joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6efc1867
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x6efc18b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x6efc1c40
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6efc603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6efc6034]
sub esp, 4
test ebx, ebx
je 0x6efc1c8b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6efc1c84
test esi, esi
je 0x6efc1c84
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6efc1c60
mov dword [esp], 0x6efc603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x6efc1e70
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6efc4290
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x6efc1ec0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6efc1f98
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6efc1efe
cmp eax, 4
jne 0x6efc1f20
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6efc1f0e
cmp edx, 4
je 0x6efc1f0e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6efc1e70
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.513ytzwy]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.513ytzwy]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.513ytzwy]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.513ytzwy]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.513ytzwy]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.513ytzwy]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40bc80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40bd12
mov eax, dword [0x418284]
test eax, eax
je 0x40bd06
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x40bd81
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x40bd27
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.0040b8d0
cmp eax, 7
jne 0x40bd9f
mov eax, dword [0x418284]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40bd72
mov edx, dword [eax + 0x30]
test edx, edx
js 0x40bd90
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x40bd53
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.0040b0e0
mov eax, dword [0x418284]
jmp 0x40bca2
mov dword [esp], edi
call fcn.0040b740
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40bcb7
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40bcf5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x40bcf5
call fcn.0040b0e0
mov eax, dword [0x418284]
jmp 0x40bce0
call fcn.0040b3b0
mov eax, dword [0x418284]
jmp 0x40bcad
call fcn.0040b3b0
mov eax, dword [0x418284]
jmp 0x40bceb
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, reloc.shlwapi.dll_PathCombineA
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x7b0dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x7b0dff
lcall 0x5de5, 0x8b10c483
jmp loc.00c92a88
Function at 0x407340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov ebx, ecx
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xc8
jb 0x40734f
lea ecx, [ebx + 0x28]
call fcn.0040a5c0
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x419c70
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x24]
mov ecx, dword [eax + 0x10]
cmp byte [ecx], 0x25
jne 0x419e1d
push esi
call fcn.00420a10
push esi
call fcn.00412b90
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x419caf
push str.xmlParsePEReference:_no_name_n
push 0x44
push esi
call fcn.00412550
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov edx, dword [esi + 0x24]
mov eax, dword [edx + 0x10]
cmp byte [eax], 0x3b
jne 0x419e10
push esi
call fcn.00420a10
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x419ce4
mov eax, dword [eax + 0x60]
test eax, eax
je 0x419ce4
mov ecx, dword [esi + 4]
push ebx
push ecx
call eax
mov edi, eax
add esp, 8
test edi, edi
jne 0x419d39
cmp dword [esi + 0x1c], 1
je 0x419d1d
mov eax, dword [esi + 0x58]
test eax, eax
jne 0x419cf8
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x419d1d
push 0
push ebx
push str.PEReference:____s__not_found_n
push 0x1b
push esi
call fcn.00411ef0
add esp, 0x14
mov dword [esi + 0x64], 0
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
ret
push ebx
push str.PEReference:____s__not_found_n
push 0x1a
push esi
call fcn.00411ff0
add esp, 0x10
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
ret
mov eax, dword [edi + 0x30]
cmp eax, 4
je 0x419d64
cmp eax, 5
je 0x419d64
push 0
push ebx
push str.Internal:____s__is_not_a_parameter_entity_n
push 0x1b
push esi
call fcn.00411ef0
add esp, 0x14
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
ret
mov edx, dword [esi + 0x24]
push edi
push esi
cmp dword [edx + 0x28], 0x412070
je 0x419d8c
call fcn.00412080
push eax
push esi
call fcn.004113e0
add esp, 0x10
mov dword [esi + 0x5c], 1
pop edi
pop esi
pop ebx
ret
call fcn.00421920
push eax
push esi
call fcn.004113e0
mov eax, dword [edi + 0x30]
add esp, 0x10
cmp eax, 5
jne 0x419d2e
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x419d2e
cmp byte [eax + 1], 0x3f
jne 0x419d2e
cmp byte [eax + 2], 0x78
jne 0x419d2e
cmp byte [eax + 3], 0x6d
jne 0x419d2e
cmp byte [eax + 4], 0x6c
jne 0x419d2e
mov al, byte [eax + 5]
cmp al, 0x20
je 0x419ded
cmp al, 9
jb 0x419de5
cmp al, 0xa
jbe 0x419ded
cmp al, 0xd
jne 0x419d2e
push esi
call fcn.00418d20
mov eax, dword [esi + 0x54]
add esp, 4
cmp eax, 0x20
jne 0x419d2e
mov dword [esi + 0xac], 0xffffffff
pop edi
pop esi
pop ebx
ret
push 0
push 0x17
push esi
call fcn.00411830
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x429b80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
push esi
push edi
test edx, edx
je 0x429bbc
mov cl, byte [edx]
mov eax, ecx
and eax, 0xff
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 1
inc edx
test cl, cl
je 0x429bbc
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x429ba2
mov edx, dword [esp + 0x14]
test edx, edx
je 0x429be5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x429be5
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x429bcb
mov edx, dword [esp + 0x18]
test edx, edx
je 0x429c0e
mov cl, byte [edx]
inc edx
test cl, cl
je 0x429c0e
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x429bf4
mov ecx, dword [esp + 0xc]
xor edx, edx
pop edi
pop esi
div dword [ecx + 4]
mov eax, edx
ret
Function at 0x42a210
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
test edx, edx
je 0x42a35b
mov cl, byte [edx]
mov eax, ecx
and eax, 0xff
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 1
inc edx
test cl, cl
je 0x42a254
push ebx
mov edi, eax
mov ebx, eax
shl edi, 5
shr ebx, 3
movsx ecx, cl
add edi, ebx
add edi, ecx
mov cl, byte [edx]
xor eax, edi
inc edx
test cl, cl
jne 0x42a239
pop ebx
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
test esi, esi
je 0x42a289
mov cl, byte [esi]
inc esi
test cl, cl
je 0x42a289
mov edx, eax
mov edi, eax
shl edx, 5
shr edi, 3
movsx ecx, cl
add edx, edi
add edx, ecx
mov cl, byte [esi]
xor eax, edx
inc esi
test cl, cl
jne 0x42a26f
mov edx, dword [esp + 0x18]
test edx, edx
je 0x42a2c2
mov cl, byte [edx]
inc edx
test cl, cl
je 0x42a2b2
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x42a298
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x42a2eb
mov cl, byte [edx]
inc edx
test cl, cl
je 0x42a2eb
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x42a2d1
mov edx, dword [esp + 0x20]
test edx, edx
je 0x42a324
mov cl, byte [edx]
inc edx
test cl, cl
je 0x42a314
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x42a2fa
mov edx, eax
mov ecx, eax
shl edx, 5
shr ecx, 3
lea edx, [edx + ecx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x24]
test edx, edx
je 0x42a34d
mov cl, byte [edx]
inc edx
test cl, cl
je 0x42a34d
mov esi, eax
mov edi, eax
shl esi, 5
shr edi, 3
movsx ecx, cl
add esi, edi
add esi, ecx
mov cl, byte [edx]
xor eax, esi
inc edx
test cl, cl
jne 0x42a333
mov ecx, dword [esp + 0xc]
xor edx, edx
pop edi
pop esi
div dword [ecx + 4]
mov eax, edx
ret
xor eax, eax
mov al, byte [esi]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 1
jmp 0x42a264
Function at 0x42b980
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x42b98e
or eax, 0xffffffff
pop ebx
ret
push esi
push edi
mov edi, dword [ebx]
mov al, byte [edi]
cmp al, 0x61
jl 0x42b9a0
cmp al, 0x7a
jle 0x42ba8e
cmp al, 0x41
jl 0x42b9ac
cmp al, 0x5a
jle 0x42ba8e
cmp al, 0x30
jl 0x42b9b8
cmp al, 0x39
jle 0x42ba8e
cmp al, 0x2d
je 0x42ba8e
cmp al, 0x5f
je 0x42ba8e
cmp al, 0x2e
je 0x42ba8e
cmp al, 0x21
je 0x42ba8e
cmp al, 0x7e
je 0x42ba8e
cmp al, 0x2a
je 0x42ba8e
cmp al, 0x27
je 0x42ba8e
cmp al, 0x28
je 0x42ba8e
cmp al, 0x29
je 0x42ba8e
cmp al, 0x25
jne 0x42ba46
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x42ba11
cmp cl, 0x39
jle 0x42ba25
cmp cl, 0x61
jl 0x42ba1b
cmp cl, 0x66
jle 0x42ba25
cmp cl, 0x41
jl 0x42ba46
cmp cl, 0x46
jg 0x42ba46
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x42ba32
cmp cl, 0x39
jle 0x42ba8e
cmp cl, 0x61
jl 0x42ba3c
cmp cl, 0x66
jle 0x42ba8e
cmp cl, 0x41
jl 0x42ba46
cmp cl, 0x46
jle 0x42ba8e
cmp al, 0x3b
je 0x42ba8e
cmp al, 0x2f
je 0x42ba8e
cmp al, 0x3f
je 0x42ba8e
cmp al, 0x3a
je 0x42ba8e
cmp al, 0x40
je 0x42ba8e
cmp al, 0x26
je 0x42ba8e
cmp al, 0x3d
je 0x42ba8e
cmp al, 0x2b
je 0x42ba8e
cmp al, 0x24
je 0x42ba8e
cmp al, 0x2c
je 0x42ba8e
cmp al, 0x5b
je 0x42ba8e
cmp al, 0x5d
je 0x42ba8e
cmp al, 0x7b
je 0x42ba8e
cmp al, 0x7d
je 0x42ba8e
cmp al, 0x7c
je 0x42ba8e
cmp al, 0x5c
je 0x42ba8e
cmp al, 0x5e
je 0x42ba8e
cmp al, 0x60
jne 0x42baa0
cmp al, 0x25
jne 0x42ba9a
add edi, 3
jmp 0x42b992
inc edi
jmp 0x42b992
mov esi, dword [esp + 0x10]
test esi, esi
je 0x42baed
mov eax, dword [esi + 0x20]
test eax, eax
je 0x42bab9
push eax
call dword [0x44ac58]
add esp, 4
test byte [esi + 0x24], 2
mov eax, dword [ebx]
je 0x42bada
mov ecx, edi
sub ecx, eax
push ecx
push eax
call fcn.00410960
add esp, 8
mov dword [esi + 0x20], eax
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov edx, edi
push 0
sub edx, eax
push edx
push eax
call fcn.0042b500
add esp, 0xc
mov dword [esi + 0x20], eax
mov dword [ebx], edi
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x42bf50
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x42bf5e
or eax, 0xffffffff
pop ebx
ret
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [ebx]
mov dl, 1
mov al, byte [edi]
cmp al, 0x61
jl 0x42bf76
cmp al, 0x7a
jle 0x42c06d
cmp al, 0x41
jl 0x42bf82
cmp al, 0x5a
jle 0x42c06d
cmp al, 0x30
jl 0x42bf8e
cmp al, 0x39
jle 0x42c06d
cmp al, 0x2d
je 0x42c06d
cmp al, 0x5f
je 0x42c06d
cmp al, 0x2e
je 0x42c06d
cmp al, 0x21
je 0x42c06d
cmp al, 0x7e
je 0x42c06d
cmp al, 0x2a
je 0x42c06d
cmp al, 0x27
je 0x42c06d
cmp al, 0x28
je 0x42c06d
cmp al, 0x29
je 0x42c06d
cmp al, 0x25
jne 0x42c01c
mov cl, byte [edi + 1]
cmp cl, 0x30
jl 0x42bfe7
cmp cl, 0x39
jle 0x42bffb
cmp cl, 0x61
jl 0x42bff1
cmp cl, 0x66
jle 0x42bffb
cmp cl, 0x41
jl 0x42c01c
cmp cl, 0x46
jg 0x42c01c
mov cl, byte [edi + 2]
cmp cl, 0x30
jl 0x42c008
cmp cl, 0x39
jle 0x42c06d
cmp cl, 0x61
jl 0x42c012
cmp cl, 0x66
jle 0x42c06d
cmp cl, 0x41
jl 0x42c01c
cmp cl, 0x46
jle 0x42c06d
cmp al, 0x3b
je 0x42c06d
cmp al, 0x2f
je 0x42c06d
cmp al, 0x3f
je 0x42c06d
cmp al, 0x3a
je 0x42c06d
cmp al, 0x40
je 0x42c06d
cmp al, 0x26
je 0x42c06d
cmp al, 0x3d
je 0x42c06d
cmp al, 0x2b
je 0x42c06d
cmp al, 0x24
je 0x42c06d
cmp al, 0x2c
je 0x42c06d
cmp al, 0x5b
je 0x42c06d
cmp al, 0x5d
je 0x42c06d
test esi, esi
je 0x42c0c8
test byte [esi + 0x24], dl
je 0x42c07f
cmp al, 0x7b
je 0x42c06d
cmp al, 0x7d
je 0x42c06d
cmp al, 0x7c
je 0x42c06d
cmp al, 0x5c
je 0x42c06d
cmp al, 0x5e
je 0x42c06d
cmp al, 0x60
jne 0x42c07f
cmp al, 0x25
jne 0x42c079
add edi, 3
jmp 0x42bf68
inc edi
jmp 0x42bf68
test esi, esi
je 0x42c0c8
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x42c094
push eax
call dword [0x44ac58]
add esp, 4
test byte [esi + 0x24], 2
mov eax, dword [ebx]
je 0x42c0b5
mov ecx, edi
sub ecx, eax
push ecx
push eax
call fcn.00410960
add esp, 8
mov dword [esi + 0x1c], eax
mov dword [ebx], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov edx, edi
push 0
sub edx, eax
push edx
push eax
call fcn.0042b500
add esp, 0xc
mov dword [esi + 0x1c], eax
mov dword [ebx], edi
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x430ef0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x4516dc]
sub esp, 0x100
test eax, eax
jne 0x4310a3
push ebp
push esi
push edi
call fcn.004310b0
mov eax, dword [0x4516d8]
push eax
call fcn.00402720
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
push str.XML_DEBUG_CATALOG
call esi
add esp, 8
test eax, eax
je 0x430f34
mov dword [0x4516cc], 1
mov eax, dword [0x4516d4]
test eax, eax
jne 0x431091
push str.XML_CATALOG_FILES
call esi
mov esi, eax
add esp, 4
test esi, esi
jne 0x430fee
push str.libxml2.dll
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
jne 0x430f6d
push eax
call sub.KERNEL32.dll_GetModuleHandleA
test eax, eax
je 0x430fe9
lea ecx, [esp + 0xc]
push 0xff
push ecx
push eax
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
je 0x430fe9
mov cl, byte [esp + eax + 0xc]
lea eax, [esp + eax + 0xc]
cmp cl, 0x5c
je 0x430f9f
lea edx, [esp + 0xc]
cmp eax, edx
jbe 0x430f9f
mov cl, byte [eax - 1]
dec eax
cmp cl, 0x5c
jne 0x430f8e
lea ecx, [esp + 0xc]
cmp eax, ecx
je 0x430fe9
mov edi, dword [sym.imp.MSVCRT.dll_strncpy]
lea edx, [esp + 0x10b]
sub edx, eax
push edx
push str...etccatalog
push eax
call edi
lea eax, [esp + 0x18]
push eax
call fcn.0042d270
mov esi, eax
add esp, 0x10
test esi, esi
je 0x430fe9
push 0xff
push esi
push str.file:___etc_xml_catalog
call edi
push esi
call dword [0x44ac58]
add esp, 0x10
mov esi, str.file:___etc_xml_catalog
mov ecx, dword [0x44cf40]
push ecx
push 1
call fcn.0042f600
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x431091
mov al, byte [esi]
push ebx
test al, al
lea ebx, [ebp + 0x3c]
je 0x43108a
mov al, byte [esi]
cmp al, 0x20
je 0x431025
cmp al, 9
jl 0x431021
cmp al, 0xa
jle 0x431025
cmp al, 0xd
jne 0x431028
inc esi
jmp 0x431013
mov al, byte [esi]
test al, al
je 0x431085
mov ecx, esi
cmp al, 0x20
je 0x431048
cmp al, 9
jl 0x43103c
cmp al, 0xa
jle 0x431048
cmp al, 0xd
je 0x431048
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x431030
mov edx, esi
sub edx, ecx
push edx
push ecx
call fcn.00410960
mov edi, eax
add esp, 8
test edi, edi
je 0x431085
mov eax, dword [0x44cf40]
push 0
push eax
push edi
push 0
push 0
push 1
call fcn.0042f6a0
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x43107b
mov ebx, eax
push edi
call dword [0x44ac58]
add esp, 4
cmp byte [esi], 0
jne 0x431013
mov dword [0x4516d4], ebp
pop ebx
mov ecx, dword [0x4516d8]
push ecx
call fcn.00402720
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x100
ret

Function at 0x4310b0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x4516dc]
test eax, eax
jne 0x4310e9
push str.XML_DEBUG_CATALOG
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x4310d5
mov dword [0x4516cc], 1
call fcn.00435360
mov dword [0x4516d8], eax
mov dword [0x4516dc], 1
ret