joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406200
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x425d51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
push str.config.ini
lea eax, [esi + 0x1b0]
lea ecx, [esp + 0x18]
push eax
push ecx
call sub.MFC42u.DLL_operator
mov ebp, dword [eax]
mov dword [esp + 0x30], 0
test ebp, ebp
je 0x406318
mov dl, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
push 0xfeff
push 1
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_int__unsigned_short_int_]
lea eax, [esp + 0x18]
push 1
push eax
lea ecx, [esi + 0xf4]
mov byte [esp + 0x38], 1
call fcn.00406bd0
mov eax, dword [esp + 0x1c]
mov ebx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
test eax, eax
je 0x406292
mov ebx, eax
mov ecx, dword [esp + 0x20]
push 0x430338
push ebp
lea edi, [ecx + ecx]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
xor ebp, ebp
add esp, 8
cmp esi, ebp
jne 0x4062ca
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
je 0x40630c
mov al, byte [ecx - 1]
test al, al
je 0x406300
cmp al, 0xff
je 0x406300
dec al
mov byte [ecx - 1], al
jmp 0x40630c
push esi
push edi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, edi
push esi
je 0x40631c
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebp
je 0x40630c
mov al, byte [ecx - 1]
test al, al
je 0x406300
cmp al, 0xff
je 0x406300
dec al
mov byte [ecx - 1], al
jmp 0x40630c
add ecx, 0xfffffffe
push ecx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
xor bl, bl
jmp 0x406359
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebp
je 0x40634b
mov al, byte [ecx - 1]
test al, al
je 0x40633f
cmp al, 0xff
je 0x40633f
dec al
mov byte [ecx - 1], al
jmp 0x40634b
add ecx, 0xfffffffe
push ecx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov bl, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x406380
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x425d71
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
push str.user.ini
lea eax, [esi + 0x1b0]
lea ecx, [esp + 0x18]
push eax
push ecx
call sub.MFC42u.DLL_operator
mov ebp, dword [eax]
mov dword [esp + 0x30], 0
test ebp, ebp
je 0x406498
mov dl, byte [esp + 0x13]
push 0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], dl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
push 0xfeff
push 1
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_int__unsigned_short_int_]
lea eax, [esp + 0x18]
push 1
push eax
lea ecx, [esi + 0x120]
mov byte [esp + 0x38], 1
call fcn.00406bd0
mov eax, dword [esp + 0x1c]
mov ebx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
test eax, eax
je 0x406412
mov ebx, eax
mov ecx, dword [esp + 0x20]
push 0x430338
push ebp
lea edi, [ecx + ecx]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
xor ebp, ebp
add esp, 8
cmp esi, ebp
jne 0x40644a
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
je 0x40648c
mov al, byte [ecx - 1]
test al, al
je 0x406480
cmp al, 0xff
je 0x406480
dec al
mov byte [ecx - 1], al
jmp 0x40648c
push esi
push edi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, edi
push esi
je 0x40649c
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebp
je 0x40648c
mov al, byte [ecx - 1]
test al, al
je 0x406480
cmp al, 0xff
je 0x406480
dec al
mov byte [ecx - 1], al
jmp 0x40648c
add ecx, 0xfffffffe
push ecx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
xor bl, bl
jmp 0x4064d9
call dword [sym.imp.MSVCRT.dll_fclose]
mov ecx, dword [esp + 0x20]
add esp, 4
cmp ecx, ebp
je 0x4064cb
mov al, byte [ecx - 1]
test al, al
je 0x4064bf
cmp al, 0xff
je 0x4064bf
dec al
mov byte [ecx - 1], al
jmp 0x4064cb
add ecx, 0xfffffffe
push ecx
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov bl, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x407e70
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x430340
push ecx
mov dword [eax], 0
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x407f21
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push esi
call ebp
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
mov edi, eax
add esp, 0x10
test edi, edi
je 0x407f17
cmp edi, 0xffffffff
je 0x407f17
push edi
call sub.MFC42u.DLL_operatornew
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407f17
push 0
push 0
push esi
call ebp
push esi
push edi
push 1
push ebx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
cmp eax, edi
je 0x407efe
push ebx
call sub.MFC42u.DLL_operatordelete
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov edx, dword [esp + 0x18]
add esp, 4
mov eax, edi
pop edi
pop esi
mov dword [edx], ebx
pop ebp
pop ebx
ret 8
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x40f270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x40f27b
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40f28a
xor al, al
ret
shr al, 4
and al, 1
ret

Function at 0x40f290
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x40f29b
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40f2aa
xor al, al
ret
not al
shr al, 4
and al, 1
ret

Function at 0x40f2c0
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40f311
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40f311
mov bl, byte [esp + 0x18]
test bl, bl
je 0x40f2f8
push esi
call fcn.0040f290
add esp, 4
test al, al
je 0x40f2f8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40f311
xor eax, eax
test bl, bl
sete al
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
pop edi
pop esi
setne al
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x40f320
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40f348
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40f348
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40f348
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x40f350
Capabilities:
Move file
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40f3b0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40f3b0
push edi
call fcn.0040f290
add esp, 4
test al, al
je 0x40f3b0
mov bl, byte [esp + 0x18]
test bl, bl
je 0x40f395
push esi
call fcn.0040f290
add esp, 4
test al, al
je 0x40f395
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40f3b0
xor eax, eax
test bl, bl
setne al
or al, 0xa
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
pop edi
pop esi
setne al
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x40f3f0
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
je 0x40f421
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40f421
push esi
call fcn.0040f270
add esp, 4
test al, al
je 0x40f421
push 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
pop edi
pop esi
setne al
ret
pop edi
xor al, al
pop esi
ret
Function at 0x40f430
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
je 0x40f4b7
push esi
call fcn.0040f290
add esp, 4
test al, al
je 0x40f457
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40f4b7
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f4b7
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ecx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40f4b0
cmp dword [esp + 0xc], edi
jne 0x40f4b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
pop edi
pop esi
setne al
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
ret
Function at 0x410080
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x411740
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x60
push ebx
push ebp
push esi
mov ebx, ecx
push edi
push 0x40
lea ecx, [esp + 0x34]
push eax
push ecx
mov ecx, ebx
call fcn.00411a30
push 0x40
lea edx, [esp + 0x34]
push 0x428054
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, ebx
call fcn.004119e0
mov al, byte [esp + 0x80]
test al, al
jne 0x4117e2
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x80], 0x10
mov ecx, 8
lea esi, [esp + 0x50]
lea edi, [esp + 0x10]
push ebp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x54]
push ecx
mov ecx, ebx
call fcn.00411910
lea edx, [esp + 0x30]
push 0x20
lea eax, [esp + 0x54]
push edx
push eax
mov ecx, ebx
call fcn.0041f250
mov eax, dword [esp + 0x80]
add ebp, 0x30
mov ecx, 8
lea esi, [esp + 0x10]
lea edi, [esp + 0x30]
dec eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x80], eax
jne 0x41178e
jmp 0x411849
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x80], 0x10
lea ebp, [ecx + 0x2d0]
mov ecx, 8
lea esi, [esp + 0x30]
lea edi, [esp + 0x10]
lea edx, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
push ebp
push edx
mov ecx, ebx
call fcn.00411910
lea eax, [esp + 0x50]
push 0x20
lea ecx, [esp + 0x34]
push eax
push ecx
mov ecx, ebx
call fcn.0041f250
mov eax, dword [esp + 0x80]
sub ebp, 0x30
mov ecx, 8
lea esi, [esp + 0x10]
lea edi, [esp + 0x50]
dec eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x80], eax
jne 0x4117f7
push 0x40
lea edx, [esp + 0x34]
push 0x428094
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, ebx
call fcn.004119e0
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x30]
push 0x40
push ecx
push edx
mov ecx, ebx
call fcn.0041f2e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 0x10

Function at 0x411880
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
push 0x40
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, edi
call fcn.00411a30
push 0x38
lea edx, [esp + 0x10]
push 0x428124
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, edi
call fcn.004119e0
mov ebx, dword [esp + 0x50]
xor esi, esi
movsx ecx, byte [esi + 0x42818c]
push ecx
lea edx, [esp + 0x10]
push 0x1c
push edx
mov ecx, edi
call fcn.0041f280
movsx eax, byte [esi + 0x42818c]
push eax
lea ecx, [esp + 0x2c]
push 0x1c
push ecx
mov ecx, edi
call fcn.0041f280
push 0x30
lea edx, [esp + 0x10]
push 0x42815c
push edx
push ebx
mov ecx, edi
call fcn.004119e0
inc esi
add ebx, 0x30
cmp esi, 0x10
jl 0x4118b9
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x411910
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x30
lea eax, [esp]
push esi
push edi
mov edi, dword [esp + 0x3c]
push 0x30
push 0x4280d4
push edi
mov esi, ecx
push eax
call fcn.004119e0
mov ecx, dword [esp + 0x40]
push 0x30
lea edx, [esp + 0xc]
push ecx
push edx
mov ecx, esi
call fcn.0041f250
lea eax, [esp + 8]
mov ecx, esi
push eax
push edi
call fcn.00411970
push 0x20
push 0x428104
push edi
push edi
mov ecx, esi
call fcn.004119e0
pop edi
pop esi
add esp, 0x30
ret 8

Function at 0x412720
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x28
xor ecx, ecx
xor eax, eax
movsx edx, byte [eax + 0x430bdc]
dec edx
cmp edx, ecx
je 0x41273b
inc eax
cmp eax, 0x20
jl 0x412727
jmp 0x41273f
mov byte [esp + ecx + 8], al
inc ecx
cmp ecx, 0x20
jl 0x412725
push ebx
push ebp
lea eax, [esp + 0x10]
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x10]
xor edx, edx
shl ebx, 6
mov eax, edx
mov ecx, edx
sar eax, 1
and ecx, 1
and eax, 0xf
shl ecx, 4
or eax, ecx
mov ecx, edx
and ecx, 0x20
xor edi, edi
or eax, ecx
xor esi, esi
movsx ebp, byte [ebx + eax + 0x4309dc]
mov eax, 8
mov ecx, esi
sar eax, cl
test ebp, eax
je 0x4127aa
mov ecx, dword [esp + 0x14]
mov al, byte [ecx + esi]
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or edi, eax
inc esi
cmp esi, 4
jl 0x412786
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
lea ecx, [ecx + eax*8]
mov eax, dword [esp + 0x3c]
shl ecx, 6
add ecx, edx
inc edx
cmp edx, 0x40
mov dword [eax + ecx*4 + 0x180], edi
jl 0x412762
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
inc eax
add edx, 4
cmp eax, 8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jl 0x412759
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8

Function at 0x4128d0
Capabilities:
Encrypt data using des

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
mov esi, ecx
push edi
call fcn.00412720
push 1
push edi
mov ecx, esi
call fcn.00412720
push 2
push edi
mov ecx, esi
call fcn.00412720
lea eax, [edi + 0x1980]
push 0x4308e4
push eax
mov ecx, esi
call fcn.00412690
add edi, 0x2180
push 0x430924
push edi
mov ecx, esi
call fcn.00412690
pop edi
xor eax, eax
pop esi
ret 4
Function at 0x4141c0
Capabilities:
Timestomp file
Write file on windows

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x2c]
push edi
push esi
push eax
call fcn.00414ea0
add esp, 8
test al, al
je 0x414270
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x414270
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x24]
push 0
push eax
push 2
push 0
push 0
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x414270
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x30]
push 0
push edx
push edi
push eax
push esi
mov dword [esp + 0x44], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x414269
cmp dword [esp + 0x30], edi
jne 0x414269
lea ecx, [esp + 8]
lea edx, [esp + 8]
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
push esi
je 0x41426a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
add esp, 0x18
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 0x18
ret

Function at 0x414280
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x28]
push edi
push eax
call fcn.00414ea0
add esp, 8
test al, al
jne 0x4142a1
pop edi
pop esi
add esp, 0x18
ret
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x4142bd
pop edi
xor al, al
pop esi
add esp, 0x18
ret
mov esi, dword [esp + 0x24]
push esi
call fcn.0040f270
add esp, 4
test al, al
jne 0x4142e1
push esi
call fcn.0040fc10
add esp, 4
test al, al
jne 0x4142e1
pop edi
pop esi
add esp, 0x18
ret
mov eax, dword [edi + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
pop edi
pop esi
setne al
add esp, 0x18
ret
Function at 0x414fd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x415013
mov eax, dword [esp + 8]
test eax, eax
je 0x415013
push esi
lea esi, [ecx + eax]
mov eax, dword [esp + 0x10]
cmp ecx, esi
not eax
jae 0x41500f
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x428564]
xor eax, edx
inc ecx
cmp ecx, esi
jb 0x414fef
pop ebx
not eax
pop esi
ret
xor eax, eax
ret

Function at 0x415060
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x190
test eax, eax
je 0x41507f
push 1
push eax
mov ecx, 0x432510
call fcn.00415ed0
test al, al
je 0x4150b3
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4150b3
mov ax, word [esp]
cmp al, 2
jne 0x4150ad
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x4150ad
mov al, 1
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
add esp, 0x190
ret

Function at 0x415930
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4269b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov byte [esi + 8], al
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov cl, byte [esp + 7]
mov dword [esp + 0x14], eax
mov byte [esi + 0x18], cl
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dl, byte [esp + 7]
mov dword [esi + 0x30], eax
mov byte [esi + 0x2c], dl
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov cl, byte [esp + 7]
mov dword [esi + 0x40], eax
mov byte [esi + 0x3c], cl
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dl, byte [esp + 7]
mov dword [esi + 0x50], eax
mov byte [esi + 0x4c], dl
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 4
call fcn.00416200
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 5
call fcn.00416530
lea ecx, [esi + 0x84]
mov byte [esp + 0x14], 6
call fcn.00417130
mov ecx, esi
mov byte [esp + 0x14], 7
mov dword [esi], 0x42896c
call fcn.00415b70
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x415de0
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esp + 4]
push edi
test edx, edx
je 0x415e87
mov eax, dword [esp + 0xc]
test eax, eax
je 0x415e87
mov edi, dword [esp + 0x10]
test edi, edi
je 0x415e87
push esi
lea esi, [edx + eax]
xor eax, eax
cmp edx, esi
jae 0x415e84
cmp eax, edi
jae 0x415e84
mov cl, byte [edx]
inc edx
cmp cl, 0x1f
jle 0x415e84
cmp cl, 0x7f
jge 0x415e84
cmp cl, 0x28
je 0x415e84
cmp cl, 0x29
je 0x415e84
cmp cl, 0x3c
je 0x415e84
cmp cl, 0x3e
je 0x415e84
cmp cl, 0x40
je 0x415e84
cmp cl, 0x2c
je 0x415e84
cmp cl, 0x3b
je 0x415e84
cmp cl, 0x3a
je 0x415e84
cmp cl, 0x5c
je 0x415e84
cmp cl, 0x22
je 0x415e84
cmp cl, 0x2f
je 0x415e84
cmp cl, 0x5b
je 0x415e84
cmp cl, 0x5d
je 0x415e84
cmp cl, 0x3f
je 0x415e84
cmp cl, 0x3d
je 0x415e84
cmp cl, 0x7b
je 0x415e84
cmp cl, 0x7d
je 0x415e84
cmp cl, 0x20
je 0x415e84
cmp cl, 9
je 0x415e84
inc eax
cmp edx, esi
jb 0x415e0f
pop esi
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x41efb0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x60
push ebx
push ebp
push esi
mov ebx, ecx
push edi
push 0x40
lea ecx, [esp + 0x34]
push eax
push ecx
mov ecx, ebx
call fcn.00411a30
push 0x40
lea edx, [esp + 0x34]
push 0x428acc
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, ebx
call fcn.004119e0
mov al, byte [esp + 0x80]
test al, al
jne 0x41f052
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x80], 0x10
mov ecx, 8
lea esi, [esp + 0x50]
lea edi, [esp + 0x10]
push ebp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x54]
push ecx
mov ecx, ebx
call fcn.0041f180
lea edx, [esp + 0x30]
push 0x20
lea eax, [esp + 0x54]
push edx
push eax
mov ecx, ebx
call fcn.0041f250
mov eax, dword [esp + 0x80]
add ebp, 0x30
mov ecx, 8
lea esi, [esp + 0x10]
lea edi, [esp + 0x30]
dec eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x80], eax
jne 0x41effe
jmp 0x41f0b9
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x80], 0x10
lea ebp, [ecx + 0x2d0]
mov ecx, 8
lea esi, [esp + 0x30]
lea edi, [esp + 0x10]
lea edx, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
push ebp
push edx
mov ecx, ebx
call fcn.0041f180
lea eax, [esp + 0x50]
push 0x20
lea ecx, [esp + 0x34]
push eax
push ecx
mov ecx, ebx
call fcn.0041f250
mov eax, dword [esp + 0x80]
sub ebp, 0x30
mov ecx, 8
lea esi, [esp + 0x10]
lea edi, [esp + 0x50]
dec eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x80], eax
jne 0x41f067
push 0x40
lea edx, [esp + 0x34]
push 0x428b0c
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, ebx
call fcn.004119e0
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x30]
push 0x40
push ecx
push edx
mov ecx, ebx
call fcn.0041f2e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 0x10
Function at 0x41f0f0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
push 0x40
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, edi
call fcn.00411a30
push 0x38
lea edx, [esp + 0x10]
push 0x428b9c
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, edi
call fcn.004119e0
mov ebx, dword [esp + 0x50]
xor esi, esi
movsx ecx, byte [esi + 0x428c04]
push ecx
lea edx, [esp + 0x10]
push 0x1c
push edx
mov ecx, edi
call fcn.0041f280
movsx eax, byte [esi + 0x428c04]
push eax
lea ecx, [esp + 0x2c]
push 0x1c
push ecx
mov ecx, edi
call fcn.0041f280
push 0x30
lea edx, [esp + 0x10]
push 0x428bd4
push edx
push ebx
mov ecx, edi
call fcn.004119e0
inc esi
add ebx, 0x30
cmp esi, 0x10
jl 0x41f129
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x41f180
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0x30
lea eax, [esp]
push esi
push edi
mov edi, dword [esp + 0x3c]
push 0x30
push 0x428b4c
push edi
mov esi, ecx
push eax
call fcn.004119e0
mov ecx, dword [esp + 0x40]
push 0x30
lea edx, [esp + 0xc]
push ecx
push edx
mov ecx, esi
call fcn.0041f250
lea eax, [esp + 8]
mov ecx, esi
push eax
push edi
call fcn.0041f1e0
push 0x20
push 0x428b7c
push edi
push edi
mov ecx, esi
call fcn.004119e0
pop edi
pop esi
add esp, 0x30
ret 8

Function at 0x41f250
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x41f272
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x41f264
pop ebx
pop esi
ret 0xc