joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457b88
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4961c8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x457bcb
cmp word [esi], dx
jne 0x457bcb
or byte [edi + eax + 0x28], 4
jmp 0x457bd0
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x457d23
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x457d03
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x457c12
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x457c48
cmp eax, edx
jae 0x457c54
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x457bea
jmp 0x457d23
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x457cff
cmp dword [ebp - 0x14], 0
je 0x457cff
mov eax, dword [ebx*4 + 0x4961c8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x457cd7
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x457ca0
mov word [esi], cx
jmp 0x457cd3
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4961c8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4961c8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4961c8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x457d23
pop ebx
cmp word [ebp - 4], bx
jne 0x457ce8
cmp esi, dword [ebp + 0xc]
jne 0x457ce8
mov word [esi], bx
jmp 0x457d20
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040150a
add esp, 0x10
cmp word [ebp - 4], bx
je 0x457d23
push 0xd
jmp 0x457d1c
mov ecx, dword [ebx*4 + 0x4961c8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x457d1a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x457d23
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4094cc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumKeyW
test eax, eax
jne 0x40950d
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x204]
mov ecx, pe_nt_image_headers32
call sub.RtlVcl160.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409518
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
mov eax, edi
call sub.RtlVcl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push esi
call sub.advapi32.dll_RegQueryValueW
test eax, eax
jne 0x409566
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x208]
mov ecx, pe_nt_image_headers32
call sub.RtlVcl160.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ca44
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41cb7e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, ebx
call sub.RtlVcl160.bpl__System__GetMem_qqri
mov esi, eax
push esi
push ebx
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
test ebx, ebx
jbe 0x41cb4e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x41cb8c
push esi
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
shr edx, 0x10
mov word [ebp - 0x16], dx
movzx edx, word [eax + 8]
and dx, 0xffff
mov word [ebp - 0x18], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1a], dx
movzx eax, word [eax + 0xc]
and ax, 0xffff
mov word [ebp - 0x1c], ax
mov edx, ebx
mov eax, esi
call sub.RtlVcl160.bpl__System__FreeMem_qqrpv
lea edx, [ebp - 0x20]
movzx eax, word [ebp - 0x16]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x20]
push 0x41cb9c
lea edx, [ebp - 0x24]
movzx eax, word [ebp - 0x18]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x24]
push 0x41cb9c
lea edx, [ebp - 0x28]
movzx eax, word [ebp - 0x1a]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x28]
push 0x41cb9c
lea edx, [ebp - 0x2c]
movzx eax, word [ebp - 0x1c]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
push dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov edx, 7
call sub.RtlVcl160.bpl__System__UStrCatN_qqrv
jmp 0x41cb5b
mov eax, dword [ebp - 8]
mov edx, 0x41cbac
call sub.RtlVcl160.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cb85
lea eax, [ebp - 0x2c]
mov edx, 4
call sub.RtlVcl160.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.RtlVcl160.bpl__System__UStrClr_qqrpv
ret
Function at 0x4cd8d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4cd8d8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4cda65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 1
call fcn.004151cc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_Close_qqrv
push 0x4cda80
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0x610]
mov eax, dword [eax + 0x310]
mov ecx, 5
mov edx, 1
call sub.RtlVcl160.bpl__System__UStrCopy_qqrx20System_UnicodeStringii
push dword [ebp - 0x18]
push 0x4cdad0
lea eax, [ebp - 0x14]
mov edx, 3
call sub.RtlVcl160.bpl__System__UStrCatN_qqrv
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call sub.RtlVcl160.bpl__System__WStrFromUStr_qqrr17System_WideStringx20System_UnicodeString
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x328]
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_Open_qqrv
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_GetFieldCount_qqrv
mov edi, eax
dec edi
test edi, edi
jle 0x4cda25
mov esi, 1
mov ecx, esi
mov edx, dword [ebx + 0x418]
mov eax, ebx
call fcn.00461d60
test al, al
je 0x4cda1d
lea edx, [ebp - 0x24]
lea eax, [esi + 1]
call sub.RtlVcl160.bpl__System_Sysutils_IntToStr_qqri
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x4cdae4
call sub.RtlVcl160.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
lea edx, [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 4]
call sub.RtlVcl160.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
lea ecx, [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.00461fe4
cmp dword [ebp - 8], 0
je 0x4cda1d
cmp dword [ebp - 4], 0
je 0x4cda1d
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x610]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_FindField_qqrx20System_UnicodeString
test eax, eax
je 0x4cda1d
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x610]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_FieldByName_qqrx20System_UnicodeString
push eax
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 8]
call sub.RtlVcl160.bpl__System_Variants__VarFromUStr_qqrr8TVarDatax20System_UnicodeString
lea edx, [ebp - 0x34]
pop eax
mov ecx, dword [eax]
call dword [ecx + pe_nt_image_headers32]
inc esi
dec edi
jne 0x4cd97a
mov eax, dword [ebp - 0xc]
call sub.PublicPkg160.bpl__Data_Db_TDataSet_Close_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cda6c
lea eax, [ebp - 0x34]
call sub.RtlVcl160.bpl__System_Variants__VarClr_qqrr8TVarData
lea eax, [ebp - 0x24]
mov edx, 5
call sub.RtlVcl160.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x10]
call sub.RtlVcl160.bpl__System__WStrClr_qqrpv
lea eax, [ebp - 8]
mov edx, 2
call sub.RtlVcl160.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x402641
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x46b034]
xor eax, esp
mov dword [esp + 0x408], eax
cmp dword [ebp + 0x1c], 0
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], ecx
jne 0x4026cb
xor esi, esi
inc esi
cmp dword [ebp + 0xc], 0x110
jne 0x4026e4
push ecx
push ecx
mov ecx, edi
mov dword [edi + 0x98], esi
call fcn.004027b9
mov dword [ebx], eax
cmp dword [edi + 0x98], 0
jne 0x40270a
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ebx
push dword [ebp + 0x14]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00401913
add esp, 0xc
test eax, eax
jne 0x40270a
push eax
push ebx
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esp + 0x20]
call fcn.00401440
test eax, eax
jne 0x40270a
xor eax, eax
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041b4ed
mov esp, ebp
pop ebp
ret 0x18
cmp dword [ebp + 0xc], 0x111
mov ecx, dword [ebp + 0x10]
jne 0x402699
push 2
movzx eax, cx
pop edx
cmp dx, ax
jne 0x40270e
push edx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
xor esi, esi
inc esi
mov dword [ebx], esi
mov eax, esi
jmp 0x4026cd
cmp si, ax
jne 0x402756
push 0x400
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0041d260
add esp, 0xc
lea eax, [esp + 0x10]
push 0x200
push eax
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x80]
call fcn.00402e90
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x402708
push 0x4d
pop edx
cmp dx, ax
jne 0x402699
sub esp, 0x10
mov ecx, edi
call fcn.00402c32
mov dword [ebx], eax
jmp 0x40270a

Function at 0x406c18
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0x44d87b
call fcn.0041bdee
mov esi, ecx
push 4
call fcn.0041b509
mov edx, dword [ebp + 8]
mov dword [ebp + 8], eax
mov dword [eax], edx
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push eax
push 0x407170
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.004266cc
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x406c5f
mov eax, esi
call fcn.0041bdbc
ret 4
push 6
mov dword [edi], ebx
call fcn.0041a317
int3

Function at 0x407988
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
xor ebx, ebx
test ecx, ecx
je 0x4079ab
cmp word [ecx], bx
je 0x4079ab
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4079ab
push 1
test al, 0x10
movzx ebx, bl
pop ecx
cmove ebx, ecx
mov al, bl
pop ebx
ret
Function at 0x407ae5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46b034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
push 0xa
pop ecx
push dword [ebp + 8]
lea edi, [ebp - 0x2c]
mov esi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x4625a4
push eax
call fcn.0040609e
add esp, 0xc
lea eax, [ebp - 0x2c]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x407b93
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x407b93
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x407b93
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x407b93
lea eax, [esi + 1]
cmp eax, dword [ebx + 0x10]
ja 0x407b73
mov dword [ebx + 0x10], eax
mov edx, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x407b6c
mov edx, dword [ebx]
xor ecx, ecx
mov byte [edx + eax], cl
jmp 0x407b7f
sub eax, dword [ebx + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.004083a9
push ecx
mov ecx, ebx
call fcn.00405edd
push esi
push edi
call fcn.00405f93
xor ecx, ecx
inc ecx
jmp 0x407b95
xor ecx, ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b4ed
leave
ret

Function at 0x407ba6
Capabilities:
Get file version info

Disassembly:
push 0x18
mov eax, 0x44d99e
call fcn.0041be57
mov esi, edx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
push eax
mov dword [ebp - 0x1c], eax
call fcn.0041b7b2
pop ecx
mov edi, eax
xor eax, eax
push edi
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push eax
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x407c2a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x4624b0
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x407c2a
mov ax, word [ecx + 0xa]
mov word [esi], ax
mov ax, word [ecx + 8]
mov word [esi + 2], ax
mov ax, word [ecx + 0xe]
mov word [esi + 4], ax
mov ax, word [ecx + 0xc]
mov word [esi + 6], ax
xor esi, esi
inc esi
test edi, edi
je 0x407c43
push edi
call fcn.0041b7ad
pop ecx
jmp 0x407c43
mov eax, esi
call fcn.0041bdbc
ret
Function at 0x407c50
Capabilities:
Get common file path

Disassembly:
push 0x854
mov eax, 0x44d9d6
call fcn.0041be21
mov edi, ecx
push 0x800
xor esi, esi
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.0041d260
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov dword [ebp - 0x840], esi
push 7
pop ebx
mov word [ebp - 0x840], ax
lea ecx, [ebp - 0x840]
lea eax, [ebp - 0x810]
mov dword [ebp - 0x830], esi
push eax
mov dword [ebp - 0x82c], ebx
call fcn.00402e90
mov dword [ebp - 4], esi
mov ecx, ebx
xor eax, eax
mov dword [ebp - 0x828], esi
mov dword [ebp - 0x814], ecx
mov word [ebp - 0x828], ax
mov byte [ebp - 4], 1
mov ebx, SysReAllocString
cmp ecx, 8
mov dword [ebp - 0x818], esi
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
lea edx, [ebp - 0x828]
xor ecx, ecx
push 0xa
mov word [eax], cx
pop ecx
call fcn.004096c4
mov eax, ebx
sub eax, dword [ebp - 0x830]
cmp eax, dword [ebp - 0x818]
jb 0x407edf
cmp dword [ebp - 0x82c], 8
lea ecx, [ebp - 0x840]
push dword [ebp - 0x818]
cmovae ecx, dword [ebp - 0x840]
lea eax, [ebp - 0x828]
cmp dword [ebp - 0x814], 8
cmovae eax, dword [ebp - 0x828]
push eax
push dword [ebp - 0x830]
push ecx
push ecx
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x858]
call fcn.004046d6
cmp dword [ebp - 0x844], 8
lea eax, [ebp - 0x858]
push esi
cmovae eax, dword [ebp - 0x858]
push eax
call fcn.00425f42
pop ecx
pop ecx
lea ecx, [ebp - 0x858]
mov esi, eax
call fcn.00401dcb
test esi, esi
jne 0x407d9b
mov ecx, dword [ebp - 0x814]
jmp 0x407cdd
sub ebx, dword [ebp - 0x830]
cmp ebx, dword [ebp - 0x818]
jb 0x407edf
push 8
pop ebx
cmp dword [ebp - 0x82c], ebx
lea ecx, [ebp - 0x840]
push dword [ebp - 0x818]
cmovae ecx, dword [ebp - 0x840]
lea eax, [ebp - 0x828]
cmp dword [ebp - 0x814], ebx
cmovae eax, dword [ebp - 0x828]
push eax
push dword [ebp - 0x830]
push ecx
push ecx
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x858]
call fcn.004046d6
lea eax, [ebp - 0x858]
mov ecx, edi
push eax
call fcn.00406b5a
lea ecx, [ebp - 0x858]
call fcn.00401dcb
cmp dword [edi + 0x14], ebx
jb 0x407e16
mov edi, dword [edi]
mov eax, dword [ebp - 0x814]
mov esi, 0x1000
cmp eax, ebx
jb 0x407e6c
mov ecx, dword [ebp - 0x828]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x860], eax
mov dword [ebp - 0x85c], ecx
cmp eax, esi
jb 0x407e63
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x85c]
push eax
call fcn.00401dfe
mov eax, dword [ebp - 0x860]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x85c]
push eax
push ecx
call fcn.0041b4fb
pop ecx
pop ecx
and dword [ebp - 0x818], 0
xor eax, eax
mov word [ebp - 0x828], ax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x814], 7
cmp eax, ebx
jb 0x407ed7
mov ecx, dword [ebp - 0x840]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x85c], eax
mov dword [ebp - 0x860], ecx
cmp eax, esi
jb 0x407ece
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x860]
push eax
call fcn.00401dfe
mov eax, dword [ebp - 0x85c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x860]
push eax
push ecx
call fcn.0041b4fb
pop ecx
pop ecx
mov eax, edi
call fcn.0041bdd0
ret
call fcn.00402eb7
int3
Function at 0x407ee5
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0x844
mov eax, 0x44da44
call fcn.0041be21
mov esi, ecx
xor ebx, ebx
push ebx
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x844], ebx
call fcn.00404bcc
mov edx, str.JaqKKLKJSDKTn9NPjHsGku6Tny6RJL6TSDpRjHcSkm6NJLrSoarRj1IJXuMOcLbSSL_RrabSkuMRau6T
lea ecx, [ebp - 0x840]
call fcn.0041008c
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x828]
call fcn.004095af
cmp dword [eax + 0x14], 8
jb 0x407f32
mov eax, dword [eax]
lea ecx, [ebp - 0x844]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x828]
call fcn.00401dcb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x840]
call fcn.00404bf8
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0041d260
add esp, 0xc
mov dword [ebp - 0x848], 0x400
cmp dword [ebp - 0x844], 0
je 0x40803c
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x850]
push eax
push ebx
push str.TEMP
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408030
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.00402e90
push ebx
push dword [0x4921ac]
mov ecx, esi
call fcn.00408371
mov edi, eax
cmp edi, 0xffffffff
je 0x408030
push 0x400
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x408030
push dword [0x4921ac]
call fcn.00428a3a
pop ecx
lea edx, [ebp - 0x810]
mov ecx, eax
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x84c]
jne 0x40800c
sub edx, ebx
lea eax, [ebp - 0x810]
sar edx, 1
push edx
push eax
push ecx
push edi
mov ecx, esi
call fcn.00408403
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0041bdd0
ret
Function at 0x409627
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
xor bl, bl
push 0xb1
mov ecx, esi
call fcn.00409d6c
jmp 0x4096b2
call fcn.0042002a
cdq
push 0x24
pop ecx
idiv ecx
push 9
pop eax
cmp eax, edx
sbb al, al
add dl, 0x30
and al, 0x27
add al, dl
lea edx, [eax - 0x30]
test edi, edi
jne 0x409669
cmp dl, 9
jbe 0x4096b2
test edi, edi
je 0x409679
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x409673
mov ecx, dword [esi]
cmp byte [edi + ecx - 1], al
je 0x4096b2
mov byte [ebp - 4], al
test bl, bl
jne 0x4096a6
mov byte [ebp - 4], al
cmp dl, 9
ja 0x40968c
inc bl
jmp 0x4096a6
cmp dword [esi + 0x10], 0xb0
jne 0x4096a6
call fcn.0042002a
push 0xa
cdq
pop ecx
idiv ecx
add dl, 0x30
mov byte [ebp - 4], dl
push dword [ebp - 4]
mov ecx, esi
push 1
call fcn.00409dcd
mov edi, dword [esi + 0x10]
cmp edi, 0xb1
jb 0x409640
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x40b41c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x40b430
mov eax, dword [eax]
push esi
push 0x462510
push eax
call fcn.00426e01
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40b4af
push ebx
push edi
mov ecx, esi
call fcn.00407a9b
mov ebx, eax
push ebx
call fcn.0041b7b2
push ebx
mov edi, eax
push 0
push edi
call fcn.0041d260
push esi
push 1
push ebx
push edi
call fcn.00427464
push esi
call fcn.00426518
mov ecx, dword [ebp - 4]
add esp, 0x24
cmp dword [ecx + 0x2c], 0
je 0x40b497
add ecx, 0x1c
cmp dword [ecx + 0x14], 0x10
jb 0x40b487
mov ecx, dword [ecx]
mov esi, dword [ebp + 8]
mov edx, edi
push esi
push ebx
call fcn.0041036e
pop ecx
pop ecx
jmp 0x40b4a3
mov esi, dword [ebp + 8]
mov ecx, esi
push ebx
push edi
call fcn.00405f93
push edi
call fcn.0041b7ad
mov eax, dword [esi + 0x10]
pop ecx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x40faa5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e90c
mov eax, dword fs:[0]
push eax
mov eax, 0x1040
call fcn.0041c5d0
mov eax, dword [0x46b034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0040f6fe
mov ebx, 0x800
mov esi, eax
push ebx
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.0041d260
xor eax, eax
push ebx
push eax
mov dword [ebp - 0x1044], eax
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x810]
push eax
call fcn.0041d260
add esp, 0x18
lea ecx, [ebp - 0x1040]
mov edx, str.3eoB
call fcn.0041008c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1028]
mov edx, eax
call fcn.004095af
lea ecx, [ebp - 0x1040]
call fcn.00404bf8
cmp dword [ebp - 0x1014], 8
lea ecx, [ebp - 0x810]
mov edx, 0x400
lea eax, [ebp - 0x1028]
cmovae eax, dword [ebp - 0x1028]
push edx
push ecx
lea ecx, [ebp - 0x1048]
push ecx
lea ecx, [ebp - 0x104c]
push ecx
lea ecx, [ebp - 0x1044]
push ecx
push edx
lea ecx, [ebp - 0x1010]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov ecx, dword [ebp - 0x1044]
mov edx, esi
push edi
call fcn.0040fa05
pop ecx
lea ecx, [ebp - 0x1028]
call fcn.00401dcb
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b4ed
leave
ret