joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445993
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1f8
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x58], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x4459c0
push 0x64
lea ecx, [ebp - 0x8c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4459c7
mov byte [ebp - 0x8c], 0
push ebx
mov ebx, dword [ebp + 0x74]
push esi
mov esi, dword [ebx + 0x46c]
push edi
push 0x1f
mov byte [ebp - 0x28], 0
xor eax, eax
pop ecx
lea edi, [ebp - 0x27]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jmp 0x445a05
cmp byte [esi + 0x11], 0
je 0x445a02
mov eax, dword [esi]
push dword [eax]
lea ecx, [ebp - 0x28]
push 0x4545e0
push 0x7d
pop eax
call fcn.0040a406
pop ecx
pop ecx
mov esi, dword [esi + 0x14]
test esi, esi
jne 0x4459e6
cmp byte [ebp - 0x28], 0
je 0x445a44
lea eax, [ebp - 0x28]
push eax
call sub.MSVCR71.dll_strlen
pop ecx
mov ecx, eax
cmp ecx, 0x7b
jbe 0x445a38
mov eax, 0x80
sub eax, ecx
push 0x4564f8
lea edi, [ebp + ecx - 0x28]
call fcn.00438a10
pop ecx
jmp 0x445a44
lea eax, [ebp + ecx - 0x29]
cmp byte [eax], 0x20
jne 0x445a44
mov byte [eax], 0
mov eax, dword [0x45c5c8]
xor ecx, ecx
inc ecx
cmp byte [eax + 0xce], 0
je 0x445a63
cmp byte [ebx + 0x4ad], 0
jne 0x445a63
mov dword [ebp + 0x5c], ecx
jmp 0x445a67
and dword [ebp + 0x5c], 0
mov eax, dword [0x45db30]
cmp eax, ecx
mov dword [ebp + 0x60], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
jg 0x445b51
and dword [ebp + 0x64], 0
mov dword [ebp + 0x60], 0x45282f
cmp dword [0x45db04], 0
mov edi, 0x453ca4
mov eax, 0x453ca8
mov dword [ebp + 0x68], edi
je 0x445a9f
mov dword [ebp + 0x68], eax
cmp dword [0x45db00], 0
je 0x445aaa
mov edi, eax
push ecx
call fcn.00411f94
lea esi, [ebp - 0x18c]
mov bl, al
call fcn.00412d7d
push eax
push dword [0x45db2c]
mov eax, dword [0x45db34]
push dword [0x45db30]
sub eax, dword [ebp + 0x5c]
mov esi, dword [ebp + 0x7c]
push eax
push dword [ebp + 0x60]
lea eax, [ebp - 0x28]
push dword [ebp + 0x64]
push eax
mov eax, dword [ebp + 0x74]
push dword [eax + 0x474]
push dword [eax + 0x478]
lea eax, [ebp - 0x8c]
push dword [ebp + 0x68]
push edi
mov edi, dword [ebp + 0x78]
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
call fcn.0040a3cc
mov esi, dword [ebp + 0x58]
add edi, eax
mov eax, esi
sub eax, edi
add eax, dword [ebp + 0x7c]
push eax
push edi
call fcn.0043db34
add esp, 0x40
push edi
call sub.MSVCR71.dll_strlen
add edi, eax
cmp dword [0x45e404], 0
pop ecx
mov eax, str._r_nPress__F5__to_refresh.
jne 0x445b39
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, edi
add esi, dword [ebp + 0x7c]
push eax
call fcn.0040a3cc
pop ecx
add eax, edi
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
dec eax
mov dword [ebp + 0x64], eax
jmp 0x445a86
Function at 0x445c2d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [0x45b0f8]
push ebx
push edi
mov byte [ebp - 0x13], al
lea edi, [ebp - 0x14]
mov eax, esi
mov byte [ebp - 0x14], 0x20
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 9
mov byte [ebp - 0x10], 0x3c
mov byte [ebp - 0xf], 0x3e
mov byte [ebp - 0xe], 0x3a
mov byte [ebp - 0xd], 0x3d
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x2a
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x21
mov byte [ebp - 7], 0x7e
mov byte [ebp - 6], 0x26
mov byte [ebp - 5], 0x7c
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0
call fcn.00438cc6
test eax, eax
je 0x445ca9
cmp byte [eax], 0x3d
jne 0x445ca2
cmp eax, esi
jbe 0x445cb4
lea ecx, [eax - 1]
cmp byte [ecx], 0x2e
jne 0x445ca2
mov eax, ecx
cmp eax, esi
jbe 0x445cb4
dec eax
jmp 0x445cb4
push esi
call sub.MSVCR71.dll_strlen
pop ecx
lea eax, [eax + esi - 1]
push esi
call fcn.00438c1f
mov ebx, eax
sub eax, esi
inc eax
cmp eax, 0xfd
pop ecx
jbe 0x445cdf
cmp byte [ebp + 0x10], 0
je 0x445cdb
mov ecx, dword [ebp + 8]
push esi
push str.This_line_does_not_contain_a_recognized_action.
call fcn.0044506b
xor eax, eax
jmp 0x445cec
mov edi, dword [ebp + 0xc]
inc eax
push esi
call fcn.00438a10
pop ecx
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc

Function at 0x448791
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8958
call fcn.0044ff40
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 8]
test esi, esi
je 0x448815
lea eax, [ebp - 0x8958]
call fcn.0043ac12
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x8114], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x8110], eax
lea eax, [ebp - 0x8958]
push eax
push 0x448dbf
mov dword [ebp - 0x8118], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8128], 0
je 0x448815
mov eax, dword [0x45b170]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x448815
cmp eax, 0x19
jge 0x44880b
cmp byte [0x460211], 0
je 0x44880b
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x448815
push 1
push eax
call fcn.0040d9dd
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 0xc
Function at 0x448c7b
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8958
call fcn.0044ff40
push ebx
push edi
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 8], edi
je 0x448db6
xor cl, cl
mov eax, ebx
call fcn.00448faf
test eax, eax
je 0x448db9
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x45b170]
mov esi, eax
push esi
mov ecx, ebx
call fcn.00448a10
test eax, eax
je 0x448ccb
mov dword [0x45fb14], edi
jmp 0x448cd1
mov edi, dword [0x45fb14]
lea eax, [ebp - 0x8958]
call fcn.0043ac12
cmp byte [ebp + 8], 0
je 0x448ced
test edi, edi
mov byte [ebp - 0x8130], 0
je 0x448cf4
mov byte [ebp - 0x8130], 1
mov eax, dword [0x45fb10]
mov dword [ebp - 0x8120], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x8118], eax
lea eax, [ebp - 0x8958]
push eax
push 0x448eb6
mov dword [ebp - 0x811c], edi
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x8128]
test eax, eax
je 0x448d8d
call fcn.0043bb7d
mov edi, eax
test edi, edi
je 0x448d46
mov esi, dword [ebp - 0x8128]
call fcn.00448f83
mov dword [ebp - 0x8128], edi
push dword [ebp - 0x8128]
call fcn.0043b4d8
mov esi, dword [ebp - 0x8128]
pop ecx
call fcn.00448f83
mov eax, dword [0x45b170]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x448db5
cmp eax, 0x19
jge 0x448d81
cmp byte [0x460211], 0
je 0x448d81
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x448db5
push 1
push eax
call fcn.0040d9dd
pop ecx
pop ecx
jmp 0x448db5
mov eax, dword [0x45fb14]
test eax, eax
je 0x448db5
cmp eax, 1
setg al
and dword [0x45fb14], 0
test al, al
je 0x448db5
call fcn.00448f83
push 0
mov ecx, ebx
call fcn.00448c7b
pop esi
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4

Function at 0x449097
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x45f45c], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x45c920
jne 0x4490b7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00415930
pop ecx
mov dword [0x45c268], 0x270
mov dword [0x45c918], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x4490d6
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44910c
mov edx, dword [0x45c920]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x449166
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [edi + 0x494]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
mov byte [edi + 0x50], 1
mov byte [edi + 0x4ad], bl
mov byte [edi + 0x4ac], bl
je 0x449288
cmp byte [eax], bl
je 0x449288
push 0x10
pop eax
call fcn.004474b9
cmp eax, ebx
je 0x4491b2
mov dword [eax], 0x45282f
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x4491b4
xor eax, eax
cmp eax, ebx
mov dword [edi + 0x240], eax
je 0x449288
mov ecx, dword [edi + 0x494]
push edi
call fcn.00440d31
cmp eax, 1
jne 0x449288
push ebx
push ebx
push ebx
push 0x67
push edi
call fcn.00444071
test eax, eax
je 0x449288
push ebx
push ebx
push dword [edi]
mov ecx, edi
call fcn.00446b4b
test eax, eax
je 0x449288
push dword [0x45e3fc]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
inc dword [edi + 0x4c]
push ebx
push ebx
push ebx
push 0x67
push edi
call fcn.00444071
test eax, eax
je 0x449288
push ebx
push ebx
push ebx
push 0x67
push edi
call fcn.00444071
test eax, eax
je 0x449288
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0x240]
push ebx
push ebx
push ebx
push ebx
mov dword [eax + 4], ecx
push ebx
push dword [edi]
mov ecx, edi
call fcn.00446f12
test eax, eax
je 0x449288
push ebx
push ebx
push ebx
push edi
mov esi, str.ErrorLevel
call fcn.0040bcf1
cmp eax, ebx
mov dword [0x45e2f0], eax
je 0x449288
push 1
push ebx
push 0xffffffffffffffff
push 0x452954
mov ecx, eax
call fcn.0040161c
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 8]
call fcn.00415930
mov eax, dword [edi + 8]
pop ecx
jmp 0x44928b
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x449439
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x540]
call fcn.00449ac8
lea eax, [ebp - 0x13c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x13c]
push 0x45b050
push eax
call sub.MSVCR71.dll_fopen
pop ecx
mov dword [esi], eax
test eax, eax
pop ecx
jne 0x449487
push 1
pop eax
jmp 0x449617
xor eax, eax
mov cl, byte [eax + 0x45b048]
mov byte [ebp + eax - 0x24], cl
mov cl, byte [eax + 0x45b040]
mov byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 8
jl 0x449489
mov edi, dword [ebp + 0xc]
push edi
call sub.MSVCR71.dll_strlen
and dword [esi + 0x110], 0
pop ecx
lea ecx, [esi + 0x110]
xor edx, edx
test eax, eax
jle 0x4494cb
movsx ebx, byte [edx + edi]
add dword [ecx], ebx
inc edx
cmp edx, eax
jl 0x4494c0
push 2
push 0xfffffffffffffff8
push dword [esi]
call sub.MSVCR71.dll_fseek
push dword [esi]
lea edi, [esi + 4]
push 1
pop ebx
push ebx
push 4
push edi
call sub.MSVCR71.dll_fread
push dword [esi]
call sub.MSVCR71.dll_ftell
push dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
push 0
push 0
push dword [esi]
call sub.MSVCR71.dll_fseek
and dword [ebp + 0xc], 0
add esp, 0x3c
cmp dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
jle 0x44954a
mov ecx, dword [esi]
test byte [ecx + 0xc], 0x10
jne 0x44954a
push ecx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call sub.MSVCR71.dll_fread
add esp, 0x10
lea ecx, [ebp - 0x540]
push dword [ebp - 0x14]
call fcn.00449b07
inc dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jl 0x44951a
xor eax, 0xaaaaaaaa
cmp dword [ebp - 0x10], eax
jne 0x44958b
push 0
push dword [edi]
push dword [esi]
call sub.MSVCR71.dll_fseek
push dword [esi]
lea eax, [ebp - 0x34]
push ebx
push 0x10
push eax
call sub.MSVCR71.dll_fread
add esp, 0x1c
test eax, eax
je 0x44958b
xor eax, eax
mov cl, byte [ebp + eax - 0x34]
cmp cl, byte [ebp + eax - 0x24]
jne 0x449586
inc eax
cmp eax, 0x10
jl 0x449576
cmp eax, 0x10
je 0x44958f
push 3
jmp 0x4495a7
push dword [esi]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call sub.MSVCR71.dll_fread
add esp, 0x10
cmp byte [ebp - 1], 3
je 0x4495b4
push 4
pop edi
push dword [esi]
call sub.MSVCR71.dll_fclose
pop ecx
mov eax, edi
jmp 0x449617
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xfac1
lea ebx, [esi + 0xc]
push edi
push 1
push ebx
call sub.MSVCR71.dll_fread
add esp, 0x20
lea eax, [edi + 0xc3d2]
mov ecx, esi
push eax
push edi
push ebx
call fcn.0044962c
and byte [edi + esi + 0xc], 0
lea eax, [esi + 0x110]
xor ecx, ecx
cmp edi, ecx
mov dword [eax], ecx
jle 0x44960a
movsx edx, byte [ebx + ecx]
add dword [eax], edx
inc ecx
cmp ecx, edi
jl 0x4495ff
push dword [esi]
call sub.MSVCR71.dll_ftell
mov dword [esi + 8], eax
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x44962c
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.00415930
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x449656
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.0041584e
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x449640
pop esi
pop edi
ret 0xc

Function at 0x44965a
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x290]
call fcn.00449b30
push 0
push dword [esi + 8]
push dword [esi]
call sub.MSVCR71.dll_fseek
add esp, 0xc
lea eax, [ebp - 0x398]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0044993c
test eax, eax
je 0x44969e
push 6
jmp 0x44972d
push dword [esi]
lea eax, [ebp - 1]
push 1
pop ebx
push ebx
push ebx
push eax
call sub.MSVCR71.dll_fread
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
push dword [esi]
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
xor edi, 0x45aa
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
mov eax, dword [ebp - 8]
push dword [esi]
xor eax, 0x45aa
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x14]
push 4
push eax
call sub.MSVCR71.dll_fread
add esp, 0x40
lea eax, [ebp - 0x18]
push dword [esi]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
push dword [esi]
lea eax, [ebp - 0x1c]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
push dword [esi]
lea eax, [ebp - 0x20]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
push dword [ebp - 0xc]
call sub.MSVCR71.dll_malloc
add esp, 0x34
mov dword [ebp + 8], eax
test eax, eax
jne 0x449733
push 8
pop eax
jmp 0x44980a
push edi
call sub.MSVCR71.dll_malloc
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x449749
push 8
pop esi
jmp 0x4497ff
push dword [esi]
push ebx
push edi
push eax
call sub.MSVCR71.dll_fread
mov eax, dword [esi + 0x110]
add esp, 0x10
add eax, 0x22af
mov ecx, esi
push eax
push edi
mov edi, dword [ebp - 0x10]
push edi
call fcn.0044962c
cmp byte [ebp - 1], bl
jne 0x4497ad
lea ecx, [ebp - 0x290]
call fcn.00449b30
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x290], eax
call fcn.00449b5c
push edi
call sub.MSVCR71.dll_free
pop ecx
jmp 0x4497b9
push dword [ebp + 8]
call sub.MSVCR71.dll_free
pop ecx
mov dword [ebp + 8], edi
push 0x45b054
push dword [ebp + 0xc]
call sub.MSVCR71.dll_fopen
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x4497d5
push 7
jmp 0x449743
push edi
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.MSVCR71.dll_fwrite
push edi
call sub.MSVCR71.dll_fclose
add esp, 0x14
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.00449a88
xor esi, esi
push dword [ebp + 8]
call sub.MSVCR71.dll_free
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x449811
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
push esi
mov esi, ecx
lea ecx, [ebp - 0x278]
call fcn.00449b30
push 0
push dword [esi + 8]
push dword [esi]
call sub.MSVCR71.dll_fseek
add esp, 0xc
lea eax, [ebp - 0x380]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.0044993c
test eax, eax
je 0x449854
push 6
pop eax
jmp 0x449937
push ebx
push edi
push dword [esi]
lea eax, [ebp - 1]
push 1
pop ebx
push ebx
push ebx
push eax
call sub.MSVCR71.dll_fread
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
push dword [esi]
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
xor edi, 0x45aa
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
xor eax, 0x45aa
push ebx
push 0x10
mov dword [ecx], eax
push dword [esi]
call sub.MSVCR71.dll_fseek
mov eax, dword [ebp + 0x10]
push dword [eax]
call sub.MSVCR71.dll_malloc
add esp, 0x40
mov dword [ebp + 0x10], eax
push edi
call sub.MSVCR71.dll_malloc
push dword [esi]
mov dword [ebp + 8], eax
push ebx
push edi
push eax
call sub.MSVCR71.dll_fread
mov eax, dword [esi + 0x110]
add esp, 0x14
add eax, 0x22af
mov ecx, esi
push eax
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0044962c
cmp byte [ebp - 1], bl
jne 0x44991f
lea ecx, [ebp - 0x278]
call fcn.00449b30
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x278], eax
call fcn.00449b5c
push edi
call sub.MSVCR71.dll_free
pop ecx
jmp 0x44992b
push dword [ebp + 0x10]
call sub.MSVCR71.dll_free
pop ecx
mov dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
pop edi
pop ebx
mov dword [eax], ecx
xor eax, eax
pop esi
leave
ret 0xc
Function at 0x44993c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
mov byte [ebp - 1], bl
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push ebx
push eax
call sub.MSVCR71.dll_fread
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push 0x16fa
push 4
push eax
call fcn.0044962c
and byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push str.FILE
push eax
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x449a6d
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29bc
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
call sub.MSVCR71.dll_fread
add esp, 0x20
lea eax, [edi + 0xa25e]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.0044962c
push dword [esi]
and byte [ebp + edi - 0x11c], 0
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29ac
push edi
push ebx
push dword [ebp + 0xc]
call sub.MSVCR71.dll_fread
add esp, 0x20
lea eax, [edi + 0xf25e]
mov ecx, esi
push eax
push edi
push dword [ebp + 0xc]
call fcn.0044962c
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and byte [edi + eax], 0
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x449a84
push ebx
push ebx
push dword [esi]
call sub.MSVCR71.dll_fseek
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call sub.MSVCR71.dll_fread
xor dword [ebp - 8], 0x45aa
push ebx
push 4
push dword [esi]
call sub.MSVCR71.dll_fseek
push ebx
push 0x10
push dword [esi]
call sub.MSVCR71.dll_fseek
push ebx
push dword [ebp - 8]
push dword [esi]
call sub.MSVCR71.dll_fseek
add esp, 0x40
jmp 0x449a71
and byte [ebp - 1], 0
cmp byte [ebp - 1], bl
je 0x449950
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x449a7d

Function at 0x449ac8
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x449af1
add edx, edx
xor edx, 0x4c11db7
jmp 0x449af3
shl edx, 1
dec ecx
jne 0x449adf
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x449ad7
pop edi
pop esi
ret

Function at 0x449c7b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x449ca0
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call sub.MSVCR71.dll_memcpy
add esp, 0xc
jmp 0x449cb3
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call sub.MSVCR71.dll_fread
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push str.JB01
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call sub.MSVCR71.dll_strcmp
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4
Function at 0x44aa9d
Capabilities:
Parse credit card information

Disassembly:
jmp 0x44ab00
cmp ecx, 0x4f
jne 0x44aaae
xor ecx, ecx
mov ch, byte [eax + 1]
mov cl, byte [eax + 2]
jmp 0x44aafe
cmp ecx, 0x5e
jne 0x44aaca
xor ecx, ecx
mov ch, byte [eax + 3]
mov cl, byte [eax + 4]
cmp ecx, dword [esp + 4]
je 0x44ab09
movzx ecx, byte [0x452386]
jmp 0x44aafe
cmp ecx, 0x38
jl 0x44aaf7
cmp ecx, 0x3d
jle 0x44aae8
cmp ecx, 0x40
jle 0x44aae3
cmp ecx, 0x43
jle 0x44aae8
cmp ecx, 0x44
jne 0x44aaf7
mov dl, byte [eax + 3]
jmp 0x44aaeb
mov dl, byte [eax + 1]
cmp dl, 0xf
je 0x44aaf5
cmp dl, 0xe
jne 0x44aaf7
inc eax
inc eax
movzx ecx, byte [ecx + 0x452328]
add eax, ecx
movzx ecx, byte [eax]
test ecx, ecx
jne 0x44aa9f
xor eax, eax
ret
Function at 0x40bb00
Capabilities:
Create thread

Disassembly:
lea eax, [esi + 0x3c]
xor ecx, ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
lea edx, [esi + 0x10]
push edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
push 4
mov dword [eax + 0x18], ecx
push eax
mov dword [eax + 0x1c], ecx
push 0x42a930
mov byte [esi + 0x5b], cl
push 0
lea ecx, [esi + 0x14]
push 0
mov byte [esi + 0x59], 1
mov dword [eax], ecx
mov dword [esi + 0x5c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xc], eax
je 0x40bb68
mov edx, dword [esi]
mov edx, dword [edx + 0x74]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x5c]
push eax
mov ecx, esi
call edx
ret

Function at 0x41b750
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x506f29
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x54b708]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebx, ebx
lea ebp, [esi + 4]
mov dword [esp + 0x1c], ebx
mov dword [ebp], vtable.s::thread::IPoolable.0
mov dword [esi], vtable.s::map::Map.0
mov dword [ebp], vtable.s::map::Map.1.0
lea eax, [esi + 0x18]
push eax
mov dword [esi + 8], vtable.s::thread::ObjLocker.0
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edi, [esi + 0x30]
push 2
mov eax, edi
call fcn.00408e60
mov dword [edi], vtable.s::col::_array::ArrayP.0
mov dword [edi + 4], vtable.s::col::_array::ArrayP.1.0
mov dword [edi + 8], vtable.s::col::_array::ArrayP.2.0
mov dword [edi + 0xc], vtable.s::col::_array::ArrayP.3.0
mov dword [edi + 0x10], vtable.s::col::_array::ArrayP.4.0
mov dword [edi + 0x14], vtable.s::col::_array::ArrayP.5.0
mov dword [edi + 0x2c], ebx
mov byte [esp + 0x1c], 3
mov edx, dword [ebp]
mov eax, dword [edx + 8]
mov ecx, ebp
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
call eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov byte [esi + 0x68], bl
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc