joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ca10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x43cac2
cmp dword [esi + 4], 0xffffffff
jne 0x43cac2
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ca41
sub ecx, edx
sar ecx, 1
movzx eax, word [esi + ecx*2 + 0x242]
cmp eax, 0x5c
je 0x43ca78
cmp eax, 0x2f
je 0x43ca78
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x43ca65
mov eax, dword [0x70fec0]
mov dword [edi], eax
push 0x20
call fcn.004ce575
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x18], ecx
mov ecx, eax
mov word [eax], 0x100
mov byte [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.0043b9b0
xor ecx, ecx
mov dword [esi], eax
test eax, eax
mov edx, 0x200
pop edi
cmove ecx, edx
mov eax, ecx
pop esi
pop ebp
ret 0xc
mov eax, 0x1000000
pop esi
pop ebp
ret 0xc
Function at 0x43f070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x43f278
cmp dword [esi + 0x6af90], 3
jb 0x43f0e8
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x43f125
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x43f125
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x43f10f
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.0043ed30
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, esi
cmp edi, 3
jb 0x43f1f8
mov edx, dword [esi + 0x6af84]
lea eax, [edi - 3]
sub edx, dword [esi + 0x6af88]
push eax
call fcn.0043e520
sub dword [esi + 0x6af90], edi
add esp, 4
mov dword [ebp - 4], eax
cmp edi, dword [esi + 0x6af98]
ja 0x43f1bf
cmp dword [esi + 0x6af90], 3
jb 0x43f1bf
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x43f163
mov eax, dword [ebp - 4]
jmp 0x43f217
add dword [esi + 0x6af84], edi
xor edi, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x43f21d
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.0043e520
add esp, 4
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
test eax, eax
je 0x43f258
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x43f235
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x43f237
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.0043e370
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x43f26b
mov ecx, esi
call fcn.0043ef10
cmp dword [esi + 0x6af90], 0
jne 0x43f093
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x43f28c
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x43f28e
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.0043e370
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43ff70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x43ff7b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x440037
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
sub edi, 1
jne 0x43ff90
pop edi
test esi, esi
je 0x44005a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x67e8a8]
sub esi, 1
jne 0x440040
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4402c0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x440398
mov eax, dword [esi + 0x3c]
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x4402f4
cmp dword [esi + 0x40], ebx
jae 0x4402f4
push eax
call fcn.004cea7d
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x44030c
lea eax, [ebx + ebx]
push eax
call fcn.004cec81
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push dword [esi + 0x3c]
call fcn.004e80a0
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x440395
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
shr ecx, 8
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, dword [esi + 0x30]
or edi, 2
movzx eax, al
mov eax, dword [eax*4 + 0x67e8a8]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x67e8a8]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x440322
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4403d6
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x4403bd
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call fcn.004e80a0
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x4403f8
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4405b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x440613
mov ecx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp ecx, ebx
jae 0x44065b
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call fcn.004e80a0
mov ecx, dword [edi + 0x78]
mov edx, esi
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
call fcn.0043ff70
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x440654
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x44065b
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.0043ff70
add esp, 4
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4445c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4445f1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4445e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x450c20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [edi], 0
cmp dword [0x725578], 0
je 0x450c77
mov eax, dword [0x728578]
test eax, eax
je 0x450c50
push eax
call dword [0x7255d0]
add esp, 4
lea edx, [ebp - 4]
mov ecx, 0x14
call fcn.0044e260
mov eax, dword [0x728578]
test eax, eax
je 0x450c72
push eax
call dword [0x7255d8]
mov esi, dword [ebp - 4]
jmp 0x450c81
mov esi, dword [ebp - 4]
jmp 0x450c84
push 0x14
call dword [0x7255a0]
mov esi, eax
add esp, 4
test esi, esi
jne 0x450c92
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x72557c], 0
mov ebx, dword [ebp + 8]
je 0x450cdc
mov eax, dword [0x725680]
test eax, eax
je 0x450cb5
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x450cdc
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x450bf0
push 0
push 0
mov dword [esi + 0xc], ebx
call fcn.004eba1c
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x450ce9
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x450d02
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4803c0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 8], esi
push edi
mov esi, dword [esi]
mov dword [ebp - 4], esi
test edx, edx
je 0x4804ff
nop dword [eax]
mov ecx, dword [edx + 4]
movzx eax, byte [edx]
test ecx, 0x200
jne 0x4804fd
cmp eax, 0x25
je 0x4804f2
cmp eax, 0x9c
je 0x4804f2
cmp eax, 0x5e
je 0x480418
cmp eax, 0x9d
jne 0x48046f
cmp byte [edx + 0x26], 0x5e
jne 0x480489
mov eax, dword [ebp - 4]
push dword [edx + 8]
mov esi, dword [ebp - 8]
mov ecx, esi
push 0
mov dl, byte [eax + 0x42]
call fcn.004914b0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4804ff
cmp dword [ebx + 0xc], 0
jne 0x4804ff
mov eax, dword [esi]
mov ecx, esi
push dword [ebx]
push ebx
mov dl, byte [eax + 0x42]
call fcn.004914b0
add esp, 8
test eax, eax
jne 0x4804ff
mov ecx, 1
test ecx, ecx
cmove eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x9a
je 0x480489
cmp eax, 0x98
je 0x480489
cmp eax, 0x9d
je 0x480489
cmp eax, 0x3d
jne 0x480493
cmp dword [edx + 0x2c], 0
jne 0x48050f
test ecx, 0x100
je 0x4804fd
mov eax, dword [edx + 0xc]
test eax, eax
je 0x4804af
test dword [eax + 4], 0x100
je 0x4804af
mov edx, eax
jmp 0x4804f5
mov edi, dword [edx + 0x14]
mov ebx, dword [edx + 0x10]
test edi, edi
je 0x4804ee
test ecx, 0x800
jne 0x4804ee
mov esi, dword [edi]
xor ecx, ecx
test esi, esi
jle 0x4804ee
lea edx, [edi + 8]
nop dword [eax]
mov eax, dword [edx]
test dword [eax + 4], 0x100
jne 0x4804e7
inc ecx
add edx, 0x18
cmp ecx, esi
jl 0x4804d0
mov edx, ebx
jmp 0x4804f5
lea eax, [ecx + ecx*2]
mov ebx, dword [edi + eax*8 + 8]
mov edx, ebx
jmp 0x4804f5
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x4803e0
xor ebx, ebx
xor ecx, ecx
xor eax, eax
pop edi
test ecx, ecx
pop esi
cmove eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
movsx esi, word [edx + 0x20]
test esi, esi
js 0x4804fd
mov eax, dword [edx + 0x2c]
add esi, esi
mov edi, dword [ebp - 4]
mov ecx, edi
push 0
mov eax, dword [eax + 4]
mov dl, byte [edi + 0x42]
push dword [eax + esi*8 + 8]
call fcn.00491670
mov esi, dword [ebp - 8]
jmp 0x48042d
Function at 0x481e90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], edi
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 0
mov ebx, ecx
mov dword [esp + 0x18], eax
test edi, edi
je 0x481ffa
push 0
push 0x44
mov ecx, ebx
call fcn.0044ea10
mov esi, eax
add esp, 8
test esi, esi
je 0x481fef
push dword [ebp + 8]
mov edx, dword [edi]
mov ecx, ebx
call fcn.00481970
add esp, 4
mov dword [esi], eax
mov edx, dword [edi + 0x1c]
mov ecx, ebx
push dword [ebp + 8]
call fcn.00481b10
add esp, 4
mov dword [esi + 0x1c], eax
mov edx, dword [edi + 0x20]
mov ecx, ebx
push dword [ebp + 8]
call fcn.00481940
add esp, 4
mov dword [esi + 0x20], eax
mov edx, dword [edi + 0x24]
mov ecx, ebx
push dword [ebp + 8]
call fcn.00481970
add esp, 4
mov dword [esi + 0x24], eax
mov edx, dword [edi + 0x28]
mov ecx, ebx
push dword [ebp + 8]
call fcn.00481940
add esp, 4
mov dword [esi + 0x28], eax
mov edx, dword [edi + 0x2c]
mov ecx, ebx
push dword [ebp + 8]
call fcn.00481970
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [esi + 0x2c], eax
mov ecx, ebx
mov al, byte [edi + 4]
lea edi, [esi + 0x30]
mov byte [esi + 4], al
mov eax, dword [esp + 0x1c]
push dword [ebp + 8]
mov dword [esi + 0x34], eax
mov dword [edi], 0
mov edx, dword [edx + 0x38]
call fcn.00481940
mov dword [esi + 0x38], eax
add esp, 4
mov eax, dword [esp + 0x10]
mov ecx, ebx
push dword [ebp + 8]
mov edx, dword [eax + 0x3c]
call fcn.00481940
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ecx + 8]
and eax, 0xffffffdf
mov dword [esi + 8], eax
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x18], 0xffffffff
mov ax, word [ecx + 6]
mov word [esi + 6], ax
mov edx, dword [ecx + 0x40]
mov ecx, ebx
call fcn.00481800
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
mov dword [eax], esi
mov edi, dword [edi + 0x30]
mov dword [esp + 0x10], edi
test edi, edi
jne 0x481ec4
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48b2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
xor edi, edi
cmp dword [ecx + 0x14], edi
jle 0x48b33a
nop dword [eax + eax]
mov eax, edi
mov ecx, edi
xor eax, 1
cmp edi, 2
cmovl ecx, eax
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x48b386
mov bl, byte [esi]
mov edx, ecx
mov ecx, dword [ebp - 4]
add edx, edx
mov eax, esi
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*8]
movzx ecx, bl
movzx esi, byte [ecx + 0x680668]
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x680668]
sub esi, ecx
jne 0x48b32b
sub edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
test bl, bl
je 0x48b37c
movzx ecx, byte [edx + eax + 1]
inc eax
movzx edx, byte [ecx + 0x680668]
mov bl, byte [eax]
movzx ecx, bl
movzx esi, byte [ecx + 0x680668]
sub esi, edx
mov edx, dword [ebp - 0xc]
je 0x48b307
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
inc edi
mov esi, dword [ebp + 8]
cmp edi, dword [ecx + 0x14]
jl 0x48b2c0
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x680668]
sub eax, 0x73
jne 0x48b373
mov esi, str.sqlite_master
sub esi, ebx
test dl, dl
je 0x48b3aa
movzx eax, byte [esi + ebx + 1]
inc ebx
movzx ecx, byte [eax + 0x680668]
mov dl, byte [ebx]
movzx eax, dl
movzx eax, byte [eax + 0x680668]
sub eax, ecx
je 0x48b352
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x48b32b
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add ecx, ecx
push 0
mov edx, ebx
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.00452e90
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x48b375
jmp 0x48b32e
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + 0x10]
test esi, esi
jne 0x48b3c0
neg eax
sbb eax, eax
jmp 0x48b3d0
test eax, eax
je 0x48b373
mov edx, eax
mov ecx, esi
call fcn.004517f0
mov ecx, dword [ebp - 4]
test eax, eax
jne 0x48b373
mov ebx, str.sqlite_temp_master
mov dword [ebp - 8], ebx
jmp 0x48b2b4
Function at 0x48b5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 8], ebx
push edi
xor edi, edi
mov dword [ebp - 4], edx
cmp dword [ebx + 0x14], edx
jle 0x48b65e
push esi
mov eax, edi
mov ecx, edi
xor eax, 1
cmp edi, 2
cmovl ecx, eax
mov eax, dword [ebx + 0x10]
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
test edx, edx
je 0x48b63f
mov ebx, dword [eax + ecx*8]
mov esi, edx
mov al, byte [edx]
movzx ecx, byte [ebx]
movzx edx, byte [ecx + 0x680668]
movzx ecx, al
movzx ecx, byte [ecx + 0x680668]
sub ecx, edx
jne 0x48b623
sub ebx, esi
test al, al
je 0x48b638
movzx ecx, byte [ebx + esi + 1]
inc esi
movzx edx, byte [ecx + 0x680668]
mov al, byte [esi]
movzx ecx, al
movzx ecx, byte [ecx + 0x680668]
sub ecx, edx
je 0x48b602
mov edx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
inc edi
cmp edi, dword [ebx + 0x14]
jl 0x48b5c1
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
jne 0x48b623
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
add ecx, 0x18
push 0
call fcn.00452e90
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x48b62f
jmp 0x48b629
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a45c0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, edx
mov edx, dword [edi + 0x30]
test edx, edx
je 0x4a45e6
push esi
call fcn.004a45c0
add esp, 4
test eax, eax
je 0x4a45e8
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [edi]
cmp esi, dword [ecx]
jge 0x4a45e1
lea edx, [esi + esi*2]
mov edx, dword [ecx + edx*8 + 8]
mov ecx, ebx
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.004803c0
Function at 0x4c3f40
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c0e6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x72400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 1
xorps xmm0, xmm0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
movsd qword [edi + 0x10], xmm0
mov dword [edi + 0x2c], 0xf
mov dword [edi + 0x28], 0
cmp dword [edi + 0x2c], 0x10
jb 0x4c3fa0
mov eax, dword [edi + 0x18]
jmp 0x4c3fa3
lea eax, [edi + 0x18]
mov esi, dword [ebp + 8]
mov byte [eax], 0
cmp byte [esi], 0
jne 0x4c3fb2
xor ecx, ecx
jmp 0x4c3fc0
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c3fb7
sub ecx, ebx
push ecx
push esi
lea ecx, [edi + 0x18]
call fcn.00407f60
mov dword [ebp - 4], 0
mov byte [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea esi, [edi + 0x40]
mov byte [ebp - 4], 1
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00438080
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c52a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
sub esp, 0xc
mov edi, ecx
call fcn.0041be30
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 4], eax
lea esi, [edi + 8]
mov ecx, 1
nop dword [eax]
mov edx, eax
lea esi, [esi + 4]
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
inc ecx
mov dword [esi - 4], eax
cmp ecx, 0x270
jl 0x4c52c0
mov dword [edi], 0x270
mov eax, edi
pop edi
pop esi
ret
Function at 0x4c9560
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50db0b
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x72400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 9
call fcn.004c05d0
xor bl, bl
mov dword [ebp - 0x118], 0xf
add esp, 8
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x12c], bl
mov dword [ebp - 4], 0
call fcn.00438e60
test al, al
je 0x4c96fb
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004e7b30
add esp, 0xc
mov dword [ebp - 0x270], 0x104
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
je 0x4c9728
lea esi, [ebp - 0x114]
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4c9610
sub esi, ecx
lea eax, [esi + 2]
mov word [ebp + esi - 0x114], 0x2a5c
cmp eax, 0x104
jae 0x4c96f6
mov byte [ebp + eax - 0x114], 0
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4c9666
lea ecx, [ebp - 0x12c]
call fcn.00406f20
xor al, al
jmp 0x4c97b2
cmp esi, 0x104
jae 0x4c96f6
mov byte [ebp + esi - 0x114], 0
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [ebp - 0x26c], 0x10
je 0x4c96e6
cmp byte [ebp - 0x240], 0x2e
je 0x4c96e6
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00417ab0
push 0x70febc
lea ecx, [ebp - 0x12c]
call fcn.00424ef0
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00424ef0
lea eax, [ebp - 0x12c]
push eax
push 0x729d48
call fcn.004c8b0a
add esp, 8
or bl, al
test al, al
je 0x4c96e6
inc dword [0x72876c]
lea eax, [ebp - 0x26c]
push eax
push edi
call esi
test eax, eax
jne 0x4c9680
jmp 0x4c9728
call fcn.004ceba5
lea eax, [ebp - 0x12c]
push eax
push 0x729d48
call fcn.004c8b0a
mov bl, al
add esp, 8
test bl, bl
je 0x4c971b
inc dword [0x72876c]
lea edx, [ebp - 0x12c]
call fcn.004c8f30
or bl, al
call fcn.00438e60
test al, al
je 0x4c9792
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x270], 0
call fcn.00438f30
test al, al
je 0x4c9792
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4c9792
cmp dword [ebp - 0x118], 0x10
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x11c], 0
lea edx, [ebp - 0x12c]
cmovae eax, dword [ebp - 0x12c]
mov byte [eax], 0
call fcn.004c8f30
or bl, al
test al, al
je 0x4c9792
inc dword [0x72876c]
mov ecx, dword [ebp - 0x118]
cmp ecx, 0x10
jb 0x4c97b0
inc ecx
push ecx
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x12c]
call fcn.00408600
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ce564
mov esp, ebp
pop ebp
ret
Function at 0x4fd397
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004fd05a

Function at 0x4fd3a2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004fd1db

Function at 0x501e0e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00501ace