joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16bd96a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.16bd4780
xor eax, eax
push ebp
push 0x16bd9773
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.16bd8efc
mov esi, eax
test esi, esi
jle 0x16bd9758
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.16bd47f0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.16bd4790
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x16bd9758
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x16bd971d
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.16bd47f0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.16bd4790
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16bd977a
lea eax, [ebp - 8]
mov edx, 2
call fcn.16bd4348
ret

Function at 0x16bd9784
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.16bd4780
xor eax, eax
push ebp
push 0x16bd984b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.16bd8efc
mov esi, eax
test esi, esi
jle 0x16bd9830
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.16bd47f0
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.16bd4790
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x16bd9830
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x16bd97fd
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.16bd47f0
mov eax, dword [ebp - 8]
call fcn.16bd4790
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16bd9852
lea eax, [ebp - 8]
mov edx, 2
call fcn.16bd4348
ret
Function at 0x16bd985c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.16bd4780
xor eax, eax
push ebp
push 0x16bd9996
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.16bd4324
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.16bd4790
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x16bd997b
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], 0x400
mov eax, dword [ebp - 0x18]
call fcn.16bd2c94
mov esi, eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x400
cmp byte [ebp + 8], 0
je 0x16bd98f7
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
jmp 0x16bd9910
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x16bd9963
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.16bd4974
lea eax, [ebp - 8]
call fcn.16bd47e8
mov edx, eax
mov eax, esi
mov ecx, dword [ebp - 0x18]
call fcn.16bd2e0c
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x16bd9948
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.16bd4378
jmp 0x16bd9962
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x16bd99b4
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.16bd4694
inc edi
test ebx, ebx
je 0x16bd98cf
mov eax, esi
call fcn.16bd2cb0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16bd999d
lea eax, [ebp - 8]
mov edx, 2
call fcn.16bd4348
ret
Function at 0x16bdb1ac
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov ebx, 0x16c06808
xor esi, esi
mov dword [0x16c02cdc], 0xffffffff
cmp dword [ebx + 0x44], 0
jne 0x16bdb1cc
mov dword [ebx + 0x44], 0x16bdb0ec
cmp dword [ebx + 0x54], 0
jne 0x16bdb1df
mov eax, dword [ebx + 0x44]
push eax
push ebx
call fcn.16bda198
mov dword [ebx + 0x54], eax
cmp dword [ebx + 0x54], 0
je 0x16bdb2ab
lea eax, [ebx + 0x58]
xor ecx, ecx
mov edx, 0x1c
call fcn.16bd31b0
mov dword [ebx + 0x58], 0x110
mov dword [ebx + 0x5c], 2
mov dword [ebx + 0x60], 7
mov dword [ebx + 0x70], 0x3e8
lea eax, [ebx + 0x58]
push eax
mov eax, dword [ebx + 0x54]
push eax
call fcn.16bda1cc
test eax, eax
je 0x16bdb2ab
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x5c], 4
lea eax, [ebx + 0x58]
push eax
mov eax, dword [ebx + 0x54]
push eax
call fcn.16bda1cc
test eax, eax
je 0x16bdb2ab
push 0x4b0
call sub.kernel32.dll_Sleep_1
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x16bdb271
lea eax, [ebx + 0x50]
push eax
push 0
push 0
push esi
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x4c], eax
cmp dword [ebx + 0x40], 0
jne 0x16bdb289
push 0x7d0
call sub.kernel32.dll_Sleep_1
cmp dword [ebx + 0x74], 0
je 0x16bdb277
jmp 0x16bdb28c
call dword [ebx + 0x40]
mov dword [ebx + 0x5c], 1
lea eax, [ebx + 0x58]
push eax
mov eax, dword [ebx + 0x54]
push eax
call fcn.16bda1cc
cmp dword [ebx + 0x54], 0
setne al
neg al
sbb esi, esi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x16bdc0f4
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pushal
cld
xor ebx, ebx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov esi, dword [ebx + 0x28]
mov ecx, 0x18
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x16bdc11b
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x16bdc112
cmp edi, 0x6a4abc5b
mov edx, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x16bdc108
mov ebx, dword [ebp + 8]
mov dword [ebx], edx
push ebp
mov ebx, edx
mov ebp, ebx
mov ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + ebp + 0x78]
mov ecx, dword [ebx + ebp + 0x18]
mov edx, dword [ebx + ebp + 0x20]
add edx, ebp
call fcn.16bdc0d8
push ecx
mov edi, eax
pop ecx
dec ecx
test ecx, ecx
je 0x16bdc17f
mov esi, dword [edx + ecx*4]
add esi, ebp
push ecx
mov ecx, 0xf
repe cmpsb byte [esi], byte es:[edi]
test ecx, ecx
jne 0x16bdc150
pop ecx
mov esi, dword [ebx + ebp + 0x24]
add esi, ebp
movzx esi, word [esi + ecx*2]
mov edi, dword [ebx + ebp + 0x1c]
add edi, ebp
mov edi, dword [edi + esi*4]
add edi, ebp
pop ebp
mov ebx, dword [ebp + 0xc]
mov dword [ebx], edi
popal
pop ebp
ret 8

Function at 0x16bdc9a8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov eax, dword [ebp + 8]
call fcn.16bd4780
xor eax, eax
push ebp
push 0x16bdca69
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0xc], 0
je 0x16bdc9ea
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.16bd451c
mov edx, dword [ebp - 4]
lea eax, [ebp + 8]
mov ecx, dword [ebp + 8]
call fcn.16bd4618
mov eax, dword [ebp + 8]
test eax, eax
je 0x16bdc9f6
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
mov eax, ebx
add eax, eax
add eax, 2
call fcn.16bd6bd4
mov esi, eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.16bd8978
mov eax, dword [ebp - 8]
call fcn.16bd4b60
mov edx, eax
mov ecx, ebx
add ecx, ecx
mov eax, esi
call fcn.16bd6488
call fcn.16bd8908
mov eax, dword [eax + 0x10]
add eax, 0x40
mov dword [eax + 4], esi
mov edx, ebx
add edx, edx
mov word [eax], dx
add dx, 2
mov word [eax + 2], dx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16bdca70
lea eax, [ebp - 8]
call fcn.16bd4a08
lea eax, [ebp - 4]
call fcn.16bd4324
lea eax, [ebp + 8]
call fcn.16bd4324
ret
Function at 0x16bdd968
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.16bd4780
xor eax, eax
push ebp
push 0x16bddab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
cmp dword [edi], 0
je 0x16bdd9b3
push 0x4021c
mov eax, dword [edi]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
je 0x16bdda8b
push 0x16bddacc
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.16bdd824
push dword [ebp - 0x2c]
push 0x16bddae0
lea eax, [ebp - 8]
mov edx, 3
call fcn.16bd4694
push 1
lea eax, [ebp - 0x1c]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0x28], 0xc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 8]
call fcn.16bd4790
push eax
push 0x4021c
push 0
push 4
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x16bdda75
lea eax, [ebp - 0x30]
mov ecx, 0x16bddaec
mov edx, dword [ebp - 8]
call fcn.16bd4618
mov eax, dword [ebp - 0x30]
push eax
call fcn.16bd75b4
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.16bd47f0
mov eax, dword [ebp - 8]
call fcn.16bd4790
push eax
push 0x4021c
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 6
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
cmp dword [edi], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16bddaba
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.16bd4348
lea eax, [ebp - 8]
mov edx, 2
call fcn.16bd4348
ret
Function at 0x16bde494
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
add esp, 0xfffffff0
call fcn.16bde490
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0x64
call sub.kernel32.dll_Sleep_1
call fcn.16bde490
sub eax, dword [esp]
sbb edx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call sub.kernel32.dll_GetTickCount_1
mov ecx, eax
sub ecx, ebx
cmp dword [esp + 0xc], 0
jne 0x16bde4e2
cmp dword [esp + 8], 0x2faf080
jb 0x16bde4ed
jmp 0x16bde4e4
jl 0x16bde4ed
cmp ecx, 0x32
jb 0x16bde4ed
xor eax, eax
jmp 0x16bde4ef
mov al, 1
add esp, 0x10
pop ebx
ret
Function at 0x16be31a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x16be324e
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x16be31c9
push 0x493e0
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x16be31bf
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x16c02ecc]
sub eax, dword [edx + 0x208]
cmp eax, 0x493e0
jl 0x16be31bf
push dword [0x16c069a4]
push 0x16be3264
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x16c02ecc]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 8]
call fcn.16bd6c04
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.16bd4694
mov eax, dword [ebp - 4]
push eax
call fcn.16bd75b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16be3255
lea eax, [ebp - 8]
mov edx, 2
call fcn.16bd4348
ret

Function at 0x16be3270
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
call fcn.16bd4780
mov eax, dword [ebp + 0xc]
call fcn.16bd4780
xor eax, eax
push ebp
push 0x16be32ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0xc], 0
jne 0x16be32b2
push 5
push 0
mov eax, dword [ebp + 8]
call fcn.16bd4790
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x16be32d1
push 5
mov eax, dword [ebp + 0xc]
call fcn.16bd4790
push eax
mov eax, dword [ebp + 8]
call fcn.16bd4790
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16be32f3
lea eax, [ebp + 8]
mov edx, 2
call fcn.16bd4348
ret
Function at 0x16be32fc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x16be3304
xor eax, eax
push ebp
push 0x16be347a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x16c03214]
mov edx, dword [edx]
call fcn.16bd451c
mov eax, dword [ebp - 4]
call fcn.16bd5f20
test al, al
jne 0x16be3355
lea eax, [ebp - 8]
mov edx, dword [0x16c03230]
mov edx, dword [edx]
call fcn.16bd451c
mov eax, dword [ebp - 8]
call fcn.16bd5f20
test al, al
je 0x16be33e9
lea eax, [ebp - 0xc]
mov edx, dword [0x16c031bc]
mov edx, dword [edx]
call fcn.16bd451c
mov eax, dword [ebp - 0xc]
mov edx, dword [0x16c06990]
call fcn.16bd790c
push 4
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x16c06990]
call fcn.16bd732c
mov eax, dword [ebp - 0x10]
call fcn.16bd4790
push eax
call sub.kernel32.dll_MoveFileExA
lea edx, [ebp - 0x14]
mov eax, dword [0x16c06990]
call fcn.16bd73a8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x16c06994]
call fcn.16bd4728
je 0x16be33e9
lea edx, [ebp - 0x18]
mov eax, dword [0x16c06990]
call fcn.16bd73a8
mov ecx, dword [ebp - 0x18]
mov eax, dword [0x16c069cc]
mov edx, dword [eax]
mov eax, dword [0x16c069bc]
call fcn.16bdb718
lea edx, [ebp - 0x1c]
mov eax, dword [0x16c06990]
call fcn.16bd73a8
mov edx, dword [ebp - 0x1c]
mov eax, 0x16c06994
call fcn.16bd4378
cmp byte [0x16c06976], 0
jne 0x16be3419
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [0x16c06994]
call fcn.16bd4790
push eax
call sub.kernel32.dll_CreateFileA
mov dword [0x16c02ec0], eax
push dword [0x16c069a4]
push 0x16be3490
lea edx, [ebp - 0x24]
mov eax, dword [0x16c02ec0]
call fcn.16bd6c04
push dword [ebp - 0x24]
push 0x16be34a4
call sub.kernel32.dll_GetCurrentProcessId
lea edx, [ebp - 0x28]
call fcn.16bd6c04
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.16bd4694
mov eax, dword [ebp - 0x20]
push eax
call fcn.16bd75b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x16be3481
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.16bd4348
ret

Function at 0x16be5cfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x16be5d35
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.16bd4414
jmp 0x16be5d3e
mov eax, ebx
mov edx, esi
call fcn.16bd4378
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x16be5d48
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x16be5d6a
movzx eax, byte [esp]
jmp 0x16be5d6c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x16be63fc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x16be6274
mov eax, dword [0x16c0321c]
cmp byte [eax], 0
je 0x16be6478
mov eax, dword [0x16c0314c]
call fcn.16bd30f4
call fcn.16bd2dbc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.16be51bc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x16be64c0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x16be64ae
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x16c03124]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x16c067f0]
call fcn.16bd4ea8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x403b1d
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 2
jne 0x403b95
mov eax, dword [ebp - 0x10]
inc eax
lea edx, [eax + 0xf]
mov eax, 0x10
dec eax
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.006b7700
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp - 0x10]
lea edx, [eax - 4]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [eax], 0x6769726f
mov byte [eax + 4], 0
jmp 0x403bf2
mov eax, dword [ebp - 0x10]
add eax, 6
lea edx, [eax + 0xf]
mov eax, 0x10
dec eax
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.006b7700
sub esp, eax
lea eax, [esp + 0x14]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
add eax, edx
mov dword [eax], 0x69726f2e
mov word [eax + 4], 0x67
mov eax, dword [0x7af074]
test eax, eax
jne 0x403c0c
mov dword [esp], 0
call fcn.0041269a
mov dword [0x7af074], eax
mov eax, dword [0x7af074]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00436411
test eax, eax
jne 0x403c85
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_rename
test eax, eax
je 0x403c71
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov eax, dword [eax]
mov dword [esp], eax
call fcn.0047f310
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Cannot_back_up__s_as__s:__s_n
mov dword [esp], 1
call fcn.004246ce
mov eax, dword [0x7af074]
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004363ce
nop
leave
ret
Function at 0x403e7e
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x1c], al
mov dword [esp + 4], 0x6d84b2
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strpbrk
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x403ecc
cmp byte [ebp - 0x1c], 0
je 0x403ebc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0047f294
jmp 0x40403b
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004046f4
jmp 0x40403b
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
inc eax
lea edx, [eax + 0xf]
mov eax, 0x10
dec eax
add eax, edx
mov ecx, 0x10
mov edx, 0
div ecx
imul eax, eax, 0x10
call fcn.006b7700
sub esp, eax
lea eax, [esp + 8]
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x40400a
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
movsx eax, al
cmp eax, 0x25
je 0x403f53
cmp eax, 0x25
jg 0x403f44
cmp eax, 0x23
je 0x403f7c
jmp 0x403ff7
cmp eax, 0x3b
je 0x403fa2
cmp eax, 0x3f
je 0x403fc8
jmp 0x403ff7
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x32
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x35
jmp 0x404007
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x32
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
jmp 0x404007
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x42
jmp 0x404007
mov al, byte [0x7bdea9]
test al, al
je 0x403ff7
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x25
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x33
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov byte [eax], 0x46
jmp 0x404007
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0xc]
mov dl, byte [edx]
mov byte [eax], dl
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
test al, al
jne 0x403f28
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
cmp byte [ebp - 0x1c], 0
je 0x404030
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0047f294
jmp 0x40403b
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.004046f4
leave
ret