joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6650
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x539630]
xor edx, edx
cmp eax, edx
jne 0x4a6676
xor eax, eax
mov byte [eax + 0x539530], al
inc eax
cmp eax, 0x100
jl 0x4a665e
mov dword [0x539630], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x539530
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4a6707
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4a66da
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4a66a8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4a6710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4a6763
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4a674a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ad0e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4db9ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004ada00
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4eff24
call fcn.004cc48d
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4ad173
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004cc48d
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4ad16c
push 0
mov ecx, eax
call fcn.004a4280
mov dword [esi + 0xc], eax
jmp 0x4ad175
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4ad175
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4ceb1a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ceb52
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ccba7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ccb7f
jmp 0x4ceb5e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d0210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4d0252
call fcn.004d5cc4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4d0252
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4d0249
xor eax, eax
jmp 0x4d025a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004d0260
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d61f4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d6222
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d6240
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d615a
jmp 0x4d6240
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d6240
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d615a
test edi, edi
mov eax, edi
jne 0x4d622a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401271
Capabilities:
Create thread

Disassembly:
jmp 0x444d38
push ecx
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 4
push esi
push 0x402bc1
push 0
push 0
call fcn.00500a90
add esp, 0x18
mov dword [esi + 0x18], eax
push 1
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
pop esi
pop ecx
ret
Function at 0x40178a
Capabilities:
Parse credit card information

Disassembly:
jmp 0x45d5df
mov eax, dword [ecx + 0x134]
push esi
cmp dword [eax + 0x387a8], 0
je 0x45d673
mov edx, dword [eax + 0x1558]
test edx, edx
jne 0x45d601
xor eax, eax
jmp 0x45d60c
mov eax, dword [eax + 0x155c]
sub eax, edx
sar eax, 2
xor esi, esi
test eax, eax
jle 0x45d673
push ebx
push edi
mov edx, dword [ecx + 0x134]
mov edx, dword [edx + 0x1558]
mov edx, dword [edx + esi*4]
test edx, edx
je 0x45d66c
cmp word [edx + 0xc], 0x1e
jne 0x45d66c
mov bl, byte [edx + 0x57]
cmp bl, 0xb
je 0x45d663
cmp bl, 0x32
je 0x45d663
cmp bl, 0x3d
je 0x45d663
cmp bl, 0x3f
je 0x45d663
cmp bl, 0x43
je 0x45d663
cmp bl, 0x42
je 0x45d663
cmp bl, 0x44
je 0x45d663
cmp bl, 0x41
je 0x45d663
cmp bl, 0x1b
je 0x45d663
cmp bl, 0x37
jne 0x45d66c
mov di, word [esp + 0x10]
mov word [edx + 0x68], di
inc esi
cmp esi, eax
jl 0x45d614
pop edi
pop ebx
pop esi
ret 4
Function at 0x402171
Capabilities:
Reference sql statements

Disassembly:
jmp 0x4379ef
mov eax, 0x62a354
call fcn.00500010
sub esp, 0x8f4
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x80]
call fcn.004d2693
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.005bf5d7
lea eax, [esi + 0x4c790]
mov byte [ebp - 4], 1
push eax
lea eax, [esi + 0x4c778]
push eax
lea eax, [esi + 0x4c760]
push eax
lea eax, [ebp - 0x10]
push str.ODBC_DSN_s_UID_s_PWD_s
push eax
call fcn.0053f356
add esp, 0x14
lea ecx, [ebp - 0x80]
push 0xa
call fcn.004dc024
push 1
lea ecx, [ebp - 0x10]
call fcn.005bf67a
push eax
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.004d27e1
test eax, eax
jne 0x437a77
push ebx
push ebx
push str.GameDB_SQL_Connection_Fail...
call fcn.00590f71
jmp 0x437b84
push 0x800
lea eax, [ebp - 0x900]
push ebx
push eax
call fcn.00500130
push 0x80
lea eax, [ebp - 0x100]
push ebx
push eax
call fcn.00500130
add esp, 0x18
lea eax, [ebp - 0x900]
push dword [ebp + 8]
push str.SELECT_TOP_3_KNIGHTS.IDNum_FROM_KNIGHTS_INNER_JOIN_KNIGHTS_RATING_ON_KNIGHTS_RATING.shIndex__KNIGHTS.IDNum_WHERE_KNIGHTS.Nation___d_ORDER_BY_nPoints_DESC
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x7c]
push 3
call sub.odbc32.dll_SQLAllocHandle
cmp ax, bx
jne 0x437b84
lea eax, [ebp - 0x900]
push 0xfffffffffffffffd
push eax
push dword [ebp - 0x18]
call sub.odbc32.dll_SQLExecDirectA
cmp ax, bx
je 0x437b02
cmp ax, 1
je 0x437b02
cmp ax, 0x64
je 0x437b84
push dword [ebp - 0x18]
push 3
call sub.odbc32.dll_SQLFreeHandle
jmp 0x437b84
push dword [ebp - 0x18]
call sub.odbc32.dll_SQLFetch
cmp ax, bx
je 0x437b15
cmp ax, 1
jne 0x437b72
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x12]
push 2
push eax
push 0xfffffffffffffff1
push 1
push dword [ebp - 0x18]
call sub.odbc32.dll_SQLGetData
xor ecx, ecx
lea eax, [esi + 0x4c994]
cmp dword [ebp + 8], 1
jne 0x437b41
cmp word [eax - 6], bx
je 0x437b56
jmp 0x437b4c
cmp dword [ebp + 8], 2
jne 0x437b4c
cmp word [eax], bx
je 0x437b64
inc ecx
inc eax
inc eax
cmp ecx, 3
jl 0x437b33
jmp 0x437b02
mov ax, word [ebp - 0x12]
mov word [esi + ecx*2 + 0x4c98e], ax
jmp 0x437b02
mov ax, word [ebp - 0x12]
mov word [esi + ecx*2 + 0x4c994], ax
jmp 0x437b02
push dword [ebp - 0x18]
push 3
call sub.odbc32.dll_SQLFreeHandle
lea ecx, [ebp - 0x80]
call fcn.004d2de3
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.005654bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.004d275f
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x402a81
Capabilities:
Read file on windows

Disassembly:
jmp 0x4ce6ff
mov eax, 0x62c172
call fcn.00500010
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.kernel32.dll_ReadFile]
lea eax, [ebp - 0x10]
push 0
lea ebx, [esi + 8]
push eax
push 4
push ebx
mov dword [ebp - 0x28], ebx
push dword [ebp + 8]
call edi
lea ecx, [ebp - 0x10]
push 0
lea eax, [esi + 0xc]
push ecx
push 4
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], eax
call edi
mov eax, dword [ebp - 0x1c]
push ecx
fld dword [eax]
fstp dword [esp]
fld dword [ebx]
push ecx
mov ecx, esi
fstp dword [esp]
call fcn.0040289c
lea eax, [ebp - 0x10]
push 0
lea ebx, [esi + 0x10]
push eax
push 4
push ebx
push dword [ebp + 8]
call edi
push dword [esi + 4]
call fcn.00565079
mov eax, dword [ebx]
and dword [esi + 4], 0
test eax, eax
pop ecx
jle 0x4ce7bf
lea eax, [eax + eax*2]
push 0xb1
mov dword [ebp - 0x24], eax
push 0x66ac1c
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.00564ca3
add esp, 0xc
test eax, eax
je 0x4ce7a5
mov ecx, dword [ebp - 0x24]
dec ecx
mov dword [ebp - 0x24], ecx
jmp 0x4ce7a7
xor eax, eax
mov ebx, dword [ebx]
lea ecx, [ebp - 0x10]
push 0
push ecx
lea ecx, [ebx + ebx*8]
mov dword [esi + 4], eax
shl ecx, 2
push ecx
push eax
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x20], 0
fldz
fstp dword [ebp - 0x18]
fldz
fcomp dword [eax]
fnstsw ax
sahf
jae 0x4ce8a2
add esi, 0x14
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x28]
fldz
fstp dword [ebp - 0x24]
fldz
fcomp dword [eax]
fnstsw ax
sahf
jae 0x4ce881
mov esi, dword [ebp - 0x14]
mov ebx, dword [esi]
test ebx, ebx
je 0x4ce80a
mov ecx, ebx
call fcn.0040137a
push ebx
call fcn.00565079
pop ecx
lea eax, [ebp - 0x10]
and dword [esi], 0
push 0
push eax
lea eax, [ebp - 0x20]
push 4
push eax
push dword [ebp + 8]
call edi
cmp dword [ebp - 0x20], 0
je 0x4ce861
push 0xc2
push 0x66ac1c
push 0x88
call fcn.00564ca3
add esp, 0xc
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
test eax, eax
je 0x4ce84f
mov ecx, eax
call fcn.004021bc
jmp 0x4ce851
xor eax, eax
push dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
mov ecx, eax
mov dword [esi], eax
call fcn.00403bbb
fld dword [ebp - 0x24]
fadd dword [0x634e0c]
mov eax, dword [ebp - 0x28]
add esi, 0x400
fst dword [ebp - 0x24]
fcomp dword [eax]
fnstsw ax
sahf
jb 0x4ce7f6
fld dword [ebp - 0x18]
fadd dword [0x634e0c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], 4
fstp dword [ebp - 0x18]
fld dword [ebp - 0x18]
fcomp dword [eax]
fnstsw ax
sahf
jb 0x4ce7de
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x402f13
Capabilities:
Resume thread

Disassembly:
jmp 0x41de61
push dword [0x6827f8]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x40350d
Capabilities:
Suspend thread

Disassembly:
jmp 0x43333a
mov eax, 0x62a0fc
call fcn.00500010
sub esp, 0x294
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
mov esi, ecx
push eax
call fcn.0053d637
lea ecx, [ebp - 0x14]
call fcn.005bfe41
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.005bfdfa
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.005bfe12
mov dword [ebp - 0x10], eax
xor ebx, ebx
push 0x80
lea eax, [ebp - 0x2a0]
push ebx
push eax
call fcn.00500130
movzx eax, byte [esi + 0x4c950]
movzx ecx, byte [esi + 0x4c951]
add esp, 0xc
cmp edi, eax
mov eax, dword [ebp - 0x18]
je 0x4333ab
sub eax, ecx
add eax, 0x18
jmp 0x4333ad
sub eax, ecx
movzx ecx, byte [esi + 0x4c952]
imul eax, eax, 0x3c
movzx edx, byte [esi + 0x4c955]
sub eax, ecx
movzx ecx, byte [esi + 0x4c953]
add eax, dword [ebp - 0x10]
mov edi, ecx
sub edi, eax
cmp dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
je 0x4333e7
cmp byte [esi + 0x4c954], 1
lea edx, [esi + 0x4c954]
jne 0x4333e7
mov byte [edx], bl
cmp eax, ecx
jne 0x43350d
mov edi, 0x100
lea eax, [ebp - 0x220]
push edi
push ebx
push eax
mov byte [0x682838], 1
call fcn.00500130
add esp, 0xc
lea eax, [ebp - 0x220]
push str._Server_Down_Command____serverdown
push edi
push eax
call fcn.00500030
add esp, 0xc
lea eax, [ebp - 0x220]
mov ecx, esi
push eax
call fcn.0040277f
push dword [0x6827f8]
call dword [sym.imp.kernel32.dll_SuspendThread]
mov ecx, esi
call fcn.00401c80
push edi
lea eax, [ebp - 0x120]
push ebx
push eax
mov byte [esi + 0x4c950], bl
mov byte [esi + 0x4c951], bl
mov byte [esi + 0x4c952], bl
mov byte [esi + 0x4c953], bl
mov byte [esi + 0x4c954], bl
mov byte [esi + 0x4c955], bl
call fcn.00500130
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.005bfe2a
push eax
lea eax, [ebp - 0x120]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push str._____ServerDownTime____d___d__d__d
push edi
push eax
call fcn.00500030
add esp, 0x1c
lea eax, [ebp - 0x120]
mov ecx, esi
push eax
call fcn.0040185c
lea ecx, [ebp - 0x1c]
call fcn.005bf5d7
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.005bfe2a
push eax
lea eax, [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
push str._____ServerDownTime____d___d__d__d_n
push eax
call fcn.0053f356
add esp, 0x18
lea ecx, [ebp - 0x1c]
add esi, 0x4cbc0
call fcn.005bf67a
push eax
mov ecx, esi
call fcn.005cf9a8
push ebx
push 7
push 0x115
mov ecx, esi
call fcn.005cc40d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.005654bc
jmp 0x43353f
movzx eax, byte [esi + 0x4c955]
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
je 0x43353f
cmp byte [esi + 0x4c954], bl
lea eax, [esi + 0x4c954]
jne 0x43353f
push edi
push 7
mov byte [esi + 0x4c955], cl
push ebx
push 0x13
mov ecx, esi
mov byte [eax], 1
call fcn.00402dc4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4039b8
Capabilities:
Read file on windows

Disassembly:
jmp 0x473488
mov eax, 0x62b532
call fcn.00500010
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x1c]
mov esi, dword [sym.imp.kernel32.dll_ReadFile]
push edi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
mov ebx, ecx
push dword [ebp + 8]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
call esi
cmp dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
jle 0x473574
mov edi, 0x140
push 0xea
push 0x665e68
push edi
call fcn.00564ca3
add esp, 0xc
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
test eax, eax
je 0x4734f3
mov ecx, eax
call fcn.00403783
jmp 0x4734f5
xor eax, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
push 0
push ecx
push edi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
call esi
mov eax, dword [ebx + 0x40198]
cmp byte [eax + 0x38828], 1
je 0x473553
mov ecx, dword [ebp - 0x10]
movsx ecx, word [ecx]
push ecx
lea ecx, [eax + 0x14ac]
call fcn.004033af
mov ebx, eax
test ebx, ebx
je 0x473553
lea eax, [ebx + 2]
push eax
mov eax, dword [ebp - 0x10]
add eax, 2
push eax
call fcn.00500240
mov eax, dword [ebp - 0x10]
add ebx, 0x22
add eax, 0x22
push ebx
push eax
call fcn.00500240
add esp, 0x10
mov ebx, dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x40188]
call fcn.00403418
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jl 0x4734cc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40b5ae
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x1f
lea eax, [ebp - 0x24]
push 0
mov edi, ecx
push eax
call fcn.00500130
mov eax, dword [ebp + 8]
add esp, 0xc
movsx ecx, word [eax + 2]
movsx edx, word [eax]
movsx esi, word [eax + 4]
mov dword [ebp + 8], ecx
mov ecx, dword [edi + 0x8098]
cmp byte [ecx + 0x1625], 3
jne 0x40b836
cmp edx, 0x2710
jl 0x40b836
push 0
push edx
call fcn.00401df7
mov ebx, eax
test ebx, ebx
je 0x40b836
mov eax, dword [edi + 0x8098]
mov cl, byte [eax + 0x1618]
cmp cl, 1
jne 0x40b672
xor ecx, ecx
lea edx, [eax + 0x1660]
movsx esi, word [edx]
cmp esi, dword [ebp + 8]
je 0x40b63a
inc ecx
add edx, 8
cmp ecx, 0xa
jl 0x40b624
jmp 0x40b836
mov byte [eax + ecx*8 + 0x1666], 3
mov eax, dword [edi + 0x8098]
cmp byte [eax + 0x1618], 1
jne 0x40b661
push dword [ebp + 8]
lea ecx, [eax + 0x15e8]
push 1
call fcn.0040399f
movzx eax, byte [ebx + 0x57]
push 0
push dword [ebp + 8]
push 8
push eax
jmp 0x40b700
cmp cl, 2
je 0x40b711
cmp cl, 3
je 0x40b711
cmp cl, 4
je 0x40b711
cmp cl, 5
jne 0x40b836
cmp byte [ebx + 0x57], 0x3d
jne 0x40b836
test esi, esi
jl 0x40b836
cmp esi, 0x5dc
jge 0x40b836
mov ecx, dword [0x682824]
mov esi, dword [ecx + esi*4]
test esi, esi
je 0x40b836
mov ecx, dword [esi + 0x8098]
mov cx, word [ecx + 0x62]
test cx, cx
jle 0x40b836
movsx edx, word [esi + 0x8a08]
movsx ecx, cx
push edx
push ecx
lea ecx, [eax + 0x15e8]
call fcn.00402b99
mov eax, dword [esi + 0x8098]
push 0
movsx eax, word [eax + 0x62]
push eax
push 8
push 0x11
mov ecx, dword [edi + 0x8098]
add ecx, 0x15e8
jmp 0x40b831
mov dl, byte [ebx + 0x57]
cmp dl, 0x3d
je 0x40b78a
cmp dl, 0x40
je 0x40b78a
cmp dl, 0x43
jne 0x40b72e
push 0
push dword [ebp + 8]
push 8
push 0x43
jmp 0x40b77f
cmp dl, 0x42
jne 0x40b73e
push 0
push dword [ebp + 8]
push 8
push 0x42
jmp 0x40b77f
cmp dl, 0x44
jne 0x40b76d
push 0
lea ecx, [eax + 0x15e8]
push dword [ebp + 8]
push 8
push 0x44
call fcn.00403d3c
mov ecx, dword [edi + 0x8098]
add ecx, 0x15e8
call fcn.004029a5
jmp 0x40b836
cmp dl, 0x41
jne 0x40b836
push 0
push dword [ebp + 8]
push 8
push 0x41
lea ecx, [eax + 0x15e8]
jmp 0x40b831
cmp cl, 4
jne 0x40b7e3
cmp dl, 0x3d
jne 0x40b79b
mov word [eax + 0x1602], si
mov eax, dword [edi + 0x8098]
xor ecx, ecx
lea edx, [eax + 0x1662]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
mov esi, dword [ebp + 8]
movsx edx, word [edx - 2]
cmp edx, esi
je 0x40b7d8
mov edx, dword [ebp - 4]
mov dx, word [edx]
test dx, dx
jle 0x40b7cc
movsx edx, dx
cmp edx, esi
je 0x40b7d8
add dword [ebp - 4], 8
inc ecx
cmp ecx, 0xa
jl 0x40b7ac
jmp 0x40b836
mov byte [eax + ecx*8 + 0x1666], 3
push esi
jmp 0x40b809
xor ecx, ecx
lea edx, [eax + 0x1660]
movsx esi, word [edx]
cmp esi, dword [ebp + 8]
je 0x40b7fe
inc ecx
add edx, 8
cmp ecx, 2
jl 0x40b7eb
jmp 0x40b836
push dword [ebp + 8]
mov byte [eax + ecx*8 + 0x1666], 3
mov ecx, dword [edi + 0x8098]
mov esi, 0x15e8
push 3
add ecx, esi
call fcn.0040399f
movzx eax, byte [ebx + 0x57]
mov ecx, dword [edi + 0x8098]
push 0
push dword [ebp + 8]
add ecx, esi
push 8
push eax
call fcn.00403d3c
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x488ef2
Capabilities:
Create thread
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 2
mov esi, ecx
push 2
call dword [sym.imp.ws2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x488fb3
mov ebx, dword [sym.imp.ws2_32.dll_setsockopt]
lea ecx, [ebp - 4]
push 4
push ecx
mov edi, 0xffff
push 0x1002
push edi
push eax
mov dword [ebp - 4], 0x8000
call ebx
lea eax, [ebp - 4]
push 4
push eax
push 0x1001
push edi
push dword [esi + 4]
call ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
push 0x1002
push edi
push dword [esi + 4]
call dword [sym.imp.ws2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x488fb3
xor ebx, ebx
lea edi, [esi + 8]
push 0x10
push ebx
push edi
call fcn.00500130
add esp, 0xc
mov word [edi], 2
push ebx
call dword [sym.imp.ws2_32.dll_htonl]
push 0x22b8
mov dword [esi + 0xc], eax
call dword [sym.imp.ws2_32.dll_htons]
push 0x10
push edi
push dword [esi + 4]
mov word [esi + 0xa], ax
call dword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x488fb7
push dword [esi + 4]
call dword [sym.imp.ws2_32.dll_closesocket]
xor al, al
jmp 0x488fda
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push 0x401406
push ebx
push ebx
call fcn.00500a90
add esp, 0x18
mov dword [esi + 0x2c], eax
push 1
push eax
call dword [sym.imp.kernel32.dll_SetThreadPriority]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4d04a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [ecx]
mov edx, esi
dec esi
test edx, edx
je 0x4d04da
mov edx, dword [esp + 8]
xor ecx, ecx
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x66af20]
xor ecx, eax
mov eax, ecx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x4d04b8
pop esi
ret

Function at 0x4d1940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
add ecx, 0x10
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp + 8]
mov cx, 0x9d
mul cx
and eax, 0xff
mov byte [ebp - 1], al
mov eax, 0x86d
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
shr eax, 8
and eax, 0xff
mov byte [ebp - 2], al
mov ah, byte [esi + ecx]
xor ah, al
mov edx, ecx
and edx, 7
mov al, byte [ebx + edx]
xor ah, al
xor ah, byte [ebp - 1]
mov byte [edi + ecx], ah
push ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov cx, 0x87b
mul cx
mov dword [ebp - 0xc], eax
pop ecx
inc ecx
cmp ecx, dword [ebp + 8]
jl 0x4d1976
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d1a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
add ecx, 0x10
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp + 8]
mov cx, 0x9d
mul cx
and eax, 0xff
mov byte [ebp - 2], al
mov eax, 0x86d
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
shr eax, 8
and eax, 0xff
mov byte [ebp - 1], al
mov ah, byte [esi + ecx]
xor ah, byte [ebp - 2]
mov edx, ecx
and edx, 7
mov al, byte [ebx + edx]
xor ah, al
xor ah, byte [ebp - 1]
mov byte [edi + ecx], ah
push ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov cx, 0x87b
mul cx
mov dword [ebp - 0xc], eax
pop ecx
inc ecx
cmp ecx, dword [ebp + 8]
jl 0x4d1a76
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d1c50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x66bc30
mov eax, dword [ebp + 0x10]
clc
jae 0x4d1c65
inc esi
xor ebx, ebx
mov bl, byte [esi]
xor bl, al
shl ebx, 2
shr eax, 8
xor eax, dword [edi + ebx]
dec dword [ebp + 0xc]
jne 0x4d1c64
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc