joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4064ec
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040358c
mov eax, dword [ebp - 0xc]
call fcn.0040358c
mov eax, dword [ebp + 8]
call fcn.0040358c
xor eax, eax
push ebp
push 0x4065f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41e6b8
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040359c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x40654d
call fcn.00402a00
mov dword [0x41e6bc], eax
cmp dword [ebp + 8], 0
jne 0x406565
lea eax, [ebp + 8]
mov edx, 0x406610
call fcn.004032b0
mov eax, dword [ebp + 8]
call fcn.0040339c
test eax, eax
jns 0x406576
call fcn.00402a00
push eax
lea eax, [ebp + 8]
call fcn.004035ec
mov edx, 1
dec edx
test eax, eax
je 0x40658e
cmp edx, dword [eax - 4]
jb 0x406593
call fcn.00402a00
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040359c
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x4065ba
call fcn.00402a00
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065ff
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040323c
lea eax, [ebp + 8]
call fcn.00403218
ret

Function at 0x406614
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040358c
mov eax, dword [ebp - 0xc]
call fcn.0040358c
xor eax, eax
push ebp
push 0x4066cf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41e6b8
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040359c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x40666d
call fcn.00402a00
mov dword [0x41e6bc], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040359c
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406699
call fcn.00402a00
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066d6
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040323c
ret
Function at 0x406788
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040358c
mov eax, dword [ebp - 0xc]
call fcn.0040358c
xor eax, eax
push ebp
push 0x406846
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x4067c8
lea eax, [ebp - 0xc]
mov edx, 0x40685c
call fcn.004032b0
mov eax, dword [ebp - 0xc]
call fcn.0040339c
test eax, eax
jns 0x4067d9
call fcn.00402a00
push eax
lea eax, [ebp - 0xc]
call fcn.004035ec
mov edx, 1
dec edx
test eax, eax
je 0x4067f1
cmp edx, dword [eax - 4]
jb 0x4067f6
call fcn.00402a00
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040359c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x40681b
call fcn.00402a00
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40684d
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040323c
ret

Function at 0x406860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040358c
xor eax, eax
push ebp
push 0x4068d0
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.0040359c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x4068aa
call fcn.00402a00
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4068d7
lea eax, [ebp - 8]
call fcn.00403218
ret

Function at 0x4068e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040358c
mov eax, dword [ebp - 0xc]
call fcn.0040358c
xor eax, eax
push ebp
push 0x40698c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41e6b8
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.0040359c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406934
call fcn.00402a00
mov dword [0x41e6bc], eax
mov eax, dword [ebp - 0xc]
call fcn.0040359c
push eax
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
jns 0x406956
call fcn.00402a00
mov dword [0x41e6bc], eax
cmp dword [0x41e6bc], 0
sete byte [ebp - 0xd]
mov eax, dword [0x41e6b8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406993
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040323c
ret
Function at 0x407058
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x41d0d4], 0
jne 0x40712a
mov byte [0x41d0d4], 1
xor eax, eax
mov dword [0x41d0cc], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x4070a0
cmp dword [esp + 0x1c], 3
jne 0x407100
cmp dword [esp + 0x20], 0x33
jbe 0x407100
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x407134
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40712a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x407164
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40712a
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x40712a
cmp byte [esp + 9], 0
jne 0x40712a
jmp 0x407115
push 0
push 0x407164
push 0x40716c
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x40712a
mov eax, dword [0x41d0c8]
call fcn.0040359c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x41d0cc], eax
add esp, 0xac
ret
Function at 0x40cc38
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x41eb74
mov edx, 0x40ccc0
call fcn.0040326c
push 0
push 0
mov eax, dword [0x41edf4]
call fcn.0040359c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
mov eax, dword [0x41edf8]
call fcn.0040359c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41eb74
mov edx, 0x40cd64
call fcn.0040326c
push 0
push 0
mov eax, dword [0x41edfc]
call fcn.0040359c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41eb74
mov edx, 0x40cdb8
call fcn.0040326c
pop ebp
ret
Function at 0x40f174
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40f3f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004026c0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00404a14
mov edx, dword [ebp - 0x10]
mov eax, 0x41eb4c
call fcn.0040326c
cmp byte [0x41ebb5], 0
jne 0x40f1d7
mov eax, dword [0x41eb4c]
push eax
mov ecx, dword [0x41ecf4]
mov edx, dword [0x41ed20]
mov eax, 0x80000002
call fcn.004064ec
mov eax, 0x41eb74
mov edx, 0x40f404
call fcn.0040326c
cmp byte [0x41ebb5], 0
je 0x40f1f9
call fcn.0040fad4
jmp 0x40f3d6
xor eax, eax
mov dword [ebp - 4], eax
push 0
mov eax, dword [0x41ee28]
call fcn.0040359c
push eax
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40f225
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x40f1fe
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x40f438
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
mov eax, dword [0x41ed08]
call fcn.0040359c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
mov eax, 0x41eb74
mov edx, 0x40f448
call fcn.0040326c
cmp dword [ebp - 8], 0
jne 0x40f27f
mov eax, dword [0x41ed10]
call fcn.0040359c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40f371
mov eax, 0x41eb74
mov edx, 0x40f4f8
call fcn.0040326c
mov eax, dword [0x41ee2c]
call fcn.0040359c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0xc], eax
mov eax, 0x41eb74
mov edx, 0x40f590
call fcn.0040326c
cmp dword [ebp - 0xc], 0
je 0x40f371
mov eax, 0x41eb74
mov edx, 0x40f638
call fcn.0040326c
call dword [ebp - 0xc]
mov eax, 0x41eb74
mov edx, 0x40f708
call fcn.0040326c
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x41eb74
mov edx, 0x40f7d8
call fcn.0040326c
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x41d1c8
mov edx, 5
call fcn.00419f04
mov eax, 0x41eb74
mov edx, 0x40f8ac
call fcn.0040326c
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x41d1c8
mov edx, 5
call fcn.00419f04
mov eax, 0x41eb74
mov edx, 0x40f8c0
call fcn.0040326c
mov eax, dword [0x41ed1c]
call fcn.0040359c
mov edx, eax
mov eax, 0x41ebc8
mov ecx, 0xbb8
call fcn.004061d4
test al, al
je 0x40f3d6
mov eax, 0x41eb74
mov edx, 0x40f94c
call fcn.0040326c
call fcn.0040fad4
mov eax, 0x41eb74
mov edx, 0x40f978
call fcn.0040326c
call fcn.00412cb4
mov eax, 0x41eb74
mov edx, 0x40fa2c
call fcn.0040326c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f3f8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040323c
ret
Function at 0x4128f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040358c
xor eax, eax
push ebp
push 0x412a20
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x41ebbc], 0
jne 0x41292a
call fcn.00412678
push 2
push 0
push 0
mov eax, dword [0x41ebbc]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
jne 0x412945
call fcn.00412678
mov eax, 0x41eb74
mov edx, 0x412a38
call fcn.0040326c
lea edx, [ebp - 0xc]
mov al, byte [0x41ebb6]
call fcn.00404a90
push dword [ebp - 0xc]
push 0x412ae8
push dword [ebp - 4]
push 0x412af4
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040345c
mov eax, 0x41eb74
mov edx, 0x412b00
call fcn.0040326c
mov byte [0x41ebb6], 0
mov eax, 0x41eb74
mov edx, 0x412b58
call fcn.0040326c
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040339c
test eax, eax
jns 0x4129ba
call fcn.00402a00
push eax
lea eax, [ebp - 4]
call fcn.004035ec
mov edx, 1
dec edx
test eax, eax
je 0x4129d2
cmp edx, dword [eax - 4]
jb 0x4129d7
call fcn.00402a00
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [0x41ebbc]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x4129f3
mov dword [ebp - 8], 0xffffffff
mov eax, 0x41eb74
mov edx, 0x412bec
call fcn.0040326c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412a27
lea eax, [ebp - 0xc]
call fcn.00403218
lea eax, [ebp - 4]
call fcn.00403218
ret
Function at 0x4184bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x41ebb4], 0
jne 0x4184fe
push 0x418504
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4184ed
push 0x41851c
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x4184fe
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret
Function at 0x40c850
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xa000]
push edi
jmp 0x40c86a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c871
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c860
mov eax, 1
add ebx, ebx
jne 0x40c883
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c878
jne 0x40c894
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c878
xor ecx, ecx
sub eax, 3
jb 0x40c8a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c91a
mov ebp, eax
add ebx, ebx
jne 0x40c8b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c8c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c8e4
inc ecx
add ebx, ebx
jne 0x40c8d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c8c5
jne 0x40c8e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c8c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c904
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c8f5
jmp 0x40c866
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c904
add edi, ecx
jmp 0x40c866
pop esi
mov edi, esi
mov ecx, 0xa1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c922
cmp byte [edi], 5
jne 0x40c922
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40c927
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c996
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xdfa8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe00c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c954
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe010]
or eax, eax
je 0x40c990
mov dword [ebx], eax
add ebx, 4
jmp 0x40c971
call dword [esi + 0xe020]
mov ebp, dword [esi + 0xe014]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c9ca
sub esp, 0xffffff80
jmp 0x402f32
Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f8
nop
mov eax, 1
mov dword [ebp - 4], eax
mov eax, str.dir__OGn__P
push eax
lea eax, [ebp - 0x1f8]
push eax
call sub.msvcrt.dll_strcpy
add esp, 8
mov eax, dword [ebp + 8]
add eax, 0xffffffff
mov dword [ebp + 8], eax
test eax, eax
je 0x4010d7
mov eax, 0x40200c
push eax
lea eax, [ebp - 0x1f8]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, dword [ebp - 4]
shl eax, 2
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov eax, 0x20
push eax
mov eax, dword [ecx]
push eax
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x4010aa
lea eax, [ebp - 0x1f8]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
lea ecx, [ebp - 0x1f8]
add ecx, eax
mov eax, dword [ebp - 4]
shl eax, 2
mov edx, dword [ebp + 0xc]
add edx, eax
mov eax, dword [edx]
push eax
mov eax, str.__s_
push eax
push ecx
call sub.msvcrt.dll_sprintf
add esp, 0xc
jmp 0x4010c7
mov eax, dword [ebp - 4]
shl eax, 2
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov eax, dword [ecx]
push eax
lea eax, [ebp - 0x1f8]
push eax
call sub.msvcrt.dll_strcat
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, eax
add eax, 1
mov dword [ebp - 4], eax
jmp 0x401027
lea eax, [ebp - 0x1f8]
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret
Function at 0x2800c0bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
cmp dword [ebx + 0x100], 0
je 0x2800c0ea
mov eax, dword [ebx + 0x100]
cmp dword [eax + 0x24], 0
je 0x2800c0ea
mov eax, dword [ebx + 0x100]
mov eax, dword [eax + 0x24]
mov dword [ebp + 8], eax
jmp 0x2800c0f1
mov dword [ebp + 8], 0x280ac738
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov edx, dword [ebp + 8]
pop ecx
mov ecx, eax
mov eax, dword [ebx + 0x934]
test ecx, ecx
mov dword [ebp - 4], ecx
je 0x2800c122
movzx esi, byte [edx]
add eax, esi
inc edx
imul eax, eax, 0x401
mov esi, eax
shr esi, 6
xor eax, esi
dec ecx
jne 0x2800c10c
lea eax, [eax + eax*8]
push 0x2c
mov edi, eax
push 1
shr edi, 0xb
xor edi, eax
imul edi, edi, 0x8001
call sym.perl510.dll_Perl_safesyscalloc
pop ecx
mov esi, eax
xor eax, eax
pop ecx
cmp dword [ebx + 0x100], eax
je 0x2800c152
mov eax, dword [ebx + 0x100]
mov eax, dword [eax + 0x18]
push edi
mov dword [esi + 0x24], eax
push dword [ebp - 4]
push dword [ebp + 8]
push ebx
call sym.perl510.dll_Perl_share_hek
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov dword [esi + 0x20], eax
mov dword [esi + 0x10], 1
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2800f5c6
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
cmp edx, 1
push esi
jbe 0x2800f6ba
movsx ecx, byte [eax]
cmp ecx, 0x39
lea esi, [eax + 1]
jg 0x2800f654
cmp ecx, 0x31
jge 0x2800f631
sub ecx, 0xf
je 0x2800f62a
sub ecx, 5
je 0x2800f623
dec ecx
je 0x2800f607
dec ecx
dec ecx
jne 0x2800f73d
push str.ARNING_BITS
jmp 0x2800f690
push str.NICODE
push esi
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x2800f741
push str.TF8LOCALE
jmp 0x2800f690
push str.AINT
jmp 0x2800f690
push 0x280b1808
jmp 0x2800f690
lea ecx, [eax + edx - 1]
cmp ecx, eax
jbe 0x2800f741
mov dl, byte [ecx]
cmp dl, 0x30
jl 0x2800f73d
cmp dl, 0x39
jg 0x2800f73d
dec ecx
jmp 0x2800f635
cmp ecx, 0x49
je 0x2800f69f
cmp ecx, 0x4f
je 0x2800f682
cmp ecx, 0x53
jne 0x2800f73d
cmp edx, 3
jne 0x2800f73d
cmp byte [esi], 0x49
jne 0x2800f73d
cmp byte [eax + 2], 0x47
jmp 0x2800f73b
cmp edx, 8
jne 0x2800f73d
push str.VERLOAD
push esi
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jmp 0x2800f73b
cmp edx, 3
jne 0x2800f73d
cmp byte [esi], 0x53
jne 0x2800f73d
cmp byte [eax + 2], 0x41
jmp 0x2800f73b
movsx eax, byte [eax]
cmp eax, 0x23
jg 0x2800f705
je 0x2800f741
cmp eax, 0x10
jg 0x2800f6ec
cmp eax, 0xe
jge 0x2800f741
cmp eax, 1
je 0x2800f741
cmp eax, 2
jle 0x2800f73d
cmp eax, 6
jle 0x2800f741
cmp eax, 7
jle 0x2800f73d
cmp eax, 9
jle 0x2800f741
cmp eax, 0xc
jmp 0x2800f73b
cmp eax, 0x13
jl 0x2800f73d
cmp eax, 0x14
jle 0x2800f741
cmp eax, 0x15
jle 0x2800f73d
cmp eax, 0x17
jle 0x2800f741
cmp eax, 0x21
jmp 0x2800f73b
cmp eax, 0x5e
jg 0x2800f72f
cmp eax, 0x5b
jge 0x2800f741
cmp eax, 0x25
jl 0x2800f73d
cmp eax, 0x29
jle 0x2800f741
cmp eax, 0x2a
jle 0x2800f73d
cmp eax, 0x2f
jle 0x2800f741
cmp eax, 0x30
jle 0x2800f73d
cmp eax, 0x3f
jle 0x2800f741
jmp 0x2800f73d
sub eax, 0x60
je 0x2800f741
sub eax, 0x1c
je 0x2800f741
dec eax
dec eax
je 0x2800f741
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x2800f745
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
cmp ebx, 0x7fffffff
push edi
jbe 0x2800f768
push ebx
push str.panic:_gv_name_too_long___lu_
push esi
call sym.perl510.dll_Perl_croak
add esp, 0xc
test byte [ebp + 0x18], 1
mov edi, dword [ebp + 0xc]
jne 0x2800f783
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x2800f783
push eax
push esi
call fcn.28012f64
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi + 0x934]
test ebx, ebx
je 0x2800f7ad
lea edx, [ebx]
mov dword [ebp + 0x14], edx
movzx edx, byte [ecx]
add eax, edx
inc ecx
imul eax, eax, 0x401
mov edx, eax
shr edx, 6
xor eax, edx
dec dword [ebp + 0x14]
jne 0x2800f795
lea eax, [eax + eax*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
push ecx
push ebx
push dword [ebp + 0x10]
push esi
call sym.perl510.dll_Perl_share_hek
mov ecx, dword [edi]
add esp, 0x10
pop edi
pop esi
mov dword [ecx + 0x10], eax
pop ebx
pop ebp
ret
Function at 0x28012aed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
cmp ebx, 0x7fffffff
push edi
jbe 0x28012b10
push ebx
push str.panic:_hv_name_too_long___lu_
push esi
call sym.perl510.dll_Perl_croak
add esp, 0xc
mov eax, dword [ebp + 0xc]
test byte [eax + 0xb], 2
je 0x28012b3c
mov ecx, dword [eax]
mov eax, dword [eax + 0xc]
mov ecx, dword [ecx + 0xc]
lea edi, [eax + ecx*4 + 4]
xor ecx, ecx
mov eax, dword [edi]
cmp eax, ecx
je 0x28012b4b
push ecx
push ecx
push ecx
push eax
push esi
call fcn.28012f7a
add esp, 0x14
jmp 0x28012b4b
cmp dword [ebp + 0x10], 0
je 0x28012b9d
push eax
call fcn.28012992
pop ecx
mov edi, eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi + 0x934]
test ebx, ebx
je 0x28012b73
lea edx, [ebx]
movzx ebx, byte [ecx]
add eax, ebx
inc ecx
imul eax, eax, 0x401
mov ebx, eax
shr ebx, 6
xor eax, ebx
dec edx
jne 0x28012b5a
mov ebx, dword [ebp + 0x14]
cmp dword [ebp + 0x10], 0
lea eax, [eax + eax*8]
je 0x28012b99
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
push ecx
push ebx
push dword [ebp + 0x10]
push esi
call sym.perl510.dll_Perl_share_hek
add esp, 0x10
jmp 0x28012b9b
xor eax, eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x28013550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
test edx, edx
mov dword [ebp - 4], 0x280cd000
je 0x2801369b
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x280135c4
test byte [ebp + 0x1d], 1
je 0x28013582
push dword [ebp + 0x14]
call sym.perl510.dll_Perl_safesysfree
mov edx, dword [ebp + 0xc]
pop ecx
mov ecx, dword [esi + 8]
mov eax, 0x400
and ecx, eax
cmp ecx, eax
jne 0x280135a0
mov eax, dword [esi]
mov eax, dword [eax + 8]
mov dword [ebp + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ebp + 0x14], eax
jmp 0x280135b8
lea eax, [ebp + 0x18]
push 0x22
push eax
push esi
push dword [ebp + 8]
call sym.perl510.dll_Perl_sv_2pv_flags
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [ebp + 0x14], eax
mov ebx, dword [esi + 8]
and dword [ebp + 0x1c], 0
shr ebx, 0x1d
jmp 0x280135c7
mov bl, byte [ebp + 0x1c]
mov edi, dword [ebp + 0x20]
and bl, 1
test edi, edi
jne 0x28013630
test esi, esi
je 0x280135f2
mov ecx, dword [esi + 8]
mov eax, 0x9000000
and ecx, eax
cmp ecx, eax
jne 0x280135f2
mov eax, dword [esi]
cmp dword [eax + 0xc], edi
jne 0x280135f2
mov eax, dword [esi + 0xc]
mov edi, dword [eax - 8]
jmp 0x28013630
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax + 0x934]
test esi, esi
je 0x2801361b
movzx edi, byte [ecx]
add eax, edi
inc ecx
imul eax, eax, 0x401
mov edi, eax
shr edi, 6
xor eax, edi
dec esi
jne 0x28013605
lea eax, [eax + eax*8]
mov edi, eax
shr edi, 0xb
xor edi, eax
imul edi, edi, 0x8001
jmp 0x28013630
mov edx, dword [ebp + 0xc]
cmp edi, dword [edx + 4]
jne 0x28013678
mov esi, dword [ebp + 0x18]
cmp esi, dword [edx + 8]
jne 0x28013678
mov al, byte [edx + 0x14]
and al, 0x60
cmp al, 0x40
jne 0x2801364c
mov eax, dword [edx + 0xc]
inc eax
jmp 0x2801364e
xor eax, eax
push esi
lea eax, [eax + edx + 0x15]
push dword [ebp + 0x14]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x28013675
mov esi, dword [ebp + 0xc]
test bl, bl
mov cl, byte [esi + 0x14]
setne al
and ecx, 1
cmp eax, ecx
je 0x28013683
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x2801362d
jmp 0x2801369b
push esi
push dword [ebp + 8]
call fcn.28013497
push eax
push dword [ebp + 8]
call sym.perl510.dll_Perl_sv_2mortal
add esp, 0x10
mov dword [ebp - 4], eax
test byte [ebp + 0x1d], 1
pop edi
pop esi
pop ebx
je 0x280136ad
push dword [ebp + 0x14]
call sym.perl510.dll_Perl_safesysfree
pop ecx
mov eax, dword [ebp - 4]
leave
ret