joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65692820
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x656929e4
pushal
mov esi, 0x65690015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x6569284a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x65692851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x65692840
mov eax, 1
add ebx, ebx
jne 0x65692863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x65692858
jne 0x65692874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x65692858
xor ecx, ecx
sub eax, 3
jb 0x65692888
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x656928fa
mov ebp, eax
add ebx, ebx
jne 0x65692893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x656928a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x656928c4
inc ecx
add ebx, ebx
jne 0x656928b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x656928a5
jne 0x656928c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x656928a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x656928e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x656928d5
jmp 0x65692846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x656928e4
add edi, ecx
jmp 0x65692846
pop esi
mov edi, esi
mov ecx, 0x24
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x65692902
cmp byte [edi], 0
jne 0x65692902
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x65692907
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x65692976
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x65692934
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12054]
or eax, eax
je 0x65692970
mov dword [ebx], eax
add ebx, 4
jmp 0x65692951
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x656929a7
cmp al, 0xef
ja 0x6569299a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6569297c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x65692989
mov ebp, dword [esi + 0x12058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x656929db
sub esp, 0xffffff80
jmp 0x65681290
Function at 0x4010fe
Capabilities:
Print debug messages
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0x41f7e8
push 1
push str.Debug
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x401150
push esi
lea eax, [ebp + 0xc]
mov esi, 0x41fe08
push eax
push 0
push dword [ebp + 8]
push 0x400
push esi
call fcn.00401000
push dword [eax + 4]
push dword [eax]
call fcn.00405b79
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.00401155
pop esi
xor eax, eax
inc eax
pop ebp
ret

Function at 0x401556
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
mov si, cx
call fcn.004034b0
mov eax, 0x41f9f8
mov dword [ebp - 0x30], str.runas
push eax
push str.Retry_run__s_n
mov dword [ebp - 0x2c], eax
call fcn.004010fe
add esp, 0x14
push 0x69
pop eax
cmp ax, si
jne 0x4015a2
mov dword [ebp - 0x28], str._i__r
jmp 0x4015e7
push 0x75
pop eax
cmp ax, si
jne 0x4015b3
mov dword [ebp - 0x28], str._u__r
jmp 0x4015e7
push 0x74
pop eax
cmp ax, si
jne 0x4015c4
mov dword [ebp - 0x28], str._t__r
jmp 0x4015e7
push 0x70
pop eax
cmp ax, si
jne 0x4015d5
mov dword [ebp - 0x28], str._p__r
jmp 0x4015e7
push 0x73
pop ecx
cmp cx, si
mov eax, str._s__r
cmovne eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
test eax, eax
jne 0x40161a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x40160a
push str.RunAsAdmin_ERROR_CANCELLED_n
jmp 0x401614
cmp eax, 2
jne 0x40161a
push str.RunAsAdmin_ERROR_FILE_NOT_FOUND_n
call fcn.004010fe
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40189e
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x104
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4018e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.SvcInstall___Cannot_install_service___d__n
call fcn.004010fe
pop ecx
pop ecx
mov eax, esi
jmp 0x40196d
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x40190b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.SvcInstall_OpenSCManager_failed__Err_d__n
jmp 0x4018da
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 1
push 2
push 0x10
push 0xf01ff
push str.Wifi_AutoInstall_Service
push str.WifiAutoInstallSrv
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x401957
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.SvcInstall_Service_Create_failed__Err_d__n
call fcn.004010fe
pop ecx
pop ecx
jmp 0x401967
push str.SvcInstall_Service_Create_OK_n
call fcn.004010fe
pop ecx
push edi
call ebx
xor edi, edi
push esi
call ebx
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040251a
mov esp, ebp
pop ebp
ret

Function at 0x40197d
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x401a5f
push esi
push 0x10024
push str.WifiAutoInstallSrv
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x401a4c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x401a19
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x401a0e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41bbc0
call fcn.004010fe
inc edi
pop ecx
cmp edi, 0x64
jl 0x4019df
jmp 0x401a19
push str.SvcUnInstall_Service_Stopped_n
call fcn.004010fe
pop ecx
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x401a38
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SvcUnInstallService_Delete_Fail:_Err_d_n
call fcn.004010fe
pop ecx
jmp 0x401a42
push str.SvcUnInstall_Service_Delete_OK_n
call fcn.004010fe
pop ecx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x401a57
push str.SvcUnInstall_Service_Not_Found.._n
call fcn.004010fe
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040251a
mov esp, ebp
pop ebp
ret
Function at 0x401ec1
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.WifiAutoInstallSrv
xor ebx, ebx
mov edi, ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x401f43
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._s_failed_with__d
lea eax, [ebp - 0xa4]
push 0x50
push eax
call fcn.00401083
add esp, 0x14
mov dword [ebp - 0xac], str.WifiAutoInstallSrv
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xac]
push ebx
push eax
push ebx
push 2
push ebx
push 0xc0020001
push ebx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040251a
mov esp, ebp
pop ebp
ret
Function at 0x4021f1
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.stopService_n
xor esi, esi
call fcn.004010fe
pop ecx
push 1
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x4022bd
push edi
push 0x24
push str.WifiAutoInstallSrv
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x4022a6
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x40229d
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push str.Service_stop_pending...__n
call fcn.004010fe
pop ecx
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x1c], 1
je 0x40228f
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x64
jl 0x402265
jmp 0x40229d
push str.Service_stopped_successfully_n
call fcn.004010fe
xor esi, esi
pop ecx
inc esi
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4022b1
push str.stopService___Service_Not_Found.._n
call fcn.004010fe
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
test esi, esi
jne 0x4022d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.stopService___Failed___d__n
call fcn.004010fe
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040251a
mov esp, ebp
pop ebp
ret

Function at 0x40c191
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040be3f
Function at 0x42fb80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
jmp 0x42fb9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42fba1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42fb90
mov eax, 1
add ebx, ebx
jne 0x42fbb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42fba8
jne 0x42fbc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fba8
xor ecx, ecx
sub eax, 3
jb 0x42fbd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42fc4a
mov ebp, eax
add ebx, ebx
jne 0x42fbe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42fbf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42fc14
inc ecx
add ebx, ebx
jne 0x42fc00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42fbf5
jne 0x42fc11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42fbf5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42fc34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42fc25
jmp 0x42fb96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42fc34
add edi, ecx
jmp 0x42fb96
pop esi
mov edi, esi
mov ecx, 6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42fc52
cmp byte [edi], 6
jne 0x42fc52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42fc57
lea edi, [esi + 0x2d000]
mov eax, dword [edi]
or eax, eax
je 0x42fccf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f930]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f96c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42fc84
mov ecx, edi
jns 0x42fcb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f974]
or eax, eax
je 0x42fcc9
mov dword [ebx], eax
add ebx, 4
jmp 0x42fca1
call dword [esi + 0x2f970]
mov ebp, dword [esi + 0x2f978]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42fd03
sub esp, 0xffffff80
jmp 0x40127c
Function at 0x50e180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd7000]
push edi
or ebp, 0xffffffff
jmp 0x50e1a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50e1a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50e198
mov eax, 1
add ebx, ebx
jne 0x50e1bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50e1cc
jne 0x50e1eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50e1eb
dec eax
add ebx, ebx
jne 0x50e1d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x50e1b0
add ebx, ebx
jne 0x50e1e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x50e23d
xor ecx, ecx
sub eax, 3
jb 0x50e203
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50e272
sar eax, 1
mov ebp, eax
jmp 0x50e20e
add ebx, ebx
jne 0x50e20e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50e1dc
inc ecx
add ebx, ebx
jne 0x50e21c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50e1dc
add ebx, ebx
jne 0x50e229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50e21e
jne 0x50e23a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50e21e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50e25c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50e24e
jmp 0x50e19e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50e25c
add edi, ecx
jmp 0x50e19e
pop esi
mov edi, esi
mov ecx, 0x2e60
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50e27a
cmp byte [edi], 0x19
jne 0x50e27a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50e27f
lea edi, [esi + 0x10c000]
mov eax, dword [edi]
or eax, eax
je 0x50e2ee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x151130]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1511e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50e2ac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1511e8]
or eax, eax
je 0x50e2e8
mov dword [ebx], eax
add ebx, 4
jmp 0x50e2c9
call dword [esi + 0x1511e4]
mov ebp, dword [esi + 0x1511ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50e322
sub esp, 0xffffff80
jmp 0x4b5eec
Function at 0x4d95d4
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004d9653
jae 0x4d95e0
xor ecx, ecx
call fcn.004d9653
jae 0x4d960a
xor eax, eax
call fcn.004d9653
jae 0x4d961b
mov al, 0x10
call fcn.004d9653
adc al, al
jae 0x4d95fc
jne 0x4d9648
stosb byte es:[edi], al
jmp 0x4d95e1
call fcn.004d965f
dec ecx
loop 0x4d9627
mov eax, ebp
call fcn.004d965d
jmp 0x4d9649
lodsb al, byte [esi]
shr eax, 1
je 0x4d966f
adc ecx, 2
mov ebp, eax
jmp 0x4d9649
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004d965d
cmp eax, 0x7d00
jae 0x4d9647
cmp eax, 0x500
jae 0x4d9648
cmp eax, 0x7f
ja 0x4d9649
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4d95e1
pop ebp
ret 8
Function at 0x4092e0
Capabilities:
Packed with generic packer
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [edi + 0x8c]
mov edx, dword [ecx + 0x7f8]
sub esp, 0x128
test edx, edx
push ebx
push esi
mov ebx, 0x14
jne 0x4093ad
cmp dword [ecx + 0x768], edx
je 0x409335
mov eax, edx
cmp eax, 0x1e
je 0x409326
test eax, eax
jne 0x409335
mov eax, dword [ecx + 0x82c]
cmp dword [eax + 0x24], 0xf
jne 0x409335
mov dword [edi + 0x5564], 8
jmp 0x4094bb
test edx, edx
jne 0x4093ad
mov eax, dword [edi + 0x5550]
sub eax, 1
test eax, eax
jg 0x40934a
xor eax, eax
jmp 0x409354
cmp eax, 0x31
jl 0x409354
mov eax, 0x31
mov esi, dword [eax*4 + 0x6a34e8]
mov dword [edi + 0x5564], esi
cmp dword [ecx + 0x7f8], 0
jne 0x409382
mov eax, dword [ecx + 0x82c]
test eax, eax
je 0x4094bb
cmp dword [eax + 0x2c], 0
jle 0x4094bb
call fcn.00453980
test al, al
jne 0x4094bb
cmp esi, 0xa
jge 0x40939f
mov dword [edi + 0x5564], ebx
jmp 0x4094bb
add esi, 0xa
mov dword [edi + 0x5564], esi
jmp 0x4094bb
mov eax, edx
cmp eax, 1
jl 0x4093bd
cmp eax, 0xf
jle 0x409484
cmp edx, 0x1f
je 0x409489
cmp edx, 0x2b
je 0x409478
cmp edx, 0x32
je 0x409478
mov eax, ecx
call fcn.004537b0
test al, al
jne 0x409478
cmp edx, 0x1e
jne 0x4093fb
mov dword [edi + 0x5564], 0xc
jmp 0x4094bb
cmp edx, 0x11
je 0x409394
cmp edx, 0x29
je 0x409394
cmp edx, 0x2d
je 0x409394
cmp edx, 0x2c
je 0x409394
cmp edx, 0x1a
je 0x409394
cmp edx, 0x10
je 0x409394
cmp edx, 0x15
je 0x409394
call fcn.00453920
test al, al
jne 0x40946c
call fcn.004538c0
test al, al
jne 0x40946c
call fcn.00453950
test al, al
jne 0x40946c
cmp edx, 0x1b
je 0x40946c
mov eax, ecx
call fcn.00453820
test al, al
jne 0x40946c
cmp edx, 0x20
je 0x40946c
cmp edx, 0x21
je 0x40946c
cmp edx, 0x22
je 0x40946c
mov dword [edi + 0x5564], 0x28
jmp 0x4094bb
mov dword [edi + 0x5564], 0x1e
jmp 0x4094bb
mov dword [edi + 0x5564], 0
jmp 0x4094bb
cmp edx, 0x1f
jne 0x409490
mov eax, 0xa
jmp 0x4094b5
lea ecx, [edx - 1]
cmp ecx, 4
ja 0x40949f
mov eax, 0xa
jmp 0x4094b5
lea eax, [edx - 6]
cmp eax, 4
mov eax, ebx
jbe 0x4094b5
add edx, 0xfffffff5
cmp edx, 4
jbe 0x4094b5
mov eax, dword [esp + 0x18]
mov dword [edi + 0x5564], eax
jmp section.GKyyds_40

Function at 0x40ab10
Capabilities:
Packed with generic packer
Parse credit card information

Disassembly:
mov eax, dword [edi + 0x8c]
cmp dword [eax + 0x768], 0
push esi
je 0x40ab8a
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x1e
je 0x40ab3b
test ecx, ecx
jne 0x40ab48
mov ecx, dword [eax + 0x82c]
cmp dword [ecx + 0x24], 0xf
jne 0x40ab48
mov esi, dword [edi + 0x160]
call fcn.00425840
pop esi
ret
cmp dword [eax + 0x768], 0
je 0x40ab8a
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x11
je 0x40ab71
cmp ecx, 0x21
je 0x40ab71
test ecx, ecx
jne 0x40ab8a
mov ecx, dword [eax + 0x82c]
cmp dword [ecx + 0x24], 5
jne 0x40ab8a
cmp dword [eax + 0x7f8], 0
jne 0x40ab3b
mov eax, dword [eax + 0x82c]
test eax, eax
je 0x40ab8a
cmp dword [eax + 0x2c], 0
jg 0x40ab3b
xor esi, esi
lea esp, [esp]
mov eax, esi
call fcn.0040d660
jmp section.GKyyds_39
Function at 0x40abb0
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push 0x64
xor ebx, ebx
lea eax, [edi + 0x54d4]
push ebx
push eax
call fcn.00626020
mov ecx, dword [edi + 0x8c]
add esp, 0xc
cmp dword [ecx + 0x7f8], ebx
jne 0x40abe4
mov edx, dword [edi + 0x5550]
call fcn.0040ab10
jmp 0x40abef
mov esi, dword [edi + 0x160]
call fcn.00425840
call fcn.004092e0
mov edx, dword [edi + 0x8c]
mov dword [edi + 0x557c], ebx
mov dword [edi + 0x5580], ebx
mov byte [edx + 0x88c], bl
mov eax, dword [edi + 0x8c]
cmp dword [eax + 0x7f8], ebx
jne 0x40ac3e
mov ecx, dword [eax + 0x82c]
cmp ecx, ebx
je 0x40ac29
cmp dword [ecx + 0x2c], ebx
jg 0x40ac3e
cmp dword [edi + 0x5550], 2
jne 0x40ac3e
mov dword [edi + 0x559c], 0x1388
jmp 0x40ac6f
mov eax, dword [eax + 0x7f8]
cmp eax, 1
jl 0x40ac65
cmp eax, 0xf
jg 0x40ac65
mov eax, dword [edi + 0x160]
cmp dword [eax + 0x6c], ebx
jle 0x40ac65
mov dword [edi + 0x559c], 0x258
jmp 0x40ac6f
jmp 0x79badd
mov ecx, dword [edi + 0x559c]
mov dword [edi + 0x5598], ebx
mov dword [edi + 0x5590], ebx
mov dword [edi + 0x5610], ebx
mov dword [edi + 0x55a4], ebx
mov byte [edi + 0x560c], bl
mov dword [edi + 0x55a0], ecx
mov dword [edi + 0x5594], 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x40af90
Capabilities:
Packed with generic packer
Parse credit card information

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x8c]
xor ebx, ebx
mov dword [ebp + 0x5568], ebx
mov byte [ebp + 0x5c4], bl
mov dword [ebp + 0x5554], ebx
mov ecx, dword [eax + 0x888]
mov dword [ebp + 0x5768], ecx
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x32
push esi
push edi
je 0x40afd9
cmp ecx, 0x2b
je 0x40afd9
mov esi, dword [eax + 0x83c]
call fcn.0045abb0
mov eax, dword [ebp + 0x8c]
cmp dword [eax + 0x7f8], ebx
jne 0x40aff8
mov edx, dword [eax + 0x82c]
mov eax, dword [edx + 0x24]
mov dword [ebp + 0x5550], eax
jmp 0x40affe
mov dword [ebp + 0x5550], ebx
mov eax, ebp
call fcn.0040a550
mov eax, ebp
mov dword [ebp + 0x557c], ebx
call fcn.0040abb0
mov ecx, dword [ebp + 0x8c]
mov edx, dword [ecx + 0x7f8]
cmp edx, 0x14
je 0x40b0a1
cmp edx, 0x18
je 0x40b0a1
mov eax, edx
cmp eax, 0x33
jl 0x40b034
cmp eax, 0x3c
jle 0x40b0a1
cmp eax, ebx
jne 0x40b044
mov eax, dword [ecx + 0x82c]
cmp dword [eax + 0x24], 0x23
je 0x40b0a1
call fcn.00453890
test al, al
jne 0x40b0a1
cmp edx, 0x1f
jne 0x40b05e
mov dword [ebp + 0x5560], 0x1388
jmp 0x40b0a7
mov eax, ecx
call fcn.004537d0
test al, al
je 0x40b075
mov dword [ebp + 0x5560], 0x96
jmp 0x40b0a7
mov eax, ecx
call fcn.00454190
test al, al
je 0x40b095
cmp dword [ebp + 0x5550], 1
jne 0x40b095
mov dword [ebp + 0x5560], 0x96
jmp 0x40b0a7
mov dword [ebp + 0x5560], 0x32
jmp 0x40b0a7
mov dword [ebp + 0x5560], ebx
jmp 0x79c0a0