joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022360
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [eax]
push ebx
push esi
push edi
xor edi, edi
inc edi
mov dword [ebp - 4], eax
mov ecx, edi
lock xadd dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 2
jne 0x1002239e
mov eax, dword [eax + 0xc]
cmp word [eax + 2], 0x3a
jne 0x1002239e
push ecx
mov eax, esp
push 0x5c
pop ecx
mov word [eax], cx
lea ecx, [ebp - 4]
call fcn.10003ec7
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10021e7c
pop ecx
pop ecx
mov ecx, eax
call fcn.100043cf
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or esi, 0xffffffff
mov ebx, eax
mov eax, dword [ebp - 8]
mov ecx, esi
lock xadd dword [eax], ecx
jne 0x100223d4
push dword [ebp - 8]
call fcn.10002b2d
pop ecx
cmp ebx, esi
jne 0x10022473
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x100223f8
cmp eax, 0x20
jne 0x10022473
jmp 0x100223f8
push edi
call fcn.10005342
push 0x5c
pop eax
mov word [ebp - 6], ax
push edi
lea eax, [ebp - 6]
push eax
lea ecx, [ebp - 4]
call fcn.1000309a
lea ecx, [ebp - 4]
test al, al
jne 0x100223f2
push 0x3a
pop eax
mov word [ebp - 6], ax
push edi
lea eax, [ebp - 6]
push eax
call fcn.1000309a
test al, al
jne 0x10022473
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10021e7c
pop ecx
pop ecx
mov ecx, eax
call fcn.100043cf
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov eax, dword [ebp - 8]
mov ecx, esi
lock xadd dword [eax], ecx
jne 0x10022462
push dword [ebp - 8]
call fcn.10002b2d
pop ecx
cmp edi, esi
je 0x10022473
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [ebp - 0x258]
mov eax, dword [ebp + 8]
test eax, eax
je 0x10022481
cmp ebx, esi
setne cl
mov byte [eax], cl
mov eax, dword [ebp - 4]
cmp ebx, esi
jne 0x1002249b
lock xadd dword [eax], esi
jne 0x10022497
push dword [ebp - 4]
call fcn.10002b2d
pop ecx
xor al, al
jmp 0x100224b2
shr ebx, 4
and bl, 1
lock xadd dword [eax], esi
jne 0x100224b0
push dword [ebp - 4]
call fcn.10002b2d
pop ecx
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002311a
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x20]
or ebx, 0xffffffff
push edi
cmp ecx, ebx
jne 0x100231ba
cmp dword [eax + 0x34], ebx
jne 0x100231ba
mov ecx, dword [eax + 0x14]
cmp dword [ecx + 8], 0
je 0x10023224
add eax, 0x10
push eax
lea ecx, [ebp - 0x10]
call fcn.1000b4d9
push ecx
mov eax, esp
lea ecx, [ebp - 0x10]
mov dword [eax], 3
call fcn.1000ae80
lea ecx, [ebp - 0x10]
test al, al
je 0x100231b3
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000b7d9
mov byte [ebp - 1], al
test al, al
jne 0x100231a6
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000c710
push eax
push 0xc
mov ecx, esi
call fcn.1002ad97
mov eax, dword [ebp - 8]
lock xadd dword [eax], ebx
jne 0x100231a6
push dword [ebp - 8]
call fcn.10002b2d
pop ecx
lea ecx, [ebp - 0x10]
call fcn.1000b7c3
mov al, byte [ebp - 1]
jmp 0x10023226
call fcn.1000b7c3
jmp 0x10023224
mov edi, ecx
cmp edi, ebx
jne 0x100231cf
push dword [eax + 0x34]
call fcn.1004b385
mov edi, eax
pop ecx
cmp edi, ebx
je 0x10023224
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
mov dword [ebp - 0xc], edx
call dword [eax + 0x18]
test al, al
je 0x10023217
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x10023217
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10006fd5
pop ecx
pop ecx
push dword [eax + 4]
mov ecx, esi
push dword [eax]
call dword [edi + 0x18]
mov al, 1
jmp 0x10023226
push dword [ebp - 0xc]
mov eax, dword [esi]
push dword [ebp - 0x10]
mov ecx, esi
call dword [eax + 0x18]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100240d5
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ebx
cmp dword [esi + 0x18], edi
jne 0x10024122
lea eax, [ebp + 0xc]
push 5
push eax
call fcn.1000187c
pop ecx
pop ecx
push eax
push 0xd
mov ecx, ebx
call fcn.1002ad97
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10024291
push dword [ebp + 0xc]
call fcn.10002b2d
pop ecx
jmp 0x10024291
mov eax, dword [ebp + 8]
or eax, dword [ebp + 0xc]
jne 0x10024144
mov eax, dword [ebp + 0x10]
or eax, dword [ebp + 0x14]
jne 0x10024144
lea eax, [ebp + 0xc]
push 0x57
push eax
call fcn.1000187c
pop ecx
pop ecx
push eax
push 8
jmp 0x100240fd
or ebx, 0xffffffff
cmp dword [esi + 0x24], ebx
jne 0x100241b3
mov eax, dword [esi + 0x20]
cmp eax, ebx
jne 0x1002418d
mov eax, dword [esi + 0x1c]
cmp eax, edi
je 0x1002416c
push eax
call fcn.1004b773
push eax
call fcn.1004b385
pop ecx
pop ecx
cmp eax, ebx
jne 0x1002418d
push 5
lea eax, [ebp + 0xc]
push eax
call fcn.1000187c
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
push eax
push 0xd
call fcn.1002ad97
mov eax, dword [ebp + 0xc]
lock xadd dword [eax], ebx
jmp 0x1002410e
mov ecx, dword [esi + 0x18]
push edi
push edi
push edi
push 0
and ecx, 2
pop ecx
setne cl
lea ecx, [ecx + ecx + 2]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x24], eax
cmp eax, ebx
jne 0x100241b3
push ebx
jmp 0x1002416e
mov eax, dword [esi + 0x18]
mov dword [ebp - 8], edi
test al, 1
je 0x100241c4
mov dword [ebp - 8], 4
test al, 2
je 0x100241cf
mov dword [ebp - 8], 2
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
sar ecx, 0x1f
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x14]
dec eax
mov edi, ebx
and edi, eax
je 0x100241f7
not eax
and eax, ebx
mov ebx, eax
mov eax, dword [ebp + 0x10]
add eax, edi
push eax
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x10024229
lea ebx, [eax + edi]
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0x28]
mov dword [ebp + 0xc], ebx
call fcn.1002406b
mov dword [eax], edi
mov eax, ebx
jmp 0x10024293
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xffffffffffffffff
cmp eax, 5
je 0x1002425d
lea eax, [ebp + 0xc]
push eax
call fcn.1000187c
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
push eax
push 8
call fcn.1002ad97
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10024288
push dword [ebp + 0xc]
jmp 0x10024282
lea eax, [ebp + 0x14]
push eax
call fcn.1000187c
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
push eax
push 0xd
call fcn.1002ad97
mov eax, dword [ebp + 0x14]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10024288
push dword [ebp + 0x14]
call fcn.10002b2d
pop ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1002fba9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0xc]
xor eax, eax
cmp dword [ebp + 0x10], eax
mov dword [ebp - 4], esi
jl 0x1002fce2
mov ebx, dword [ebp + 0xc]
jg 0x1002fbd2
cmp ebx, eax
jb 0x1002fce2
cmp ebx, ebx
jne 0x1002fce2
cmp dword [ebp + 0x10], eax
jne 0x1002fce2
xor esi, esi
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], eax
je 0x1002fc36
push dword [edi + 0x1c]
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 8]
add eax, esi
push 1
push eax
call fcn.1004d2d8
add esp, 0x10
add esi, eax
adc dword [ebp - 8], 0
test eax, eax
jne 0x1002fc20
call fcn.1004bbaf
xor ecx, ecx
cmp dword [eax], 4
sete cl
mov eax, ecx
jmp 0x1002fc30
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jl 0x1002fbed
jg 0x1002fc2e
cmp esi, ebx
jb 0x1002fbed
xor eax, eax
test eax, eax
jne 0x1002fbed
jmp 0x1002fc84
cmp dword [edi + 0x34], 0xffffffff
je 0x1002fc84
jmp 0x1002fc41
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ebx, esi
push ebx
add eax, esi
push eax
push dword [edi + 0x34]
call fcn.1004d09a
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1002fc66
call fcn.1004bbaf
cmp dword [eax], 4
je 0x1002fc3e
test ebx, ebx
jle 0x1002fc81
mov eax, ebx
cdq
add esi, eax
adc dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jl 0x1002fc3e
jg 0x1002fc81
cmp esi, dword [ebp + 0xc]
jb 0x1002fc3e
mov ebx, dword [ebp + 0xc]
or ebx, dword [ebp + 0x10]
je 0x1002fcdb
mov eax, esi
or eax, dword [ebp - 8]
jne 0x1002fcdb
or esi, 0xffffffff
mov dword [ebp - 8], esi
call fcn.1004bbaf
mov edi, eax
call fcn.1004bbaf
push dword [edi]
mov ebx, eax
lea eax, [ebp + 8]
push eax
call fcn.1000187c
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
push eax
xor eax, eax
cmp dword [ebx], 0x1c
sete al
lea eax, [eax + eax + 2]
push eax
call fcn.1002ad97
mov eax, dword [ebp + 8]
or ecx, esi
lock xadd dword [eax], ecx
jne 0x1002fcdb
push dword [ebp + 8]
call fcn.10002b2d
pop ecx
mov edx, dword [ebp - 8]
mov eax, esi
jmp 0x1002fd13
lea eax, [ebp + 8]
push 0x16
push eax
call fcn.1000187c
pop ecx
pop ecx
push eax
push 2
mov ecx, esi
call fcn.1002ad97
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1002fd0e
push dword [ebp + 8]
call fcn.10002b2d
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002feaf
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
xor eax, eax
cmp dword [ebp + 0x10], eax
mov dword [ebp - 8], edi
jl 0x10030035
jg 0x1002fed5
cmp dword [ebp + 0xc], eax
jb 0x10030035
mov ecx, dword [ebp + 0xc]
cmp ecx, ecx
jne 0x10030035
cmp dword [ebp + 0x10], eax
jne 0x10030035
xor edi, edi
push ebx
mov dword [ebp - 0xc], eax
cmp dword [esi + 0x1c], eax
je 0x1002ff99
mov byte [ebp - 2], 1
push dword [esi + 0x1c]
mov eax, dword [ebp + 0xc]
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push 1
push eax
call fcn.1004de97
push dword [esi + 0x1c]
mov ebx, eax
call fcn.1004bd0e
add esp, 0x14
test eax, eax
setne byte [ebp - 1]
cmp byte [ebp - 2], 0
je 0x1002ff51
cmp byte [ebp - 1], 0
je 0x1002ff51
test ebx, ebx
jne 0x1002ff51
push ebx
push dword [esi + 0x1c]
call fcn.10048348
pop ecx
push edx
push eax
push dword [esi + 0x1c]
call fcn.1004dba8
add esp, 0x10
mov byte [ebp - 2], bl
jmp 0x1002ff57
add edi, ebx
adc dword [ebp - 0xc], 0
cmp byte [ebp - 1], 0
jne 0x1003002d
test ebx, ebx
jne 0x1002ff76
call fcn.1004bbaf
xor ecx, ecx
cmp dword [eax], 4
sete cl
mov eax, ecx
jmp 0x1002ff8f
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x1002fefc
jg 0x1002ff8d
cmp edi, dword [ebp + 0xc]
jb 0x1002fefc
xor eax, eax
test eax, eax
jne 0x1002fefc
jmp 0x1002ffe9
cmp dword [esi + 0x34], 0xffffffff
je 0x1002fff6
mov eax, dword [ebp + 0xc]
sub eax, edi
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 0x34]
call fcn.1004da0f
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x1002ffc7
call fcn.1004bbaf
cmp dword [eax], 4
je 0x1002ff9f
test ebx, ebx
jle 0x1002ffe2
mov eax, ebx
cdq
add edi, eax
adc dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x1002ff9f
jg 0x1002ffe2
cmp edi, dword [ebp + 0xc]
jb 0x1002ff9f
cmp ebx, 0xffffffff
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x1003002d
mov eax, edi
or eax, dword [ebp - 0xc]
jne 0x1003002d
or edi, 0xffffffff
mov dword [ebp - 0xc], edi
call fcn.1004bbaf
push dword [eax]
lea eax, [ebp + 8]
push eax
call fcn.1000187c
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
push eax
push 1
call fcn.1002ad97
mov eax, dword [ebp + 8]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x1003002d
push dword [ebp + 8]
call fcn.10002b2d
pop ecx
mov edx, dword [ebp - 0xc]
mov eax, edi
pop ebx
jmp 0x10030066
lea eax, [ebp + 8]
push 0x16
push eax
call fcn.1000187c
pop ecx
pop ecx
push eax
push 1
mov ecx, edi
call fcn.1002ad97
mov eax, dword [ebp + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10030061
push dword [ebp + 8]
call fcn.10002b2d
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x10030e7d
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
lea eax, [esi + 0x50]
push eax
lea ecx, [ebp - 4]
call fcn.100085f8
cmp byte [esi + 0x54], 0
je 0x10030ebf
cmp byte [esi + 0x70], 0
jne 0x10030ea6
mov byte [esi + 0x71], 1
jmp 0x10030ebf
push 0
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push edi
mov byte [esi + 0x56], 1
call fcn.10030de6
pop ecx
pop ecx
lea ecx, [ebp - 4]
call fcn.10008aec
pop edi
pop esi
leave
ret

Function at 0x1003106a
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
lea eax, [esi + 0x50]
push eax
lea ecx, [ebp - 4]
call fcn.100085f8
xor ebx, ebx
cmp byte [esi + 0x54], bl
jne 0x10031151
lea eax, [esi + 0x68]
push eax
push 4
push edi
push 0x10031012
push dword [esi + 0x5c]
mov byte [esi + 0x54], 1
push ebx
mov byte [esi + 0x55], bl
mov byte [esi + 0x56], bl
mov byte [esi + 0x57], bl
mov dword [esi + 0x58], ebx
call fcn.1004dfb5
add esp, 0x18
mov dword [esi + 0x64], eax
cmp eax, ebx
jne 0x100310d7
call fcn.1004bbaf
push str.QThread::start:_Failed_to_create_thread
push dword [eax]
call fcn.10001c74
pop ecx
mov byte [esi + 0x54], bl
mov byte [esi + 0x55], 1
jmp 0x10031150
mov eax, dword [ebp + 8]
mov dword [esi + 0x60], eax
sub eax, ebx
je 0x1003111c
dec eax
je 0x10031118
dec eax
je 0x10031113
dec eax
je 0x1003110f
dec eax
je 0x1003110a
dec eax
je 0x10031106
dec eax
je 0x10031102
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
jmp 0x1003111f
push 0xf
jmp 0x1003111e
push 2
jmp 0x1003111e
xor eax, eax
inc eax
jmp 0x1003111f
xor eax, eax
jmp 0x1003111f
or eax, 0xffffffff
jmp 0x1003111f
push 0xfffffffffffffffe
jmp 0x1003111e
push 0xfffffffffffffff1
pop eax
push eax
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x10031138
push str.QThread::start:_Failed_to_set_thread_priority
call fcn.10001bb8
pop ecx
push dword [esi + 0x64]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10031151
push str.QThread::start:_Failed_to_resume_new_thread
call fcn.10001bb8
pop ecx
lea ecx, [ebp - 4]
call fcn.10008aec
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x10031481
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x100d4c80
lea ecx, [ebp - 4]
call fcn.100085f8
lea eax, [ebp + 8]
mov esi, 0x100d2f88
push eax
mov ecx, esi
call fcn.1003116e
lea eax, [ebp + 0xc]
push eax
mov ecx, 0x100d2f8c
call fcn.1003116e
xor edi, edi
cmp dword [0x100d4c74], edi
jne 0x100314ff
cmp dword [0x100d4c78], edi
jne 0x100314e9
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x100d4c78
push 1
mov ecx, esi
mov dword [0x100d4c78], eax
call fcn.100312de
push eax
mov ecx, esi
call fcn.100311cf
push edi
push edi
push 0x10031321
call fcn.1004e166
add esp, 0xc
mov dword [0x100d4c74], eax
jmp 0x1003150b
push dword [0x100d4c78]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 4]
call fcn.10008aec
pop edi
pop esi
leave
ret

Function at 0x10031517
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
call fcn.10030d71
push dword [0x100d2f84]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x10031612
lea eax, [ebp - 4]
push eax
push 2
mov dword [ebp - 4], ebx
call fcn.1000211a
pop ecx
pop ecx
test al, al
je 0x10031582
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0x74]
push esi
push dword [0x100d2f84]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov byte [eax + 0x54], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov byte [eax + 0x55], bl
mov ecx, dword [ebp - 4]
call fcn.10030dc7
jmp 0x100315cc
push 0x38
call fcn.100465d6
pop ecx
cmp eax, ebx
je 0x1003159b
push 1
mov ecx, eax
call fcn.1000ec48
mov esi, eax
jmp 0x1003159d
xor esi, esi
push esi
push dword [0x100d2f84]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 8
call fcn.100465d6
pop ecx
cmp eax, ebx
je 0x100315c0
push esi
mov ecx, eax
call fcn.1000edce
jmp 0x100315c2
xor eax, eax
mov ecx, esi
mov dword [esi + 4], eax
call fcn.1000edac
cmp dword [0x100d4ae8], ebx
jne 0x100315de
mov eax, dword [esi + 4]
mov dword [0x100d4ae8], eax
jmp 0x10031612
or dword [ebp - 8], 0xffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push ebx
push ebx
lea eax, [ebp - 8]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push dword [esi + 4]
push dword [ebp - 8]
call fcn.10031481
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10039766
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
and dword [ebp - 0x21c], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x220], esi
call edi
mov ebx, eax
cmp ebx, esi
jbe 0x100397b7
push ebx
lea ecx, [ebp - 0x220]
call fcn.100219d8
push ebx
push dword [ebp - 0x218]
call edi
mov ebx, eax
push ebx
push dword [ebp - 0x218]
push dword [ebp + 8]
call fcn.10003c54
add esp, 0xc
pop edi
lea eax, [ebp - 0x210]
pop esi
pop ebx
cmp dword [ebp - 0x218], eax
je 0x100397e6
push dword [ebp - 0x218]
call fcn.10001746
pop ecx
mov eax, dword [ebp + 8]
leave
ret
Function at 0x1003c37d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x1003c40a
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.10046cd0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x1003c3ca
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x1003c3ec
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x1003c4c8
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x1003c432
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x1003c43d
xor eax, eax
jmp 0x1003c489
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x1003c45a
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.1004483e
jmp 0x1003c46a
cmp ecx, 2
jne 0x1003c473
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.10044ccc
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.10046cd0
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x1003c4b4
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x1003c4c8
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x1003c388
pop edi
pop ebx
leave
ret

Function at 0x1003edc7
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [edx]
push ebx
mov bl, byte [ecx]
movsx eax, bl
cmp eax, 0x3d
jg 0x1003edfb
je 0x1003edf4
cmp eax, 0x21
je 0x1003edf4
cmp eax, 0x24
je 0x1003edf4
cmp eax, 0x25
jle 0x1003ee0a
cmp eax, 0x2e
jle 0x1003edf4
cmp eax, 0x39
jle 0x1003ee0a
cmp eax, 0x3b
jg 0x1003ee0a
inc ecx
mov al, 1
mov dword [edx], ecx
pop ebx
ret
cmp eax, 0x40
je 0x1003edf4
cmp eax, 0x5f
je 0x1003edf4
cmp eax, 0x7e
je 0x1003edf4
cmp bl, 0x61
jl 0x1003ee14
cmp bl, 0x7a
jle 0x1003edf4
cmp bl, 0x41
jl 0x1003ee1e
cmp bl, 0x5a
jle 0x1003edf4
sub bl, 0x30
cmp bl, 9
jbe 0x1003edf4
call fcn.1003e969
test al, al
setne al
pop ebx
ret
Function at 0x10046552
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100d3940]
jne 0x1004655c
repz ret
jmp fcn.1004ee11

Function at 0x1004bd42
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1004bd73
call fcn.1004bbc2
mov dword [eax], esi
call fcn.1004bbaf
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10052617
add esp, 0x14
push 0x16
pop eax
jmp 0x1004bdc8
test dword [ebp + 0xc], 0xfffffff9
jne 0x1004bd4f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1004bda0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1004bbd5
pop ecx
call fcn.1004bbaf
mov eax, dword [eax]
jmp 0x1004bdc8
test al, 0x10
jne 0x1004bdc6
test al, 1
je 0x1004bdc6
test byte [ebp + 0xc], 2
je 0x1004bdc6
call fcn.1004bbc2
mov dword [eax], 5
call fcn.1004bbaf
mov dword [eax], 0xd
jmp 0x1004bd97
xor eax, eax
pop esi
pop ebp
ret

Function at 0x1004bde3
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1004be14
call fcn.1004bbc2
mov dword [eax], esi
call fcn.1004bbaf
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10052617
add esp, 0x14
or eax, 0xffffffff
jmp 0x1004be4f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1004be31
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1004bbd5
pop ecx
jmp 0x1004be0f
test byte [ebp + 0xc], 0x80
je 0x1004be3c
and eax, 0xfffffffe
jmp 0x1004be3f
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1004be22
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10054635
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sahf
sbb al, dl
lea eax, [ebp - 0x58]
push eax
call fcn.100543a1
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10054356
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1005467f
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.10054391
sub al, 0xca
push edx
add cl, byte [ebp - 0x17af3fbb]
invalid