joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4647b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480588
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4c3408]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0
or esi, 0xffffffff
mov dword [ebp - 0x30], esi
mov ecx, 0x4c5edc
call fcn.00420db0
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0x3c], edi
cmp edi, 0x32
jge 0x464840
cmp esi, 0xffffffff
jne 0x464849
test edi, edi
jle 0x46481d
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
mov dword [ebp - 0x3c], edi
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push ebx
call fcn.00464b00
mov esi, eax
mov dword [ebp - 0x30], esi
jmp 0x464807
cmp esi, 0xffffffff
je 0x4648f6
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edi, edi
mov dword [ebp - 0x40], edi
cmp edi, 0xa
jae 0x464889
mov eax, dword [ebx + 0x104]
push 0
lea ecx, [ebp - 0x44]
push ecx
push dword [eax - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4648d5
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0x34], 1
cmp dword [ebp + 0xc], 0
je 0x464896
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 1
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00403720
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
call fcn.0042ac90
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004014b0
mov dword [ebp - 4], 0
jmp 0x4648f6
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
jmp 0x464858
push 0x104
push 0
push ebx
call fcn.0043f7e0
add esp, 0xc
lea ecx, [ebx + 0x104]
call fcn.00429030
lea ecx, [ebx + 0x108]
call fcn.00429030
mov ecx, 0x4c5edc
call fcn.004212b0
mov edi, eax
test edi, edi
je 0x46495d
push edi
mov ecx, 0x4c5edc
call fcn.00421360
mov dword [ebp - 0x38], eax
mov ecx, edi
call fcn.004212a0
test eax, eax
je 0x464973
mov ecx, edi
call fcn.004212a0
cmp ebx, eax
jne 0x464973
push 0
push edi
mov ecx, 0x4c5edc
call fcn.004215a0
test ebx, ebx
je 0x46496a
push 1
mov ecx, ebx
call fcn.00464730
mov dword [ebp - 4], 0xffffffff
jmp 0x464999
mov edi, dword [ebp - 0x38]
jmp 0x464928
mov ecx, 0x4c5edc
call fcn.00421530
cmp esi, 0xffffffff
je 0x4649af
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00439f38
mov esp, ebp
pop ebp
ret
Function at 0x465e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4c3408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x410], eax
test edi, edi
je 0x465f52
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x465f52
test ebx, ebx
je 0x465f52
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0043f7e0
lea ecx, [ebp - 0x404]
add esp, 0xc
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x465ea0
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x465f52
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x1c]
sub eax, 1
je 0x465eef
sub eax, 3
je 0x465f46
sub eax, 3
jne 0x465ef8
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x408], eax
lea eax, [ebp - 0x408]
push eax
push ebx
lea eax, [ebp + 0x1c]
push eax
push 0
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x40c]
test eax, eax
mov ecx, 1
mov ebx, 0
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439f38
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x408], 4
jmp 0x465ef8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439f38
mov esp, ebp
pop ebp
ret
Function at 0x4670d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x46711a
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x468180
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 8]
mov dword [esi + 0x4c], 0x67452301
push eax
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov dword [esi + 0x5c], 0xc3d2e1f0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043f7e0
xor eax, eax
add esp, 0xc
mov word [esi + 0x48], ax
xorps xmm0, xmm0
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], eax
pop esi
ret
Function at 0x46c700
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481708
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4c3408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x38], ebx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
sub eax, dword [edi]
test eax, 0xfffffffc
je 0x46c848
cmp dword [ebp + 0xc], 0xffffffff
jne 0x46c75d
call fcn.0046cf40
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x46c75d
xor al, al
jmp 0x46c84a
cmp dword [ebx + 0xac], 0x10
lea eax, [ebx + 0x98]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
jb 0x46c77c
mov eax, dword [eax]
lea ecx, [ebp - 0x30]
push ecx
push 0x2001f
push 0
push eax
push dword [ebx + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [ebp - 0x30]
test eax, eax
je 0x46c7ac
test ebx, ebx
je 0x46c848
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x30], ebx
test ebx, ebx
je 0x46c848
mov esi, dword [edi]
mov edi, dword [edi + 4]
cmp esi, edi
je 0x46c830
nop dword [eax]
push dword [esi]
lea eax, [ebp - 0x28]
push eax
call fcn.00474260
add esp, 8
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x46c7dd
mov eax, dword [eax]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
sete byte [ebp - 0x29]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x46c807
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00401820
mov ecx, dword [ebp - 0x34]
add esi, 4
cmp byte [ebp - 0x29], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
lea eax, [ecx + 1]
mov byte [ebp - 0x28], 0
cmove eax, ecx
mov dword [ebp - 0x34], eax
cmp esi, edi
jne 0x46c7c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x34], 0
jle 0x46c848
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x38]
call fcn.0046e680
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439f38
mov esp, ebp
pop ebp
ret 8
Function at 0x46cbd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48186b
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x4c3408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x449], 1
call fcn.0046cf40
cmp eax, 0xffffffff
jne 0x46cc23
mov dword [ebp - 0x454], 2
jmp 0x46cc33
mov ecx, 0x3e7
cmp eax, ecx
cmovge eax, ecx
mov dword [ebp - 0x454], eax
cmp dword [esi + 0xac], 0x10
lea eax, [esi + 0x98]
mov dword [ebp - 0x450], 0
jb 0x46cc4e
mov eax, dword [eax]
lea ecx, [ebp - 0x450]
push ecx
push 0x20019
push 0
push eax
push dword [esi + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [ebp - 0x450]
test eax, eax
je 0x46cc87
test edi, edi
je 0x46ce09
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x450], edi
test edi, edi
je 0x46ce09
mov esi, 1
cmp dword [ebp - 0x454], esi
jl 0x46ce02
push esi
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x30]
movq qword [ebp - 0x1f], xmm0
push 0x4837a0
push eax
movups xmmword [ebp - 0x2f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
call fcn.00401cb0
push 0x400
lea eax, [ebp - 0x430]
push 0
push eax
call fcn.0043f7e0
add esp, 0x18
mov dword [ebp - 0x458], 0x3ff
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x430]
push eax
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x46cdf5
cmp byte [ebp - 0x430], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], 0
mov byte [ebp - 0x448], 0
jne 0x46cd52
xor eax, eax
jmp 0x46cd69
lea eax, [ebp - 0x430]
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46cd60
sub eax, edx
push eax
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x448]
call fcn.00404580
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0x45c], esi
test ecx, ecx
je 0x46ce5b
mov eax, dword [ecx]
lea edx, [ebp - 0x448]
push edx
lea edx, [ebp - 0x45c]
push edx
mov eax, dword [eax + 8]
call eax
test al, al
sete byte [ebp - 0x44a]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x434]
cmp eax, 0x10
jb 0x46cdd1
inc eax
lea ecx, [ebp - 0x448]
push eax
push dword [ebp - 0x448]
call fcn.00401820
cmp byte [ebp - 0x44a], 0
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], 0
mov byte [ebp - 0x448], 0
jne 0x46ce52
inc esi
cmp esi, dword [ebp - 0x454]
jle 0x46cca0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x46ce2f
mov esi, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov dword [ebp + 0x2c], 0
mov al, byte [ebp - 0x449]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439f38
mov esp, ebp
pop ebp
ret 0x28
mov byte [ebp - 0x449], 0
jmp 0x46ce02
call fcn.0043b603
int3
Function at 0x46cf40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4818fb
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4c3408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ecx + 0x98]
mov dword [ebp - 0x22c], 0
or edi, 0xffffffff
cmp dword [eax + 0x14], 0x10
jb 0x46cf89
mov eax, dword [eax]
lea edx, [ebp - 0x22c]
push edx
push 0x2001f
push 0
push eax
push dword [ecx + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [ebp - 0x22c]
test eax, eax
je 0x46cfc2
test esi, esi
je 0x46d17a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x22c], esi
test esi, esi
je 0x46d17a
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 0x234], 0
push 0
push eax
call fcn.0043f7e0
add esp, 0xc
mov dword [ebp - 0x230], 0x200
lea eax, [ebp - 0x230]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x46d173
nop dword [eax + eax]
cmp byte [ebp - 0x210], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
jne 0x46d05c
xor ecx, ecx
jmp 0x46d06e
lea ecx, [ebp - 0x210]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46d065
sub ecx, edx
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.00404580
mov dword [ebp - 4], 0
lea eax, [ebp - 0x228]
push eax
call fcn.00473b40
add esp, 4
mov bl, al
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x214]
cmp ecx, 0x10
jb 0x46d0ed
mov edx, dword [ebp - 0x228]
inc ecx
cmp ecx, 0x1000
jb 0x46d0e4
test dl, 0x1f
jne 0x46d198
mov eax, dword [edx - 4]
cmp eax, edx
jae 0x46d198
sub edx, eax
cmp edx, 4
jb 0x46d198
cmp edx, 0x23
ja 0x46d198
mov edx, eax
push edx
call fcn.00439f33
add esp, 4
mov dword [ebp - 0x214], 0xf
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x228], 0
test bl, bl
je 0x46d120
lea eax, [ebp - 0x210]
push eax
call fcn.0044f535
add esp, 4
cmp eax, edi
cmovg edi, eax
mov ebx, dword [ebp - 0x234]
lea eax, [ebp - 0x210]
push 0x200
push 0
inc ebx
push eax
mov dword [ebp - 0x234], ebx
call fcn.0043f7e0
add esp, 0xc
mov dword [ebp - 0x230], 0x200
lea eax, [ebp - 0x230]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x46d020
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439f38
mov esp, ebp
pop ebp
ret
call fcn.00443b69
int3
Function at 0x46e010
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4c3408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], eax
cmp dword [edi + 0xac], 0x10
lea esi, [edi + 0x98]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
jb 0x46e043
mov eax, dword [esi]
jmp 0x46e045
mov eax, esi
push eax
push dword [edi + 0x7c]
call fcn.0046dc90
add esp, 8
test al, al
jne 0x46e067
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439f38
mov esp, ebp
pop ebp
ret 8
push ebx
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
push dword [ebp - 0x2c]
xor bl, bl
call fcn.0046ce70
cmp dword [ebp - 0x34], 0
jle 0x46e18c
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x28], 0
jb 0x46e091
mov esi, dword [esi]
lea eax, [ebp - 0x28]
push eax
push 0x2001f
push 0
push esi
push dword [edi + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [ebp - 0x28]
test eax, eax
je 0x46e0c1
test edi, edi
je 0x46e18c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x28], edi
test edi, edi
je 0x46e18c
mov ecx, dword [ebp - 0x2c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46e0d0
sub ecx, edx
mov edx, dword [ebp - 0x30]
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x46e0e0
sub edx, esi
lea eax, [edx + ecx]
lea esi, [eax*2 + 0xe]
push esi
call fcn.0043a304
push esi
mov esi, eax
mov dword [ebp - 0x38], eax
push 0
push esi
call fcn.0043f7e0
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push str._s__s
push esi
call fcn.00401cb0
push dword [ebp - 0x34]
xorps xmm0, xmm0
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x24]
movq qword [ebp - 0x13], xmm0
push 0x4837a0
push eax
movups xmmword [ebp - 0x23], xmm0
mov dword [ebp - 0xb], 0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.00401cb0
mov ecx, esi
add esp, 0x2c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46e152
sub ecx, edx
lea eax, [ecx + 1]
push eax
push esi
push 1
push 0
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmove ebx, ecx
call fcn.0043a30d
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00439f38
mov esp, ebp
pop ebp
ret 8
Function at 0x46e1b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xdc], 0x10
lea esi, [edi + 0xc8]
jb 0x46e1cb
mov eax, dword [esi]
jmp 0x46e1cd
mov eax, esi
push eax
push dword [edi + 0x7c]
call fcn.0046dc90
add esp, 8
test al, al
jne 0x46e1e5
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
xor bl, bl
mov dword [ebp - 4], 0
cmp dword [esi + 0x14], 0x10
jb 0x46e1f7
mov esi, dword [esi]
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push esi
push dword [edi + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 4]
test eax, eax
je 0x46e225
test esi, esi
je 0x46e263
push esi
call edi
xor esi, esi
mov dword [ebp - 4], esi
test esi, esi
je 0x46e263
mov edx, dword [ebp + 8]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46e234
sub ecx, dword [ebp + 8]
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push 0x4b063c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
movzx ebx, bl
mov ecx, 1
push esi
cmove ebx, ecx
call edi
mov al, bl
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46e680
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481c16
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x4c3408]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x46e6ca
call fcn.0046cf40
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x46e6ca
xor al, al
jmp 0x46e8ce
cmp dword [esi + 0xac], 0x10
lea eax, [esi + 0x98]
mov dword [ebp - 0x448], 0
jb 0x46e6e5
mov eax, dword [eax]
lea ecx, [ebp - 0x448]
push ecx
push 0x2001f
push 0
push eax
push dword [esi + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [ebp - 0x448]
test eax, eax
je 0x46e71e
test ebx, ebx
je 0x46e8cc
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x448], ebx
test ebx, ebx
je 0x46e8cc
mov esi, 1
mov edi, esi
mov dword [ebp - 0x44c], esi
cmp dword [ebp + 8], esi
jl 0x46e8c5
nop dword [eax]
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.0043f7e0
lea eax, [ebp - 0x428]
mov dword [ebp - 0x450], 0x3ff
push edi
push eax
call fcn.00474260
add esp, 0x14
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x450]
cmp dword [ebp - 0x414], 0x10
lea eax, [ebp - 0x428]
push ecx
cmovae eax, dword [ebp - 0x428]
lea ecx, [ebp - 0x410]
push ecx
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46e87b
cmp esi, edi
je 0x46e874
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x46e7c0
push dword [ebp - 0x44c]
lea eax, [ebp - 0x440]
sub esi, ecx
push eax
call fcn.00474260
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 1
cmp dword [ecx + 0x14], 0x10
jb 0x46e7ec
mov ecx, dword [ecx]
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x410]
push eax
push 1
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete byte [ebp - 0x441]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x42c]
cmp eax, 0x10
jb 0x46e82e
inc eax
lea ecx, [ebp - 0x440]
push eax
push dword [ebp - 0x440]
call fcn.00401820
cmp byte [ebp - 0x441], 0
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
je 0x46e86e
cmp dword [ebp - 0x414], 0x10
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [ebp - 0x44c]
inc esi
mov dword [ebp - 0x44c], esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x414]
cmp eax, 0x10
jb 0x46e8a0
inc eax
lea ecx, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
call fcn.00401820
inc edi
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
cmp edi, dword [ebp + 8]
jle 0x46e740
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439f38
mov esp, ebp
pop ebp
ret 4
Function at 0x46fcf0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x46fef9
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x46fef8
cmp eax, 0x29
jne 0x46fd28
cmp dword [esi + 0x10], 0
jne 0x46fef8
test dword [esi + 0x50], 0x10000000
je 0x46fefd
cmp eax, 0x2e
jne 0x46fd7f
push 5
lea ecx, [esi + 0x24]
call fcn.00472990
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x46fd73
cmp byte [eax], 0x5c
jne 0x46fd71
inc eax
cmp eax, ecx
je 0x46fd71
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x46fd5e
mov dl, byte [eax]
cmp dl, 0x28
je 0x46fd6f
cmp dl, 0x29
je 0x46fd6f
test cl, 0x10
jne 0x46fd71
mov cl, byte [eax]
cmp cl, 0x7b
je 0x46fd6f
cmp cl, 0x7d
jne 0x46fd71
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00473410
jmp 0x46fee5
cmp eax, 0x5c
jne 0x46fe24
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x46fdc4
cmp byte [eax], 0x5c
jne 0x46fdc2
inc eax
cmp eax, ecx
je 0x46fdc2
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x46fdaf
mov dl, byte [eax]
cmp dl, 0x28
je 0x46fdc0
cmp dl, 0x29
je 0x46fdc0
test cl, 0x10
jne 0x46fdc2
mov cl, byte [eax]
cmp cl, 0x7b
je 0x46fdc0
cmp cl, 0x7d
jne 0x46fdc2
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00473410
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x46fdf1
cmp byte [esi + 0x48], 0x62
jne 0x46fdf1
push 4
lea ecx, [esi + 0x24]
call fcn.00472990
mov ecx, esi
call fcn.00472a40
jmp 0x46feec
test eax, eax
je 0x46fe18
cmp byte [esi + 0x48], 0x42
jne 0x46fe18
push 4
lea ecx, [esi + 0x24]
call fcn.00472990
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00472a40
jmp 0x46feec
mov ecx, esi
call fcn.0046ff20
jmp 0x46fee5
cmp eax, 0x5b
jne 0x46fe47
mov ecx, esi
call fcn.00472a40
mov ecx, esi
call fcn.00470650
push 4
push 0x5d
mov ecx, esi
call fcn.00472060
jmp 0x46fee5
cmp eax, 0x28
jne 0x46fe71
mov ecx, esi
call fcn.00472a40
mov ecx, esi
call fcn.00473680
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00472060
test bl, bl
je 0x46feec
jmp 0x46fee5
cmp eax, 0x5e
jne 0x46fe89
push 2
lea ecx, [esi + 0x24]
call fcn.00472990
mov ecx, esi
call fcn.00472a40
jmp 0x46feec
cmp eax, 0x24
jne 0x46fea1
push 3
lea ecx, [esi + 0x24]
call fcn.00472990
mov ecx, esi
call fcn.00472a40
jmp 0x46feec
cmp eax, 0x2a
je 0x46ff12
cmp eax, 0x2b
je 0x46ff12
cmp eax, 0x3f
je 0x46ff12
cmp eax, 0x7b
je 0x46ff12
cmp eax, 0x7d
jne 0x46fec3
test dword [esi + 0x50], 0x10000000
je 0x46ff04
cmp eax, 0x5d
jne 0x46fed1
test dword [esi + 0x50], 0x10000000
je 0x46ff0b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0046f0b0
mov ecx, esi
call fcn.00472a40
mov ecx, esi
call fcn.00472a90
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x46fd00
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.0043b660
push 6
call fcn.0043b660
push 4
call fcn.0043b660
push 0xa
call fcn.0043b660
int3