joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040a7e3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040a7e3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040a7e3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040a7e3
mov dword [0x41203c], eax
call fcn.0040a7e3
test eax, eax
jge 0x402550
push 8
call fcn.0040a7e3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040a7e3
pop ecx
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040a7e3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040a7e3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040a7e3
jmp 0x402495

Function at 0x40a7e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40a7f2
pop dword [ebp - 0x3c]
mov eax, 0x25c7d99a
sub eax, 0x258731a8
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3ce13
push 0
mov eax, 0x337847c9
add eax, 0xccc8990f
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xfec4c11e
sub ecx, 0xfec46a6f
mov ebx, eax
mov edi, 0xa4b84b6
sub edi, 0xa0a48f2
add edi, dword [ebp - 0x3c]
mov edx, 0x20e0a245
xor dword [ebp - 0x30], 0x86eed272
mov esi, dword [edi]
xor dword [ebp - 0x18], edx
add esi, edx
add dword [ebp - 8], 0xf4709858
mov dword [ebx], esi
add ebx, 4
add edi, 0x5922cf67
sub edi, 0x5922cf63
loop 0x40a84b
add eax, 0xb9b9f8b7
sub eax, 0xb9b8ab28
xor ebx, ebx
add ebx, eax
add eax, 0xd0834403
add eax, 0x2f7cbc02
mov ecx, 0x9f8ebd67
add ecx, 0x60b14299
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x412c4f
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0xc]
push edi
call fcn.00412deb
mov edi, dword [esi + 0x24]
mov ecx, dword [edi]
cmp ecx, 0x3a
je 0x45cdb8
cmp ecx, 0x3d
je 0x45cdb8
lea edx, [eax - 0x4e]
cmp edx, 0x1a
ja case.0x412c85.88
movzx edx, byte [edx + 0x412dd0]
jmp dword [edx*4 + 0x412d90]
cmp ecx, 0x39
je 0x412c9b
cmp ecx, 0x3b
je 0x412c9b
cmp ecx, 0x3c
jne case.0x412c85.88
cmp ecx, 0x3f
jge 0x43a58f
push 0
push eax
push ebx
mov ecx, esi
call fcn.00412bd9
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp byte [esi + 0x24a], 0
je 0x412cf6
push eax
push ebx
mov ecx, esi
mov byte [esi + 0x257], 1
call fcn.0040d260
pop edi
pop esi
pop ebx
pop ebp
ret 4
cmp ecx, 0x4d
jmp 0x427e4c
cmp ecx, 0xa
jmp 0x427e4c
cmp ecx, 0x15
jmp 0x427e4c
cmp ecx, 0x4c
jmp 0x427e4c
cmp byte [esi + 0x24b], 0
je 0x45cdb8
cmp eax, 0x58
je 0x412d2f
cmp eax, 0x59
je 0x412d2f
cmp eax, 0x5d
je 0x412d2f
cmp eax, 0x5a
je 0x412d2f
cmp eax, 0x5b
je 0x412d2f
cmp eax, 0x5f
je 0x412d2f
cmp eax, 0x60
je 0x412d2f
cmp eax, 0x61
jne 0x45cdb8
cmp ecx, 0x30
je 0x412ca4
cmp ecx, 0x33
je 0x412ca4
cmp ecx, 0x34
je 0x412ca4
cmp ecx, 0x31
je 0x412ca4
cmp ecx, 0x32
je 0x412ca4
cmp ecx, 0x35
je 0x412ca4
cmp ecx, 0x36
je 0x412ca4
cmp ecx, 0x37
jne 0x45cdb8
jmp 0x412ca4
mov ecx, dword [ebp + 8]
push ecx
push eax
push ebx
mov ecx, esi
call fcn.004b0665
pop edi
pop esi
pop ebx
pop ebp
ret 4
sete dl
test dl, dl
jne 0x412c9b
jmp case.0x412c85.88
cmp ecx, 0x41
je 0x412c9b
cmp ecx, 0x42
je 0x412c9b
cmp ecx, 0x43
je 0x412c9b
jmp case.0x412c85.88
cmp ecx, 0x40
jg 0x412ca4
cmp dword [esi + 0x1c4], 0
jle 0x412ca4
mov ecx, dword [ebx + 4]
mov dword [edi + 0x34], ecx
mov ecx, dword [ebx + 0xc]
mov edx, dword [esi + 0x24]
mov dword [edx + 0x3c], ecx
mov edx, dword [esi + 0x24]
add dword [esi + 0x1c4], 0xffffffff
mov byte [edx + 0x2c], 1
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx + 0x14]
mov dword [esi + 0x24], edx
jmp 0x412ca4
cmp ecx, 0x97
jmp 0x427e4c
cmp ecx, 0x46
jmp 0x427e4c
cmp ecx, 0x3e
je 0x412c9b
cmp ecx, 0x3f
je 0x43a58f
cmp ecx, 0x40
je 0x412c9b
jmp case.0x412c85.88
cmp ecx, 0xc
jmp 0x427e4c
cmp ecx, 0xb
jmp 0x427e4c
cmp ecx, 8
jmp 0x427e4c
cmp ecx, 0x1c
jmp 0x427e4c
cmp ecx, 9
jmp 0x427e4c
cmp ecx, 0xd
jmp 0x427e4c
cmp byte [esi + 0x24a], 0
je 0x412d7c
jmp 0x412d89
Function at 0x415482
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov esi, ecx
mov dword [ebp - 4], 0
je 0x499bb1
lea ebx, [ebx]
mov ecx, dword [edi]
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
call fcn.0041645f
mov ecx, dword [edi]
mov eax, dword [ecx]
cmp eax, 0x39
jl 0x4154c7
cmp eax, 0x3d
jle 0x417914
cmp eax, 0x41
je 0x439fea
mov ecx, dword [esi + 0x48]
mov edi, dword [edi + 8]
call fcn.00415474
test edi, edi
jne 0x41549e
jmp 0x499bb1
mov eax, dword [edi + 8]
test eax, eax
je 0x41793a
mov eax, dword [eax]
mov eax, dword [eax]
cmp eax, 0x3b
je 0x4154c7
cmp eax, 0x3c
je 0x4154c7
cmp eax, 0x3d
je 0x4154c7
mov eax, dword [esi + 0x58]
lea ecx, [eax + 0x18]
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ecx
cmp dword [eax + 0x38], 0
jne 0x499ba3
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x58], edx
jmp 0x4154c7
mov eax, dword [edi + 8]
test eax, eax
je 0x499b8e
mov edx, dword [eax]
mov eax, dword [edx]
cmp eax, 0x42
je 0x4154c7
cmp eax, 0x43
je 0x4154c7
jmp 0x499b8e
add ecx, 4
push ecx
push 0x754e
mov ecx, esi
call fcn.0044926b
jmp 0x4154c7
mov edx, dword [esi + 0x40]
mov ecx, dword [edx + 0x10]
mov dword [esi + 0x40], ecx
jmp 0x417950
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41d800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp byte [edi + 0x49], 0
jne 0x42f028
mov edx, dword [esi]
mov ax, word [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
and edx, 0xfffff013
or edx, 0x13
mov dword [esi], edx
mov word [esi + 2], ax
mov eax, dword [esi]
and eax, 0xffff3fff
or eax, 0x3000
mov dword [esi + 4], ecx
mov dword [esi], eax
cmp dword [edi + 0x40], 0
jne 0x439bc0
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x41d86b
mov eax, dword [edi + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x5c]
lea ebx, [esi + 8]
push ebx
push ecx
mov ecx, dword [ebp + 0x14]
push ecx
push eax
call edx
test eax, eax
jl 0x49e13c
mov eax, dword [esi]
shr eax, 0xc
and eax, 0xf
lea ecx, [esi + eax*4]
mov edx, dword [edi + 0x40]
test edx, edx
mov dword [ebp + 8], ecx
je 0x49e165
add esi, dword [edi + 0x4c]
cmp byte [edi + 0x48], 0
jne 0x43d2da
mov ecx, dword [edi + 0x44]
mov al, dl
mov bl, 0xc
imul bl
test edx, edx
mov byte [esi], 1
mov byte [esi + 1], al
jbe 0x49e165
lea eax, [esi + 8]
mov esi, edx
movzx edx, word [ecx]
mov word [eax - 4], dx
movzx edx, word [ecx + 4]
mov word [eax - 2], dx
movzx edx, byte [ecx + 8]
mov byte [eax], dl
mov edx, dword [ecx + 0xc]
shl edx, 8
xor edx, dword [eax]
add eax, 0xc
and edx, 0xffff00
xor dword [eax - 0xc], edx
movzx edx, byte [ecx + 0x10]
mov byte [eax - 9], dl
mov edx, dword [ecx + 0x14]
mov dword [eax - 8], edx
add ecx, 0x18
sub esi, 1
jne 0x41d8ad
jmp 0x49e165
mov al, byte [ebp + 0xc]
add al, al
add al, al
or al, 2
mov byte [esi], al
lea ecx, [esi + 1]
jmp 0x41d876
or eax, 8
mov dword [esi], eax
jmp 0x41d848
mov ecx, edx
lea ebx, [ecx + ecx*2]
add ebx, ebx
add ebx, ebx
add ebx, ebx
mov eax, 0xaaaaaaab
mul ebx
shr edx, 4
cmp edx, ecx
jne 0x49e14e
mov byte [esi], 0x41
movzx edx, byte [esi]
mov eax, ebx
shl eax, 8
or edx, eax
mov dword [esi], edx
mov ecx, dword [edi + 0x44]
push ebx
push ecx
add esi, 4
push esi
call fcn.00401410
mov eax, dword [ebp + 8]
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
push 0
push 0
push 0
push eax
call dword [fcn.004013ac]
jmp 0x41d86b
push 0
push 0
push 0
call fcn.004b19b7
push eax
call dword [fcn.004013ac]
jmp 0x43d2f7
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x4705cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e70c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov cl, 1
mov al, 0x6f
push edi
mov dl, 0x6e
mov byte [ebp - 0x24], cl
mov byte [ebp - 0x22], cl
mov byte [ebp - 7], cl
push 0xf5
mov ecx, esi
mov byte [ebp - 0x23], 0
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x20], 0x54
mov byte [ebp - 0x1f], 2
mov byte [ebp - 0x1e], 0x16
mov byte [ebp - 0x1d], 0x57
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x70
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], al
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0x45
mov byte [ebp - 0x15], 0x78
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], dl
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], al
mov byte [ebp - 9], 0x77
mov byte [ebp - 8], 0x73
call fcn.0041f1b5
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
push 0
push 0
push 0x1e
lea edi, [ebp - 0x24]
push edi
push eax
mov eax, dword [esi + 0x1c]
push eax
mov eax, dword [esi + 0x18]
push eax
push ecx
mov ecx, dword [edx + 0x50]
call ecx
test eax, eax
pop edi
pop esi
jl 0x49eb6c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401402
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push eax
call dword [fcn.004013ac]
jmp 0x47068a
Function at 0x4712fb
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4e70c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
lea ebx, [ebp - 0x88]
push ebx
lea ebx, [ebp - 0x80]
push ebx
push edx
movzx edx, byte [ebp + 8]
mov dword [eax], 0
mov edi, ecx
mov ecx, dword [edi + 0x18]
push edx
mov dword [ebp - 0x98], eax
mov eax, dword [edi + 0x10]
push ecx
mov dword [ebp - 0x80], 0
mov esi, dword [eax]
push ecx
push eax
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x84], 0xffffffff
call eax
jmp 0x49e20e
push esi
call dword [sym.imp.vsansi.dll_DeleteFileW]
jmp 0x49e297
push 0
push 0
call dword [sym.imp.vsansi.dll_GetTempPathW]
mov esi, eax
test esi, esi
je 0x49e2a7
lea eax, [esi + esi]
cmp eax, 0x78
ja 0x49e22a
lea ebx, [ebp - 0x7c]
mov dword [ebp - 0x90], 0
push ebx
push esi
call dword [sym.imp.vsansi.dll_GetTempPathW]
push 0x20a
call dword [fcn.00401028]
mov esi, eax
test esi, esi
je 0x49e259
push esi
push 0
push 0x46773c
push ebx
call dword [sym.imp.vsansi.dll_GetTempFileNameW]
test eax, eax
je 0x49e26d
push 0
push 0x100
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.vsansi.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x84], eax
je 0x47135c
mov ecx, dword [ebp - 0x88]
push 0
lea edx, [ebp - 0x94]
push edx
mov edx, dword [ebp - 0x80]
push ecx
push edx
push eax
call dword [0x401384]
test eax, eax
je 0x47135c
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x94]
jne 0x47135c
mov ecx, dword [edi + 4]
mov ecx, dword [ecx + 4]
push esi
call fcn.00401cf1
mov edx, dword [ebp - 0x98]
mov dword [edx], eax
push esi
mov esi, dword [fcn.0040102c]
call esi
cmp dword [ebp - 0x90], 1
je 0x49e28f
cmp dword [ebp - 0x80], 0
je 0x47146d
mov edi, dword [edi + 0x10]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x58]
lea edx, [ebp - 0x80]
push edx
push edi
call eax
test eax, eax
jl 0x49e2c8
mov eax, dword [ebp - 0x84]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
je 0x471482
push eax
call dword [fcn.0040138c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401402
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jge 0x471368
mov ecx, dword [edi + 4]
mov edx, dword [ecx + 0x14]
push eax
push 0
push 0x75b8
push edx
jmp 0x49e2bb
push eax
call dword [fcn.00401028]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x90], 1
jne 0x471395
push eax
push eax
push eax
call fcn.004b19b7
push eax
call dword [fcn.004013ac]
jmp 0x471395
push eax
push eax
push eax
call fcn.004b19b7
push eax
call dword [fcn.004013ac]
jmp 0x4713b2
call fcn.004b19b7
push ebx
push eax
push 0
push 0x75ba
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.004ba044
add esp, 0x14
jmp 0x47143a
push ebx
call esi
jmp 0x471450
call fcn.004b19b7
push esi
push eax
push 0
push 0x75b9
jmp 0x49e27b
call fcn.004b19b7
mov edx, dword [edi + 4]
push eax
mov eax, dword [edx + 0x14]
push 0
push 0x77ea
push eax
call fcn.004ba044
add esp, 0x10
jmp 0x471450
push 0
push 0
push 0
push eax
call dword [fcn.004013ac]
jmp 0x47146d
Function at 0x474b24
Capabilities:
Query environment variable

Disassembly:
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x474ab0
sub eax, ecx
sar eax, 1
cmp eax, 0x8000
jae 0x474ade
push ebx
push ebx
push esi
call dword [sym.imp.vsansi.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x24], eax
add eax, eax
push eax
push ebx
call dword [fcn.004013c0]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
je 0x474af0
push dword [ebp - 0x24]
push dword [ebp - 8]
push esi
call dword [sym.imp.vsansi.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.00473fad
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [ebp - 0x14]
push esi
mov dword [eax + 4], ecx
call edi
mov eax, dword [ebp + 8]
push dword [ebp - 0x28]
mov dword [eax], ebx
call edi
cmp dword [ebp - 8], ebx
je 0x474b66
push dword [ebp - 8]
call edi
jmp 0x474b66
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, dword [fcn.004013c4]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp + 8], eax
je 0x474b74
push esi
cmp dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov esi, dword [eax]
mov dword [ebp - 0x28], esi
jne 0x474c4f
cmp esi, ebx
je 0x474b66
cmp word [esi], 0x40
je 0x474b94
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x474b4b
pop esi
push dword [ebp - 0x18]
call fcn.00471e9d
cmp dword [ebp - 4], ebx
jne 0x47922c
push dword [ebp - 0xc]
call dword [fcn.00401054]
pop edi
pop ebx
leave
ret 4
add esi, 2
push esi
call fcn.0046ae6e
cmp word [esi], bx
je 0x4791e5
lea eax, [ebp - 4]
push eax
push esi
call fcn.0046945a
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x47921f
cmp eax, ebx
je 0x474c5c
cmp word [ecx], bx
je 0x474c5c
push ecx
lea eax, [ebp - 0x18]
push eax
call fcn.00475953
test al, al
je 0x4791f8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x1010000
push dword [ebp - 4]
mov dword [ebp - 0x1c], ebx
call fcn.00475bc0
test eax, eax
jl 0x4791ff
push dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
call fcn.0047587d
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
call dword [fcn.00401058]
lea eax, [eax + eax + 2]
push eax
push ebx
call dword [fcn.004013c0]
mov esi, eax
cmp esi, ebx
je 0x479204
push dword [ebp - 0xc]
push dword [ebp - 0xc]
call dword [fcn.00401058]
inc eax
push eax
push esi
call fcn.004a3f16
mov eax, esi
lea ecx, [eax + 2]
jmp 0x474ab0
push dword [ebp - 4]
call edi
mov dword [ebp - 4], ebx
jmp 0x474b5c
push ecx
call edi
jmp 0x47920d
push 0x401bac
push 0xb
call fcn.004a4fb8
pop ecx
pop ecx
jmp 0x474b0e
push dword [ebp - 4]
push 4
jmp 0x4791ec
push dword [ebp - 4]
jmp 0x4791ea
push 5
call fcn.004a4fb8
jmp 0x4791f2
push esi
push 0xb
mov dword [ebp - 4], ebx
call fcn.004a4fb8
pop ecx
pop ecx
jmp 0x474b66
push 5
call fcn.004a4fb8
pop ecx
jmp 0x474b73
push dword [ebp - 4]
call edi
jmp 0x474b85
Function at 0x479860
Capabilities:
Parse credit card information

Disassembly:
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x469d8b
sub eax, edx
sar eax, 1
lea eax, [esi + eax*2]
cmp eax, esi
jbe 0x469e07
mov dx, word [ebp + 0xc]
movzx ecx, word [eax]
cmp cx, dx
je 0x469e04
movzx ecx, cx
cmp cx, 0x5c
je 0x469e04
cmp cx, 0x7c
je 0x469e04
cmp cx, 0x2a
je 0x469e04
cmp cx, 0x3f
je 0x469e04
cmp cx, 0x3c
je 0x469e04
cmp cx, 0x3e
je 0x469e04
cmp cx, 0x2f
je 0x469e04
cmp cx, 0x5b
je 0x469e04
cmp cx, 0x5d
je 0x469e04
cmp cx, 0x3b
je 0x469e04
cmp cx, 0x3d
je 0x469e04
cmp cx, 0x2c
je 0x469e04
sub eax, 2
cmp eax, esi
ja 0x469da5
jmp 0x479876
add eax, 2
pop esi
pop ebp
ret 8
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x469d86
xor eax, eax
pop esi
pop ebp
ret 8
pop esi
pop ebp
ret 8
Function at 0x4a49ae
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [fcn.004013c0]
push 0x208
push 0
mov esi, 0x104
call edi
mov ebx, eax
mov eax, dword [ebp + 0xc]
and word [eax], 0
test ebx, ebx
je 0x4a4ae4
and word [ebx], 0
lea eax, [esi - 1]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.vsansi.dll_GetModuleFileNameW]
test eax, eax
je 0x4a4a23
push ebx
call dword [sym.imp.vsansi.dll_GetModuleHandleW]
test eax, eax
jne 0x4a4a23
call dword [fcn.004013b4]
cmp eax, 0x7e
jne 0x4a4a23
push ebx
call dword [fcn.004013c4]
add esi, esi
lea eax, [esi + esi]
push eax
push 0
call edi
mov ebx, eax
test ebx, ebx
jne 0x4a49e0
test ebx, ebx
je 0x4a4ae4
cmp word [ebx], 0
je 0x4a4ae4
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.vsansi.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x4a4ae4
push esi
push 0
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 4], edi
je 0x4a4ae4
push edi
push esi
push 0
push ebx
call sub.vsansi.dll_GetFileVersionInfoW
test eax, eax
je 0x4a4ae4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x472208
push edi
call sub.vsansi.dll_VerQueryValueW
test eax, eax
je 0x4a4ae4
cmp dword [ebp - 8], 0
je 0x4a4ae4
mov eax, dword [ebp - 0xc]
cmp word [eax + 0xc], 0
je 0x4a4ab9
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push 0x4a4b30
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044a354
add esp, 0x1c
jmp 0x4a4adb
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push 0x4a4b18
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044a354
add esp, 0x18
test eax, eax
setge al
test al, al
jne 0x4a4af4
push 0x4a3190
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004a3f16
cmp dword [ebp - 4], 0
je 0x4a4b03
push dword [ebp - 4]
call dword [fcn.004013c4]
test ebx, ebx
je 0x4a4b0e
push ebx
call dword [fcn.004013c4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4a5054
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x4e70c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x4efc30]
mov edi, dword [ebp + 0xc]
push 2
lea eax, [ebp - 0x51c]
push 1
mov esi, 0x200
push eax
mov dword [ebp - 0x520], esi
mov byte [ebp - 0x51c], 0xff
mov byte [ebp - 0x51b], 0xfe
mov byte [0x4ef969], 0
call dword [0x401228]
lea eax, [ebp - 0x528]
push eax
call dword [0x401248]
lea eax, [ebp - 0x528]
push eax
call dword [0x40124c]
push eax
push 0x4a52ac
lea eax, [ebp - 0x404]
push esi
push eax
call dword [0x40122c]
add esp, 0x28
test eax, eax
jne 0x4a50e0
and word [ebp - 0x404], ax
lea eax, [ebp - 0x404]
push eax
push 0x2ee0
call fcn.004a4dcc
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x404]
push eax
push 0
call fcn.004a49ae
lea eax, [ebp - 0x404]
push eax
push 0x2ee1
call fcn.004a4dcc
pop ecx
pop ecx
push 0x4a5294
call dword [sym.imp.vsansi.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a514e
push esi
lea eax, [ebp - 0x404]
push eax
push ebx
call fcn.004a49ae
push ebx
call dword [fcn.004013bc]
lea eax, [ebp - 0x404]
push eax
push 0x2eea
call fcn.004a4dcc
pop ecx
pop ecx
lea eax, [ebp - 0x518]
push eax
mov dword [ebp - 0x518], 0x114
call dword [sym.imp.vsansi.dll_GetVersionExW]
cmp dword [ebp - 0x508], 2
jne 0x4a5175
mov eax, 0x4a527c
jmp 0x4a5188
cmp dword [ebp - 0x508], 1
mov eax, 0x4a5264
je 0x4a5188
mov eax, 0x4a5254
lea ecx, [ebp - 0x504]
push ecx
push dword [ebp - 0x50c]
push dword [ebp - 0x510]
push dword [ebp - 0x514]
push eax
push 0x2ee2
call fcn.004a4dcc
add esp, 0x18
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.vsansi.dll_GetUserNameW]
lea eax, [ebp - 0x404]
push eax
push 0x2ee3
call fcn.004a4dcc
push 0x2ee4
call fcn.004a4dcc
push dword [edi]
mov esi, dword [0x401230]
push 0x4a316c
push dword [0x4efc30]
call esi
xor ebx, ebx
inc ebx
add esp, 0x18
cmp dword [ebp + 8], ebx
jle 0x4a521c
mov eax, dword [edi + ebx*4]
test eax, eax
je 0x4a5216
push eax
push 0x4a524c
push dword [0x4efc30]
call esi
add esp, 0xc
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x4a51fe
push 0x44ab8c
push dword [0x4efc30]
call esi
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov byte [0x4ef968], 0
mov byte [0x4ef969], 1
pop ebx
call fcn.00401402
leave
ret 8

Function at 0x4a5695
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov ebx, ecx
jne 0x4a56ae
push 0x80004005
call fcn.004a414e
xor edi, edi
push esi
call dword [sym.imp.vsansi.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4a56b0
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4a5cce
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4e70c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], esi
call fcn.004a5608
mov edi, eax
cmp edi, esi
je 0x4a5d2e
lea ecx, [ebp - 0x208]
call fcn.004a55a3
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401402
leave
ret 4
mov edi, dword [sym.imp.vsansi.dll_RegEnumKeyExW]
jmp 0x4a5d4c
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x208]
call fcn.004a5cce
cmp eax, esi
jne 0x4a5d94
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 0x100
call edi
test eax, eax
je 0x4a5d36
lea ecx, [ebp - 0x208]
call fcn.004a55a3
push dword [ebp - 0x210]
push dword [ebx]
call dword [sym.imp.vsansi.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x208]
mov esi, eax
call fcn.004a55a3
mov eax, esi
jmp 0x4a5d1d