joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409f73
Capabilities:
Hash data via wincrypt

Disassembly:
push 0x6c
mov eax, 0x538fa3
call fcn.0053655e
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x44]
push 0x559fbc
call fcn.00401ca5
xor eax, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x44]
push eax
call fcn.004068e7
mov eax, dword [ebp - 0x2c]
lea edi, [esi + 4]
mov dword [esi], eax
mov ecx, edi
lea eax, [ebp - 0x28]
push eax
call fcn.00401f0b
lea ecx, [ebp - 0x28]
call fcn.00402554
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00402554
cmp dword [esi + 0x1c], 0
je 0x40a043
cmp dword [esi + 0x20], 0
je 0x40a043
push 0
push dword [ebp + 0xc]
push ebx
push dword [esi + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40a03f
push str.Updating_hash_failed_
lea ecx, [ebp - 0x78]
call fcn.00401ca5
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x5c]
and dword [ebp - 0x48], 0
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x78]
push eax
call fcn.004068e7
mov eax, dword [ebp - 0x60]
mov ecx, edi
mov dword [esi], eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00401f0b
lea ecx, [ebp - 0x5c]
call fcn.00402554
lea ecx, [ebp - 0x78]
jmp 0x40a089
mov al, 1
jmp 0x40a090
push str.Cryptographic_provider_not_acquired_
lea ecx, [ebp - 0x44]
call fcn.00401ca5
xor eax, eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x44]
push eax
call fcn.004068e7
mov eax, dword [ebp - 0x2c]
mov ecx, edi
mov dword [esi], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00401f0b
lea ecx, [ebp - 0x28]
call fcn.00402554
lea ecx, [ebp - 0x44]
call fcn.00402554
xor al, al
call fcn.00536508
ret 8
Function at 0x40da24
Capabilities:
Create directory

Disassembly:
push 0x90
mov eax, 0x539773
call fcn.0053655e
mov esi, dword [ebp + 8]
push esi
call fcn.0040d971
pop ecx
test al, al
jne 0x40db9f
xor ebx, ebx
lea ecx, [ebp - 0x9c]
push ebx
push ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.0040c9fd
mov edi, eax
mov dword [ebp - 0x9c], edi
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.0040a64a
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
je 0x40dac6
lea eax, [ebp - 0x34]
push eax
push dword [edi]
lea ecx, [ebp - 0x9c]
call fcn.0040b47c
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040ac85
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.0040a6e6
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00403ae4
lea ecx, [ebp - 0x58]
call fcn.0040257a
mov edi, dword [ebp - 0x9c]
jmp 0x40da78
mov esi, dword [edi]
jmp 0x40db6d
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x94]
call fcn.0040a64a
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x94]
call fcn.0040b09c
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.0040a686
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 5
push eax
call fcn.0040d971
pop ecx
lea ecx, [ebp - 0x40]
mov bl, al
call fcn.00403ae4
lea ecx, [ebp - 0x58]
call fcn.0040257a
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.0040257a
test bl, bl
jne 0x40db54
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x94]
call fcn.0040b09c
cmp dword [eax + 0x14], 8
jb 0x40db43
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x70]
call fcn.0040257a
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 1
call fcn.00403ae4
lea ecx, [ebp - 0x94]
call fcn.0040257a
mov esi, dword [esi]
cmp esi, edi
jne 0x40dacd
lea ecx, [ebp - 0x1c]
call fcn.00403ae4
lea ecx, [ebp - 0x34]
call fcn.0040257a
lea ecx, [ebp - 0x9c]
call fcn.0040cbb4
push 0x2c
push dword [ebp - 0x9c]
call fcn.0040140e
pop ecx
pop ecx
mov al, 1
call fcn.00536508
ret
Function at 0x40faf6
Capabilities:
Initialize winsock library

Disassembly:
push 0x24c
mov eax, 0x539b93
call fcn.0053655e
mov esi, ecx
mov dword [ebp - 0x1a4], esi
mov dword [ebp - 0x1a8], esi
call fcn.004b4c21
xor ebx, ebx
mov dword [esi], vtable.Http.0
mov dword [esi + 0xc], ebx
xor eax, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov word [esi + 0x18], ax
mov byte [esi + 0x1a], 1
mov dword [ebp - 4], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x5c], ebx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 3
mov dword [esi + 0x60], ebx
call fcn.0041e978
xor eax, eax
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], 7
mov word [esi + 0xc0], ax
mov byte [ebp - 4], 5
mov word [esi + 0xd8], 0x100
cmp byte [0x600f44], al
jne 0x40fc4c
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 1
lea ecx, [ebp - 0x258]
mov edi, eax
push 3
call fcn.00404da4
test edi, edi
je 0x40fbe8
push edi
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 6
push 0x55b0a4
push eax
call fcn.0040446a
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
lea eax, [ebp - 0x258]
push eax
push str.Http::Http
push 0x21
push str.C:workprojects_rubilnik_srccommonHttp.cpp
push ebx
jmp 0x40fc22
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 7
push str.WinSock_init_ok__version
push eax
call fcn.0040446a
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_short_int_]
lea eax, [ebp - 0x258]
push eax
push str.Http::Http
push 0x23
push str.C:workprojects_rubilnik_srccommonHttp.cpp
push 1
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0x1f0]
call fcn.00404fea
lea ecx, [ebp - 0x1f0]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov byte [0x600f44], 1
mov eax, esi
call fcn.00536508
ret
Function at 0x410446
Capabilities:
Read http header

Disassembly:
push 0x24
mov eax, 0x539ced
call fcn.0053655e
mov ebx, ecx
mov dword [ebp - 0x30], ebx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov edi, dword [ebp + 0xc]
push 0x559fc4
mov dword [ebp - 0x2c], esi
call fcn.00401cd4
xor edx, edx
mov eax, edi
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], edx
jb 0x41047f
mov eax, dword [edi]
lea ecx, [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push edx
push eax
push 0xffff
push dword [ebx + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x41050a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x41050a
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00536606
cmp dword [edi + 0x14], 8
mov ebx, eax
pop ecx
jb 0x4104c9
mov edi, dword [edi]
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push ebx
push edi
push 0xffff
push dword [eax + 0x14]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x41050a
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040261b
push ebx
call fcn.0053660f
pop ecx
xor eax, eax
mov ecx, esi
mov byte [ebp - 0x30], al
push dword [ebp - 0x30]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00403889
lea ecx, [ebp - 0x28]
call fcn.0040257a
mov eax, esi
call fcn.00536508
ret 0xc
Function at 0x4106bc
Capabilities:
Initialize winhttp library
Reference http user-agent string

Disassembly:
push 0xcc
mov eax, 0x539d76
call fcn.0053655e
mov esi, ecx
call fcn.00410176
xor eax, eax
mov word [esi + 0xd8], 0x100
xor ebx, ebx
mov word [esi + 0x18], ax
lea ecx, [esi + 0x28]
mov dword [esi + 0x60], ebx
call fcn.0041015e
push 0x55b6b8
lea ecx, [ebp - 0x28]
call fcn.00401cd4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x410768
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 3
lea ecx, [ebp - 0xd8]
mov dword [esi + 0x60], eax
call fcn.00404da4
push dword [esi + 0x60]
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 1
push str.WinHttpOpen_last_error
push eax
call fcn.0040b103
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea eax, [ebp - 0xd8]
push eax
push str.Http::init
push 0x24e
jmp 0x4107c2
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x4107e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 3
lea ecx, [ebp - 0xd8]
mov dword [esi + 0x60], eax
call fcn.00404da4
push dword [esi + 0x60]
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 2
push str.WinHttpSetTimeouts_last_error
push eax
call fcn.0040b103
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea eax, [ebp - 0xd8]
push eax
push str.Http::init
push 0x255
push str.C:workprojects_rubilnik_srccommonHttp.cpp
push ebx
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0x70]
call fcn.00404fea
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
jmp 0x4107e9
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.0040257a
mov al, bl
call fcn.00536508
ret
Function at 0x4111d0
Capabilities:
Resolve dns

Disassembly:
push 0xf8
mov eax, 0x539ec8
call fcn.0053655e
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x28]
push eax
call fcn.004043f8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
push eax
call sub.WS2_32.dll_gethostbyname
lea ecx, [ebp - 0x28]
mov ebx, eax
call fcn.00402554
test ebx, ebx
jne 0x41128c
push 1
push 3
lea ecx, [ebp - 0x104]
call fcn.00404da4
push dword [ebp - 0x44]
lea eax, [ebp - 0xf4]
xor esi, esi
push str.Yow__Bad_host_lookup_for
push eax
mov dword [ebp - 4], esi
call fcn.0040446a
pop ecx
pop ecx
push eax
call fcn.0040a098
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
push str.Http::resolveHost
push 0x215
push str.C:workprojects_rubilnik_srccommonHttp.cpp
push esi
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0x9c]
call fcn.00404fea
lea ecx, [ebp - 0x9c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
jmp 0x411302
xor esi, esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov eax, dword [ebx + 0xc]
mov dword [ebp - 4], 1
mov eax, dword [eax]
jmp 0x4112eb
push 4
push eax
lea eax, [ebp - 0x48]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [ebp - 0x48]
call sub.WS2_32.dll_inet_ntoa
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0041e3d3
pop ecx
pop ecx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x54]
call fcn.00404ce1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0040257a
mov eax, dword [ebx + 0xc]
inc esi
mov eax, dword [eax + esi*4]
test eax, eax
jne 0x4112a5
lea eax, [ebp - 0x54]
mov ecx, edi
push eax
call fcn.0040fac6
lea ecx, [ebp - 0x54]
call fcn.00403ae4
mov eax, edi
call fcn.00536508
ret
Function at 0x4113b3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00536760
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [edi + 0x14], ebx
je 0x4114cc
call fcn.00410438
mov ecx, 0xc8
cmp ax, cx
jne 0x4114cc
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
jb 0x411404
mov esi, dword [esi]
push ebx
push ebx
push 0x80
push 2
push 2
push 0x40000000
push esi
lea ecx, [ebp - 0x1010]
call fcn.00405781
test eax, eax
js 0x4114b7
mov ecx, edi
call fcn.0041034e
mov esi, dword [ebp - 0x1010]
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x1008], ebx
push 0x1000
lea eax, [ebp - 0x1004]
mov ecx, edi
push eax
call fcn.004110f1
mov dword [ebp - 0x1014], eax
test eax, eax
je 0x411494
add dword [ebp - 0x1008], eax
lea ecx, [ebp - 0x100c]
push ebx
push ecx
push eax
lea eax, [ebp - 0x1004]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x411486
call fcn.00405442
jmp 0x411488
mov eax, ebx
test eax, eax
js 0x411494
cmp dword [ebp - 0x1014], ebx
ja 0x411441
test esi, esi
je 0x4114a1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
mov eax, dword [ebp - 0x1018]
test eax, eax
je 0x4114b3
cmp dword [ebp - 0x1008], eax
jne 0x4114bd
mov bl, 1
jmp 0x4114bd
mov esi, dword [ebp - 0x1010]
test esi, esi
je 0x4114c8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x4114ce
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005364e2
leave
ret 4
Function at 0x41172a
Capabilities:
Read .ini file

Disassembly:
push 0x3c
mov eax, 0x539f6f
call fcn.0053655e
mov edi, ecx
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], ecx
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
push ecx
xor ebx, ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
inc ebx
mov dword [ebp - 0x14], 7
push 0xa000
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], ebx
mov word [ebp - 0x28], ax
call fcn.004116df
cmp dword [edi + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x41177d
mov edi, dword [edi]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
push 0x559fc4
lea ecx, [ebp - 0x40]
mov ebx, eax
call fcn.00401cd4
xor eax, eax
mov byte [ebp - 4], 2
mov edi, eax
test ebx, ebx
je 0x411819
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x40]
cmovae eax, dword [ebp - 0x28]
movzx eax, word [eax + edi*2]
push eax
call fcn.00411911
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
cmp word [eax + edi*2], cx
jne 0x411814
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x4117ee
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0040a280
jmp 0x4117fa
lea ecx, [ebp - 0x40]
push ecx
push eax
mov ecx, esi
call fcn.0040a2a2
push 0x559fc4
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push 0x559fc4
lea ecx, [ebp - 0x40]
call fcn.0040261b
inc edi
cmp edi, ebx
jb 0x4117ae
lea ecx, [ebp - 0x40]
call fcn.0040257a
lea ecx, [ebp - 0x28]
call fcn.0040257a
mov eax, esi
call fcn.00536508
ret 4

Function at 0x411833
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539faa
mov eax, dword fs:[0]
push eax
mov eax, 0x4038
call fcn.00536760
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x14], 8
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x4044], esi
jb 0x41187a
mov ecx, dword [ecx]
cmp dword [edx + 0x14], 8
jb 0x411882
mov edx, dword [edx]
cmp dword [eax + 0x14], 8
jb 0x41188a
mov eax, dword [eax]
push ecx
push 0x2000
lea ecx, [ebp - 0x4010]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x4010]
push eax
lea ecx, [ebp - 0x4028]
call fcn.00401cd4
and dword [ebp - 4], 0
lea eax, [ebp - 0x4028]
push eax
lea eax, [ebp - 0x4040]
push eax
call fcn.0041c8ee
pop ecx
pop ecx
lea ecx, [ebp - 0x4028]
mov byte [ebp - 4], 2
call fcn.0040257a
lea eax, [ebp - 0x4040]
push eax
push esi
call fcn.00404416
pop ecx
pop ecx
lea ecx, [ebp - 0x4040]
call fcn.00402554
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005364e2
leave
ret 0xc
Function at 0x412039
Capabilities:
Print debug messages

Disassembly:
push 0xec
mov eax, 0x53a097
call fcn.0053655e
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
test eax, eax
jle 0x412085
lea ecx, [edi + eax*2]
movzx edx, word [ecx]
cmp edx, 0x2f
je 0x412082
cmp edx, 0x5c
je 0x412082
dec eax
sub ecx, 2
test eax, eax
jg 0x41206b
jmp 0x412085
lea edi, [ecx + 2]
push 1
push 3
lea ecx, [ebp - 0xf8]
call fcn.00404da4
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x18]
call fcn.0040a1fb
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.00411f9b
mov esi, eax
mov dword [esp], 0x55b30c
lea eax, [ebp - 0x28]
push eax
push 0x55b8e4
push dword [ebp - 0x44]
mov ecx, ebx
mov byte [ebp - 4], 2
push 0x55b098
push edi
push 0x55a6d0
push dword [ebp - 0x48]
call fcn.00412011
movzx eax, ax
push eax
push 0x55b8e8
push esi
lea eax, [ebp - 0xe8]
push 0x55b8f0
push eax
call fcn.0040446a
pop ecx
pop ecx
push eax
call fcn.0040a098
pop ecx
pop ecx
push eax
call fcn.0040446a
pop ecx
pop ecx
push eax
call fcn.00411d69
pop ecx
pop ecx
push eax
call fcn.0040446a
pop ecx
pop ecx
push eax
call fcn.0040446a
pop ecx
pop ecx
push eax
call fcn.0040446a
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
push eax
call fcn.0040446a
pop ecx
pop ecx
push eax
call fcn.0040a098
pop ecx
pop ecx
push eax
call fcn.0040446a
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0040257a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040257a
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040a1fb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x28]
call fcn.0040257a
lea esi, [ebx + 0x24]
cmp dword [esi], 0
je 0x4121ec
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xe0]
call fcn.0040a1fb
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004043f8
pop ecx
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0040257a
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
mov ecx, esi
push eax
call fcn.0040664d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x4121e4
call fcn.00405442
lea ecx, [ebp - 0x28]
call fcn.00402554
lea ecx, [ebp - 0x90]
call fcn.00404fea
lea ecx, [ebp - 0x90]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
call fcn.00536508
ret 0x14

Function at 0x4122de
Capabilities:
Create process on windows

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x4122e6
mov ecx, dword [ecx]
push 5
xor eax, eax
push eax
push eax
push ecx
push 0x55a570
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x418bf2
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x418d4a
push edi
push 0x29
pop edi
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x418d48
cmp eax, edi
jne 0x418c33
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x418d48
cmp eax, edi
jne 0x418c33
test dword [esi + 0x50], edx
je 0x418d56
cmp eax, 0x2e
jne 0x418c4e
push 5
lea ecx, [esi + 0x24]
call fcn.0041bd60
mov ecx, esi
call fcn.0041bd9e
jmp 0x418d33
cmp eax, 0x5c
jne 0x418ca0
mov ecx, esi
call fcn.0041bd9e
test byte [esi + 0x50], 0x80
je 0x418c94
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x418c7d
push 4
lea ecx, [esi + 0x24]
call fcn.0041bd60
mov ecx, esi
call fcn.0041bd9e
jmp 0x418d3a
cmp al, 0x42
jne 0x418c94
push 4
lea ecx, [esi + 0x24]
call fcn.0041bd60
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x418c71
mov ecx, esi
call fcn.00418ed1
jmp 0x418d33
cmp eax, 0x5b
jne 0x418cc0
mov ecx, esi
call fcn.0041bd9e
mov ecx, esi
call fcn.00419605
cmp dword [esi + 0x4c], 0x5d
je 0x418c42
push 4
jmp 0x418d58
cmp eax, 0x28
jne 0x418cdc
mov ecx, esi
call fcn.0041bd9e
mov ecx, esi
call fcn.0041c7a5
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x418d56
jmp 0x418d28
cmp eax, 0x5e
jne 0x418ce5
push 2
jmp 0x418c69
cmp eax, 0x24
jne 0x418cf1
push 3
jmp 0x418c69
cmp eax, 0x2a
je 0x418d52
cmp eax, 0x2b
je 0x418d52
cmp eax, 0x3f
je 0x418d52
cmp eax, 0x7b
je 0x418d52
cmp eax, 0x7d
jne 0x418d0f
test dword [esi + 0x50], edx
je 0x418d4e
cmp eax, 0x5d
jne 0x418d19
test dword [esi + 0x50], edx
je 0x418cb9
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00417ed7
mov bl, 1
mov ecx, esi
call fcn.0041bd9e
test bl, bl
je 0x418d3a
mov ecx, esi
call fcn.0041bdfb
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x418c08
pop ebx
pop edi
mov al, cl
pop esi
ret
push 6
jmp 0x418d58
push 0xa
jmp 0x418d58
push 5
mov ecx, esi
call fcn.0041af4b
int3
Function at 0x418d60
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x418ebb
push edi
push 0x29
pop edi
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x418eb9
cmp eax, edi
jne 0x418da1
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x418eb9
cmp eax, edi
jne 0x418da1
test dword [esi + 0x50], edx
je 0x418ec7
cmp eax, 0x2e
jne 0x418dbc
push 5
lea ecx, [esi + 0x24]
call fcn.0041bd60
mov ecx, esi
call fcn.0041bdcc
jmp 0x418ea4
cmp eax, 0x5c
jne 0x418e11
mov ecx, esi
call fcn.0041bdcc
test byte [esi + 0x50], 0x80
je 0x418e05
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x418ded
push 4
lea ecx, [esi + 0x24]
call fcn.0041bd60
mov ecx, esi
call fcn.0041bdcc
jmp 0x418eab
cmp eax, 0x42
jne 0x418e05
push 4
lea ecx, [esi + 0x24]
call fcn.0041bd60
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x418de1
mov ecx, esi
call fcn.00418f77
jmp 0x418ea4
cmp eax, 0x5b
jne 0x418e31
mov ecx, esi
call fcn.0041bdcc
mov ecx, esi
call fcn.0041964e
cmp dword [esi + 0x4c], 0x5d
je 0x418db0
push 4
jmp 0x418ec9
cmp eax, 0x28
jne 0x418e4d
mov ecx, esi
call fcn.0041bdcc
mov ecx, esi
call fcn.0041c824
mov bl, al
cmp dword [esi + 0x4c], edi
jne 0x418ec7
jmp 0x418e99
cmp eax, 0x5e
jne 0x418e56
push 2
jmp 0x418dd9
cmp eax, 0x24
jne 0x418e62
push 3
jmp 0x418dd9
cmp eax, 0x2a
je 0x418ec3
cmp eax, 0x2b
je 0x418ec3
cmp eax, 0x3f
je 0x418ec3
cmp eax, 0x7b
je 0x418ec3
cmp eax, 0x7d
jne 0x418e80
test dword [esi + 0x50], edx
je 0x418ebf
cmp eax, 0x5d
jne 0x418e8a
test dword [esi + 0x50], edx
je 0x418e2a
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00417f35
mov bl, 1
mov ecx, esi
call fcn.0041bdcc
test bl, bl
je 0x418eab
mov ecx, esi
call fcn.0041bec6
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x418d76
pop ebx
pop edi
mov al, cl
pop esi
ret
push 6
jmp 0x418ec9
push 0xa
jmp 0x418ec9
push 5
mov ecx, esi
call fcn.0041af4b
int3