joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48425d
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x484286
xor al, al
leave
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
mov eax, dword [esi - 0xc]
cmp eax, 0x4f
push edi
jle 0x48429c
lea esi, [esi + eax*2 - 0x9e]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
push dword [ebp - 8]
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x4842c7
cmp edi, 0xea
jne 0x4842d3
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
leave
ret

Function at 0x48489c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
jne 0x4848b5
xor eax, eax
jmp 0x484968
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4848d9
push eax
jmp 0x48495f
mov eax, dword [ebp + 0xc]
sub dword [ebp + 0x10], 2
push edi
lea ecx, [ebp - 0x10]
add eax, 2
push ecx
push eax
push ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x48495a
mov eax, dword [ebp + 0x10]
shr eax, 1
push eax
push 0x78
pop ecx
lea edx, [ebp - 8]
call fcn.004411bc
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
lea esi, [ebp - 8]
call fcn.004189d3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x484952
cmp dword [ebp - 0xc], edi
je 0x484952
mov eax, esi
push eax
push dword [ebp + 8]
call fcn.004843e4
lea ecx, [ebp - 8]
movzx esi, al
call fcn.004036cd
cmp ebx, edi
je 0x48494e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x484968
lea ecx, [ebp - 8]
call fcn.004036cd
cmp ebx, edi
je 0x484965
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x486157
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0x518960
test eax, eax
je 0x4861a9
push 0xea60
push eax
mov byte [esi + 9], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4861a4
cmp dword [ebp - 4], 0x103
jne 0x4861a4
push 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x14]
call edi
lea ecx, [esi + 0x68]
call fcn.004036cd
mov eax, dword [esi + 0x60]
test eax, eax
je 0x4861bf
push eax
call edi
and dword [esi + 0x60], 0
mov eax, dword [esi + 0x58]
test eax, eax
je 0x4861cd
push eax
call edi
and dword [esi + 0x58], 0
lea ecx, [esi + 0x40]
call fcn.004036cd
lea ecx, [esi + 0x38]
call fcn.004036cd
lea ecx, [esi + 0x20]
call fcn.004036cd
lea ecx, [esi + 0x1c]
call fcn.004036cd
pop edi
leave
ret

Function at 0x4861f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x20]
call fcn.004412d2
mov eax, dword [ebp + 0xc]
lea edi, [esi + 0x1c]
call fcn.004412d2
mov eax, dword [esi + 0x14]
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
cmp eax, ebx
je 0x486224
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 8]
push eax
push ebx
push esi
push 0x486648
push ebx
push ebx
mov dword [esi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x486249
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x486259
cmp byte [ebp + 0x10], bl
je 0x486257
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
jmp 0x486259
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x489fe9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edx, 0x3c9f
sub edx, 0xa180
pop edx
mov dword [ebp - 0x15d8], 1
push ecx
and ecx, 0x6401
pop ecx
push edi
push esi
add esp, 4
xor edi, 0x7ccc
pop edi
push edi
push eax
add esp, 4

Function at 0x48a01c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub edi, 0x5467
or edi, 0xd7f
jmp 0x48a02e
and edi, 0x849f
pop edi
mov dword [ebp - 0x2104], 0x38
mov dword [ebp - 0x2108], 0xe6
mov dword [ebp - 0x210c], 0x6e
mov dword [ebp - 0x2038], 0x6e
mov dword [ebp - 0x203c], 0x78
mov dword [ebp - 0x1690], 1
push ecx
xor ecx, 0x1d45
or ecx, 0x192f
xor ecx, 0x7f74
xor ecx, 0x1486b
pop ecx
push eax
push edi
add esp, 4
xor eax, 0x6a6b
add eax, 0xaf62
and eax, 0xd65b
pop eax
imul eax, dword [ebp - 0x1690], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x1690], 0xfe
sub eax, ecx
xor eax, 0xe6
imul eax, dword [ebp - 0x1690]
imul edx, dword [ebp - 0x1690], 0xfe
sub eax, edx
mov dword [ebp - 0x1694], eax
push edx
push esi
add esp, 4
xor edx, 0x130f1
jmp 0x48a0f0
xor edx, 0x1146a
and edx, 0x1014a
pop edx
push edi
push esi
add esp, 4
sub edi, 0x106e2
jmp 0x48a10d
pop edi
push ecx
push edx
add esp, 4
add ecx, 0x12b12
pop ecx
push edx
push edx
add esp, 4
sub edx, 0x12301
or edx, 0xdb8d
pop edx
push ecx
or ecx, 0x12e00
and ecx, 0x1434a
and ecx, 0xa37b
pop ecx
mov eax, dword [ebp - 0x9dc]
add eax, 0xfe
imul ecx, dword [ebp - 0x9d8], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x9d8], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x1fe0], eax
mov eax, dword [ebp - 0x1fe0]
mov dword [ebp - 0x1fe4], eax
mov ecx, dword [ebp - 0x1fe4]
sub ecx, 0x6e
mov dword [ebp - 0x2034], ecx
mov dword [ebp - 0xabc], 1
push ebx
push edx
add esp, 4
call 0x48a1ac
add byte [edi], bh
dec ebp
xor cl, byte [eax + 0x44]
inc ebp
add esp, 4
pop ebx
push ebx
and ebx, 0x128e0
pop ebx
push ecx
push edx
add esp, 4
or ecx, 0x11c9
jmp 0x48a1cc
pop ecx
imul edx, dword [ebp - 0xabc], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0xabc], 0xfe
sub edx, eax
xor edx, dword [ebp - 0x2034]
imul edx, dword [ebp - 0xabc]
imul ecx, dword [ebp - 0xabc], 0xfe
sub edx, ecx
mov dword [ebp - 0xac0], edx
push eax
push esi
add esp, 4
and eax, 0x3f7c
and eax, 0x5547
xor eax, 0x18598
add eax, 0x155eb
pop eax
push edx
push ecx
add esp, 4
sub edx, 0x142d3
pop edx
push eax
add eax, 0x5dd1
pop eax
mov edx, dword [ebp - 0x9dc]
add edx, 0xfe
imul eax, dword [ebp - 0x9d8], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x9d8], 0xfe
sub eax, ecx
invalid
Function at 0x48a1ac
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub edi, 0x5467
or edi, 0xd7f
jmp 0x48a02e
and edi, 0x849f
pop edi
mov dword [ebp - 0x2104], 0x38
mov dword [ebp - 0x2108], 0xe6
mov dword [ebp - 0x210c], 0x6e
mov dword [ebp - 0x2038], 0x6e
mov dword [ebp - 0x203c], 0x78
mov dword [ebp - 0x1690], 1
push ecx
xor ecx, 0x1d45
or ecx, 0x192f
xor ecx, 0x7f74
xor ecx, 0x1486b
pop ecx
push eax
push edi
add esp, 4
xor eax, 0x6a6b
add eax, 0xaf62
and eax, 0xd65b
pop eax
imul eax, dword [ebp - 0x1690], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x1690], 0xfe
sub eax, ecx
xor eax, 0xe6
imul eax, dword [ebp - 0x1690]
imul edx, dword [ebp - 0x1690], 0xfe
sub eax, edx
mov dword [ebp - 0x1694], eax
push edx
push esi
add esp, 4
xor edx, 0x130f1
jmp 0x48a0f0
xor edx, 0x1146a
and edx, 0x1014a
pop edx
push edi
push esi
add esp, 4
sub edi, 0x106e2
jmp 0x48a10d
pop edi
push ecx
push edx
add esp, 4
add ecx, 0x12b12
pop ecx
push edx
push edx
add esp, 4
sub edx, 0x12301
or edx, 0xdb8d
pop edx
push ecx
or ecx, 0x12e00
and ecx, 0x1434a
and ecx, 0xa37b
pop ecx
mov eax, dword [ebp - 0x9dc]
add eax, 0xfe
imul ecx, dword [ebp - 0x9d8], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x9d8], 0xfe
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x1fe0], eax
mov eax, dword [ebp - 0x1fe0]
mov dword [ebp - 0x1fe4], eax
mov ecx, dword [ebp - 0x1fe4]
sub ecx, 0x6e
mov dword [ebp - 0x2034], ecx
mov dword [ebp - 0xabc], 1
push ebx
push edx
add esp, 4
call 0x48a1ac
add byte [edi], bh
dec ebp
xor cl, byte [eax + 0x44]
inc ebp
add esp, 4
pop ebx
push ebx
and ebx, 0x128e0
pop ebx
push ecx
push edx
add esp, 4
or ecx, 0x11c9
jmp 0x48a1cc
pop ecx
imul edx, dword [ebp - 0xabc], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0xabc], 0xfe
sub edx, eax
xor edx, dword [ebp - 0x2034]
imul edx, dword [ebp - 0xabc]
imul ecx, dword [ebp - 0xabc], 0xfe
sub edx, ecx
mov dword [ebp - 0xac0], edx
push eax
push esi
add esp, 4
and eax, 0x3f7c
and eax, 0x5547
xor eax, 0x18598
add eax, 0x155eb
pop eax
push edx
push ecx
add esp, 4
sub edx, 0x142d3
pop edx
push eax
add eax, 0x5dd1
pop eax
mov edx, dword [ebp - 0x9dc]
add edx, 0xfe
imul eax, dword [ebp - 0x9d8], 0xfe
add eax, 0x56f3663b
imul ecx, dword [ebp - 0x9d8], 0xfe
sub eax, ecx
invalid
Function at 0x48bc43
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edi
push esi
add esi, 0x2701
Function at 0x48c88a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
inc dword [ebx - 0x6a76fe3e]
mov al, bh
invalid
Function at 0x48ce86
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edi, 0xb1ba
mov edx, 0x810000b1
out dx, eax
cli
cmp eax, 0x9e80000
add byte [eax], al
add byte [eax], al
cmp al, byte [ebp + 0x4d]

Function at 0x48ce8a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add edi, 0xb1ba
mov edx, 0x810000b1
out dx, eax
cli
cmp eax, 0x9e80000
add byte [eax], al
add byte [eax], al
cmp al, byte [ebp + 0x4d]

Function at 0x48cea3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x810000b1
out dx, eax
cli
cmp eax, 0x9e80000
add byte [eax], al
add byte [eax], al
cmp al, byte [ebp + 0x4d]
dec ecx
cmp al, byte [edi + 0x3c]
add esp, 4
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x48cec4
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x48cf1e
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x48cdec
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x48cdec
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x48cf08
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x48cf12
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x48cf67
push esi
push eax
add esp, 4
sub esi, 0x108ae
pop esi
push eax
and eax, 0x9fcf
call 0x48cf49
add byte [esi + 0x32], al
dec edi
xor bh, byte [eax]
xor cl, byte [eax + 0x39]
push eax
add esp, 4
xor eax, 0x115ee
and eax, 0xbc20
pop eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x48cfcf
push esi
push ebx
add esp, 4
or esi, 0x6861
sub esi, 0xcfa
xor esi, 0x13eda
fidivr dword [esi]
add dword [eax], eax

Function at 0x48cf49
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, 0x810000b1
out dx, eax
cli
cmp eax, 0x9e80000
add byte [eax], al
add byte [eax], al
cmp al, byte [ebp + 0x4d]
dec ecx
cmp al, byte [edi + 0x3c]
add esp, 4
pop edi
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x48cec4
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x163c], ecx
jmp 0x48cf1e
movzx eax, word [ebp - 0x1c8]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x48cdec
movzx edx, word [ebp - 0x1c8]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x48cdec
movzx ecx, word [ebp - 0x1c8]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x48cf08
mov dword [ebp - 0x1638], 0xffffffff
jmp 0x48cf12
mov dword [ebp - 0x1638], 1
mov eax, dword [ebp - 0x1638]
mov dword [ebp - 0x163c], eax
cmp dword [ebp - 0x163c], 0
jne 0x48cf67
push esi
push eax
add esp, 4
sub esi, 0x108ae
pop esi
push eax
and eax, 0x9fcf
call 0x48cf49
add byte [esi + 0x32], al
dec edi
xor bh, byte [eax]
xor cl, byte [eax + 0x39]
push eax
add esp, 4
xor eax, 0x115ee
and eax, 0xbc20
pop eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x2fc], ecx
jmp 0x48cfcf
push esi
push ebx
add esp, 4
or esi, 0x6861
sub esi, 0xcfa
xor esi, 0x13eda
fidivr dword [esi]
add dword [eax], eax
Function at 0x48d30f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esp + edi + 0x34], al
inc ebx
xor al, 0x4f
cmp byte [ecx + 0x3a], al
Function at 0x48d91f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub edx, 0x6eba
xor edx, 0xb11a
pop edx
push edx
push edi
add esp, 4
xor edx, 0x144d6
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19f4], ecx
mov edx, dword [ebp - 0x19f4]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19f8], eax
mov ecx, dword [ebp - 0x19f8]
mov dword [ebp - 0x16a8], ecx
push eax
or eax, 0xd9c
sub eax, 0xeeeb
and eax, 0xe934
pop eax
push eax
push eax
add esp, 4
or eax, 0x86a4
invalid
Function at 0x48dc84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [edi*8 + 0x518bffff]
sbb byte [ecx - 0x39f6b], cl
call dword [ecx + 0x50]
Function at 0x48f0de
Capabilities:
Execute syscall

Disassembly:
lock or dword [ecx], edi
inc edi
dec esi
cmp eax, dword [esi + 0x5ce31ef]
add eax, 0x8855565f
leave
or dword [esi + 0x62ae0ce], eax
add eax, 0x198acc5e
cli
add al, 4
add eax, 0xee050505
sub eax, 0x55050510
pop ebx
mov cl, cl
or ebp, ebp
syscall
add eax, 0x55500505
inc edi
dec ebp
dec esi
cmp bh, byte [esi]
push esp
push edx
mov cl, cl
or dword [esi + 0x663cfcd], eax
add eax, 0xfc865c5d
ret 0x60e

Function at 0x4aa49a
Capabilities:
Parse credit card information

Disassembly:
push 0x68
mov eax, 0x4ef794
call fcn.004cd03b
mov esi, ecx
push str.PIDTemplate
lea ecx, [ebp - 0x6c]
call fcn.0040521c
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
lea edx, [ebp - 0x6c]
push edx
lea edx, [ebp - 0x2c]
push edx
call dword [eax]
mov byte [ebp - 4], 2
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x6c]
call fcn.00401774
cmp dword [ebp - 0x18], 3
jb 0x4aa59d
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004013f4
mov ecx, eax
call fcn.00401206
cmp word [eax], 0x3c
jne 0x4aa59d
push ebx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401020
mov ecx, eax
call fcn.0043355c
mov ecx, eax
call fcn.00401206
cmp word [eax], 0x3e
jne 0x4aa59d
mov eax, dword [ebp - 0x18]
add eax, 0xfffffffe
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00412f5c
mov byte [ebp - 4], 3
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401665
mov byte [ebp - 4], 2
push edi
push ebx
lea ecx, [ebp - 0x6c]
call fcn.00401774
push str.PIDKEY
lea ecx, [ebp - 0x6c]
call fcn.0040521c
mov byte [ebp - 4], 4
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
lea edx, [ebp - 0x6c]
push edx
lea edx, [ebp - 0x48]
push edx
call dword [eax]
mov byte [ebp - 4], 6
push edi
push ebx
lea ecx, [ebp - 0x6c]
call fcn.00401774
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x18]
je 0x4aa5b3
mov byte [ebp - 4], 2
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.00401774
or dword [ebp - 4], 0xffffffff
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401774
xor al, al
call fcn.004cd0be
ret
mov dword [ebp - 0x4c], edi
cmp eax, edi
jbe 0x4aa639
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
call fcn.0040e22d
movzx eax, word [eax]
cmp eax, 0x3d
jg 0x4aa5f6
je 0x4aa62e
sub eax, 0x23
je 0x4aa5db
dec eax
dec eax
je 0x4aa5db
dec eax
jmp 0x4aa608
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
call fcn.0040e22d
movzx eax, word [eax]
push eax
call fcn.004c8b58
pop ecx
test eax, eax
je 0x4aa58f
jmp 0x4aa62e
cmp eax, 0x3f
jl 0x4aa60a
cmp eax, 0x40
jle 0x4aa62e
cmp eax, 0x5e
je 0x4aa62e
cmp eax, 0x60
je 0x4aa62e
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x48]
call fcn.0040e22d
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0040e22d
mov cx, word [esi]
cmp cx, word [eax]
jne 0x4aa58f
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x34]
jb 0x4aa5ba
mov byte [ebp - 4], 2
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.00401774
or dword [ebp - 4], 0xffffffff
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401774
mov al, bl
jmp 0x4aa5ad
Function at 0x4ae7f3
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x4ef5b2
call fcn.004cd03b
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x104
lea eax, [ebp - 0x21c]
push eax
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
mov word [ebp + eax*2 - 0x21c], cx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x240]
call fcn.0040521c
xor esi, esi
inc esi
mov dword [ebp - 4], esi
push edi
lea ecx, [ebp - 0x240]
call fcn.0045ca50
mov dword [ebp - 0x220], esi
mov byte [ebp - 4], bl
push ebx
push esi
lea ecx, [ebp - 0x240]
call fcn.00401774
push str.msiexec.exe
lea ecx, [ebp - 0x240]
call fcn.0040521c
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x240]
mov ebx, edi
call fcn.0042045e
mov byte [ebp - 4], 0
push 0
push esi
lea ecx, [ebp - 0x240]
call fcn.00401774
mov eax, edi
call fcn.004cd0be
ret
Function at 0x4b4786
Capabilities:
Create process on windows

Disassembly:
push 0xd0
mov eax, 0x4fb2c6
call fcn.004cd03b
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
call fcn.004ae7f3
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x506db4
lea ecx, [ebp - 0x30]
call fcn.0040521c
mov byte [ebp - 4], 1
lea esi, [ebp - 0x68]
mov ecx, edi
call fcn.0045ddf0
mov byte [ebp - 4], 2
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
call fcn.0040b252
mov byte [ebp - 4], 1
xor edi, edi
push ebx
inc edi
push edi
mov ecx, esi
call fcn.00401774
mov esi, 0x51b504
push esi
call fcn.004c6f29
pop ecx
push eax
mov eax, esi
lea esi, [ebp - 0x30]
call fcn.0040e569
lea eax, [ebp - 0x84]
push eax
call fcn.0041fbb4
mov byte [ebp - 4], 3
push 0x50f260
lea ecx, [ebp - 0x68]
call fcn.0040521c
mov byte [ebp - 4], 4
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x84]
call fcn.0040f30b
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0x68]
call fcn.00401774
push dword [ebp - 0x6c]
lea eax, [ebp - 0x84]
call fcn.0040f30b
push str.AI_CLEAR_TEMP1
lea ecx, [ebp - 0x68]
call fcn.0040521c
mov byte [ebp - 4], 5
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x84]
call fcn.0040f30b
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0x68]
call fcn.00401774
push 0x50f1b8
lea ecx, [ebp - 0x68]
call fcn.0040521c
mov byte [ebp - 4], 6
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x84]
call fcn.0040f30b
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0x68]
call fcn.00401774
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x84]
call fcn.0046c870
pop ecx
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.0040b252
mov byte [ebp - 4], 3
push ebx
push edi
lea ecx, [ebp - 0x68]
call fcn.00401774
push 0x40
lea eax, [ebp - 0xd8]
push ebx
push eax
mov dword [ebp - 0xdc], 0x44
call fcn.004c6270
mov dword [ebp - 0x94], ebx
xor eax, eax
lea edi, [ebp - 0x90]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea esi, [ebp - 0x68]
lea ecx, [ebp - 0x4c]
stosd dword es:[edi], eax
call fcn.0045ddf0
mov byte [ebp - 4], 8
cmp dword [eax + 0x18], 8
jb 0x4b4916
mov esi, dword [eax + 4]
jmp 0x4b4919
lea esi, [eax + 4]
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xdc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x30]
call fcn.0040e22d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.00401774
cmp esi, ebx
je 0x4b4961
push 0xffffffffffffffff
push dword [ebp - 0x94]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x84]
push eax
call fcn.004057b5
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.00401774
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x4c]
push eax
call fcn.00404867
call fcn.004cd0be
ret 4
Function at 0x4b7dc6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ef2e2
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x541770]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
lea eax, [ecx + 0xec]
mov dword [esp + 0x1c], eax
inc dword [eax]
mov byte [esp + 0x20], 0
and dword [esp + 0x38], 0
lea edi, [ecx + 0xf0]
mov ebx, dword [edi + 0xc]
lea esi, [esp + 0x24]
call fcn.004a1a6f
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov ebx, dword [edi + 0x10]
lea esi, [esp + 0x24]
call fcn.004a1a6f
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4b7e47
cmp esi, dword [esp + 0x24]
je 0x4b7e4c
call fcn.004c6ae5
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esp + 0x28]
je 0x4b7e97
test esi, esi
jne 0x4b7e8f
call fcn.004c6ae5
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4b7e6b
call fcn.004c6ae5
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push ebx
call dword [eax]
test esi, esi
jne 0x4b7e93
call fcn.004c6ae5
cmp ebx, dword [esi + 0x10]
jb 0x4b7e86
call fcn.004c6ae5
add ebx, 0x4c
mov dword [esp + 0x18], ebx
jmp 0x4b7e2d
mov eax, dword [esi]
jmp 0x4b7e61
mov esi, dword [esi]
jmp 0x4b7e7c
mov eax, edi
call fcn.004b813d
or dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x1c]
dec dword [eax]
mov byte [esp + 0x20], 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4be899
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
mov ecx, dword [esi + 0x40]
push edi
mov edi, 0xffff
xor al, al
mov bl, 1
cmp ecx, edi
je 0x4bea35
mov ebp, 0x10000000
cmp ecx, 0x7c
je 0x4bea35
cmp ecx, 0x29
jne 0x4be8e3
cmp dword [esi + 0x10], 0
jne 0x4bea35
test dword [esi + 0x44], ebp
jne 0x4be8e3
push 5
call fcn.004c5fe2
pop ecx
jmp 0x4bea1f
cmp ecx, 0x2e
jne 0x4be8ff
push 5
lea eax, [esi + 0x18]
push eax
call fcn.004beb36
mov eax, esi
call fcn.004be86d
jmp 0x4bea1f
cmp ecx, 0x5c
jne 0x4be960
mov eax, esi
call fcn.004be86d
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x4be933
cmp word [esi + 0x3e], 0x62
jne 0x4be933
push 4
lea eax, [esi + 0x18]
push eax
call fcn.004beb36
mov eax, esi
call fcn.004be86d
jmp 0x4bea26
test eax, eax
je 0x4be954
cmp word [esi + 0x3e], 0x42
jne 0x4be954
push 4
lea eax, [esi + 0x18]
push eax
call fcn.004beb36
mov eax, dword [esi + 0x1c]
add eax, 8
or dword [eax], 1
jmp 0x4be927
mov eax, esi
call fcn.004bf492
jmp 0x4bea1f
cmp ecx, 0x5b
jne 0x4be98a
mov eax, esi
call fcn.004be86d
mov eax, esi
call fcn.004bf447
cmp dword [esi + 0x40], 0x5d
je 0x4be8f3
push 4
call fcn.004c5fe2
pop ecx
jmp 0x4be8f3
cmp ecx, 0x28
jne 0x4be9b4
mov eax, esi
call fcn.004be86d
call fcn.004bf529
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x4be9ab
push 5
call fcn.004c5fe2
pop ecx
mov eax, esi
call fcn.004be86d
jmp 0x4bea1b
cmp ecx, 0x5e
jne 0x4be9c0
push 2
jmp 0x4be91e
cmp ecx, 0x24
jne 0x4be9cc
push 3
jmp 0x4be91e
cmp ecx, 0x2a
je 0x4bea13
cmp ecx, 0x2b
je 0x4bea13
cmp ecx, 0x3f
je 0x4bea13
cmp ecx, 0x7b
je 0x4bea13
cmp ecx, 0x7d
jne 0x4be9f1
test dword [esi + 0x44], ebp
jne 0x4be9f1
push 6
jmp 0x4be8d8
cmp ecx, 0x5d
jne 0x4bea02
test dword [esi + 0x44], ebp
jne 0x4bea02
push 4
jmp 0x4be8d8
mov ax, word [esi + 0x3e]
lea ecx, [esi + 0x18]
call fcn.004bf6bf
jmp 0x4be8f3
push 0xa
call fcn.004c5fe2
pop ecx
test bl, bl
je 0x4bea26
mov eax, esi
call fcn.004bf5f7
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, edi
jne 0x4be8b9
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret