joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e310
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, eax
xor eax, eax
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov al, byte [esi]
test al, al
je 0x43e377
push ebx
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov eax, dword [edi + eax*4]
shr ecx, 8
xor eax, ecx
mov ecx, dword [edx + 4]
mov dword [edx], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
mov ebx, dword [edi + eax*4]
shr ecx, 8
xor ecx, ebx
inc esi
mov dword [edx + 8], ecx
mov al, byte [esi]
test al, al
jne 0x43e330
pop ebx
pop esi
ret
Function at 0x406ced
Capabilities:
Parse pe header

Disassembly:
push 0x74
push 0x40af98
call fcn.00406fd4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x406d2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406d2d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x406d45
cmp eax, 0x20b
je 0x406d32
mov dword [ebp - 0x1c], ebx
jmp 0x406d59
cmp dword [ecx + 0x84], 0xe
jbe 0x406d2d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x406d53
cmp dword [ecx + 0x74], 0xe
jbe 0x406d2d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x40ea78], 0xffffffff
or dword [0x40ea7c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x40d464]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x40d460]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40ea74], eax
call fcn.00406f30
call fcn.00535000
cmp dword [0x40d320], ebx
jne 0x406db9
push 0x406fd0
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00406fbe
push 0x40c00c
push 0x40c008
call sub.MSVCR71.dll__initterm
push 0x406f74
call fcn.00406f1e
mov eax, dword [0x40d45c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40d458]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x406e0d
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x40c004
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x406e8b
cmp al, bl
je 0x406e37
cmp dword [ebp - 0x20], ebx
jne 0x406e8b
mov al, byte [esi]
cmp al, bl
je 0x406e47
cmp al, 0x20
ja 0x406e47
inc esi
mov dword [ebp - 0x24], esi
jmp 0x406e37
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x406e63
movzx eax, word [ebp - 0x54]
jmp 0x406e66
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00404254
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x406e83
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x406ee0
cmp al, 0x22
jne 0x406e9a
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x406ead
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x406e25
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040700f
ret
Function at 0x954058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9541a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x95407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95406a
add dl, dl
jne 0x954089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9540dc
xor eax, eax
add dl, dl
jne 0x954096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x95417d
add dl, dl
jne 0x9540a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9540b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9540bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9540c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9540d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x954075
mov eax, 1
add dl, dl
jne 0x9540ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9540f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9540e1
sub eax, ebx
mov ebx, 1
jne 0x954128
mov ecx, 1
add dl, dl
jne 0x95410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x954119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x954105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x954075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x95413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x95414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x954136
cmp eax, 0x7d00
jae 0x95416d
cmp eax, 0x500
jb 0x954168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x954075
cmp eax, 0x7f
ja 0x954170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x954075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x95419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x954075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x9a41b8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9a4308
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9a41de
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a41ca
add dl, dl
jne 0x9a41e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a423c
xor eax, eax
add dl, dl
jne 0x9a41f6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9a42dd
add dl, dl
jne 0x9a4205
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a4210
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a421b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a4226
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9a4232
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9a41d5
mov eax, 1
add dl, dl
jne 0x9a424a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9a4255
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a4241
sub eax, ebx
mov ebx, 1
jne 0x9a4288
mov ecx, 1
add dl, dl
jne 0x9a426e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9a4279
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a4265
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a41d5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9a429f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9a42aa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9a4296
cmp eax, 0x7d00
jae 0x9a42cd
cmp eax, 0x500
jb 0x9a42c8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a41d5
cmp eax, 0x7f
ja 0x9a42d0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9a41d5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9a42fe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9a41d5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408e84
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x518904aa
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2d364e6
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x405683
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.0040558a
mov ebx, eax
test eax, eax
je 0x4056ae
push eax
call fcn.0056cb5f
inc eax
setne al
push ebx
movzx esi, al
call fcn.00406120
pop ebx
jmp 0x4056bb
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
inc eax
setne al
movzx esi, al
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret

Function at 0x4056cb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3b4
mov eax, dword [0x696020]
mov esi, dword [ebp + 8]
test eax, eax
je 0x4056fe
push 0x118
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.msvcrt.dll_strncpy
add esp, 0xc
mov byte [ebp - 0x34], 0
jmp 0x405757
call fcn.00405542
test eax, eax
je 0x405746
lea ebx, [ebp - 0x3bc]
push ebx
push 0x118
call fcn.0056cb8f
mov eax, ebx
call fcn.004055f1
mov ebx, eax
test eax, eax
je 0x405757
push 0x118
push eax
lea eax, [ebp - 0x14c]
push eax
call sub.msvcrt.dll_strncpy
push ebx
mov byte [ebp - 0x34], 0
call fcn.00406120
add esp, 0x10
jmp 0x405757
lea eax, [ebp - 0x14c]
push eax
push 0x118
call sub.KERNEL32.DLL_GetTempPathA
cld
or ecx, 0xffffffff
xor eax, eax
lea edi, [ebp - 0x14c]
repne scasb al, byte es:[edi]
not ecx
lea ebx, [ecx - 1]
jmp 0x405777
cmp byte [ebx + ebp - 0x14d], 0x5c
jne 0x40577b
dec ebx
test ebx, ebx
jg 0x40576c
mov byte [ebx + ebp - 0x14c], 0
lea eax, [ebp - 0x14c]
mov edi, esi
push eax
push str._s_sqlite_
push esi
call sub.msvcrt.dll_sprintf
cld
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov ebx, 0xe
lea edi, [ecx - 1]
lea eax, [esi + edi]
push eax
push 0xf
call fcn.00415fa0
add esp, 0x14
movzx ax, byte [edi + esi]
xor edx, edx
mov ecx, 0x3e
div cx
and edx, 0x3f
mov al, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi], al
inc edi
dec ebx
jns 0x4057b7
mov byte [edi + esi], 0
push esi
call fcn.00405683
pop edi
test eax, eax
jne 0x405783
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x405c57
Capabilities:
Get file attributes

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x405cb8
call fcn.00405542
test eax, eax
jne 0x405c83
cld
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor eax, eax
cmp ecx, 0x104
ja 0x405cb8
mov eax, ebx
call fcn.0040558a
mov edi, eax
test eax, eax
je 0x405ca1
push eax
call fcn.0056cb5f
mov ebx, eax
push edi
call fcn.00406120
pop ecx
jmp 0x405ca9
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
je 0x405cb8
xor eax, eax
test bl, 0x10
setne al
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x40604a
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x696050], 0
push ebx
mov esi, dword [ebp + 8]
jne 0x406091
call fcn.00405fde
cmp dword [0x696050], 0
jne 0x40608c
call sub.KERNEL32.DLL_TlsAlloc
mov dword [0x696040], eax
inc eax
jne 0x406082
call fcn.00405fe9
xor eax, eax
jmp 0x406111
mov dword [0x696050], 1
call fcn.00405fe9
push dword [0x696040]
call sub.KERNEL32.DLL_TlsGetValue
test esi, esi
mov ebx, eax
jle 0x4060d9
test eax, eax
jne 0x40610f
push 0xc
call fcn.00405520
mov ebx, eax
pop eax
test ebx, ebx
je 0x40610f
mov eax, dword [0x63c534]
mov dword [ebx], eax
mov eax, dword [0x63c538]
mov dword [ebx + 4], eax
mov eax, dword [0x63c53c]
mov dword [ebx + 8], eax
push ebx
push dword [0x696040]
call sub.KERNEL32.DLL_TlsSetValue
jmp 0x40610f
test eax, eax
setne al
shr esi, 0x1f
test eax, esi
je 0x40610f
push 0xc
push 0x63c534
push ebx
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40610f
push ebx
call fcn.00405532
push 0
xor ebx, ebx
push dword [0x696040]
call sub.KERNEL32.DLL_TlsSetValue
pop eax
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4289d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
cmp edx, 1
push edi
mov edi, eax
push esi
mov eax, 0x17
push ebx
mov esi, edx
push ecx
jle 0x428a61
jmp 0x4289f0
movzx eax, byte [ebx + 0x63fb30]
jmp 0x428a61
movzx eax, byte [edi]
movzx eax, byte [eax + 0x63c540]
lea ecx, [eax*4]
movzx eax, byte [edi + edx - 1]
movzx eax, byte [eax + 0x63c540]
imul eax, eax, 3
xor ecx, eax
xor ecx, edx
mov edx, 0x7f
mov eax, ecx
mov ebx, edx
cdq
idiv ebx
movzx eax, byte [edx + str.Pk_]
mov ebx, eax
dec ebx
js 0x428a5c
movzx eax, byte [ebx + 0x63f9b0]
cmp eax, esi
jne 0x428a53
movzx eax, word [ebx + ebx + 0x63fa30]
add eax, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE
push esi
push edi
push eax
call fcn.0040629b
add esp, 0xc
test eax, eax
je 0x4289e7
movzx eax, byte [ebx + 0x63f930]
jmp 0x428a27
mov eax, 0x17
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x428a69
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.004289d0
Function at 0x4433c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 0xc]
mov bl, byte [esi]
movzx eax, bl
mov edx, eax
and edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp + 8], 0xff
jg 0x443408
test al, 2
je 0x443408
mov edx, 8
mov eax, dword [ebp + 8]
mov edi, edx
mov ecx, dword [ebp + 8]
cdq
idiv edi
and ecx, 7
movzx eax, byte [esi + eax + 1]
sar eax, cl
test al, 1
jne 0x4435bb
inc esi
and bl, 2
je 0x443411
add esi, 0x20
movzx ebx, byte [esi]
inc esi
test ebx, ebx
je 0x4435d2
cmp ebx, 1
jne 0x443473
movzx eax, byte [esi]
inc esi
mov dword [ebp - 0x14], eax
cmp eax, 0xbf
jle 0x443466
and eax, 0x3f
movzx edx, byte [eax + 0x644590]
imul ebx, edx, 6
mov ecx, dword [edx*4 + 0x6445d0]
and dword [ebp - 0x14], ecx
mov cl, bl
shl dword [ebp - 0x14], cl
mov eax, edx
dec edx
test eax, eax
jle 0x443466
movzx eax, byte [esi]
sub ebx, 6
and eax, 0x3f
mov cl, bl
inc esi
shl eax, cl
or dword [ebp - 0x14], eax
jmp 0x44344c
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 8], edi
jne 0x443411
jmp 0x4435bb
cmp ebx, 2
mov cl, byte [esi]
jne 0x443524
movzx ecx, cl
inc esi
mov dword [ebp - 0x14], ecx
cmp ecx, 0xbf
jle 0x4434c7
mov eax, ecx
and eax, 0x3f
movzx edx, byte [eax + 0x644590]
imul ebx, edx, 6
mov eax, dword [edx*4 + 0x6445d0]
and ecx, eax
mov dword [ebp - 0x14], ecx
mov cl, bl
shl dword [ebp - 0x14], cl
mov eax, edx
dec edx
test eax, eax
jle 0x4434c7
movzx eax, byte [esi]
sub ebx, 6
and eax, 0x3f
mov cl, bl
inc esi
shl eax, cl
or dword [ebp - 0x14], eax
jmp 0x4434ad
movzx ebx, byte [esi]
inc esi
cmp ebx, 0xbf
jle 0x443506
mov eax, ebx
and eax, 0x3f
movzx edx, byte [eax + 0x644590]
imul edi, edx, 6
and ebx, dword [edx*4 + 0x6445d0]
mov ecx, edi
shl ebx, cl
mov eax, edx
dec edx
test eax, eax
jle 0x443506
movzx eax, byte [esi]
sub edi, 6
and eax, 0x3f
mov ecx, edi
inc esi
shl eax, cl
or ebx, eax
jmp 0x4434ed
mov edi, dword [ebp - 0x14]
cmp dword [ebp + 8], edi
setge dl
xor eax, eax
cmp dword [ebp + 8], ebx
setle al
test edx, eax
je 0x443411
jmp 0x4435bb
mov edx, pe_nt_image_headers32
mov eax, dword [ebp + 8]
mov edi, edx
cdq
idiv edi
mov dword [ebp - 0x18], eax
movzx eax, byte [eax + 0x64e4b0]
shl eax, 7
add eax, edx
movzx edx, cl
movzx eax, word [eax + eax + 0x6446b0]
cmp edx, 4
lea eax, [eax*8 + 0x6506b0]
ja case.default.0x443557
jmp dword [edx*4 + 0x651950]
cmp ebx, 3
jne 0x4435ca
jmp 0x4435bb
mov cl, byte [eax + 1]
xor edi, edi
cmp cl, 9
setne dl
xor eax, eax
cmp cl, 5
setne al
test edx, eax
je 0x443585
cmp cl, 8
je 0x443585
mov di, 1
xor eax, eax
cmp ebx, 3
sete al
cmp edi, eax
jmp 0x4435b9
movzx eax, byte [eax + 1]
movzx edx, byte [esi + 1]
cmp edx, dword [eax*4 + 0x644510]
jmp 0x4435ac
mov al, byte [eax + 1]
jmp 0x4435a9
mov al, byte [eax]
cmp byte [esi + 1], al
setne dl
cmp ebx, 3
sete al
xor eax, edx
test al, 1
je 0x4435ca
xor eax, eax
cmp dword [ebp - 0x10], 0
sete al
jmp 0x4435d5
xor eax, eax
jmp 0x4435d5
add esi, 2
jmp 0x443411
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x444b81
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x7e4
mov ebx, eax
mov dword [esp + 8], 0xd
mov dword [esp + 4], str.urn:publicid:
mov dword [esp], eax
call fcn.0047965a
mov edx, eax
xor eax, eax
test edx, edx
jne 0x444cdf
add ebx, 0xd
jmp 0x444cbf
cmp eax, 0x7cc
ja 0x444cc9
cmp dl, 0x2b
jne 0x444bd4
mov byte [ebp + eax - 0x7d8], 0x20
inc eax
jmp 0x444c03
cmp dl, 0x3a
jne 0x444beb
mov byte [ebp + eax - 0x7d8], 0x2f
mov byte [ebp + eax - 0x7d7], 0x2f
jmp 0x444c00
cmp dl, 0x3b
jne 0x444c0b
mov byte [ebp + eax - 0x7d8], 0x3a
mov byte [ebp + eax - 0x7d7], 0x3a
add eax, 2
lea edx, [ebx + 1]
jmp 0x444cbd
cmp dl, 0x25
lea ecx, [ebx + 1]
jne 0x444cb3
mov edx, ecx
mov cl, byte [ebx + 1]
cmp cl, 0x32
jne 0x444c33
mov cl, byte [ebx + 2]
cmp cl, 0x42
jne 0x444c4a
mov byte [ebp + eax - 0x7d8], 0x2b
jmp 0x444ca2
cmp cl, 0x33
jne 0x444ca8
mov cl, byte [ebx + 2]
cmp cl, 0x41
jne 0x444c59
mov byte [ebp + eax - 0x7d8], 0x3a
jmp 0x444ca2
cmp cl, 0x46
jne 0x444c68
mov byte [ebp + eax - 0x7d8], 0x2f
jmp 0x444ca2
cmp cl, 0x42
jne 0x444c77
mov byte [ebp + eax - 0x7d8], 0x3b
jmp 0x444ca2
cmp cl, 0x37
jne 0x444c86
mov byte [ebp + eax - 0x7d8], 0x27
jmp 0x444ca2
cmp cl, 0x46
jne 0x444ca8
mov byte [ebp + eax - 0x7d8], 0x3f
jmp 0x444ca2
cmp cl, 0x33
jne 0x444c95
mov byte [ebp + eax - 0x7d8], 0x23
jmp 0x444ca2
cmp cl, 0x35
jne 0x444ca8
mov byte [ebp + eax - 0x7d8], 0x25
inc eax
lea edx, [ebx + 3]
jmp 0x444cbd
mov byte [ebp + eax - 0x7d8], 0x25
inc eax
jmp 0x444cbd
mov byte [ebp + eax - 0x7d8], dl
inc eax
mov edx, ecx
mov ebx, edx
mov dl, byte [ebx]
test dl, dl
jne 0x444bb9
mov byte [ebp + eax - 0x7d8], 0
lea eax, [ebp - 0x7d8]
mov dword [esp], eax
call fcn.004794a2
add esp, 0x7e4
pop ebx
pop ebp
ret

Function at 0x445694
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x696240], 0
jne 0x4456d1
mov dword [esp], str.XML_DEBUG_CATALOG
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4456bd
mov dword [0x696660], 1
call fcn.00490082
mov dword [0x696240], 1
mov dword [0x696670], eax
leave
ret
Function at 0x445892
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x696240], 0
jne 0x4459b5
call fcn.00445694
mov eax, dword [0x696670]
mov dword [esp], eax
call fcn.00490022
mov dword [esp], str.XML_DEBUG_CATALOG
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4458d4
mov dword [0x696660], 1
cmp dword [0x696250], 0
jne 0x4459a8
mov dword [esp], str.XML_CATALOG_FILES
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
jne 0x4458f8
mov ebx, str.file:___etc_xml_catalog
mov edx, dword [0x5dd0b0]
mov eax, 1
call fcn.004456d3
mov edi, eax
test eax, eax
je 0x4459a8
lea eax, [eax + 0x3c]
mov dword [ebp - 0x1c], eax
jmp 0x445999
inc ebx
mov al, byte [ebx]
lea edx, [eax - 9]
cmp dl, 1
jbe 0x44591a
cmp al, 0x20
je 0x44591a
cmp al, 0xd
je 0x44591a
mov edx, ebx
test al, al
je 0x445999
jmp 0x445936
inc ebx
mov al, byte [ebx]
test al, al
je 0x44594c
lea ecx, [eax - 9]
cmp cl, 1
jbe 0x44594c
cmp al, 0x20
je 0x44594c
cmp al, 0xd
jne 0x445935
mov eax, ebx
mov dword [esp], edx
sub eax, edx
mov dword [esp + 4], eax
call fcn.00479405
mov esi, eax
test eax, eax
je 0x445999
mov eax, dword [0x5dd0b0]
xor edx, edx
mov dword [esp + 4], eax
xor ecx, ecx
mov eax, 1
mov dword [esp + 8], 0
mov dword [esp], esi
call fcn.00444e36
mov edx, dword [ebp - 0x1c]
test eax, eax
mov dword [edx], eax
je 0x445990
mov dword [ebp - 0x1c], eax
mov dword [esp], esi
call dword [0x5dd270]
cmp byte [ebx], 0
jne 0x44591b
mov dword [0x696250], edi
mov eax, dword [0x696670]
mov dword [esp], eax
call fcn.00490027
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x445a7b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
test eax, eax
je 0x445b03
lea eax, [ebp - 0x3c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll__stat_1
test eax, eax
js 0x445b03
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.msvcrt.dll__open
mov esi, eax
test eax, eax
js 0x445b03
mov edi, dword [ebp - 0x28]
lea eax, [edi + 0xa]
mov dword [esp], eax
call dword [0x5dd278]
mov ebx, eax
test eax, eax
jne 0x445ad4
mov eax, str.allocating_catalog_data
call fcn.00444daa
jmp 0x445b05
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll__read
mov edi, eax
test eax, eax
jns 0x445af5
mov dword [esp], ebx
call dword [0x5dd270]
jmp 0x445b03
mov dword [esp], esi
call sub.msvcrt.dll__close
mov byte [ebx + edi], 0
jmp 0x445b05
xor ebx, ebx
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x452a81
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, eax
mov edi, edx
or eax, 0xffffffff
test edx, edx
je 0x452bff
mov esi, dword [edx]
jmp 0x452aa7
cmp al, 0x25
jne 0x452aa6
add esi, 3
jmp 0x452aa7
inc esi
mov al, byte [esi]
lea edx, [eax - 0x41]
cmp dl, 0x19
jbe 0x452a9d
lea edx, [eax - 0x61]
cmp dl, 0x19
jbe 0x452a9d
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x452a9d
cmp al, 0x5f
je 0x452a9d
cmp al, 0x2d
je 0x452a9d
cmp al, 0x2e
je 0x452aa6
cmp al, 0x21
je 0x452aa6
cmp al, 0x7e
je 0x452aa6
cmp al, 0x2a
je 0x452aa6
cmp al, 0x27
je 0x452aa6
cmp al, 0x28
je 0x452aa6
cmp al, 0x29
je 0x452aa6
cmp al, 0x25
jne 0x452b21
mov dl, byte [esi + 1]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x452b04
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x452b04
sub edx, 0x41
cmp dl, 5
ja 0x452b81
mov dl, byte [esi + 2]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x452aa1
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x452aa1
sub edx, 0x41
cmp dl, 5
jbe 0x452aa1
jmp 0x452b81
cmp al, 0x2f
je 0x452a9d
cmp al, 0x3b
je 0x452a9d
cmp al, 0x3f
je 0x452aa6
cmp al, 0x3a
je 0x452aa6
cmp al, 0x40
je 0x452aa6
cmp al, 0x26
je 0x452aa6
cmp al, 0x3d
je 0x452aa6
cmp al, 0x2b
je 0x452aa6
cmp al, 0x24
je 0x452aa6
cmp al, 0x2c
je 0x452aa6
cmp al, 0x5b
je 0x452aa6
cmp al, 0x5d
je 0x452aa6
test ebx, ebx
je 0x452bfb
test byte [ebx + 0x24], 1
je 0x452c07
cmp al, 0x7d
je 0x452a9d
cmp al, 0x7b
je 0x452a9d
cmp al, 0x7c
je 0x452aa6
cmp al, 0x5c
je 0x452aa6
cmp al, 0x5e
je 0x452aa6
cmp al, 0x60
je 0x452aa6
jmp 0x452c07
mov dword [esp], eax
call dword [0x5dd270]
test byte [ebx + 0x24], 2
mov eax, dword [edi]
je 0x452be0
mov edx, esi
mov dword [esp], eax
sub edx, eax
mov dword [esp + 4], edx
call fcn.00479405
jmp 0x452bf8
mov edx, esi
mov dword [esp + 8], 0
sub edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004522b2
mov dword [ebx + 0x1c], eax
mov dword [edi], esi
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x452bbd
jmp 0x452bc6