joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a84a
Capabilities:
Write file on windows

Disassembly:
push eax
lea ecx, [ebp - 4]
call fcn.004878c3
mov edi, dword [ebp - 4]
push 0
push dword [ebp + 0x10]
add edi, 0x200
push dword [ebp + 0xc]
and edi, 0xfffffe00
push dword [ebp + 8]
lea ebx, [edi + esi]
call fcn.00482cfc

Function at 0x44a8a6
Capabilities:
Write file on windows

Disassembly:
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x44a91e
cmp edx, dword [ebp + 0x10]
jne 0x44a91e
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [0x4a64e8]
test eax, eax
je 0x44a91e
push esi
push ebx
push edi
call fcn.0045c559
add byte [ebx - 0x3b7ce78b], cl
or al, 0x83
inc byte [ecx]
jne 0x44a8c6
push 0x10
push dword [ebp + 0x14]
lea eax, [ebx + 0x1ce]
push eax
call fcn.0045c575
add esp, 0xc
dec esi
push 0
push dword [ebp + 0x10]
neg esi
push dword [ebp + 0xc]
sbb esi, esi

Function at 0x44a8d3
Capabilities:
Write file on windows

Disassembly:
push dword [ebp + 8]
and esi, 0xffff55ab
add esi, 0xaa55
mov word [ebx + 0x1fe], si
call fcn.00482d75
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jne 0x44a91e
cmp edx, dword [ebp + 0x10]
jne 0x44a91e
push dword [ebp - 8]
push ebx
push edi
call fcn.00487d51
invalid

Function at 0x44b9a8
Capabilities:
Write file on windows

Disassembly:
adc byte [ebx - 0x387eebbb], cl
add byte [eax], al
add al, byte [eax]
invalid
Function at 0x44b9dc
Capabilities:
Write file on windows

Disassembly:
cmp dword [ebp + 0x14], ebx
jl 0x44bae9
jle 0x44bae0
cmp dword [ebp + 0x18], ebx
jne 0x44ba1c
mov eax, dword [ebp - 8]
cdq
cmp dword [ebp + 0x14], edx
jl 0x44ba1c
jg 0x44b9f2
cmp dword [ebp + 0x10], eax
jbe 0x44ba1c
xor cl, cl
jmp 0x44ba1e
push eax
call 0x4e0003
mov dword [ebp - 8], eax
jmp 0x44b9ce
mov cl, 1
cmp dword [ebp + 0x14], ebx
jl 0x44ba35
jg 0x44ba2e
cmp dword [ebp + 0x10], 0x10000000
jbe 0x44ba35
mov esi, 0x10000000
jmp 0x44ba38
mov esi, dword [ebp + 0x10]
cmp cl, bl
mov edx, dword [ebp + 0xc]
mov eax, esi
je 0x44baac
movzx esi, word [ebp + 0x1c]
sub esi, dword [ebp + 0x18]
cmp ebx, dword [ebp + 0x14]
jl 0x44ba57
invalid
jg 0x44ba54
cmp esi, dword [ebp + 0x10]
jbe 0x44ba57
mov esi, dword [ebp + 0x10]
push 1
push ebx
push ebx
push dword [ebp + 8]
call fcn.00483eea
add esp, 0x10
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 4]
push eax
movzx eax, word [ebp + 0x1c]
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], edx
call dword [0x4a64e8]
mov eax, dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
add eax, edi
push eax
mov dword [ebp - 0x10], edi
call fcn.0045d744
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.0043908b
movzx eax, word [ebp + 0x1c]
add esp, 0x1c
mov edx, edi
jmp 0x44bab6
cmp dword [ebp + 0x1c], ebx
je 0x44bab6
and esi, dword [ebp - 0x28]
mov eax, esi
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push edx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [0x4a6194]
sub dword [ebp + 0x10], esi
mov dword [ebp + 0x18], ebx
sbb dword [ebp + 0x14], ebx
add dword [ebp + 0xc], esi
cmp dword [ebp + 0x14], ebx
jg 0x44b9dd
jl 0x44bae9
cmp dword [ebp + 0x10], ebx
ja 0x44b9dd
lea ecx, [ebp - 0xc]
call fcn.00482d07
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44bafc
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push esi
push edi
mov eax, 0x4c1b94
mov edi, ecx
push eax
mov dword [ebp - 0xc], edi
call dword [0x4a64f0]
mov al, byte [edi + 9]
xor esi, esi
cmp dword [ebp + 0x10], esi
setl byte [ebp - 5]
and al, 0x11
cmp byte [ebp - 5], 0
mov byte [ebp - 6], al
jne 0x44bb35
test byte [ebp + 0x14], 0x40
je 0x44bb39
mov byte [ebp - 6], 0
and byte [ebp + 0x14], 1
push ebx
push 0x50
pop eax
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], eax
call fcn.0043dd9c
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], esi
call fcn.0048fac5
mov edi, dword [ebp + 8]

Function at 0x44c4cc
Capabilities:
Parse credit card information

Disassembly:
push edx
push eax
lea eax, [ebp - 0xf8]
push eax
add edi, 0x10
adc al, ch
clc
insb byte es:[edi], dx
or byte [eax], al
Function at 0x44c4d6
Capabilities:
Parse credit card information

Disassembly:
push edx
push eax
lea eax, [ebp - 0xf8]
push eax
add edi, 0x10
adc al, ch
clc
insb byte es:[edi], dx
or byte [eax], al

Function at 0x44c4e0
Capabilities:
Parse credit card information

Disassembly:
stosb byte es:[edi], al
add byte [ebx - 0x7a72f33c], al
or bh, bh
invalid

Function at 0x44c4f4
Capabilities:
Parse credit card information

Disassembly:
cmp esi, 1
jge 0x44c4fb
xor esi, esi
lea eax, [esi + 2]
push eax
lea ecx, [ebp - 0x54]
lodsb al, byte [esi]
call fcn.004904c7
dec esi

Function at 0x44c508
Capabilities:
Parse credit card information

Disassembly:
lea eax, [ebp - 0xf8]
js 0x44c21e
lea ecx, [esi + 1]
mov dx, word [eax]
mov esi, dword [ebp - 4]
mov word [esi], dx
push ss
add dword [ebp - 4], 2
inc eax
inc eax
dec ecx
jne 0x44c517
jmp 0x44c221

Function at 0x44c51f
Capabilities:
Parse credit card information

Disassembly:
lea eax, [ebp - 0xf8]
js 0x44c21e
lea ecx, [esi + 1]
mov dx, word [eax]
mov esi, dword [ebp - 4]
mov word [esi], dx
push ss
add dword [ebp - 4], 2
inc eax
inc eax
dec ecx
jne 0x44c517
jmp 0x44c221

Function at 0x44c533
Capabilities:
Parse credit card information

Disassembly:
jmp 0x44c543
cmp ax, 0x25
je 0x44c54b
cmp ax, 0x3d
je 0x44c54b
inc edi
inc edi
mov ax, word [edi]
test ax, ax
jne 0x44c535
mov eax, edi
sub eax, esi
sar eax, 1
cmp word [edi], 0x25
and eax, 0xfec4589
mov esi, 0x7d89fb45
call 0xc7113aec
inc ebp
or eax, dword [eax]
mov dword [ebp - 0x20], eax
jne 0x44c6d9
cmp byte [ebp - 6], 0
jne 0x44c5a7
mov ax, word [ebx]
cmp ax, 0x26
je 0x44c58a
cmp byte [ebp - 5], 0
je 0x44c5a7
cmp ax, 0x5e
je 0x44c5a7
inc edi
inc edi
cmp word [ebx], 0x26
mov dword [ebp - 0x28], ebx
jne 0x44c649
inc ebx
inc ebx
mov dword [ebp - 0x20], 1
jmp 0x44c649
inc edi
inc edi
cmp word [ebx], 0x5e
jne 0x44c5b5
push es
inc ebx
inc ebx
mov byte [ebp + 0xb], 8
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0xc]
and word [eax], 0
cmp byte [ebp - 8], 0
jne 0x44c635
push 0
call dword [0x4a649c]
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
push dword [ebp - 0xc]
and word [eax], 0
push ebx
call dword [0x4a6488]
mov esi, eax
test esi, esi
jle 0x44c614
invalid

Function at 0x44c554
Capabilities:
Parse credit card information

Disassembly:
and eax, 0xfec4589
mov esi, 0x7d89fb45
call 0xc7113aec
inc ebp
or eax, dword [eax]

Function at 0x44c63d
Capabilities:
Parse credit card information

Disassembly:
add byte [eax], al
cmp byte [ebp - 5], 1
jne 0x44c6d1
xor al, al
je 0x44c21e
dec edi
dec edi
xor al, al
je 0x44c6d9
dec edi
dec edi
mov eax, dword [ebp - 0x14]
add eax, 3
push eax
lea ecx, [ebp - 0x54]
call fcn.004906a8
cmp word [edi], 0x25
jne 0x44c724
lea ecx, [edi + 2]
mov ax, word [ecx]
cmp ax, 0x25
je 0x44c71f
cmp ax, 0x2a
je 0x44c71f
cmp ax, 0x40
je 0x44c71f
cmp ax, 0x23
je 0x44c71f
cmp ax, 0x7e
je 0x44c71f
push eax
call fcn.0045e4de
add esp, 4
test al, al
je 0x44c724
inc dword [ebp - 0x14]
mov edi, ecx
dec dword [ebp - 0x14]
js 0x44c21e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
inc ecx
mov dx, word [eax]
mov esi, dword [ebp - 4]
mov word [esi], dx
add dword [ebp - 4], 2
inc eax
inc eax
dec ecx
jne 0x44c734
jmp 0x44c21e
Function at 0x44c694
Capabilities:
Parse credit card information

Disassembly:
dec ebp
lock and word [esi], 0
mov esi, dword [eax]
push esi
call dword [0x4a6508]
mov ebx, eax
lea eax, [ebx + 2]
push eax
lea ecx, [ebp - 0x54]
call fcn.00490656
add al, 0
dec ebx
js 0x44c21e
lea eax, [ebx + 1]
Function at 0x44c788
Capabilities:
Parse credit card information

Disassembly:
add byte [esi + 0xf], cl
mov byte [esi - 0x72000006], cl
dec dword [ebp - 0x7499feba]

Function at 0x44c78f
Capabilities:
Parse credit card information

Disassembly:
dec dword [ebp - 0x7499feba]
or ecx, dword [ebx - 0x769903ab]
or al, byte [ebx + 0x4302fc45]

Function at 0x44c8eb
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x92], 0
jne 0x44c903
test byte [ecx + 9], 0xf
jne 0x44c903
pop ebp
jmp fcn.0044c7f3
pop ebp
jmp fcn.0044bafc

Function at 0x44d074
Capabilities:
Get disk information

Disassembly:
add byte [ebp - 0x72af27bb], cl
inc ebp
or byte [eax - 0x18], dl
pop esp
wait
add eax, dword [eax]
test eax, eax
pop ecx
pop ecx
jle 0x44d23e
mov eax, dword [ebp - 8]
cmp word [eax], 0x2a
mov esi, dword [0x4a6508]
xor eax, 0x4a6508
mov esi, 0x80070057

Function at 0x44d094
Capabilities:
Get disk information

Disassembly:
xor eax, 0x4a6508
push edi
push eax
sete byte [ebp - 1]
call esi
inc eax
inc eax
push eax
lea ecx, [ebp - 8]
call fcn.0048a26b
push 0x42f
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
call fcn.0048a254
cmp byte [ebp - 1], bl
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + 0x20e]
mov dword [ecx], ebx
mov edi, eax
mov dword [eax + 0x648], ebx
mov dword [eax], ebx
je 0x44d0e7
push eax
push 0x324
add bh, bh
adc eax, 0x4a61f0
mov eax, dword [ebp - 8]
mov edi, eax

Function at 0x44d0e2
Capabilities:
Get disk information

Disassembly:
mov eax, dword [ebp - 8]
jmp 0x44d0ec
cmp word [eax], bx
je 0x44d105
cmp word [eax + 2], 0x3a
jne 0x44d105
mov word [eax + 4], 0x5c
mov eax, dword [ebp - 8]
mov word [eax + 6], bx
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBitBucketVolume_
lea ecx, [ebp - 0xc]
call fcn.0048a34b
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0x18], eax
and ecx, edi
push es
add byte [eax], al
push eax
lea ecx, [ebp - 0xc]
call fcn.0048a2eb
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
cmp byte [ebp - 1], bl
je 0x44d15d
mov si, word [edi + 4]
push edi
mov word [edi + 4], bx
call dword [0x4a61ec]
cmp eax, 3
add esp, dword [esi - 0x77]
ja 0x44d15b
jne 0x44d20f
mov esi, dword [ebp - 0x10]
push 0x208
push esi
push edi
call dword [0x4a626c]
test eax, eax
jne 0x44d186
call dword [0x4a6498]
cmp eax, ebx
jne 0x44d17e
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
jmp 0x44d20f
push 0xa
push dword [ebp - 0x10]
push str._Volume
call fcn.0048570c
add esp, 0xc
test al, al
je 0x44d1a2
mov esi, dword [ebp - 0x10]
add esi, 0x14
push esi
call dword [0x4a6508]
lea eax, [esi + eax*2 - 2]
cmp word [eax], 0x5c
jne 0x44d1b6
mov word [eax], bx
mov eax, dword [ebp - 0x18]
and esi, ecx
push es
add byte [eax], al
cmp byte [ebp - 1], bl
je 0x44d228
push edi
call dword [0x4a6508]
lea edi, [edi + eax*2 + 2]
cmp word [edi], bx
jne 0x44d13c
lea ecx, [ebp - 0x10]
call fcn.00484446
lea ecx, [ebp - 0xc]
call fcn.0048444e
mov esi, dword [ebp - 0x14]
pop edi
jmp 0x44d243
lea ecx, [ebp - 8]
call fcn.00484461
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x44d1f0
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [ebp - 0xc]
lea eax, [esi + eax*2]
push eax
call dword [0x4a64d0]
dec edx
add byte [edx + 4], ch
lea eax, [ebp - 0x1c]
push eax
push 4
push str.MaxCapacity
push esi
mov esi, 0x80000001
push esi
call fcn.004855e1
add esp, 0x18
cmp eax, ebx
jne 0x44d1ef
mov dword [ebp - 0x14], ebx
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.NukeOnDelete
in al, dx
dec edx
add bh, bh
jne 0x44d1f3
push esi
call fcn.00485601
add dword [ebx], 0
add esp, 0x18
cmp eax, ebx
jne 0x44d20f

Function at 0x44d1f9
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [ebp - 0xc]
lea eax, [esi + eax*2]
push eax
call dword [0x4a64d0]
dec edx
add byte [edx + 4], ch
lea eax, [ebp - 0x1c]
push eax
push 4
push str.MaxCapacity
push esi
mov esi, 0x80000001
push esi
call fcn.004855e1
add esp, 0x18
cmp eax, ebx
jne 0x44d1ef
mov dword [ebp - 0x14], ebx
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.NukeOnDelete
in al, dx
dec edx
add bh, bh
jne 0x44d1f3
push esi
call fcn.00485601
add dword [ebx], 0
add esp, 0x18
cmp eax, ebx
jne 0x44d20f

Function at 0x44d202
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [ebp - 0xc]
lea eax, [esi + eax*2]
push eax
call dword [0x4a64d0]
dec edx
add byte [edx + 4], ch
lea eax, [ebp - 0x1c]
push eax
push 4
push str.MaxCapacity
push esi
mov esi, 0x80000001
push esi
call fcn.004855e1
add esp, 0x18
cmp eax, ebx
jne 0x44d1ef
mov dword [ebp - 0x14], ebx
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.NukeOnDelete
in al, dx
dec edx
add bh, bh
jne 0x44d1f3
push esi
call fcn.00485601
add dword [ebx], 0
add esp, 0x18
cmp eax, ebx
jne 0x44d20f

Function at 0x44d204
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [ebp - 0xc]
lea eax, [esi + eax*2]
push eax
call dword [0x4a64d0]
dec edx
add byte [edx + 4], ch
lea eax, [ebp - 0x1c]
push eax
push 4
push str.MaxCapacity
push esi
mov esi, 0x80000001
push esi
call fcn.004855e1
add esp, 0x18
cmp eax, ebx
jne 0x44d1ef
mov dword [ebp - 0x14], ebx
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.NukeOnDelete
in al, dx
dec edx
add bh, bh
jne 0x44d1f3
push esi
call fcn.00485601
add dword [ebx], 0
add esp, 0x18
cmp eax, ebx
jne 0x44d20f

Function at 0x44d20b
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [ebp - 0xc]
lea eax, [esi + eax*2]
push eax
call dword [0x4a64d0]
dec edx
add byte [edx + 4], ch
lea eax, [ebp - 0x1c]
push eax
push 4
push str.MaxCapacity
push esi
mov esi, 0x80000001
push esi
call fcn.004855e1
add esp, 0x18
cmp eax, ebx
jne 0x44d1ef
mov dword [ebp - 0x14], ebx
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.NukeOnDelete
in al, dx
dec edx
add bh, bh
jne 0x44d1f3
push esi
call fcn.00485601
add dword [ebx], 0
add esp, 0x18
cmp eax, ebx
jne 0x44d20f
Function at 0x44d570
Capabilities:
Write file on windows

Disassembly:
jge 0x44d57e
xor ebx, ebx
cmp word [edi], 0x3a
jne 0x44d59f
inc edi
inc edi
push 0x3a
push edi
mov dword [ebp + 0xc], edi
call dword [0x4a65c0]
test eax, eax
je 0x44d657
mov esi, edi
mov word [edi], bx
inc edi
inc edi
mov dword [ebp + 0xc], edi
jmp 0x44d62c
mov esi, dword [0x4a65bc]
push 0x5c
push ebx
push edi
call esi
push 0x2e
push ebx
push edi
call esi
mov edi, eax
inc edi
inc edi
test eax, eax
je 0x44d657
mov esi, dword [0x4a64e0]
push 0x4aed80

Function at 0x44d5de
Capabilities:
Write file on windows

Disassembly:
test eax, eax
je 0x44d627
push str.jpeg
push edi
call esi
test eax, eax
je 0x44d627
push 0x4aed50
push edi
call esi
test eax, eax
jne 0x44d601
mov esi, str.image_gif
jmp 0x44d630
push str.tiff
push edi
call esi
test eax, eax
jne 0x44d614
mov esi, str.image_tiff
jmp 0x44d630
push 0x4aed10
push edi
mov esi, str.image_jpeg
cmp esi, ebx
je 0x44d657

Function at 0x44d5ef
Capabilities:
Write file on windows

Disassembly:
test eax, eax
je 0x44d627
push str.jpeg
push edi
call esi
test eax, eax
je 0x44d627
push 0x4aed50
push edi
call esi
test eax, eax
jne 0x44d601
mov esi, str.image_gif
jmp 0x44d630
push str.tiff
push edi
call esi
test eax, eax
jne 0x44d614
mov esi, str.image_tiff
jmp 0x44d630
push 0x4aed10
push edi
mov esi, str.image_jpeg
cmp esi, ebx
je 0x44d657

Function at 0x44d61a
Capabilities:
Write file on windows

Disassembly:
call esi
test eax, eax
jne 0x44d657
mov esi, str.image_bmp
jmp 0x44d630
Function at 0x45675a
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov ax, word [esi]
cmp ax, 0x2d
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], 0xfffffff0
mov byte [ebp + 0x6f], 0
mov byte [ebp + 0x5f], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x2b], 0
inc ebp
sub eax, dword [eax]
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x2a], 0
mov byte [ebp + 0x29], 0
mov dword [ebp + 0x4c], ebx
mov cl, 0x2a
jne 0x456794
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [ebp + 0x14], ecx
jne 0x4569e7

Function at 0x4567ef
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
test al, al
je 0x45683c
lea eax, [ebp + 0x78]
add esi, 2
push eax
mov dword [ebp + 0x30], esi
call fcn.0045ad94
cmp word [esi], 0x3a
pop ecx
je 0x456812
or dword [ebp + 0x4c], 7
lea eax, [ebp + 0x60]
push eax
inc esi
lea eax, [ebp + 0x30]
inc esi
push eax
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x30], esi
call fcn.004903a7
test eax, eax
pop ecx
pop ecx
jle 0x4569d8
mov eax, dword [ebp + 0x60]
or dword [ebp + 0x4c], eax
jmp 0x4569d8
push 2
push esi
push 0x4af560
call fcn.0048edc0
add esp, 0xc
test al, al
lea eax, [ebp + 0x78]
je 0x456888
add esi, 4
push eax
mov dword [ebp + 0xc], esi
call 0x45adf1
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x60], ebx
call fcn.0049f1e7
add esp, 0xc
test eax, eax
jle 0x4569d8
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ebx
jmp 0x4569d8
push 2
pop esi
push esi
push eax
push 0x4aaeec
call fcn.00495890
add esp, 0xc
test al, al
je 0x4568a7
mov byte [ebp + 0x65], 1
jmp 0x4569d8
xor dword [ecx], eax
add byte [eax], al
push 4
lea eax, [ebp + 0x78]
push eax
push str.byte
call fcn.004958b0
add esp, 0xc
test al, al
je 0x4568c7
mov byte [ebp + 0x64], 1
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4aa480
call fcn.004958cf
add esp, 0xc
test al, al
je 0x4568e6
mov byte [ebp + 0x67], 3
jmp 0x4569d8
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4af554
call fcn.004958ee
add esp, 0xc
test al, al
je 0x456905
or byte [ebp + 0x67], 1
jmp 0x4569d8
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4af550
call fcn.0049590d
add esp, 0xc
test al, al
Function at 0x456ab8
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
movzx eax, word [esi + 2]
cmp dword [ebp + 0x14], eax
jne 0x4569e7
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x4569e7
call fcn.0048d9f9
test al, al
jne 0x4569e7
xor edi, edi
mov esi, ecx
inc edi
push edi
push esi
push 0x4af564
mov dword [ebp + 0x78], esi
call fcn.0048ed63
add esp, 0xc
je 0x456924
or byte [ebp + 0x67], 2
jmp 0x4569d8
push 4
lea eax, [ebp + 0x78]
push eax
push str.name
call fcn.0049592d
add esp, 0xc
test al, al
je 0x456944
mov byte [ebp + 0x2b], 1
jmp 0x4569d8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4af544
call fcn.0049594c
add esp, 0xc
test al, al
je 0x45695f
inc byte [ebp + 0x66]
jmp 0x4569d8
push esi
lea eax, [ebp + 0x78]
inc ebp
js 0x4569b4
push 0x4af540
call fcn.00495967
add esp, 0xc
test al, al
je 0x45697a
dec byte [ebp + 0x66]
jmp 0x4569d8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4af53c
call fcn.00495982
add esp, 0xc
test al, al
je 0x456995
inc byte [ebp + 0x53]
jmp 0x4569d8
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4af538
call fcn.0049599d
add esp, 0xc
test al, al
je 0x4569b1
mov byte [ebp + 0x2a], 1
jmp 0x4569d8
push 4
lea eax, [ebp + 0x78]
push eax
push str.init
call fcn.004959ba
add esp, 0xc
test al, al
je 0x4569ce
mov byte [ebp + 0x29], 1
jmp 0x4569d8
lea eax, [ebp + 0x78]
push eax
call fcn.0045af69
xchg edx, eax
inc ebp
add byte [eax], al
pop ecx
mov esi, dword [ebp + 0x78]
movzx eax, word [esi]
cmp dword [ebp + 0x14], eax
je 0x4567a5
lea ecx, [ebp + 8]
call fcn.00493b69
lea ecx, [ebp - 0x10]
call fcn.00493b71
lea ecx, [ebp + 0x10]
call fcn.00493b79
lea ecx, [ebp + 4]
call fcn.00493b81
lea ecx, [ebp]
call fcn.00493b89
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x456a61
cmp cx, 0x75
je 0x456a61
cmp cx, 0x62
je 0x456a61
cmp ax, 0x5e
je 0x456a61
cmp ax, 0x2b
je 0x456a61
cmp ax, 0x23
je 0x456a61
cmp ax, 0x40
je 0x456a61
cmp ax, 0x24
je 0x456a61
cmp ax, 0x2a
je 0x456a61
cmp ax, 0x7e
je 0x456a61
cmp ax, 0x2e
je 0x456a61
cmp ax, 0x3f
jne 0x456a7a
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x78], esi
je 0x456a7a
movzx eax, word [esi]
movsx ecx, byte [ebp + 0x6f]
cmp ecx, eax
je 0x456a80
cmp word [esi], 0x24
jne 0x456a8a
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp + 0x5f], al
mov dword [ebp + 0x78], esi
cmp byte [ebp + 0x6f], 0x41
jl 0x456a9a
cmp byte [ebp + 0x6f], 0x5a
jg 0x456a9a
or byte [ebp + 0x6f], 0x20
lea eax, [ebp + 0x78]
push eax
call 0x48dd04
mov edi, dword [ebp + 0x78]
mov dword [esp], 0x4af528
push edi
mov dword [ebp + 0x1c], edi
call dword [0x4a65b4]
mov esi, eax

Function at 0x456ac3
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
cmp esi, ebx
je 0x456ac0
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x44], edx
push ebp
inc esp
cmp word [edi], bx
je 0x456b53
Function at 0x456ac7
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
cmp esi, ebx
je 0x456ac0
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x44], edx
push ebp
inc esp
cmp word [edi], bx
je 0x456b53
Function at 0x456bae
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
dec ebp
adc al, ch
push ss
jb 0x456bb7
add byte [ebp + 0x16e8f04d], cl
jb 0x456bbf
invalid
add byte [ebp + 0x16e8084d], cl
or al, ch
push ss
jb 0x456bc7
add byte [ebp - 0x17af87bb], cl
popal
jb 0x456bd0
js 0x456c19
add byte [edx + 0xa], ch

Function at 0x456cec
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
je 0x456cf6
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x40], eax

Function at 0x456f27
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
call esi
test eax, eax
je 0x456f4e
push str.HKCC
push edi
call esi
test eax, eax
je 0x456f45
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x456f45
mov dword [ebp + 0x78], 0x80000005
jmp 0x456f70
Function at 0x45aabb
Capabilities:
Get disk information
Write file on windows

Disassembly:
je 0x45ab54
lea ecx, [ebx + 0xa]
mov dword [ebp + 0x78], ecx
cmp word [ecx], 0x2a
mov edi, ecx
jne 0x45aaf4
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp + 0x1c]
add ecx, 2
push eax
mov dword [ebp + 0x1c], ecx
call fcn.0049c839
mov edi, dword [ebp + 0x1c]
jge 0x45aad9
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x4b], 1
jne 0x45aaef
lea eax, [ebp - 0xdc]
push eax
inc edi
lea eax, [ebp + 0x1c]
inc edi
push eax
mov dword [ebp + 0x1c], edi
call fcn.0049c85d
mov edi, dword [ebp + 0x1c]
cmp word [edi], 0x2a
pop ecx
pop ecx
mov byte [ebp - 0x4b], 0x11
jne 0x45aaef
inc edi
inc edi
mov ecx, edi
mov dword [ebp + 0x78], ecx
xor edx, edx
mov dx, word [ecx]
cmp dx, 0x5c
je 0x45ab24
cmp dx, 0x2f
je 0x45ab24
mov byte [ebp - 0x2c], 1
jmp 0x45ab24
mov eax, edx
call fcn.00491d3b
test al, al
jne 0x45ab29
cmp dx, 0x23
je 0x45ab29
invalid
inc ecx
inc ecx
mov dword [ebp + 0x78], ecx
mov dx, word [ecx]
test dx, dx
jne 0x45ab0b
sub ecx, edi
sar ecx, 1
test ecx, ecx
jle 0x45ab45
push ecx
push edi
lea ecx, [ebp - 0xb4]
call fcn.00497ddc
mov dword [ebp - 0x28], 0xfffc0000
lea eax, [ebp + 0x78]
push eax
call fcn.00491daf
mov edi, dword [ebp + 0x78]
pop ecx
jmp 0x45ab94
inc eax
push 2
push ebx
push 0x4af8d4
call fcn.004930d8
add esp, 0xc
test al, al
invalid
je 0x45ab6e
lea edi, [ebx + 4]
mov dword [ebp + 0x78], edi
mov ax, word [edi]
call fcn.004978fd
test al, al
je 0x45ab8c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.00494707
mov edi, dword [ebp + 0x78]
jge 0x45ac02
pop ecx
pop ecx
cmp word [ebx], 0
setne byte [ebp - 0x2d]
push 0
push 0x200
push dword [ebp - 0xa8]

Function at 0x45ab1b
Capabilities:
Get disk information
Write file on windows

Disassembly:
or eax, 0x4d894141
js fcn.0045ab88
mov edx, dword [ecx]

Function at 0x45abce
Capabilities:
Get disk information
Write file on windows

Disassembly:
add byte [ecx + 0x77e8787d], cl
test dword [ebx], eax
add byte [edx + 2], ch