joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017011
Capabilities:
Link many functions at runtime

Disassembly:
push 0x21c
mov eax, 0x1008a082
call fcn.1003800f
mov edi, ecx
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.10050310
add esp, 0xc
lea ecx, [ebp - 0x228]
push edi
call fcn.10015938
mov dword [ebp - 4], ebx
cmp dword [edi + 0x3c], ebx
jne 0x1001717c
mov ecx, edi
call fcn.1001718f
push 1
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10017244
add esp, 0xc
test eax, eax
jne 0x1001709c
push str.McLWAPI.DLL
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10056804
add esp, 0xc
test eax, eax
jne 0x1001709c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x3c], eax
cmp dword [edi + 0x3c], 0
jne 0x100170ef
push 4
call fcn.10005f35
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
test eax, eax
je 0x100170e6
call esi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x21c]
push eax
push str.McLWAPI.DLL
push str.LoadLibrary:_s_failed__error_code:_d
push 0xa5
push str.CMcLightWeightAPIWrapper::Init
push str.e:_buildenginespace_temp_bbb325e7_afe9_463c_b2d3_becb043abe3e_securitycenterincludeMcLightWeightAPIWrapper.h
push 4
call fcn.10015595
add esp, 0x1c
call esi
mov ebx, eax
jmp 0x1001717c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegisterProtectionProvider
push dword [edi + 0x3c]
call esi
push str.UnregisterProtectionProvider
push dword [edi + 0x3c]
mov dword [edi + 0x20], eax
call esi
push str.NotifyProtectionStatusChange
push dword [edi + 0x3c]
mov dword [edi + 0x24], eax
call esi
push str.ReportStatisticData
push dword [edi + 0x3c]
mov dword [edi + 0x28], eax
call esi
push str.GetStatisticData
push dword [edi + 0x3c]
mov dword [edi + 0x2c], eax
call esi
push str.SetStatisticDataStorageFormat
push dword [edi + 0x3c]
mov dword [edi + 0x30], eax
call esi
push str.GetStatisticDataStorageFormat
push dword [edi + 0x3c]
mov dword [edi + 0x34], eax
call esi
mov dword [edi + 0x38], eax
cmp dword [edi + 0x20], ebx
je 0x10017172
cmp dword [edi + 0x24], ebx
je 0x10017172
cmp dword [edi + 0x28], ebx
je 0x10017172
cmp dword [edi + 0x2c], ebx
je 0x10017172
cmp dword [edi + 0x30], ebx
je 0x10017172
cmp dword [edi + 0x34], ebx
je 0x10017172
test eax, eax
jne 0x1001717c
mov ecx, edi
call fcn.100162d8
push 0x7f
pop ebx
lea ecx, [ebp - 0x228]
call fcn.10015aa6
mov eax, ebx
call fcn.10037fb9
ret
Function at 0x10017244
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x100b802c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x444]
push esi
push edi
push 6
pop ecx
push 6
mov esi, str.Install_Dir
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x1009286c
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
push 0x410
xor esi, esi
push esi
push eax
call fcn.10050310
add esp, 0xc
mov dword [ebp - 0x448], esi
test ebx, ebx
je 0x10017473
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10017473
push esi
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x44c], 0x410
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWAREMcAfeeMSC
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.100199ca
add esp, 0x1c
test eax, eax
jne 0x1001730f
cmp dword [ebp - 0x448], 1
jne 0x1001730f
lea eax, [ebp - 0x444]
push eax
call fcn.100156ae
dec eax
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.10056bcc
add esp, 0xc
test eax, eax
jne 0x100173c3
xor eax, eax
mov dword [ebp - 0x44c], 0x208
mov word [ebp - 0x444], ax
lea eax, [ebp - 0x444]
push 0x208
push eax
push str.7323885B_407F_4839_9695_96F545FF6286
call fcn.1001970b
add esp, 0xc
test eax, eax
je 0x10017388
lea eax, [ebp - 0x444]
push eax
call fcn.100156ae
dec eax
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.10056bcc
add esp, 0xc
test eax, eax
je 0x10017388
push 0x5c
pop esi
lea eax, [ebp - 0x444]
push esi
push eax
call fcn.10019c03
pop ecx
pop ecx
test eax, eax
je 0x100173c6
lea ecx, [ebp - 0x444]
cmp eax, ecx
jbe 0x100173c6
xor ecx, ecx
mov word [eax + 2], cx
jmp 0x100173c6
xor eax, eax
mov word [ebp - 0x444], ax
lea eax, [ebp - 0x444]
push eax
push esi
push esi
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x10017467
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x444]
push 0x208
push eax
call fcn.10056804
add esp, 0xc
push 0x5c
pop esi
lea eax, [ebp - 0x444]
push eax
call fcn.100156ae
dec eax
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.10056bcc
add esp, 0xc
lea ecx, [ebp + eax*2 - 0x446]
mov eax, dword [ebp + 0x10]
movzx edx, word [ecx]
cmp si, dx
je 0x1001741f
test eax, eax
je 0x1001741a
push 0x10091100
lea eax, [ebp - 0x444]
push 0x208
push eax
call fcn.10056804
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10017476
jmp 0x10017426
cmp si, dx
jne 0x10017426
test eax, eax
jne 0x10017426
mov word [ecx], ax
push 0x22
pop ecx
cmp cx, word [ebp - 0x444]
lea edx, [ebp - 0x444]
lea eax, [ebp - 0x442]
cmovne eax, edx
push eax
push edi
push ebx
call fcn.10056fdf
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10017476
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
jne 0x10017476
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10017476
xor eax, eax
mov esi, 0xe8
mov word [ebx], ax
jmp 0x10017476
push 0x57
pop esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037f93
mov esp, ebp
pop ebp
ret
Function at 0x100177d1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 3
pop esi
call fcn.100178ec
mov ebx, eax
test ebx, ebx
je 0x100178e1
cmp byte [ebp + 8], 0
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
lea eax, [edi + edi]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
je 0x10017810
push str.szInstallDir32
jmp 0x10017815
push str.szInstallDir64
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
test eax, eax
jne 0x100178d6
test esi, esi
je 0x100178d6
mov ecx, esi
xor edx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, dx
jne 0x10017839
sub ecx, dword [ebp - 0x10]
mov eax, edi
sar ecx, 1
sub eax, ecx
sub eax, 1
je 0x10017887
mov ecx, esi
xor eax, eax
mov word [esi + edi*2 - 2], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, dx
jne 0x10017861
sub ecx, dword [ebp - 0x10]
mov eax, edi
sar ecx, 1
sub eax, ecx
dec eax
push eax
push 0x10091100
push esi
call fcn.10057043
add esp, 0xc
xor edx, edx
cmp dword [ebp + 0xc], 0
je 0x100178d6
mov ecx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, dx
jne 0x10017895
sub ecx, dword [ebp - 0x10]
mov eax, edi
sar ecx, 1
sub eax, ecx
sub eax, 1
je 0x100178d6
mov ecx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0x10], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, dx
jne 0x100178b6
sub ecx, dword [ebp - 0x10]
sar ecx, 1
sub edi, ecx
dec edi
push edi
push dword [ebp + 0xc]
push esi
call fcn.10057043
add esp, 0xc
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 8]
pop edi
test esi, esi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100178fe
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x100b802c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 5
mov eax, 0x20019
jne 0x10017947
cmp dword [ebp - 0x110], 0
je 0x1001794c
mov eax, 0x20219
test esi, esi
je 0x1001796f
lea ecx, [ebp - 0x11c]
push ecx
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
cmove ecx, dword [ebp - 0x11c]
jmp 0x10017971
xor ecx, ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10037f93
mov esp, ebp
pop ebp
ret
Function at 0x1001a024
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x100b802c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1001a0e0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1001a0e0
lea eax, [ebp - 0x408]
push eax
push 0x10008
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1001a0e2
xor ecx, ecx
mov dword [ebp - 0x40c], 0x400
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push ecx
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x1001a0c8
test esi, esi
jne 0x1001a0d2
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x408]
call fcn.1001a024
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1001a073
jmp 0x1001a0d2
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001a0e2
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10037f93
mov esp, ebp
pop ebp
ret
Function at 0x1001bba2
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x1001bcbe
cmp dword [ebp + 0xc], 0
je 0x1001bcbe
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x4000
mov edi, eax
call fcn.10001000
mov esi, eax
pop ecx
test esi, esi
jne 0x1001bbdf
push 8
jmp 0x1001bcaf
push edi
xor ebx, ebx
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x1001bc01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1001bcb0
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x4000
push esi
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x1001bc2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001bcb0
mov eax, dword [ebp - 8]
mov ecx, ebx
shr eax, 2
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], bl
test eax, eax
je 0x1001bca1
push 0xc
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push dword [esi + ecx*4]
mov dword [ebp - 0x14], ebx
push edi
mov dword [ebp - 0x10], ebx
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x1001bc6f
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 8]
jg 0x1001bc6f
mov eax, dword [ebp + 8]
sub eax, ecx
cmp eax, dword [ebp - 0x14]
jl 0x1001bc7d
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp - 8]
jb 0x1001bc41
jmp 0x1001bca1
mov eax, dword [ebp - 0xc]
push 0x104
push dword [ebp + 0xc]
push dword [esi + eax*4]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1001bc9b
mov byte [ebp - 1], 1
jmp 0x1001bca1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], bl
jne 0x1001bcb0
push 5
pop ebx
push esi
call fcn.10001010
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
jmp 0x1001bcc1
push 0x57
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1001bd4b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x100b802c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
call fcn.100178ec
mov edi, eax
test edi, edi
je 0x1001be24
push ebx
mov ebx, 0x80
mov dword [esi], 0x5e0
push ebx
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.10050310
add esp, 0xc
mov dword [ebp - 0x90], ebx
lea eax, [ebp - 0x90]
xor ebx, ebx
mov dword [ebp - 0x94], ebx
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x94]
push eax
push 2
push str.system_core_version
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1001be12
lea eax, [ebp - 0x88]
mov dword [ebp - 0x8c], ebx
push eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x88], ebx
push eax
lea eax, [ebp - 0x84]
push str._lu._lu
push eax
call fcn.1001bec4
mov eax, dword [ebp - 0x8c]
add esp, 0x10
cmp eax, 0xf
jb 0x1001be12
cmp dword [ebp - 0x88], 4
jb 0x1001be12
imul eax, eax, 0x64
add eax, dword [ebp - 0x88]
mov dword [esi], eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 4]
push eax
call fcn.1001bd2f
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10037f93
mov esp, ebp
pop ebp
ret

Function at 0x1001c720
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x1008a5ae
call fcn.1003800f
mov ebx, ecx
mov dword [ebp - 0x220], ebx
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x18]
xor edi, edi
mov dword [ebp - 0x224], ebx
mov dword [ebx], edi
mov ecx, esi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], esi
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.1001d6de
mov dword [esi], eax
lea esi, [ebx + 0x24]
mov dword [ebx + 0x20], edi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], edi
jb 0x1001c78d
mov eax, dword [esi]
jmp 0x1001c78f
mov eax, esi
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 1
test eax, eax
je 0x1001c7ac
push eax
mov ecx, esi
call fcn.10007826
jmp 0x1001c81a
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.10050310
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
push str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp word [ebp - 0x218], 0
je 0x1001c80b
lea eax, [ebp - 0x218]
push eax
call fcn.10057401
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.100033ff
mov eax, ebx
call fcn.10037fb9
ret 4
Function at 0x1001d551
Capabilities:
Check if file exists
Copy file
Create directory
Move file

Disassembly:
push 0x234
mov eax, 0x1008a770
call fcn.1003800f
mov edi, ecx
mov dword [ebp - 0x220], edi
mov eax, dword [ebp + 8]
lea esi, [edi + 0x14]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x224], esi
test esi, esi
je 0x1001d585
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
add edi, 0x24
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 8
jb 0x1001d597
mov eax, dword [edi]
jmp 0x1001d599
mov eax, edi
push 1
push eax
lea ecx, [ebp - 0x240]
call fcn.1001c824
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.10050310
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x1001d5c6
mov eax, dword [edi]
jmp 0x1001d5c8
mov eax, edi
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
call fcn.10002b5b
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push str.trusted.tmp
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1001d68e
cmp dword [edi + 0x14], 8
jb 0x1001d62a
mov eax, dword [edi]
jmp 0x1001d62c
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1001d658
cmp dword [edi + 0x14], 8
jb 0x1001d641
mov eax, dword [edi]
jmp 0x1001d643
mov eax, edi
push ebx
push ebx
push 2
push ebx
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
jmp 0x1001d672
cmp dword [edi + 0x14], 8
jb 0x1001d662
mov eax, dword [edi]
jmp 0x1001d664
mov eax, edi
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1001d6ae
cmp dword [edi + 0x14], 8
jb 0x1001d67e
mov edi, dword [edi]
push 4
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x240]
call fcn.1001c9ba
test esi, esi
je 0x1001d6a4
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, ebx
call fcn.10037fb9
ret 4
lea ecx, [ebp - 0x240]
call fcn.1001c9ba
push str.67136527_5D6B_4AC9_865B_3E392E982420
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov ecx, dword [ebp - 0x220]
call fcn.1001cf27
mov ecx, dword [ebp - 0x220]
call fcn.1001d181
mov ebx, eax
jmp 0x1001d699
Function at 0x1001f039
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0x4a8
mov eax, 0x1008a876
call fcn.1003800f
mov edi, ecx
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x10], esi
jne 0x1001f05b
xor eax, eax
jmp 0x1001f1ec
lea ecx, [ebp - 0x2a4]
push 3
mov dword [ebp - 0x2a8], ecx
lea ecx, [ebp - 0x2a8]
push eax
call fcn.1001ee64
mov ebx, 0x104
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10050310
push ebx
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.10050310
add esp, 0x18
push dword [ebp - 0x2a8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.1001ef99
push dword [ebp - 0x2a8]
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.1001ef99
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x100937ac
push ebx
lea eax, [ebp - 0x114]
push eax
call fcn.1001ef2b
lea eax, [ebp - 0x224]
push eax
push 0xffffffffffffffff
push 0x1001f23d
push 0x1001f222
push 0x1001f246
push 0x1001f234
push 0x1001f22b
push 0x1001f24f
push fcn.10001000
call dword [edi + 4]
mov ebx, eax
add esp, 0x24
test ebx, ebx
je 0x1001f1d0
push 0x108
lea eax, [ebp - 0x4b4]
push esi
push eax
call fcn.10050310
lea eax, [ebp - 0x4b4]
push eax
push esi
push 0x1001f254
push esi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [edi + 8]
push ebx
call dword [edi + 0xc]
add esp, 0x2c
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1001f1d0
cmp dword [ebp - 0x4b4], 0
je 0x1001f1c3
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3ac], eax
lea ecx, [ebp - 0x3ac]
push 3
lea eax, [ebp - 0x4b0]
push eax
call fcn.1001edaa
push dword [ebp - 0x3ac]
mov byte [ebp - 4], 1
call fcn.1001b208
mov esi, eax
lea eax, [ebp - 0x3a8]
pop ecx
cmp dword [ebp - 0x3ac], eax
je 0x1001f1c3
push dword [ebp - 0x3ac]
call fcn.10056501
pop ecx
lea eax, [ebp - 0x4b0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x2a4]
cmp dword [ebp - 0x2a8], eax
je 0x1001f1ea
push dword [ebp - 0x2a8]
call fcn.10056501
pop ecx
mov eax, esi
call fcn.10037fb9
ret 4
Function at 0x10023fa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4

Function at 0x10024440
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
Function at 0x10024aa0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x10024c6e
push ebx
cmp eax, 0x7c
je 0x10024c6d
cmp eax, 0x29
jne 0x10024ad7
cmp dword [esi + 0x10], 0
jne 0x10024c6d
test dword [esi + 0x50], 0x10000000
je 0x10024c72
cmp eax, 0x2e
jne 0x10024b34
push 5
lea ecx, [esi + 0x24]
call fcn.10026b20
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x10024b28
cmp word [eax], 0x5c
jne 0x10024b25
add eax, 2
cmp eax, ecx
je 0x10024b25
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x10024b11
movzx edx, word [eax]
cmp edx, 0x28
je 0x10024b23
cmp edx, 0x29
je 0x10024b23
test cl, 0x10
jne 0x10024b25
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x10024b23
cmp ecx, 0x7d
jne 0x10024b25
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.100278b0
jmp 0x10024c58
cmp eax, 0x5c
jne 0x10024b9b
mov ecx, esi
call fcn.10026ba0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x10024b67
cmp word [esi + 0x48], 0x62
jne 0x10024b67
push 4
lea ecx, [esi + 0x24]
call fcn.10026b20
mov ecx, esi
call fcn.10026ba0
jmp 0x10024c5f
test eax, eax
je 0x10024b8f
cmp word [esi + 0x48], 0x42
jne 0x10024b8f
push 4
lea ecx, [esi + 0x24]
call fcn.10026b20
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10026ba0
jmp 0x10024c5f
mov ecx, esi
call fcn.10024c90
jmp 0x10024c58
cmp eax, 0x5b
jne 0x10024bbe
mov ecx, esi
call fcn.10026ba0
mov ecx, esi
call fcn.10025220
push 4
push 0x5d
mov ecx, esi
call fcn.10026290
jmp 0x10024c58
cmp eax, 0x28
jne 0x10024be4
mov ecx, esi
call fcn.10026ba0
mov ecx, esi
call fcn.10027bb0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.10026290
test bl, bl
je 0x10024c5f
jmp 0x10024c58
cmp eax, 0x5e
jne 0x10024bfc
push 2
lea ecx, [esi + 0x24]
call fcn.10026b20
mov ecx, esi
call fcn.10026ba0
jmp 0x10024c5f
cmp eax, 0x24
jne 0x10024c14
push 3
lea ecx, [esi + 0x24]
call fcn.10026b20
mov ecx, esi
call fcn.10026ba0
jmp 0x10024c5f
cmp eax, 0x2a
je 0x10024c87
cmp eax, 0x2b
je 0x10024c87
cmp eax, 0x3f
je 0x10024c87
cmp eax, 0x7b
je 0x10024c87
cmp eax, 0x7d
jne 0x10024c36
test dword [esi + 0x50], 0x10000000
je 0x10024c79
cmp eax, 0x5d
jne 0x10024c44
test dword [esi + 0x50], 0x10000000
je 0x10024c80
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.100244f0
mov ecx, esi
call fcn.10026ba0
mov ecx, esi
call fcn.10026bf0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10024ab2
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.10034f51
push 6
call fcn.10034f51
push 4
call fcn.10034f51
push 0xa
call fcn.10034f51
int3

Function at 0x10028100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x10028131
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10028120
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x100283c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b802c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x100283ed
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x10028409
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x100283f8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x1002843f
cmp dword [ecx], edi
jne 0x10028437
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x10028447
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10028447
cmp dword [ecx], edi
jne 0x1002844a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.100233f0
push edi
call fcn.10001010
mov eax, dword [ebp - 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.10037f93
mov esp, ebp
pop ebp
ret 8