joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4085f7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x41411c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov eax, 0x4148f0
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], edi
mov word [ebp - 0x1c], di
mov dword [ebp - 0x24], edi
call fcn.00404fde
cmp eax, edi
jbe 0x4086ec
cmp edi, eax
mov dword [ebp - 0x28], edi
jb 0x40863f
call dword [sym.imp.MOZCRT19.dll__invalid_parameter_noinfo]
mov eax, dword [0x4148f4]
mov ecx, dword [ebp - 0x28]
lea ebx, [ecx + eax]
lea eax, [ebp - 0xd8]
push eax
call fcn.00409e9b
pop ecx
mov ebx, eax
mov eax, 0x410c7c
lea ecx, [ebp - 0xf4]
call fcn.0040426f
push 0xffffffffffffffff
mov esi, eax
push edi
mov eax, ebx
call fcn.0040bc94
lea esi, [ebp - 0x54]
call fcn.0040a880
xor ebx, ebx
push edi
inc ebx
push ebx
lea esi, [ebp - 0xf4]
call fcn.00405155
lea eax, [ebp - 0xbc]
push 0x410c74
push eax
lea eax, [ebp - 0x54]
call fcn.0040c807
pop ecx
pop ecx
push 0xffffffffffffffff
push edi
lea esi, [ebp - 0x20]
call fcn.0040bc94
push edi
push ebx
lea esi, [ebp - 0xbc]
call fcn.00405155
push edi
push ebx
lea esi, [ebp - 0x54]
call fcn.00405155
push edi
push ebx
lea esi, [ebp - 0xd8]
call fcn.00405155
inc dword [ebp - 0x24]
add dword [ebp - 0x28], 0x1c
mov eax, 0x4148f0
call fcn.00404fde
cmp dword [ebp - 0x24], eax
jb 0x40863f
push 0x44
pop esi
push esi
lea eax, [ebp - 0xa0]
push edi
push eax
call sub.MOZCRT19.dll_memset
mov dword [ebp - 0xa0], esi
push 0x10
xor esi, esi
lea eax, [ebp - 0x38]
inc esi
push edi
push eax
mov dword [ebp - 0x74], esi
mov word [ebp - 0x70], si
call sub.MOZCRT19.dll_memset
mov eax, dword [ebp - 0x1c]
add esp, 0x18
cmp dword [ebp - 8], 8
jae 0x408728
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0xa0]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x408755
push dword [ebp - 0x38]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [ebp - 0x34]
call ebx
push edi
push esi
lea esi, [ebp - 0x20]
call fcn.00405155
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ea20
leave
ret
Function at 0x408b95
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x768]
sub esp, 0x7e8
mov eax, dword [0x41411c]
xor eax, ebp
mov dword [ebp + 0x764], eax
mov eax, dword [ebp + 0x770]
push ebx
push esi
push edi
mov dword [ebp - 0x80], eax
mov edi, 0x1f5
push edi
lea eax, [ebp - 0x74]
mov esi, ecx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0xb0
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x78]
xor esi, esi
xor ebx, ebx
sub eax, ecx
je 0x408c32
push eax
lea eax, [ebp + ecx*2 - 0x74]
push eax
lea eax, [ebp + 0x378]
push edi
push eax
call dword [sym.imp.MOZCRT19.dll_wcsncpy_s]
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x78]
add esp, 0x10
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
mov word [ebp + eax*2 + 0x378], si
lea eax, [ebp + 0x378]
push eax
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
dec ebx
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x74]
push eax
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x80]
mov esi, eax
dec esi
call fcn.00408b7b
pop ecx
mov ecx, dword [ebp + 0x764]
sub esi, ebx
pop edi
add eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ea20
add ebp, 0x768
leave
ret
Function at 0x408ecd
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x79c]
sub esp, 0x81c
mov eax, dword [0x41411c]
xor eax, ebp
mov dword [ebp + 0x798], eax
push ebx
push esi
push edi
mov edi, ecx
push edi
mov dword [ebp - 0x70], edi
mov esi, edx
call dword [sym.imp.USER32.dll_GetDC]
xor ebx, ebx
push ebx
push ebx
push 0x31
push edi
mov dword [ebp - 0x6c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x408f17
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x400
lea eax, [ebp - 0x68]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp + 0x7bc], 8
mov eax, dword [ebp + 0x7a8]
jae 0x408f3c
lea eax, [ebp + 0x7a8]
mov edi, dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x7b8]
push eax
push dword [ebp - 0x6c]
call edi
test eax, eax
je 0x408f7d
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MOZCRT19.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x6c]
call edi
test eax, eax
je 0x408f7d
mov ecx, dword [ebp - 0x80]
sub ecx, dword [ebp - 0x78]
jns 0x408fa6
xor ebx, ebx
push 0
push 1
lea esi, [ebp + 0x7a4]
call fcn.00405155
mov ecx, dword [ebp + 0x798]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040ea20
add ebp, 0x79c
leave
ret
mov eax, dword [ebp + 0x7c4]
test eax, eax
jne 0x408fb8
mov eax, dword [esi + 8]
sub eax, dword [esi]
sub eax, dword [ebp - 0x78]
cmp byte [ebp + 0x7c0], 0
lea ebx, [eax + ecx]
je 0x408fc8
sub dword [esi], ebx
jmp 0x408fcb
add dword [esi + 8], ebx
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
push ecx
push dword [ebp - 0x70]
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x408f7d
Function at 0x40a4b5
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x41411c]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x44]
push eax
xor esi, esi
push esi
push esi
push 0x1a
push esi
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x40a5ab
cmp dword [ebx + 0x14], esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
je 0x40a52e
lea eax, [ebp - 0x64]
push eax
call fcn.00409e9b
cmp dword [eax + 0x18], 8
pop ecx
jb 0x40a517
mov eax, dword [eax + 4]
jmp 0x40a51a
add eax, 4
push eax
lea eax, [ebp - 0x44]
push eax
call edi
push esi
push 1
lea esi, [ebp - 0x64]
call fcn.00405155
xor esi, esi
mov ebx, dword [ebp - 0x48]
lea eax, [ebp - 0x64]
push eax
call fcn.00409e9b
cmp dword [eax + 0x18], 8
pop ecx
jb 0x40a546
mov eax, dword [eax + 4]
jmp 0x40a549
add eax, 4
push eax
lea eax, [ebp - 0x44]
push eax
call edi
push esi
push 1
lea esi, [ebp - 0x64]
call fcn.00405155
push str.Crash_Reports
lea eax, [ebp - 0x44]
push eax
call edi
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x64]
call fcn.0040426f
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00409f5e
pop ecx
pop ecx
push 0xffffffffffffffff
xor esi, esi
push esi
push eax
mov ecx, 0x41414c
call fcn.0040444c
push esi
push 1
lea ecx, [ebp - 0x80]
call fcn.00404930
push esi
push 1
lea esi, [ebp - 0x64]
call fcn.00405155
mov al, 1
pop edi
jmp 0x40a5ad
xor al, al
mov ecx, dword [ebp + 0x1c4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ea20
add ebp, 0x1c8
leave
ret

Function at 0x40a5c4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
lea eax, [ebp - 0x1c]
push esi
push eax
mov ebx, ecx
call fcn.00409e9b
cmp dword [eax + 0x18], 8
pop ecx
jb 0x40a5e3
mov eax, dword [eax + 4]
jmp 0x40a5e6
add eax, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
neg ebx
push 0
sbb bl, bl
push 1
lea esi, [ebp - 0x1c]
inc bl
call fcn.00405155
pop esi
test bl, bl
pop ebx
je 0x40a61a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40a61a
xor al, al
leave
ret
mov al, 1
leave
ret

Function at 0x40a61e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x1c]
sub esp, 0x1c
push eax
call fcn.00409e9b
cmp dword [eax + 0x18], 8
pop ecx
jb 0x40a639
mov eax, dword [eax + 4]
jmp 0x40a63c
add eax, 4
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
push 1
lea esi, [ebp - 0x1c]
mov edi, eax
call fcn.00405155
xor eax, eax
cmp edi, 0xffffffff
pop edi
setne al
pop esi
leave
ret
Function at 0x40a65f
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x38
push ebx
mov ebx, eax
call fcn.004035b0
test eax, eax
jne 0x40a678
mov al, 1
jmp 0x40a6d8
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.00409e9b
cmp dword [eax + 0x18], 8
pop ecx
jb 0x40a68e
mov esi, dword [eax + 4]
jmp 0x40a691
lea esi, [eax + 4]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.00409e9b
cmp dword [eax + 0x18], 8
pop ecx
jb 0x40a6a9
mov eax, dword [eax + 4]
jmp 0x40a6ac
add eax, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, eax
dec ebx
neg ebx
push 0
sbb bl, bl
push 1
lea esi, [ebp - 0x1c]
inc bl
call fcn.00405155
push 0
push 1
lea esi, [ebp - 0x38]
call fcn.00405155
mov al, bl
pop esi
pop ebx
leave
ret

Function at 0x40a6db
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
lea eax, [ebp - 0x1c]
push esi
push eax
mov ebx, ecx
call fcn.00409e9b
cmp dword [eax + 0x18], 8
pop ecx
jb 0x40a6fa
mov eax, dword [eax + 4]
jmp 0x40a6fd
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
dec ebx
neg ebx
push 0
sbb bl, bl
push 1
lea esi, [ebp - 0x1c]
inc bl
call fcn.00405155
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x40cfdb
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x41411c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], eax
mov byte [ebp - 0x6a], bl
mov dword [ebp - 0x88], 0x40
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x50], 0xf
call fcn.00405a3c
push ebx
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x4c]
push eax
push 5
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x40d072
push 0xa
lea eax, [ebp - 0x4c]
push ebx
push eax
mov byte [ebp - 0x6a], 1
call dword [sym.imp.MOZCRT19.dll_wcstol]
mov edi, dword [ebp - 0x54]
add esp, 0xc
cmp edi, eax
mov dword [ebp - 0x78], eax
ja 0x40d072
cmp dword [ebp - 0x50], eax
je 0x40d072
push 1
push eax
lea ecx, [ebp - 0x68]
call fcn.00405a58
test al, al
je 0x40d072
push edi
lea ecx, [ebp - 0x68]
call fcn.00405a3c
mov edi, dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
push ebx
push ebx
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x74], ebx
push esi
jmp 0x40d11a
mov ecx, dword [ebp - 0x70]
cmp ecx, ebx
jbe 0x40d144
lea eax, [ebp - 0x69]
push eax
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 0x69], bl
call fcn.0040daba
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x70]
lea esi, [ebp - 0x98]
call fcn.0040d9f8
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
setne byte [ebp - 0x69]
cmp byte [ebp - 0x69], bl
je 0x40d130
mov eax, dword [ebp - 0x84]
cmp eax, ebx
jbe 0x40d130
add dword [ebp - 0x74], eax
push eax
call fcn.0040d9f8
push eax
lea eax, [ebp - 0x68]
call fcn.0040585f
cmp dword [ebp - 0x94], ebx
je 0x40d0ff
push dword [ebp - 0x94]
call sub.MOZCRT19.dll_void___cdecl_operator_delete_void__
pop ecx
push ebx
push ebx
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call edi
test eax, eax
setne byte [ebp - 0x69]
cmp byte [ebp - 0x69], bl
jne 0x40d087
mov byte [ebp - 0x6a], bl
jmp 0x40d189
cmp dword [ebp - 0x94], ebx
je 0x40d144
push dword [ebp - 0x94]
call sub.MOZCRT19.dll_void___cdecl_operator_delete_void__
pop ecx
cmp byte [ebp - 0x69], bl
je 0x40d12b
cmp byte [ebp - 0x6a], bl
je 0x40d156
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x74], eax
jne 0x40d12b
cmp dword [ebp - 0x80], ebx
mov byte [ebp - 0x6a], 1
je 0x40d189
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040d767
pop ecx
push 0xffffffffffffffff
push dword [ebp - 0x80]
xor ebx, ebx
call fcn.00406fd9
push ebx
push 1
lea esi, [ebp - 0xa4]
call fcn.00405155
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.00404930
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x6a]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ea20
leave
ret

Function at 0x40ea20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41411c]
jne 0x40ea2a
repz ret
jmp fcn.0040f020
Function at 0x40eaa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x411550
push 0x40ef3a
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x41411c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov ecx, dword fs:[0x18]
mov esi, dword [ecx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0
push esi
push 0x414948
call edi
test eax, eax
je 0x40eb1a
cmp eax, esi
jne 0x40eb35
mov ebx, 1
mov edx, dword [0x414944]
mov esi, 1
cmp edx, esi
jne 0x40eb42
push 0x1f
call sub.MOZCRT19.dll__amsg_exit
add esp, 4
jmp 0x40eb72
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40eb03
mov eax, dword [0x414944]
test eax, eax
jne 0x40eb6c
mov dword [0x414944], esi
push 0x4103e0
push 0x4103cc
call sub.MOZCRT19.dll__initterm_e
add esp, 8
test eax, eax
je 0x40eb72
jmp 0x40ecbe
mov dword [0x414578], esi
mov ecx, dword [0x414944]
cmp ecx, esi
jne 0x40eb98
push 0x4103c8
push 0x410380
call sub.MOZCRT19.dll__initterm
add esp, 8
mov dword [0x414944], 2
test ebx, ebx
jne 0x40eba8
push ebx
push 0x414948
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x41494c], 0
je 0x40ebce
push 0x41494c
call fcn.0040f250
add esp, 4
test eax, eax
je 0x40ebce
push 0
push 2
push 0
call dword [0x41494c]
mov eax, dword [sym.imp.MOZCRT19.dll__wcmdln]
cmp dword [eax], 0
je 0x40ecbe
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, 0x20
ja 0x40ec3e
test ax, ax
je 0x40ebf6
test edx, edx
jne 0x40ec3e
movzx eax, word [ecx]
test ax, ax
je 0x40ec0c
cmp ax, 0x20
ja 0x40ec0c
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40ebf6
test byte [ebp - 0x3c], 1
movzx eax, word [ebp - 0x38]
jne 0x40ec1b
mov eax, 0xa
push eax
push ecx
push 0
push 0x400000
call main
mov dword [0x414574], eax
cmp dword [0x414568], 0
jne 0x40ec88
push eax
call dword [sym.imp.MOZCRT19.dll_exit]
cmp ax, 0x22
jne 0x40ec50
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40ebe4
cmp dword [0x414578], 0
jne 0x40ec97
call dword [sym.imp.MOZCRT19.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x414574]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ede0
Capabilities:
Terminate process

Disassembly:
call fcn.0040f360
jmp fcn.0040eaa0
Function at 0x412565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123e4

Function at 0x41695c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004162ca

Function at 0x416967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416505
Function at 0x404424
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
cmp eax, 1
jne 0x404460
add esp, 0xfffffff4
push dword [edx + 0x4c]
call sym._getc
cmp eax, 0xffffffff
jne 0x404450
xor eax, eax
jmp 0x40446c
mov byte [ebx], al
mov eax, 1
jmp 0x40446c
push dword [edx + 0x4c]
push eax
push 1
push ebx
call sym._fread
mov ebx, dword [ebp - 0x18]
leave
ret

Function at 0x404474
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push ebx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push dword [ebx + 0x4c]
push esi
push 1
push dword [ebp + 0xc]
call sym._fwrite
mov edx, dword [ebx + 0x40]
test edx, edx
jl 0x40449c
add edx, esi
mov dword [ebx + 0x40], edx
lea esp, [ebp - 0x18]
pop ebx
pop esi
leave
ret

Function at 0x40456c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov edx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
xor al, 1
test al, 1
jne 0x404595
push dword [edx + 0x4c]
push ecx
push 1
push ebx
call sym._fwrite
jmp 0x4045a0
add esp, 0xfffffffc
push ecx
push ebx
push edx
call sym._xsputn__9streambufPCci
mov ebx, dword [ebp - 0x18]
leave
ret

Function at 0x407400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
add esp, 0xfffffffc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x38]
call sym._read
leave
ret

Function at 0x40aad4
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40aaf9
mov dword [0x413164], eax
add esp, 0xfffffff8
push sym._eh_context_free
push eax
call sym.___mingwthr_key_dtor
jmp 0x40aafe
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40ab14
mov dword [sym._eh_context_initialize], 0x40abf8
jmp 0x40ab1e
mov dword [sym._eh_context_initialize], 0x40abac
leave
ret

Function at 0x40abf8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
add esp, 0xfffffff4
push dword [0x413164]
call sub.KERNEL32.dll_TlsGetValue
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x40ac45
call sym._new_eh_context
mov ebx, eax
add esp, 0xfffffff8
push ebx
push dword [0x413164]
call sub.KERNEL32.dll_TlsSetValue
add esp, 8
test eax, eax
jne 0x40ac3a
call sub.KERNEL32.dll_GetLastError
jmp 0x40ac3c
xor eax, eax
test eax, eax
je 0x40ac45
call sym.___terminate
mov eax, ebx
mov ebx, dword [ebp - 0x18]
leave
ret
Function at 0x40ad70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
push edi
push esi
push ebx
mov eax, dword [sym._eh_context_initialize]
call eax
mov edx, eax
lea eax, [edx + 4]
mov dword [ebp - 0x644], eax
mov eax, dword [edx + 4]
lea ecx, [eax + 4]
mov dword [ebp - 0x648], ecx
cmp dword [eax + 4], 0
je 0x40ae2d
lea ebx, [ebp - 0x640]
mov dword [ebp - 0x64c], ebx
mov dword [ebx + 4], 0
mov eax, dword [edx + 4]
mov dword [ebp - 0x640], eax
lea eax, [ebp - 0x638]
mov dword [ebp - 0x638], ebp
mov dword [eax + 4], 0x40add8
mov dword [eax + 8], esp
jmp 0x40adda
mov edx, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x644]
mov dword [eax], edx
mov ecx, dword [ebp - 0x648]
cmp dword [ecx], 0
je 0x40ae16
nop
mov ebx, dword [ebp - 0x648]
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebx], eax
add esp, 0xfffffff8
push 2
push edx
call ecx
add esp, 0x10
cmp dword [ebx], 0
jne 0x40adf4
mov edx, dword [ebp - 0x64c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x644]
mov dword [ecx], eax
jmp 0x40ae2d
mov ebx, dword [ebp - 0x644]
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
call sym.___sjthrow
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec ecx
outsb dx, byte [esi]
je 0x40aebd
jb 0x40aec8
popal
insb byte es:[edi], dx
and byte [ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x40aecb
insb byte es:[edi], dx
jb 0x40ae86
inc edx
jne sym.___get_eh_table_version
cmp ah, byte [eax]
dec esi
outsd dx, dword [esi]
and byte [edx + 0x75], dh
outsb dx, byte [esi]
je sym.___get_eh_table_language
insd dword es:[edi], dx
and byte gs:[ecx + edi*2 + 0x70], dh
and byte gs:[ebp + 0x61], ch
je 0x40aee2
push 0x2e7265
in eax, 0x83
in al, dx
or al, ch
xor esp, edi
invalid
mov al, 0x41
inc ecx
add byte [ebx - 0x17afbf40], al
mov byte [0x31000043], al
add byte [eax], al
xor eax, eax
ror cl, 0xc3
mov esi, esi
leave
ret
movsx eax, word [eax + 4]
leave
ret
Function at 0x402880
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or eax, 0xffffffff
mov word [ebp - 0xc], ax
push ebx
xor ecx, ecx
mov eax, 0x65
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
mov dword [ebp - 0x20], ebx

Function at 0x4096a0
Capabilities:
Generate random numbers using a mersenne twister
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 4]
dec ebx
add al, 0x56
push edi
mov edi, eax
mov eax, dword [edi]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov esi, dword [eax]
push esi
call fcn.004111c1
add esp, 4

Function at 0x40f0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
test esi, esi
je 0x40f0e9
mov bl, 1
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + edx]
cmp cl, 0x7f
ja 0x425e64
inc eax
cmp eax, esi
jb 0x40f0d0
test bl, bl
je 0x425eb2
pop edi
xor eax, eax
pop ebx
ret
dec ebp
or byte [ecx], dl
inc ebp
or al, 0xe9
mov esi, 0x32fffe81
shr cl, 0x9e
cmp esi, 0xc2f980ff
jb 0x425e86
cmp cl, 0xdf
ja 0x425e86
mov edi, 0x491400
jmp 0x425ea6
cmp cl, 0xe0
jb 0x425e97
cmp cl, 0xef
ja 0x425e97
mov edi, 0x3e8
add byte [edi], cl
cmp cl, 0xf0
jb 0x425ecb
cmp cl, 0xf4
ja 0x425ecb
mov edi, 0x422c40
inc eax
xor bl, bl
cmp eax, esi
jae 0x425ec3
mov cl, byte [eax + edx]
cmp cl, 0x80
jb 0x425ecb
xor byte [edx + 0x16], 0x80
stc
mov edi, 0x4f401177
cmp cl, 0xbf
ja 0x425ecb
inc eax
dec edi
jne 0x425ea9
jmp 0x42f0ee
pop edi
mov ebx, 0x491400
pop ebx
ret
mov cl, byte [esi]
movzx eax, cl
cmp eax, 0x68
ja case.default.0x42efa0
movzx edx, byte [eax + 0x42f1f2]
jmp dword [edx*4 + 0x42f1ba]
add esi, 4
test ebx, 0x8d000800
je 0x8c42ef8b
mov al, byte [esi - 1]
cmp al, 0xc0
jb 0x42ef8b
movzx edx, al
and edx, 0x3f
movzx eax, byte [edx + 0x4862c0]
add esi, eax
jmp 0x42ef8b
add al, byte [edi + 0x46]
jmp 0x42ef8b
add byte [eax], al
je 0x42f143
invalid
or eax, 0xffffffff
pop edi
pop esi
enter 0x5fff, 0x5e
pop ebx
add byte [eax], al
add byte [ebx + ecx*4 - 1], dh
loopne 0x42f1bc
inc edx
add byte [esi + 0x330042f0], cl
int1
inc edx
add byte [edx + 0x300042f1], ah
int1
inc edx
add byte [edi - 0x31ffbd10], bl
invalid
or eax, 0xd0d0d0d
add dword [ecx], eax
add dword [ecx], eax
add dword [0xd0d0505], eax
or eax, 0xd0d0d0d
or eax, 0xd0d0d06
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or eax, 0xd0d070d
or eax, 0xd0d0d0d
or eax, 0xd0d0d0d
or byte [eax], cl
or dword [0x10a], ecx
add byte [eax], al
or ecx, dword [ebx]
or ecx, dword [ebx]
add dword [esp + ecx], ecx
or al, 0xc
or eax, 0x1010d0d
add dword [ecx], eax
add dword [ebp - 0xe5117af], ecx
inc edx
add byte [eax - 0xf], ch
inc edx
add byte [eax + 0x42f1], dl
add byte [edx], al
add al, byte [eax]
add byte [ecx], al
add dword [ebp - 0x75], edx
in al, dx
add dword [ebp + 8], 0x53
push esi
mov esi, dword [ebp + 0x10]
out dx, eax
add dword [edx - 0x49f06ff4], ecx
or byte [ebp - 0x57c03af], cl