joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457a30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x410], eax
test edi, edi
je 0x457b42
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x457b42
test ebx, ebx
je 0x457b42
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00431580
lea ecx, [ebp - 0x404]
add esp, 0xc
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x457a90
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x457b42
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x1c]
sub eax, 1
je 0x457adf
sub eax, 3
je 0x457b36
sub eax, 3
jne 0x457ae8
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x408]
push eax
push ebx
lea eax, [ebp + 0x1c]
push eax
push 0
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x40c]
test eax, eax
mov ecx, 1
mov ebx, 0
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042bd08
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x408], 4
jmp 0x457ae8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bd08
mov esp, ebp
pop ebp
ret
Function at 0x458cc0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x458d0a
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x459d60
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 8]
mov dword [esi + 0x4c], 0x67452301
push eax
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov dword [esi + 0x5c], 0xc3d2e1f0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00431580
xor eax, eax
add esp, 0xc
mov word [esi + 0x48], ax
xorps xmm0, xmm0
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], eax
pop esi
ret
Function at 0x45e290
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470ef8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x38], ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
sub eax, dword [edi]
test eax, 0xfffffffc
je 0x45e3d8
cmp dword [ebp + 0xc], 0xffffffff
jne 0x45e2ed
call fcn.0045e920
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x45e2ed
xor al, al
jmp 0x45e3da
cmp dword [ebx + 0x94], 0x10
lea eax, [ebx + 0x80]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
jb 0x45e30c
mov eax, dword [eax]
lea ecx, [ebp - 0x30]
push ecx
push 0x2001f
push 0
push eax
push dword [ebx + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [ebp - 0x30]
test eax, eax
je 0x45e33c
test ebx, ebx
je 0x45e3d8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x30], ebx
test ebx, ebx
je 0x45e3d8
mov esi, dword [edi]
mov edi, dword [edi + 4]
cmp esi, edi
je 0x45e3c0
nop dword [eax]
push dword [esi]
lea eax, [ebp - 0x28]
push eax
call fcn.00465a10
add esp, 8
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x45e36d
mov eax, dword [eax]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
sete byte [ebp - 0x29]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x45e397
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00401800
mov ecx, dword [ebp - 0x34]
add esi, 4
cmp byte [ebp - 0x29], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
lea eax, [ecx + 1]
mov byte [ebp - 0x28], 0
cmove eax, ecx
mov dword [ebp - 0x34], eax
cmp esi, edi
jne 0x45e350
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x34], 0
jle 0x45e3d8
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x38]
call fcn.0045feb0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bd08
mov esp, ebp
pop ebp
ret 8
Function at 0x45e5b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x470fcb
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x449], 1
call fcn.0045e920
cmp eax, 0xffffffff
jne 0x45e603
mov dword [ebp - 0x454], 2
jmp 0x45e613
mov ecx, 0x3e7
cmp eax, ecx
cmovge eax, ecx
mov dword [ebp - 0x454], eax
cmp dword [esi + 0x94], 0x10
lea eax, [esi + 0x80]
mov dword [ebp - 0x450], 0
jb 0x45e62e
mov eax, dword [eax]
lea ecx, [ebp - 0x450]
push ecx
push 0x20019
push 0
push eax
push dword [esi + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [ebp - 0x450]
test eax, eax
je 0x45e667
test edi, edi
je 0x45e7e9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x450], edi
test edi, edi
je 0x45e7e9
mov esi, 1
cmp dword [ebp - 0x454], esi
jl 0x45e7e2
push esi
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x30]
movq qword [ebp - 0x1f], xmm0
push 0x473788
push eax
movups xmmword [ebp - 0x2f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
call fcn.00401c50
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.00431580
add esp, 0x18
mov dword [ebp - 0x458], 0x3ff
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x430]
push eax
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x45e7d5
cmp byte [ebp - 0x430], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], 0
mov byte [ebp - 0x448], 0
jne 0x45e732
xor eax, eax
jmp 0x45e749
lea eax, [ebp - 0x430]
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45e740
sub eax, edx
push eax
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x448]
call fcn.004040b0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0x45c], esi
test ecx, ecx
je 0x45e83b
mov eax, dword [ecx]
lea edx, [ebp - 0x448]
push edx
lea edx, [ebp - 0x45c]
push edx
mov eax, dword [eax + 8]
call eax
test al, al
sete byte [ebp - 0x44a]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x434]
cmp eax, 0x10
jb 0x45e7b1
inc eax
lea ecx, [ebp - 0x448]
push eax
push dword [ebp - 0x448]
call fcn.00401800
cmp byte [ebp - 0x44a], 0
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], 0
mov byte [ebp - 0x448], 0
jne 0x45e832
inc esi
cmp esi, dword [ebp - 0x454]
jle 0x45e680
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x45e80f
mov esi, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov dword [ebp + 0x2c], 0
mov al, byte [ebp - 0x449]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bd08
mov esp, ebp
pop ebp
ret 0x28
mov byte [ebp - 0x449], 0
jmp 0x45e7e2
call fcn.0042d3cf
int3
Function at 0x45e920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47105b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ecx + 0x80]
mov dword [ebp - 0x22c], 0
or edi, 0xffffffff
cmp dword [eax + 0x14], 0x10
jb 0x45e969
mov eax, dword [eax]
lea edx, [ebp - 0x22c]
push edx
push 0x2001f
push 0
push eax
push dword [ecx + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [ebp - 0x22c]
test eax, eax
je 0x45e9a2
test esi, esi
je 0x45eb5a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x45eb5a
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 0x234], 0
push 0
push eax
call fcn.00431580
add esp, 0xc
mov dword [ebp - 0x230], 0x200
lea eax, [ebp - 0x230]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x45eb53
nop dword [eax + eax]
cmp byte [ebp - 0x210], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
jne 0x45ea3c
xor ecx, ecx
jmp 0x45ea4e
lea ecx, [ebp - 0x210]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45ea45
sub ecx, edx
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.004040b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x228]
push eax
call fcn.004652f0
add esp, 4
mov bl, al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x214]
cmp ecx, 0x10
jb 0x45eacd
mov edx, dword [ebp - 0x228]
inc ecx
cmp ecx, 0x1000
jb 0x45eac4
test dl, 0x1f
jne 0x45eb78
mov eax, dword [edx - 4]
cmp eax, edx
jae 0x45eb78
sub edx, eax
cmp edx, 4
jb 0x45eb78
cmp edx, 0x23
ja 0x45eb78
mov edx, eax
push edx
call fcn.0042bd03
add esp, 4
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
test bl, bl
je 0x45eb00
lea eax, [ebp - 0x210]
push eax
call fcn.0044118a
add esp, 4
cmp eax, edi
cmovg edi, eax
mov ebx, dword [ebp - 0x234]
lea eax, [ebp - 0x210]
push 0x200
push 0
inc ebx
push eax
mov dword [ebp - 0x234], ebx
call fcn.00431580
add esp, 0xc
mov dword [ebp - 0x230], 0x200
lea eax, [ebp - 0x230]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x45ea00
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bd08
mov esp, ebp
pop ebp
ret
call fcn.00435909
int3
Function at 0x45f900
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], eax
cmp dword [edi + 0x94], 0x10
lea esi, [edi + 0x80]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
jb 0x45f933
mov eax, dword [esi]
jmp 0x45f935
mov eax, esi
push eax
push dword [edi + 0x64]
call fcn.0045f580
add esp, 8
test al, al
jne 0x45f957
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042bd08
mov esp, ebp
pop ebp
ret 8
push ebx
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
push dword [ebp - 0x2c]
xor bl, bl
call fcn.0045e850
cmp dword [ebp - 0x34], 0
jle 0x45fa7c
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x28], 0
jb 0x45f981
mov esi, dword [esi]
lea eax, [ebp - 0x28]
push eax
push 0x2001f
push 0
push esi
push dword [edi + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [ebp - 0x28]
test eax, eax
je 0x45f9b1
test edi, edi
je 0x45fa7c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x28], edi
test edi, edi
je 0x45fa7c
mov ecx, dword [ebp - 0x2c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45f9c0
sub ecx, edx
mov edx, dword [ebp - 0x30]
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x45f9d0
sub edx, esi
lea eax, [edx + ecx]
lea esi, [eax*2 + 0xe]
push esi
call fcn.0042c0b7
push esi
mov esi, eax
mov dword [ebp - 0x38], eax
push 0
push esi
call fcn.00431580
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push str._s__s
push esi
call fcn.00401c50
push dword [ebp - 0x34]
xorps xmm0, xmm0
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x24]
movq qword [ebp - 0x13], xmm0
push 0x473788
push eax
movups xmmword [ebp - 0x23], xmm0
mov dword [ebp - 0xb], 0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.00401c50
mov ecx, esi
add esp, 0x2c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45fa42
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmove ebx, ecx
call fcn.0042c0c0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0042bd08
mov esp, ebp
pop ebp
ret 8
Function at 0x45feb0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471376
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x45fefa
call fcn.0045e920
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x45fefa
xor al, al
jmp 0x4600fe
cmp dword [esi + 0x94], 0x10
lea eax, [esi + 0x80]
mov dword [ebp - 0x448], 0
jb 0x45ff15
mov eax, dword [eax]
lea ecx, [ebp - 0x448]
push ecx
push 0x2001f
push 0
push eax
push dword [esi + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [ebp - 0x448]
test eax, eax
je 0x45ff4e
test ebx, ebx
je 0x4600fc
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x448], ebx
test ebx, ebx
je 0x4600fc
mov esi, 1
mov edi, esi
mov dword [ebp - 0x44c], esi
cmp dword [ebp + 8], esi
jl 0x4600f5
nop dword [eax]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00431580
lea eax, [ebp - 0x428]
mov dword [ebp - 0x450], 0x3ff
push edi
push eax
call fcn.00465a10
add esp, 0x14
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x414], 0x10
lea eax, [ebp - 0x428]
push ecx
cmovae eax, dword [ebp - 0x428]
lea ecx, [ebp - 0x410]
push ecx
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4600ab
cmp esi, edi
je 0x4600a4
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x45fff0
push dword [ebp - 0x44c]
lea eax, [ebp - 0x440]
sub esi, ecx
push eax
call fcn.00465a10
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 1
cmp dword [ecx + 0x14], 0x10
jb 0x46001c
mov ecx, dword [ecx]
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x410]
push eax
push 1
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete byte [ebp - 0x441]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x42c]
cmp eax, 0x10
jb 0x46005e
inc eax
lea ecx, [ebp - 0x440]
push eax
push dword [ebp - 0x440]
call fcn.00401800
cmp byte [ebp - 0x441], 0
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
je 0x46009e
cmp dword [ebp - 0x414], 0x10
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [ebp - 0x44c]
inc esi
mov dword [ebp - 0x44c], esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x414]
cmp eax, 0x10
jb 0x4600d0
inc eax
lea ecx, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
call fcn.00401800
inc edi
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
cmp edi, dword [ebp + 8]
jle 0x45ff70
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bd08
mov esp, ebp
pop ebp
ret 4
Function at 0x461510
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x461719
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x461718
cmp eax, 0x29
jne 0x461548
cmp dword [esi + 0x10], 0
jne 0x461718
test dword [esi + 0x50], 0x10000000
je 0x46171d
cmp eax, 0x2e
jne 0x46159f
push 5
lea ecx, [esi + 0x24]
call fcn.004641b0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x461593
cmp byte [eax], 0x5c
jne 0x461591
inc eax
cmp eax, ecx
je 0x461591
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x46157e
mov dl, byte [eax]
cmp dl, 0x28
je 0x46158f
cmp dl, 0x29
je 0x46158f
test cl, 0x10
jne 0x461591
mov cl, byte [eax]
cmp cl, 0x7b
je 0x46158f
cmp cl, 0x7d
jne 0x461591
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00464c30
jmp 0x461705
cmp eax, 0x5c
jne 0x461644
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4615e4
cmp byte [eax], 0x5c
jne 0x4615e2
inc eax
cmp eax, ecx
je 0x4615e2
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x4615cf
mov dl, byte [eax]
cmp dl, 0x28
je 0x4615e0
cmp dl, 0x29
je 0x4615e0
test cl, 0x10
jne 0x4615e2
mov cl, byte [eax]
cmp cl, 0x7b
je 0x4615e0
cmp cl, 0x7d
jne 0x4615e2
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00464c30
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x461611
cmp byte [esi + 0x48], 0x62
jne 0x461611
push 4
lea ecx, [esi + 0x24]
call fcn.004641b0
mov ecx, esi
call fcn.00464260
jmp 0x46170c
test eax, eax
je 0x461638
cmp byte [esi + 0x48], 0x42
jne 0x461638
push 4
lea ecx, [esi + 0x24]
call fcn.004641b0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00464260
jmp 0x46170c
mov ecx, esi
call fcn.00461740
jmp 0x461705
cmp eax, 0x5b
jne 0x461667
mov ecx, esi
call fcn.00464260
mov ecx, esi
call fcn.00461e70
push 4
push 0x5d
mov ecx, esi
call fcn.00463970
jmp 0x461705
cmp eax, 0x28
jne 0x461691
mov ecx, esi
call fcn.00464260
mov ecx, esi
call fcn.00464ea0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00463970
test bl, bl
je 0x46170c
jmp 0x461705
cmp eax, 0x5e
jne 0x4616a9
push 2
lea ecx, [esi + 0x24]
call fcn.004641b0
mov ecx, esi
call fcn.00464260
jmp 0x46170c
cmp eax, 0x24
jne 0x4616c1
push 3
lea ecx, [esi + 0x24]
call fcn.004641b0
mov ecx, esi
call fcn.00464260
jmp 0x46170c
cmp eax, 0x2a
je 0x461732
cmp eax, 0x2b
je 0x461732
cmp eax, 0x3f
je 0x461732
cmp eax, 0x7b
je 0x461732
cmp eax, 0x7d
jne 0x4616e3
test dword [esi + 0x50], 0x10000000
je 0x461724
cmp eax, 0x5d
jne 0x4616f1
test dword [esi + 0x50], 0x10000000
je 0x46172b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004608d0
mov ecx, esi
call fcn.00464260
mov ecx, esi
call fcn.004642b0
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x461520
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.0042d42c
push 6
call fcn.0042d42c
push 4
call fcn.0042d42c
push 0xa
call fcn.0042d42c
int3
Function at 0x466830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472158
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b0408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x466993
cmp byte [ebx + 0x3d], 0
je 0x466993
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x466884
xor al, al
jmp 0x466995
mov ecx, 0xf
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 8
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
nop
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x466909
sub eax, 1
je 0x46690d
sub eax, 2
je 0x46695f
xor bl, bl
jmp 0x466961
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x466945
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00468fc2
add esp, 0x10
cmp esi, eax
jne 0x466905
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x46695f
test esi, esi
jne 0x4668d0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404d50
jmp 0x4668c9
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x46697d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00401800
mov dword [ebp - 0x14], 0xf
mov al, bl
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jmp 0x466995
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bd08
mov esp, ebp
pop ebp
ret
Function at 0x404830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xc]
cmp dword [esi + 4], 0xffffffff
je 0x4048a5
cmp dword [esi + 0x54], 0xffffffff
je 0x4048a5
cmp dword [esi + 0x1ac], 0
je 0x404858
mov ecx, esi
call fcn.00404b90
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x198], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x404c80
push 0
push 0
mov dword [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1ac], eax
test eax, eax
je 0x4048a5
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4048c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xc]
cmp dword [esi + 0x2c], 0
je 0x4048d9
mov ecx, esi
call fcn.00404c30
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x4048fc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
mov dword [esi + 0x24], 0
push eax
push 0
push esi
push 0x4066d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x4048ee
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404b90
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xc]
cmp dword [esi + 0x1ac], 0
je 0x404c1c
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x404bfb
push eax
mov dword [esi + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x404bfb
mov eax, dword [esi + 0x1ac]
test eax, eax
je 0x404c1c
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x404c06
push 0
push dword [esi + 0x1ac]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1ac], 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
xor eax, eax
pop esi
ret
push dword [esi + 0x1ac]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1ac], 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, 1
pop esi
ret