x2c
ret
mov eax, 0xffffffff
jmp 0x5156f3
Function at 0x516074
Capabilities:
Create directory
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x154
mov ebx, eax
mov eax, dword [0x68cbb4]
mov esi, dword [eax]
test esi, esi
jne 0x5160dc
mov esi, 0x625894
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [eax + 0x44]
sub esp, 8
test eax, eax
jne 0x516118
mov eax, dword [0x68cbb4]
mov edx, dword [eax]
test edx, edx
jne 0x516108
mov byte [ebx], 0x2e
mov byte [ebx + 1], 0
mov eax, dword [0x68cbb4]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x40]
sub esp, 0x10
add esp, 0x154
pop ebx
pop esi
ret
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], str.BITROCK_TEMP_FOLDER
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
test eax, eax
jne 0x51614c
mov eax, dword [0x68cbb4]
mov esi, 0x625898
jmp 0x51608e
mov word [ebx], 0x2e
mov word [ebx + 2], 0
jmp 0x5160ba
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
mov eax, dword [0x68cbb4]
call dword [eax + 0x40]
sub esp, 0x10
test eax, eax
je 0x5160a3
mov eax, 1
add esp, 0x154
pop ebx
pop esi
ret
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateDirectoryW
sub esp, 8
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_FindFirstFileW
sub esp, 8
cmp eax, 0xffffffff
je 0x5160fb
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
push ecx
test byte [esp + 0x10], 0x10
je 0x5160fb
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x625898
mov dword [esp], ebx
mov eax, dword [0x68cbb4]
call dword [eax + 0x40]
sub esp, 0x10
test eax, eax
je 0x5160fb
jmp 0x51613e
Function at 0x51656c
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x31c
mov ebx, dword [esp + 0x330]
lea eax, [esp + 0x108]
call fcn.00516074
test eax, eax
je 0x516710
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000100
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
lea eax, [esp + 0x108]
mov dword [esp], eax
mov eax, dword [0x68cbb4]
call dword [eax + 0x14]
sub esp, 0x1c
mov edi, eax
cmp eax, 0xffffffff
je 0x51671d
test ebx, ebx
je 0x5166fc
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004fc2d4
mov edx, dword [esp + 0x38]
test edx, edx
jle 0x5166ca
lea ebx, [eax + 1]
lea esi, [eax + edx + 1]
jmp 0x516629
inc ebx
cmp ebx, esi
je 0x51669d
mov ebp, ebx
cmp byte [ebx - 1], 0xa
jne 0x516624
lea edx, [ebx - 1]
sub edx, eax
je 0x516663
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x51672c
mov dword [esp + 0x10], 0
lea eax, [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6258c8
mov dword [esp], edi
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x51672c
mov eax, ebx
inc ebx
cmp ebx, esi
jne 0x516629
mov edx, ebp
sub edx, eax
je 0x5166ca
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
test eax, eax
je 0x51672c
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
call fcn.004fe768
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
inc eax
je 0x51672c
mov dword [esp], edi
call fcn.00516324
add esp, 0x31c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
add esp, 0x31c
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
je 0x516738
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], ecx
lea esi, [esi]
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
call fcn.004fe768
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
call fcn.0057c980
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
push ecx
lea eax, [esp + 0x108]
mov dword [esp], eax
mov eax, dword [0x68cbb4]
call dword [eax + 0x1c]
push ebx
xor eax, eax
add esp, 0x31c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5167a4
Capabilities:
Create pipe

Disassembly:
sub esp, 0x2c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [esp + 0x1c]
mov dword [esp + 4], eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_CreatePipe
sub esp, 0x10
test eax, eax
jne 0x5167e8
call sub.KERNEL32.dll_GetLastError
mov dword [esp], eax
call fcn.0057c980
xor eax, eax
add esp, 0x2c
ret
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00516324
mov edx, dword [esp + 0x30]
mov dword [edx], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call fcn.00516324
mov edx, dword [esp + 0x34]
mov dword [edx], eax
mov eax, 1
add esp, 0x2c
ret
Function at 0x53eadc
Capabilities:
Get system information on windows

Disassembly:
push ebx
sub esp, 0x68
mov dword [esp + 4], 4
mov dword [esp], 0x68c620
call fcn.00509044
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
lea ebx, [esp + 0x1c]
test eax, eax
je 0x53eb06
cmp eax, ebx
jbe 0x53eb3c
lea eax, [esp + 0x3c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
push edx
mov dword [esp + 8], 0x1c
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
jne 0x53eb4c
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
test eax, eax
je 0x53eb78
mov edx, dword [esp + 0x70]
mov dword [edx], eax
mov eax, 1
add esp, 0x68
pop ebx
ret
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
lea edx, [edx + eax + 0x8000]
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov edx, dword [esp + 0x70]
mov dword [edx], eax
mov eax, 1
add esp, 0x68
pop ebx
ret
mov eax, dword [esp + 0x40]
neg eax
and eax, ebx
mov dword [edx], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
jmp 0x53eb3c
Function at 0x53f150
Capabilities:
Access peb ldr_data

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
lea edx, [esp + 0xc]
mov eax, dword fs:[0]
mov dword [edx], eax
lea eax, [0x53f1a5]
mov dword [edx + 4], eax
mov dword [edx + 8], ebp
mov dword [edx + 0xc], esp
mov dword [edx + 0x10], 1
mov dword fs:[0], edx
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
cpuid
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov edx, dword fs:[0]
mov eax, 0
mov dword [edx + 0x10], eax
jmp 0x53f1af
mov esp, dword [edx + 0xc]
mov ebp, dword [edx + 8]
mov eax, dword [edx]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
add esp, 0x20
pop ebx
pop esi
pop edi
ret

Function at 0x54d620
Capabilities:
Query environment variable

Disassembly:
push edi
push ebx
sub esp, 0x14
mov dword [esp], 0x68c630
call fcn.004eec50
mov dword [esp], 0x62ada0
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x54d6ac
mov eax, dword [0x68c634]
test eax, eax
je 0x54d65c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x54d698
call sub.msvcrt.dll__tzset
mov eax, dword [0x68c634]
test eax, eax
je 0x54d672
mov dword [esp], eax
call fcn.004ee144
xor eax, eax
mov ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
mov dword [esp], ecx
call fcn.004edfec
mov dword [0x68c634], eax
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], 0x68c630
call fcn.004eecb4
add esp, 0x14
pop ebx
pop edi
ret
mov ecx, dword [0x68c634]
test ecx, ecx
je 0x54d698
call sub.msvcrt.dll__tzset
mov eax, dword [0x68c634]
mov dword [esp], eax
call fcn.004ee144
mov dword [0x68c634], 0
jmp 0x54d698
Function at 0x550840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x60]
mov esi, dword [esp + 0x6c]
mov edx, dword [esi + 0x34]
test edx, edx
je 0x5509a7
mov eax, dword [edi + 0x64]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 0x1ec]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
mov dword [edi + 0x1ec], eax
mov dword [esp + 0x30], esi
mov ebx, dword [esp + 0x74]
and ebx, 2
mov dword [esp + 0x28], 0
xor ecx, ecx
mov eax, dword [esp + 0x74]
or eax, 0x20
mov dword [esp + 0x24], eax
test ebx, ebx
je 0x55098c
mov dword [esp + 0x3c], 1
mov dword [esp + 0x38], 0
mov ebp, dword [esi + 0x34]
mov edx, dword [ebp + 0xc]
cmp edx, ecx
jne 0x5508c4
jmp 0x5509a0
mov ebp, edx
mov edx, eax
mov eax, dword [edx + 0xc]
cmp eax, ecx
jne 0x5508c0
mov dword [esp + 0x38], ebp
cmp dword [edx], 0x5509d0
je 0x550914
xor ebp, ebp
mov edx, dword [esp + 0x38]
test edx, edx
je 0x5508e8
mov ecx, dword [edx + 0xc]
test ebp, ebp
je 0x550898
mov eax, dword [esp + 0x34]
mov dword [edi + 0x1ec], eax
mov edx, dword [esp + 0x28]
test edx, edx
je 0x55090a
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004e11a0
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [edx + 4]
mov ebp, dword [edx]
test ebp, ebp
je 0x5508d7
mov eax, dword [esp + 0x24]
mov dword [edx + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [edx + 0x18], eax
inc dword [edx + 0x1c]
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x5509b3
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], edx
mov dword [esp + 0x20], edx
call fcn.00550444
mov ebp, eax
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x1c]
dec eax
mov dword [edx + 0x1c], eax
test eax, eax
jg 0x5508d9
mov dword [esp], edx
call fcn.004ee144
jmp 0x5508d9
mov dword [esp + 0x3c], 0
mov eax, dword [edx + 0xc]
mov dword [esp + 0x38], eax
jmp 0x5508cf
mov edx, ebp
jmp 0x5508cf
xor ebp, ebp
mov eax, ebp
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [esp + 0x20], edx
call fcn.004e139c
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x20]
jmp 0x550936
Function at 0x57662c
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x43c
mov eax, dword [0x68cbb4]
mov ecx, dword [eax]
test ecx, ecx
je 0x576668
mov dword [esp + 8], 0x104
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0x62d3fc
call sub.KERNEL32.dll_GetEnvironmentVariableW
sub esp, 0xc
test eax, eax
jne 0x576768
mov dword [esp], 0x68c654
call fcn.004eec50
lea ebx, [esp + 0x228]
mov edx, dword [0x68c658]
test edx, edx
je 0x576778
mov dword [esp], 0x68c654
call fcn.004eecb4
mov eax, dword [0x68c658]
mov dword [esp], eax
call fcn.00579478
test eax, eax
je 0x5766d1
mov dword [esp], eax
call fcn.004dda84
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.::bitrock_dll_dir
mov eax, dword [esp + 0x450]
mov dword [esp], eax
call fcn.004f6230
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x62d458
mov eax, dword [0x68c658]
mov dword [esp], eax
mov eax, dword [0x68cbb4]
call dword [eax + 0x40]
sub esp, 0x10
test eax, eax
je 0x57675a
mov dword [esp], ebx
call fcn.00579478
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x26
call fcn.00505cd8
mov edx, dword [esp + 0x450]
mov dword [esp], edx
call fcn.00505cec
mov dword [esp + 4], eax
mov dword [esp], str.couldnt_create_temporary_directory:__s
call fcn.004ec210
mov dword [esp + 4], eax
mov eax, dword [esp + 0x450]
mov dword [esp], eax
call fcn.004e1100
mov dword [esp], 0x68c654
call fcn.004eecb4
xor eax, eax
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00516770
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call sub.KERNEL32.dll_GetTempPathW
sub esp, 8
mov dword [esp + 0x1c], eax
cmp eax, 0xf7
ja 0x576710
mov dword [esp + 4], str.BRLXXXXXXXX
mov edx, dword [esp + 0x1c]
lea eax, [ebx + edx*2]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
call sub.KERNEL32.dll_GetCurrentProcessId
mov ebp, eax
mov eax, dword [esp + 0x1c]
lea edi, [ebx + eax*2 + 6]
mov esi, 0x100
jmp 0x5767ee
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x576840
mov ecx, ebp
shl ecx, 0x10
add ecx, ebp
lea ecx, [ebp + ecx*2]
lea ecx, [ebp + ecx*8]
lea ecx, [ebp + ecx*8]
lea ebp, [ebp + ecx*2]
dec esi
je 0x576840
mov dword [esp + 8], ebp
mov dword [esp + 4], str._08x
mov dword [esp], edi
call sub.USER32.dll_wsprintfW
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateDirectoryW
sub esp, 8
test eax, eax
je 0x5767c8
mov edx, dword [esp + 0x1c]
lea eax, [edx + edx + 0x18]
mov dword [esp], eax
call fcn.004edfec
mov dword [0x68c658], eax
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
jmp 0x576689
mov dword [esp], eax
call fcn.0057c980
jmp 0x57671c
Function at 0x57ede0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, eax
mov ebp, ecx
mov esi, dword [esp + 0x54]
mov eax, dword [esi + 0x10]
mov dword [esp], eax
mov dword [esp + 0x2c], edx
call sub.KERNEL32.dll_ResetEvent
push edi
lea edi, [ebx + 0x68]
mov dword [esp], edi
call sub.KERNEL32.dll_EnterCriticalSection
push eax
sub dword [ebx + 0x9c], ebp
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], edx
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], edi
mov dword [esp + 0x2c], eax
call sub.KERNEL32.dll_LeaveCriticalSection
push eax
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x57eea0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
je 0x57ee78
cmp eax, 0x461
je 0x57eea0
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 1
mov edx, dword [esp + 0x50]
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_GetOverlappedResult
sub esp, 0x10
test eax, eax
je 0x57ee6c
lea esi, [esi]
mov dword [esp], edi
call sub.KERNEL32.dll_EnterCriticalSection
push ecx
mov eax, dword [ebx + 0x9c]
sub eax, ebp
mov edx, dword [esp + 0x50]
add eax, dword [edx]
mov dword [ebx + 0x9c], eax
mov dword [esp], edi
call sub.KERNEL32.dll_LeaveCriticalSection
push ebx
mov eax, 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x57fa78
Capabilities:
Create thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x58]
call fcn.0057f834
mov dword [esp], 0xa0
call fcn.004edfec
mov ebp, eax
mov ecx, 0xa0
xor eax, eax
mov edi, ebp
rep stosb byte es:[edi], al
mov dword [ebp + 0xc], ebx
mov dword [ebp], esi
mov dword [ebp + 0x1c], 1
mov dword [ebp + 0x20], 0xa
call fcn.004eeae0
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x30], 0x1000
mov dword [ebp + 0x34], 0x1000
mov dword [esp + 8], ebp
mov dword [esp + 4], str.file_x
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], str.serial
call fcn.004d6a3c
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x34]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x30]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_SetupComm
sub esp, 0xc
mov dword [esp + 4], 0xf
mov dword [esp], esi
call sub.KERNEL32.dll_PurgeComm
sub esp, 8
mov dword [esp + 4], 0x68c9d8
mov dword [esp], esi
call sub.KERNEL32.dll_SetCommTimeouts
sub esp, 8
lea eax, [ebp + 0x68]
mov dword [esp], eax
call sub.KERNEL32.dll_InitializeCriticalSection
push ecx
test bl, 2
jne 0x57fc9c
and ebx, 4
je 0x57fc4a
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x60], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x80], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x84], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x88], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x57f39c
mov dword [esp + 4], 0x100
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp + 0x64], eax
mov dword [esp + 0xc], 0x62e836
mov dword [esp + 8], 0x62e83b
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004dc05c
mov dword [esp + 0xc], 0x62e848
mov dword [esp + 8], str._eofchar
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004dc05c
mov eax, dword [ebp + 8]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp + 0x4c], eax
jmp 0x57fb5a
Function at 0x585a94
Capabilities:
Parse credit card information

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
mov eax, dword [eax + 0x6c]
test eax, eax
je 0x585aac
mov eax, ebx
pop ebx
pop esi
pop edi
jmp fcn.00583f64
mov eax, dword [ebx + 0x60]
call fcn.00582460
mov esi, eax
mov eax, dword [ebx + 0x60]
call fcn.00582460
mov edi, eax
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x585acc
pop ebx
pop esi
pop edi
ret
mov eax, dword [ebx + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], 0x62f8f4
mov dword [ebx + 8], 0x62f90c
mov eax, ebx
call fcn.00583f64
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.005850f4
mov eax, ebx
call fcn.00583f64
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x585ac7
mov dword [ebx + 0x6c], esi
jmp 0x585ac7
Function at 0x585c40
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x50
mov ebx, eax
mov esi, edx
movsx edi, byte [eax]
lea edx, [esp + 0x1e]
call fcn.00585b70
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.___c
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov al, byte [ebx + 1]
test al, 1
jne 0x585e88
test al, 2
jne 0x585e60
test al, 4
jne 0x585e38
test al, 8
jne 0x585e10
test al, 0x10
jne 0x585de8
test al, 0x40
je 0x585dc0
mov eax, dword [ebx + 4]
test eax, eax
jne 0x585da4
cmp dword [ebx + 8], 0x10001
je 0x585cfb
movsx eax, word [ebx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__d_
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
movsx eax, word [ebx + 0xa]
cmp ax, 0x100
je 0x585ceb
mov dword [esp + 8], eax
mov dword [esp + 4], 0x62f54c
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], esi
mov dword [esp], 0x7d
call sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x14]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov dword [esp + 4], str.__ld__ld
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x585d41
lea edx, [esp + 0x1e]
call fcn.00585b70
mov dword [esp + 8], eax
mov dword [esp + 4], str._L:_s
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x585d65
lea edx, [esp + 0x1e]
call fcn.00585b70
mov dword [esp + 8], eax
mov dword [esp + 4], str._R:_s
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x585eb0
mov dword [esp + 4], esi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x585d8e
mov edx, esi
call fcn.00585c40
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x585d9c
mov edx, esi
call fcn.00585c40
add esp, 0x50
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], eax
mov dword [esp + 4], str.___d_
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
jmp 0x585cac
mov dword [esp + 0xc], esi
mov dword [esp + 8], 7
mov dword [esp + 4], 1
mov dword [esp], str._UNUSED
call sub.msvcrt.dll_fwrite
jmp 0x585ca1
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str._hasbackref
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c99
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0xb
mov dword [esp + 4], 1
mov dword [esp], str._hascapture
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c91
mov dword [esp + 0xc], esi
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str._hasmixed
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c89
mov dword [esp + 0xc], esi
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str._shortest
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c81
mov dword [esp + 0xc], esi
mov dword [esp + 8], 8
mov dword [esp + 4], 1
mov dword [esp], str._longest
call sub.msvcrt.dll_fwrite
mov al, byte [ebx + 1]
jmp 0x585c79
mov dword [esp + 4], esi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
jmp 0x585d70