joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d43e
Capabilities:
Copy file
Get file size
Read file on windows

Disassembly:
push 0x10
mov eax, 0x4218b3
call fcn.00420a1c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 0xf
pop edi
mov dword [ebp - 4], 1
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
cmova eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 7
push SysReAllocString
push eax
call esi
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x40d4d2
cmp dword [ebp + 0x34], ebx
je 0x40d53b
cmp dword [ebp + 0x38], edi
lea ecx, [ebp + 0x24]
push ebx
cmova ecx, dword [ebp + 0x24]
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], edi
push ecx
cmova eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [ebp + 0x38], edi
lea eax, [ebp + 0x24]
push ebx
cmova eax, dword [ebp + 0x24]
push 0x80
push 3
push ebx
push 7
push SysReAllocString
push eax
call esi
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x40d53b
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x40d53d
push ebx
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40d533
mov eax, dword [ebp - 0x18]
mov dl, byte [esi + ebx]
mov ecx, dword [eax + 4]
mov byte [ebp - 0xd], dl
cmp ecx, dword [eax + 8]
je 0x40d51f
mov byte [ecx], dl
inc dword [eax + 4]
jmp 0x40d52e
lea edx, [ebp - 0xd]
push edx
push ecx
mov ecx, eax
call fcn.0040ec39
mov eax, dword [ebp - 0x18]
inc ebx
cmp ebx, edi
jb 0x40d50a
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov bl, 1
lea ecx, [ebp + 0xc]
call fcn.0040400e
lea ecx, [ebp + 0x24]
call fcn.0040400e
mov al, bl
call fcn.004209f9
ret 0x34
Function at 0x410b11
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
mov eax, dword [0x427040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x218]
push edi
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1a
push ebx
call esi
test eax, eax
js 0x410d4d
movaps xmm0, xmmword [0x402260]
mov ecx, ebx
movups xmmword [ebp - 0x554], xmm0
mov dword [ebp - 0x544], 0x76737857
mov dword [ebp - 0x540], 0x696b65
movsx eax, byte [ebp - 0x554]
and eax, 0x8000000f
jns 0x410b7c
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x553], al
inc ecx
cmp ecx, 0x16
jb 0x410b69
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [ebp - 0x553]
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 0x53d], bl
push 0x104
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
call ebx
test eax, eax
je 0x410d4d
lea eax, [ebp - 0x428]
push eax
xor eax, eax
push eax
push eax
push 0x23
push eax
call esi
test eax, eax
js 0x410d4d
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call esi
movaps xmm0, xmmword [0x402550]
add esp, 0xc
movups xmmword [ebp - 0x554], xmm0
mov dword [ebp - 0x544], 0x7468786e
xor ecx, ecx
mov word [ebp - 0x540], 0x6977
mov byte [ebp - 0x53e], 0
movsx eax, byte [ebp - 0x554]
and eax, 0x8000000f
jns 0x410c37
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x553], al
inc ecx
cmp ecx, 0x15
jb 0x410c24
lea eax, [ebp - 0x553]
mov byte [ebp - 0x53e], 0
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call ebx
test eax, eax
jne 0x410c88
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x410c88
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x530]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x410d4d
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x218]
call fcn.0041af94
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call esi
add esp, 0xc
mov dword [ebp - 0x53c], 0x7077674b
mov al, 0x4b
mov dword [ebp - 0x538], 0x6f777081
mov word [ebp - 0x534], 0x6d
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x410cfb
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x53b], al
inc ecx
cmp ecx, 8
jae 0x410d10
mov al, byte [ebp - 0x53c]
jmp 0x410cec
lea eax, [ebp - 0x53b]
mov byte [ebp - 0x533], 0
push eax
lea eax, [ebp - 0x320]
push 0x104
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x320]
push eax
call ebx
test eax, eax
je 0x410d4d
lea edx, [ebp - 0x110]
lea ecx, [ebp - 0x320]
call fcn.0041af94
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fa65
leave
ret
Function at 0x410d5c
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x2a4
mov eax, 0x421dcc
call fcn.00420a4f
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x410fc0
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x258]
call fcn.0040406a
mov edx, eax
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x402710]
movups xmmword [ebp - 0x27c], xmm0
mov word [ebp - 0x25c], 0x7072
movaps xmm0, xmmword [0x402460]
movups xmmword [ebp - 0x26c], xmm0
mov byte [ebp - 0x25a], bl
movsx eax, byte [ebp - 0x27c]
and eax, 0x8000000f
jns 0x410dde
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x27b], al
inc ecx
cmp ecx, 0x21
jb 0x410dcb
lea eax, [ebp - 0x27b]
mov byte [ebp - 0x25a], bl
push eax
lea ecx, [ebp - 0x2ac]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 2
call fcn.0040400e
sub esp, 0x18
lea eax, [ebp - 0x2ac]
mov ecx, esp
push eax
call fcn.004051dd
call fcn.0041b179
add esp, 0x18
test eax, eax
je 0x410fb5
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x410fb5
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x274]
call fcn.0040406a
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, ebx
movaps xmm0, xmmword [0x402630]
movups xmmword [ebp - 0x240], xmm0
mov dword [ebp - 0x230], 0x5c677671
mov dword [ebp - 0x22c], 0x636e6e6b
mov byte [ebp - 0x228], bl
movsx eax, byte [ebp - 0x240]
and eax, 0x8000000f
jns 0x410ea3
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23f], al
inc ecx
cmp ecx, 0x17
jb 0x410e90
lea eax, [ebp - 0x23f]
mov byte [ebp - 0x228], bl
push eax
lea ecx, [ebp - 0x294]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 5
call fcn.0040400e
cmp dword [ebp - 0x280], 0xf
lea eax, [ebp - 0x294]
push ebx
cmova eax, dword [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x410f09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410faa
mov al, 0x3c
mov dword [ebp - 0x24c], 0x7b5a683c
mov dword [ebp - 0x248], 0x457f7180
mov ecx, ebx
mov dword [ebp - 0x244], 0x6e703a
movsx eax, al
and eax, 0x8000000f
jns 0x410f3a
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x24b], al
inc ecx
cmp ecx, 0xa
jae 0x410f4f
mov al, byte [ebp - 0x24c]
jmp 0x410f2b
lea eax, [ebp - 0x24b]
mov byte [ebp - 0x241], bl
push eax
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x240]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x240]
cmp dword [ebp - 0x22c], 0xf
lea ecx, [ebp - 0x2ac]
cmova edx, dword [ebp - 0x240]
cmp dword [ebp - 0x298], 0xf
cmova ecx, dword [ebp - 0x2ac]
call fcn.0041af62
lea ecx, [ebp - 0x240]
call fcn.0040400e
lea ecx, [ebp - 0x294]
call fcn.0040400e
lea ecx, [ebp - 0x2ac]
call fcn.0040400e
call fcn.00420a0d
ret
Function at 0x410fc6
Capabilities:
Create directory
Get common file path

Disassembly:
push 0x2ac
mov eax, 0x421e32
call fcn.00420a4f
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x41121f
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040406a
mov edx, eax
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x402470]
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x22c], 0x777a7f81
mov word [ebp - 0x228], 0x7382
mov byte [ebp - 0x226], bl
movsx eax, byte [ebp - 0x23c]
and eax, 0x8000000f
jns 0x411044
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23b], al
inc ecx
cmp ecx, 0x15
jb 0x411031
lea eax, [ebp - 0x23b]
mov byte [ebp - 0x226], bl
push eax
lea ecx, [ebp - 0x26c]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 2
call fcn.0040400e
sub esp, 0x18
lea eax, [ebp - 0x26c]
mov ecx, esp
push eax
call fcn.004051dd
call fcn.0041b179
add esp, 0x18
test eax, eax
je 0x411214
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x411214
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.0040406a
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, ebx
movaps xmm0, xmmword [0x4026b0]
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x22c], 0x6370696b
mov word [ebp - 0x228], 0x6e
movsx eax, byte [ebp - 0x23c]
and eax, 0x8000000f
jns 0x411102
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23b], al
inc ecx
cmp ecx, 0x14
jb 0x4110ef
lea eax, [ebp - 0x23b]
mov byte [ebp - 0x227], bl
push eax
lea ecx, [ebp - 0x254]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 5
call fcn.0040400e
cmp dword [ebp - 0x240], 0xf
lea eax, [ebp - 0x254]
push ebx
cmova eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x411168
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x411209
mov al, 0x72
mov dword [ebp - 0x234], 0x64665e72
mov dword [ebp - 0x230], 0x6e737530
mov ecx, ebx
mov dword [ebp - 0x22c], 0x67766b
movsx eax, al
and eax, 0x8000000f
jns 0x411199
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x233], al
inc ecx
cmp ecx, 0xa
jae 0x4111ae
mov al, byte [ebp - 0x234]
jmp 0x41118a
lea eax, [ebp - 0x233]
mov byte [ebp - 0x229], bl
push eax
lea edx, [ebp - 0x254]
lea ecx, [ebp - 0x284]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x284]
cmp dword [ebp - 0x270], 0xf
lea ecx, [ebp - 0x26c]
cmova edx, dword [ebp - 0x284]
cmp dword [ebp - 0x258], 0xf
cmova ecx, dword [ebp - 0x26c]
call fcn.0041af62
lea ecx, [ebp - 0x284]
call fcn.0040400e
lea ecx, [ebp - 0x254]
call fcn.0040400e
lea ecx, [ebp - 0x26c]
call fcn.0040400e
call fcn.00420a0d
ret
Function at 0x412212
Capabilities:
Contain obfuscated stackstrings
Create directory
Encode data using xor
Get common file path

Disassembly:
push 0x29c
mov eax, 0x421f82
call fcn.00420a4f
lea eax, [ebp - 0x118]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x412459
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x238]
call fcn.0040406a
mov edx, eax
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x402940]
movups xmmword [ebp - 0x25c], xmm0
mov dword [ebp - 0x23c], 0x787984
movaps xmm0, xmmword [0x402440]
movups xmmword [ebp - 0x24c], xmm0
movsx eax, byte [ebp - 0x25c]
and eax, 0x8000000f
jns 0x41228f
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x25b], al
inc ecx
cmp ecx, 0x22
jb 0x41227c
lea eax, [ebp - 0x25b]
mov byte [ebp - 0x239], bl
push eax
lea ecx, [ebp - 0x28c]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 2
call fcn.0040400e
sub esp, 0x18
lea eax, [ebp - 0x28c]
mov ecx, esp
push eax
call fcn.004051dd
call fcn.0041b179
add esp, 0x18
test eax, eax
je 0x41244e
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x41244e
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x250]
call fcn.0040406a
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, ebx
movaps xmm0, xmmword [0x402110]
movups xmmword [ebp - 0x234], xmm0
mov word [ebp - 0x224], 0x372d
mov byte [ebp - 0x222], bl
mov al, byte [ebp - 0x234]
xor byte [ebp + ecx - 0x233], al
inc ecx
cmp ecx, 0x11
jb 0x412336
lea eax, [ebp - 0x233]
mov byte [ebp - 0x222], bl
push eax
lea ecx, [ebp - 0x274]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 5
call fcn.0040400e
cmp dword [ebp - 0x260], 0xf
lea eax, [ebp - 0x274]
push ebx
cmova eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4123a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x412443
mov cl, 0x30
mov dword [ebp - 0x230], 0x53516c30
mov dword [ebp - 0x22c], 0x5e455f53
mov eax, ebx
mov dword [ebp - 0x228], 0x481e4344
mov word [ebp - 0x224], 0x5c5d
mov byte [ebp - 0x222], bl
xor byte [ebp + eax - 0x22f], cl
inc eax
cmp eax, 0xd
jae 0x4123e8
mov cl, byte [ebp - 0x230]
jmp 0x4123d3
lea eax, [ebp - 0x22f]
mov byte [ebp - 0x222], bl
push eax
lea edx, [ebp - 0x274]
lea ecx, [ebp - 0x2a4]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x2a4]
cmp dword [ebp - 0x290], 0xf
lea ecx, [ebp - 0x28c]
cmova edx, dword [ebp - 0x2a4]
cmp dword [ebp - 0x278], 0xf
cmova ecx, dword [ebp - 0x28c]
call fcn.0041af62
lea ecx, [ebp - 0x2a4]
call fcn.0040400e
lea ecx, [ebp - 0x274]
call fcn.0040400e
lea ecx, [ebp - 0x28c]
call fcn.0040400e
call fcn.00420a0d
ret
Function at 0x41245f
Capabilities:
Contain obfuscated stackstrings
Create directory
Encode data using xor
Get common file path

Disassembly:
push 0x2ac
mov eax, 0x421e32
call fcn.00420a4f
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4126ba
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040406a
mov edx, eax
mov dword [ebp - 4], ebx
mov ecx, ebx
movaps xmm0, xmmword [0x402570]
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x22c], 0x5c0a5750
mov word [ebp - 0x228], 0x4849
mov byte [ebp - 0x226], bl
mov al, byte [ebp - 0x23c]
xor byte [ebp + ecx - 0x23b], al
inc ecx
cmp ecx, 0x15
jb 0x4124ca
lea eax, [ebp - 0x23b]
mov byte [ebp - 0x226], bl
push eax
lea ecx, [ebp - 0x26c]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 2
call fcn.0040400e
sub esp, 0x18
lea eax, [ebp - 0x26c]
mov ecx, esp
push eax
call fcn.004051dd
call fcn.0041b179
add esp, 0x18
test eax, eax
je 0x4126af
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4126af
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.0040406a
mov edx, eax
mov byte [ebp - 4], 3
mov ecx, ebx
movaps xmm0, xmmword [0x402700]
movups xmmword [ebp - 0x23c], xmm0
mov dword [ebp - 0x22c], 0x74527274
mov word [ebp - 0x228], 0x79
movsx eax, byte [ebp - 0x23c]
and eax, 0x8000000f
jns 0x41258e
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23b], al
inc ecx
cmp ecx, 0x14
jb 0x41257b
lea eax, [ebp - 0x23b]
mov byte [ebp - 0x227], bl
push eax
lea ecx, [ebp - 0x254]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], 5
call fcn.0040400e
cmp dword [ebp - 0x240], 0xf
lea eax, [ebp - 0x254]
push ebx
cmova eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4125f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4126a4
mov al, 6
mov dword [ebp - 0x234], 0x69676206
mov dword [ebp - 0x230], 0x747b7569
mov ecx, ebx
mov dword [ebp - 0x22c], 0x7e34797a
mov word [ebp - 0x228], 0x7273
mov byte [ebp - 0x226], bl
movsx eax, al
and eax, 0x8000000f
jns 0x412634
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x233], al
inc ecx
cmp ecx, 0xd
jae 0x412649
mov al, byte [ebp - 0x234]
jmp 0x412625
lea eax, [ebp - 0x233]
mov byte [ebp - 0x226], bl
push eax
lea edx, [ebp - 0x254]
lea ecx, [ebp - 0x284]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x284]
cmp dword [ebp - 0x270], 0xf
lea ecx, [ebp - 0x26c]
cmova edx, dword [ebp - 0x284]
cmp dword [ebp - 0x258], 0xf
cmova ecx, dword [ebp - 0x26c]
call fcn.0041af62
lea ecx, [ebp - 0x284]
call fcn.0040400e
lea ecx, [ebp - 0x254]
call fcn.0040400e
lea ecx, [ebp - 0x26c]
call fcn.0040400e
call fcn.00420a0d
ret
Function at 0x41664e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x427040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x4166a6
cmp byte [esi + 0x3d], bl
je 0x4166a6
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4166e0
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x4166b7
sub eax, 1
je 0x4166ba
dec eax
sub eax, 1
jne 0x4166e0
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fa65
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4166d8
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4166e0
cmp byte [esi + 0x3d], bl
sete al
jmp 0x4166a8
xor al, al
jmp 0x4166a8
Function at 0x418069
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4181ff
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4181ff
cmp eax, 0x29
jne 0x4180d5
cmp dword [esi + 0x10], 0
jne 0x4181ff
test dword [esi + 0x50], edx
je 0x418205
cmp eax, 0x5d
jne 0x4180b0
test dword [esi + 0x50], edx
je 0x418195
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00418ccd
mov bl, 1
mov ecx, esi
call fcn.00418041
test bl, bl
je 0x4180d1
mov ecx, esi
call fcn.00418be7
mov cl, 1
jmp 0x418070
cmp eax, 0x2e
jne 0x4180ed
push 5
lea ecx, [esi + 0x24]
call fcn.004182cf
mov ecx, esi
call fcn.00418041
jmp 0x4180ca
cmp eax, 0x5c
jne 0x418139
mov ecx, esi
call fcn.00418041
test byte [esi + 0x50], 0x80
je 0x418130
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x418119
push 4
lea ecx, [esi + 0x24]
call fcn.004182cf
mov ecx, esi
call fcn.00418041
jmp 0x4180d1
cmp al, 0x42
jne 0x418130
push 4
lea ecx, [esi + 0x24]
call fcn.004182cf
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x418110
mov ecx, esi
call fcn.00418a80
jmp 0x4180ca
cmp eax, 0x5b
jne 0x418199
mov ecx, esi
call fcn.00418041
lea ecx, [esi + 0x24]
call fcn.00419abc
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x418166
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00418041
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x418184
cmp eax, 0x5d
jne 0x418184
push eax
lea ecx, [esi + 0x24]
call fcn.00419b06
mov ecx, esi
call fcn.00418041
mov ecx, esi
call fcn.00419804
cmp dword [esi + 0x4c], 0x5d
je 0x4180e4
push 4
jmp 0x418207
cmp eax, 0x28
jne 0x4181b9
mov ecx, esi
call fcn.00418041
mov ecx, esi
call fcn.00418b58
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x418205
jmp 0x4180bf
cmp eax, 0x5e
jne 0x4181c5
push 2
jmp 0x418108
cmp eax, 0x24
jne 0x4181d1
push 3
jmp 0x418108
cmp eax, 0x2a
je 0x4181fb
cmp eax, 0x2b
je 0x4181fb
cmp eax, 0x3f
je 0x4181fb
cmp eax, 0x7b
je 0x4181fb
cmp eax, 0x7d
jne 0x4180a2
test dword [esi + 0x50], edx
jne 0x4180b0
push 6
jmp 0x418207
push 0xa
jmp 0x418207
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.0041745a
int3

Function at 0x41ad97
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 0xf
jbe 0x41ad9f
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41adb2
test al, 0x10
je 0x41adb2
mov al, 1
ret
xor al, al
ret
Function at 0x41b53c
Capabilities:
Encode data using xor

Disassembly:
push 0x5c
mov eax, 0x422e42
call fcn.00420a4f
mov dword [ebp - 0x64], edx
mov ebx, ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0x60], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + 0x48]
jmp 0x41b5e2
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], ecx
xor edi, edi
mov dword [ebp - 0x14], ecx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x41b57a
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.0041b899
xor edx, edx
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0x18]
cmova eax, dword [ebp - 0x28]
test ecx, ecx
je 0x41b5ba
mov edi, eax
cmp word [edi], 0x3d
je 0x41b609
add edi, 2
sub ecx, 1
jne 0x41b5ac
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
add esi, 2
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 7
jbe 0x41b5e2
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
call fcn.004041fc
xor ecx, ecx
cmp word [esi], cx
jne 0x41b564
mov edi, ebx
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], 0xf
mov byte [ebx], cl
mov eax, ebx
call fcn.00420a0d
ret
test edi, edi
je 0x41b5ba
sub edi, eax
sar edi, 1
cmp edi, 0xffffffff
je 0x41b5ba
push edi
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041b81f
mov byte [ebp - 4], 1
cmp dword [ebp - 0x30], 0
jne 0x41b645
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x40]
lea esi, [esi + eax*2]
add esi, 2
call fcn.0041b86e
jmp 0x41b5c7
cmp dword [ebp - 0x2c], 7
lea edx, [ebp - 0x40]
cmova edx, dword [ebp - 0x40]
or ecx, 0xffffffff
movzx eax, word [edx]
mov ebx, eax
mov dword [ebp - 0x60], ebx
mov ebx, dword [ebp - 0x5c]
test ax, ax
je 0x41b680
movzx eax, ax
xor eax, ecx
lea edx, [edx + 2]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x4011b0]
movzx eax, word [edx]
test ax, ax
jne 0x41b666
cmp ecx, dword [ebp - 0x64]
jne 0x41b62e
push 0xffffffffffffffff
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041b81f
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 7
jbe 0x41b6a9
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push esi
call fcn.0041fde6
pop ecx
xor ecx, ecx
mov edi, eax
push ecx
push ecx
lea eax, [esi + 1]
push eax
push edi
push 0xffffffffffffffff
push dword [ebp - 0x5c]
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
mov ecx, ebx
call fcn.0040406a
lea ecx, [ebp - 0x58]
call fcn.0041b86e
lea ecx, [ebp - 0x40]
call fcn.0041b86e
mov edx, dword [ebp - 0x14]
cmp edx, 7
jbe 0x41b601
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
call fcn.004041fc
jmp 0x41b601