joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413030
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push ecx
push edx
call sub.ADVAPI32.dll_CryptCreateHash
add esp, 0xc
test eax, eax
jne 0x413070
mov eax, ebx
mov edx, 0x99
call fcn.00412fc0
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_CryptHashData
test eax, eax
jne 0x4130a0
mov edx, 0x9e
mov eax, ebx
call fcn.00412fc0
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 4]
leave
ret
sub esp, 0xc
lea eax, [ebp - 0xc]
push 0
push eax
mov eax, dword [ebp + 0x10]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_CryptGetHashParam
add esp, 0xc
test eax, eax
jne 0x413093
mov edx, 0xa3
mov eax, ebx
call fcn.00412fc0
jmp 0x413093

Function at 0x4134c0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov esi, eax
lea eax, [ebp - 0x10]
mov edi, edx
push 0xf0000040
mov ebx, ecx
push 1
push 0
push 0
push eax
call sub.ADVAPI32.dll_CryptAcquireContextA
add esp, 0xc
test eax, eax
jne 0x413500
mov eax, esi
mov edx, 0xc0
call fcn.00412fc0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x10]
push 0x20
mov eax, dword [ebp + 0xc]
mov ecx, edi
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, esi
push ebx
call fcn.00413030
add esp, 0x10
test eax, eax
jne 0x413535
push eax
push eax
push 0
mov edi, dword [ebp - 0x10]
push edi
call sub.ADVAPI32.dll_CryptReleaseContext
pop ebx
pop esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push eax
call sub.ADVAPI32.dll_CryptDestroyHash
add esp, 0xc
push eax
push eax
push 0
mov edi, dword [ebp - 0x10]
push edi
call sub.ADVAPI32.dll_CryptReleaseContext
pop ebx
pop esi
jmp 0x41352d
Function at 0x415570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x415680
push ebx
push 0x36
push 1
push str.Registered_XSLT_Extensions_n___________________________n
call sub.msvcrt.dll_fwrite
mov eax, dword [0x61db60]
add esp, 0x10
test eax, eax
je 0x415690
push ebx
push 0x20
push 1
push str.Registered_Extension_Functions:_n
call sub.msvcrt.dll_fwrite
pop eax
mov eax, dword [0x61db70]
push eax
call fcn.004ce600
add esp, 0xc
push ebx
push 0x415720
mov ecx, dword [0x61db60]
push ecx
call fcn.0048ae50
pop edx
mov eax, dword [0x61db70]
push eax
call fcn.004ce610
mov eax, dword [0x61db80]
add esp, 0x10
test eax, eax
je 0x4156b0
push ebx
push 0x20
push 1
push str._nRegistered_Extension_Elements:_n
call sub.msvcrt.dll_fwrite
pop eax
mov eax, dword [0x61db70]
push eax
call fcn.004ce600
add esp, 0xc
push ebx
push 0x415720
mov eax, dword [0x61db80]
push eax
call fcn.0048ae50
pop eax
mov ecx, dword [0x61db70]
push ecx
call fcn.004ce610
mov edx, dword [0x61db90]
add esp, 0x10
test edx, edx
je 0x4156d0
push ebx
push 0x1f
push 1
push str._nRegistered_Extension_Modules:_n
call sub.msvcrt.dll_fwrite
pop eax
mov eax, dword [0x61db70]
push eax
call fcn.004ce600
add esp, 0xc
push ebx
push 0x4156f0
mov eax, dword [0x61db90]
push eax
call fcn.0048ae50
mov eax, dword [0x61db70]
add esp, 0x10
mov dword [ebp + 8], eax
mov ebx, dword [ebp - 4]
leave
jmp fcn.004ce610
mov ebx, dword [sym.imp.msvcrt.dll__iob]
add ebx, 0x20
jmp 0x415582
push ebx
push 0x22
push 1
push str.No_registered_extension_functions_n
call sub.msvcrt.dll_fwrite
mov eax, dword [0x61db80]
add esp, 0x10
test eax, eax
jne 0x4155ed
nop
push ebx
push 0x22
push 1
push str._nNo_registered_extension_elements_n
call sub.msvcrt.dll_fwrite
mov edx, dword [0x61db90]
add esp, 0x10
test edx, edx
jne 0x41563a
push ebx
push 0x21
push 1
push str._nNo_registered_extension_modules_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x424e28
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x424e63
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x424e4a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x424e5b
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x424e65
inc edi
add eax, 0x28
cmp edi, esi
jb 0x424e40
xor eax, eax
pop edi
pop esi
ret

Function at 0x4251b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00424df8
push eax
push esi
push dword [ebp + 8]
call fcn.00424dad
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00424df8
push eax
push esi
push dword [ebp + 8]
call fcn.00424dad
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00424de8
pushfd
push eax
push 0xff7c9d88
invalid

Function at 0x425470
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x42549c
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x425497
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x425481
and ecx, 0xfff
dec dword [edi]
add byte [eax], al
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x425489
cmp edx, ebx
jne 0x4255d7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x425458
add eax, dword [eax + 4]
jmp 0x425445
mov dword [ebp + 0xc], ebx
jmp 0x4254a7
Function at 0x425510
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4254bf
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4254dd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x42553b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x425522
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x42552b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x425535
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x425517
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
invalid
xchg byte [edi - 1], cl

Function at 0x4256b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
test dword [esi - 4], eax
invalid
call dword [ebx]
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
jl 0x4256ae
invalid

Function at 0x425c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.00424de8
in al, 0xb7
insd dword es:[edi], dx
cmp byte [eax - 0x22f5b], al
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00424dc6
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
invalid
invalid
cwde
Function at 0x42db30
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
mov edi, eax
push 2
push eax
call sym.xml.exe_xsltGetSecurityPrefs
pop esi
test eax, eax
pop edx
je 0x42db64
push ebx
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x40]
push edx
push edi
call eax
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x42dbe0
sub esp, 0xc
mov esi, dword [ebp - 0x44]
push esi
call fcn.0048d340
add esp, 0x10
mov esi, eax
test eax, eax
je 0x42dbc6
sub esp, 0xc
push eax
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x42db8e
test al, 0x10
jne 0x42dbd5
lea eax, [ebp - 0x30]
push ebx
push ebx
push eax
push esi
call fcn.0050dae0
add esp, 0x10
inc eax
je 0x42dc06
mov ax, word [ebp - 0x2a]
mov ebx, 1
and eax, 0xf000
cmp eax, 0x4000
je 0x42dbd5
sub esp, 0xc
push esi
call dword [0x519080]
add esp, 0x10
test ebx, ebx
js 0x42dbcb
mov ebx, 1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 2
jmp 0x42dbb5
sub esp, 0xc
mov eax, dword [ebp - 0x44]
push eax
push str.File_write_for__s_refused_n
push 0
push 0
mov edi, dword [ebp - 0x40]
push edi
call sym.xml.exe_xsltTransformError
mov eax, ebx
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push 3
push edi
call sym.xml.exe_xsltGetSecurityPrefs
pop edx
test eax, eax
pop ecx
je 0x42dc26
push ecx
push esi
mov edx, dword [ebp - 0x40]
push edx
push edi
call eax
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x42dc54
mov ecx, esi
mov edx, dword [ebp - 0x40]
mov eax, edi
call fcn.0042db30
mov ebx, eax
cmp eax, 1
jne 0x42dbb5
push ebx
push ebx
push 0x1ed
push esi
call sub.msvcrt.dll__mkdir
add esp, 0x10
mov ebx, eax
jmp 0x42dbb5
sub esp, 0xc
mov eax, dword [ebp - 0x44]
push eax
push str.Directory_creation_for__s_refused_n
push 0
push 0
mov edi, dword [ebp - 0x40]
push edi
call sym.xml.exe_xsltTransformError
add esp, 0x14
push esi
call dword [0x519080]
add esp, 0x10
jmp 0x42dbcb

Function at 0x436140
Capabilities:
Query environment variable

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
sub esp, 8
mov ecx, dword [0x61e1b0]
test ecx, ecx
je 0x436155
leave
ret
mov dword [0x61e1b0], 1
call fcn.004ce740
sub esp, 0xc
mov dword [0x61e1c0], eax
push str.XML_MEM_BREAKPOINT
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x436191
push edx
push 0x61e1d0
push 0x5274ef
push eax
call sub.msvcrt.dll_sscanf
add esp, 0x10
sub esp, 0xc
push str.XML_MEM_TRACE
call sub.msvcrt.dll_getenv
mov edx, eax
add esp, 0x10
xor eax, eax
test edx, edx
je 0x436153
push eax
push 0x61e1e0
push 0x527501
push edx
call sub.msvcrt.dll_sscanf
xor eax, eax
add esp, 0x10
leave
ret
Function at 0x439300
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x7d8
mov ebx, eax
push 0xd
push str.urn:publicid:
push eax
call fcn.00483dc0
add esp, 0x10
xor edx, edx
test eax, eax
jne 0x439382
lea eax, [ebx + 0xd]
xor ecx, ecx
mov dl, byte [eax]
test dl, dl
je 0x439366
lea esi, [esi]
cmp ecx, 0x7cc
ja 0x439366
cmp dl, 0x2b
je 0x439390
cmp dl, 0x3a
je 0x4393a0
cmp dl, 0x3b
je 0x4393c0
cmp dl, 0x25
je 0x4393da
mov byte [ebp + ecx - 0x7d4], dl
lea edx, [eax + 1]
inc ecx
mov eax, edx
lea esi, [esi]
mov dl, byte [eax]
test dl, dl
jne 0x439330
sub esp, 0xc
lea eax, [ebp - 0x7d4]
mov byte [ebp + ecx - 0x7d4], 0
push eax
call fcn.00483c60
add esp, 0x10
mov edx, eax
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret
lea edx, [eax + 1]
mov byte [ebp + ecx - 0x7d4], 0x20
mov eax, edx
inc ecx
jmp 0x439360
lea edx, [eax + 1]
mov byte [ebp + ecx - 0x7d4], 0x2f
mov byte [ebp + ecx - 0x7d3], 0x2f
mov eax, edx
add ecx, 2
jmp 0x439360
lea edx, [eax + 1]
mov byte [ebp + ecx - 0x7d4], 0x3a
mov byte [ebp + ecx - 0x7d3], 0x3a
mov eax, edx
add ecx, 2
jmp 0x439360
mov bl, byte [eax + 1]
lea edx, [eax + 1]
cmp bl, 0x32
je 0x4393fa
cmp bl, 0x33
je 0x439421
mov byte [ebp + ecx - 0x7d4], 0x25
mov eax, edx
inc ecx
jmp 0x439360
mov bl, byte [eax + 2]
cmp bl, 0x42
je 0x43943e
cmp bl, 0x46
je 0x43945c
cmp bl, 0x37
je 0x439472
cmp bl, 0x33
je 0x43947d
cmp bl, 0x35
jne 0x4393ea
mov byte [ebp + ecx - 0x7d4], 0x25
inc ecx
jmp 0x439447
mov bl, byte [eax + 2]
cmp bl, 0x41
je 0x439451
cmp bl, 0x42
je 0x439467
cmp bl, 0x46
jne 0x4393ea
mov byte [ebp + ecx - 0x7d4], 0x3f
inc ecx
jmp 0x439447
mov byte [ebp + ecx - 0x7d4], 0x2b
inc ecx
lea edx, [eax + 3]
mov eax, edx
jmp 0x439360
mov byte [ebp + ecx - 0x7d4], 0x3a
inc ecx
jmp 0x439447
mov byte [ebp + ecx - 0x7d4], 0x2f
inc ecx
jmp 0x439447
mov byte [ebp + ecx - 0x7d4], 0x3b
inc ecx
jmp 0x439447
mov byte [ebp + ecx - 0x7d4], 0x27
inc ecx
jmp 0x439447
mov byte [ebp + ecx - 0x7d4], 0x23
inc ecx
jmp 0x439447

Function at 0x439eb0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x61e230]
test eax, eax
je 0x439ec1
leave
ret
sub esp, 0xc
push str.XML_DEBUG_CATALOG
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x439edf
mov dword [0x61e650], 1
call fcn.004ce720
mov dword [0x61e230], 1
mov dword [0x61e660], eax
leave
ret
Function at 0x43a0f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [0x61e230]
test eax, eax
je 0x43a10a
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00439eb0
sub esp, 0xc
mov eax, dword [0x61e660]
push eax
call fcn.004ce620
mov dword [esp], str.XML_DEBUG_CATALOG
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x43a13a
mov dword [0x61e650], 1
mov edi, dword [0x61e240]
test edi, edi
je 0x43a15d
sub esp, 0xc
mov eax, dword [0x61e660]
push eax
call fcn.004ce630
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push str.XML_CATALOG_FILES
call sub.msvcrt.dll_getenv
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x43a233
mov edx, dword [0x519200]
mov eax, 1
call fcn.00439f00
mov edi, eax
test eax, eax
je 0x43a144
lea eax, [eax + 0x3c]
mov dword [ebp - 0x10], eax
mov dl, byte [ebx]
test dl, dl
je 0x43a1bb
mov ecx, ebx
jmp 0x43a1a4
mov dl, byte [ecx + 1]
inc ecx
mov ebx, ecx
cmp dl, 0x20
je 0x43a1a0
lea eax, [edx - 9]
cmp al, 1
jbe 0x43a1a0
cmp dl, 0xd
je 0x43a1a0
test dl, dl
jne 0x43a1cf
mov dword [0x61e240], edi
jmp 0x43a144
cmp dl, 0xd
je 0x43a1db
inc ebx
mov dl, byte [ebx]
test dl, dl
je 0x43a1db
cmp dl, 0x20
je 0x43a1db
lea eax, [edx - 9]
cmp al, 1
ja 0x43a1c3
mov eax, ebx
push esi
sub eax, ecx
push esi
push eax
push ecx
call fcn.00483b00
add esp, 0x10
mov esi, eax
test eax, eax
je 0x43a22c
push edx
push 0
mov eax, dword [0x519200]
xor edx, edx
push eax
xor ecx, ecx
mov eax, 1
push esi
call fcn.00439760
mov edx, dword [ebp - 0x10]
add esp, 0x10
test eax, eax
mov dword [edx], eax
je 0x43a218
mov dword [ebp - 0x10], eax
sub esp, 0xc
push esi
call dword [0x519080]
mov dl, byte [ebx]
add esp, 0x10
jmp 0x43a195
mov dl, byte [ebx]
jmp 0x43a195
mov ebx, str.file:___etc_xml_catalog
jmp 0x43a177

Function at 0x43a310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, eax
test eax, eax
jne 0x43a330
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.0050dae0
add esp, 0x10
test eax, eax
js 0x43a31f
push eax
push eax
push 0
push ebx
call sub.msvcrt.dll__open
add esp, 0x10
mov esi, eax
test eax, eax
js 0x43a31f
mov edi, dword [ebp - 0x1c]
sub esp, 0xc
lea eax, [edi + 0xa]
push eax
call dword [0x519088]
add esp, 0x10
test eax, eax
je 0x43a38f
mov ebx, eax
push eax
push edi
push ebx
push esi
call sub.msvcrt.dll__read
mov edi, eax
mov dword [esp], esi
call sub.msvcrt.dll__close
add esp, 0x10
test edi, edi
js 0x43a39d
mov byte [ebx + edi], 0
jmp 0x43a321
mov eax, str.allocating_catalog_data
xor ebx, ebx
call fcn.004395d0
jmp 0x43a321
sub esp, 0xc
push ebx
call dword [0x519080]
xor ebx, ebx
add esp, 0x10
jmp 0x43a321
Function at 0x452f70
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x25
je 0x452f90
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push ebx
call fcn.00438ac0
mov dword [esp], ebx
call fcn.00450a70
add esp, 0x10
mov esi, eax
test eax, eax
je 0x453047
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3b
je 0x452fce
lea esp, [ebp - 0xc]
mov eax, ebx
xor ecx, ecx
mov edx, 0x17
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0044d130
sub esp, 0xc
push ebx
call fcn.00438ac0
mov edi, dword [ebx + 0x1b8]
mov eax, dword [ebx]
inc edi
add esp, 0x10
mov dword [ebx + 0x1b8], edi
test eax, eax
je 0x453043
mov eax, dword [eax + 0x60]
test eax, eax
je 0x453043
push ecx
push ecx
push esi
mov edx, dword [ebx + 4]
push edx
call eax
add esp, 0x10
mov edi, eax
cmp dword [ebx + 0xac], 0xffffffff
je 0x452f87
test edi, edi
je 0x453089
mov eax, dword [edi + 0x30]
sub eax, 4
cmp eax, 1
jbe 0x45305f
mov ecx, str.Internal:____s__is_not_a_parameter_entity_n
push eax
mov edx, 0x1b
push eax
mov eax, ebx
push 0
push esi
call fcn.0044c3c0
add esp, 0x10
mov dword [ebx + 0x5c], 1
jmp 0x452f87
xor edi, edi
jmp 0x453002
lea esp, [ebp - 0xc]
mov eax, ebx
mov ecx, str.xmlParsePEReference:_no_name_n
mov edx, 0x44
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0044c4a0
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x28], 0x44b370
je 0x4530dc
mov edx, edi
mov eax, ebx
call fcn.0044dbb0
push edi
push edi
push eax
push ebx
call fcn.0044d700
add esp, 0x10
test eax, eax
jns 0x453037
jmp 0x452f87
cmp dword [ebx + 0x1c], 1
je 0x45309d
mov eax, dword [ebx + 0x58]
test eax, eax
jne 0x4530b7
mov eax, dword [ebx + 0x5c]
test eax, eax
jne 0x4530b7
sub esp, 0xc
mov ecx, str.PEReference:____s__not_found_n
mov edx, 0x1a
mov eax, ebx
push esi
call fcn.0044c070
add esp, 0x10
jmp 0x453037
mov ecx, str.PEReference:____s__not_found_n
push eax
mov edx, 0x1b
push eax
mov eax, ebx
push 0
push esi
call fcn.0044c3c0
add esp, 0x10
mov dword [ebx + 0x64], 0
jmp 0x453037
push esi
push esi
push edi
push ebx
call fcn.004372d0
pop edx
pop ecx
push eax
push ebx
call fcn.0044d700
add esp, 0x10
test eax, eax
js 0x452f87
cmp dword [edi + 0x30], 5
jne 0x453037
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x453037
cmp byte [eax + 1], 0x3f
jne 0x453037
cmp byte [eax + 2], 0x78
jne 0x453037
cmp byte [eax + 3], 0x6d
jne 0x453037
cmp byte [eax + 4], 0x6c
jne 0x453037
mov dl, byte [eax + 5]
cmp dl, 0x20
je 0x453152
lea eax, [edx - 9]
cmp al, 1
jbe 0x453152
cmp dl, 0xd
jne 0x453037
sub esp, 0xc
push ebx
call fcn.00452cd0
add esp, 0x10
cmp dword [ebx + 0x54], 0x20
jne 0x453037
mov dword [ebx + 0xac], 0xffffffff
jmp 0x452f87
Function at 0x46bc50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0x1c]
test ebx, ebx
jne 0x46bc80
lea esp, [ebp - 0xc]
or eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
test edx, edx
je 0x46bc72
push ecx
push 0
push eax
push edx
call fcn.0048c900
add esp, 0x10
test eax, eax
je 0x46bc72
mov edx, dword [ebp - 0x10]
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0046b650
Function at 0x48ad40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + 0x10]
test edx, edx
je 0x48ad8d
mov bl, byte [edx]
xor eax, eax
mov al, bl
lea edx, [eax + eax]
shl eax, 5
sub eax, edx
add edi, eax
test bl, bl
je 0x48ad8d
lea esi, [esi]
mov eax, edi
mov edx, edi
shl edx, 5
shr eax, 3
add eax, edx
movsx edx, bl
add eax, edx
xor edi, eax
mov al, byte [esi + 1]
mov bl, al
inc esi
test al, al
jne 0x48ad70
mov edx, edi
mov eax, edi
shr edx, 3
shl eax, 5
lea ecx, [edx + eax]
xor ecx, edi
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x48adcd
mov edx, dword [ebp - 0x14]
mov al, byte [edx]
test al, al
je 0x48adcd
mov bl, al
mov esi, edx
mov eax, ecx
mov edx, ecx
shl edx, 5
shr eax, 3
add eax, edx
movsx edx, bl
add eax, edx
xor ecx, eax
mov al, byte [esi + 1]
mov bl, al
inc esi
test al, al
jne 0x48adb0
mov edx, ecx
mov eax, ecx
shr edx, 3
mov esi, dword [ebp + 8]
shl eax, 5
lea ebx, [edx + eax]
xor ebx, ecx
test esi, esi
je 0x48ae0e
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
test al, al
je 0x48ae0e
mov cl, al
mov esi, dword [ebp + 8]
mov eax, ebx
mov edx, ebx
shl edx, 5
shr eax, 3
add eax, edx
movsx edx, cl
add eax, edx
xor ebx, eax
mov al, byte [esi + 1]
mov cl, al
inc esi
test al, al
jne 0x48adf1
mov ecx, dword [ebp - 0x10]
mov eax, ebx
xor edx, edx
div dword [ecx + 4]
mov eax, edx
pop edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4b5af0
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
je 0x4b5b29
sub esp, 0xc
mov ebx, dword [edx + 4]
push ebx
call fcn.00443df0
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4b5b30
push ecx
push eax
push str.__Annot:__s_n
push esi
call sub.msvcrt.dll_fprintf
mov dword [esp], ebx
call dword [0x519080]
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
push esi
push 0xf
push 1
push str.__Annot:_empty_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4b5b33
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
je 0x4b5b29
sub esp, 0xc
mov ebx, dword [edx + 4]
push ebx
call fcn.00443df0
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4b5b30
push ecx
push eax
push str.__Annot:__s_n
push esi
call sub.msvcrt.dll_fprintf
mov dword [esp], ebx
call dword [0x519080]
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
push esi
push 0xf
push 1
push str.__Annot:_empty_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret