joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a1f1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x20], ecx
or eax, 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x41a31c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00419fb4
mov edx, eax
xor eax, eax
test edx, edx
jne 0x41a31c
call fcn.004199dc
call fcn.00419848
mov esi, eax
or edx, 0xffffffff
xor eax, eax
mov ecx, edx
mov edi, esi
repne scasb al, byte es:[edi]
mov ebx, ecx
not ebx
mov ecx, edx
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
lea eax, [ebx + edx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x659a1a
mov dword [esp], ebx
call fcn.0059fc30
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0059fc30
mov dword [esp + 4], str..pem
mov dword [esp], ebx
call fcn.0059fc30
mov dword [esp + 4], 0x659a9c
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x41a2d7
mov dword [esp + 0xc], eax
mov ecx, dword [ebp - 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call fcn.0059fc68
jmp 0x41a312
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.could_not_open__s_for_writing:__s
mov dword [esp + 8], 0x255
mov dword [esp + 4], str.src_userpref.c
mov dword [esp], str.userpref_set_device_public_key
call fcn.0041f669
mov dword [esp], ebx
call fcn.0059fbf8
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret

Function at 0x41a324
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00419fb4
test eax, eax
je 0x41a3b6
call fcn.00419848
mov esi, eax
or edx, 0xffffffff
xor eax, eax
mov ecx, edx
mov edi, esi
repne scasb al, byte es:[edi]
mov ebx, ecx
not ebx
mov ecx, edx
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
lea eax, [ebx + edx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ebx, eax
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x659a1a
mov dword [esp], ebx
call fcn.0059fc30
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0059fc30
mov dword [esp + 4], str..pem
mov dword [esp], ebx
call fcn.0059fc30
mov dword [esp], ebx
call sub.msvcrt.dll_remove
mov dword [esp], ebx
call fcn.0059fbf8
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x41ece9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
or esi, 0xffffffff
test ebx, ebx
je 0x41edf2
mov eax, ebx
call fcn.0041e654
cmp dword [ebx + 0x1c], 0
je 0x41ed5a
mov dword [esp + 0xc], str.callback_already_set__removing_n
mov dword [esp + 8], 0x1a1
mov dword [esp + 4], str.src_notification_proxy.c
mov dword [esp], str.np_set_notify_callback
call fcn.0041f669
mov esi, dword [ebx]
mov dword [ebx], 0
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
push eax
push eax
mov dword [ebx + 0x1c], 0
mov dword [ebx], esi
test edi, edi
je 0x41edc2
mov dword [esp], 0xc
call sub.msvcrt.dll_malloc
mov esi, 0xffffff00
test eax, eax
je 0x41edeb
mov dword [eax], ebx
mov dword [eax + 4], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 8], edx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x41e6d0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebx + 0x1c], eax
xor esi, esi
inc eax
jne 0x41edeb
mov dword [ebx + 0x1c], 0
jmp 0x41ede6
mov dword [esp + 0xc], str.no_callback_set
mov dword [esp + 8], 0x1c3
mov dword [esp + 4], str.src_notification_proxy.c
mov dword [esp], str.np_set_notify_callback
call fcn.0041f669
mov esi, 0xffffff00
mov eax, ebx
call fcn.0041e692
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x426e10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x426e2c
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x426e20
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
test edi, edi
je 0x426e20
mov edx, 0xaaaaaaab
mov eax, edi
mul edx
shr edx, 1
lea eax, [edx*4 + 5]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x40], edi
xor edx, edx
jmp 0x426f2c
mov al, byte [ebx + edx + 1]
shr al, 4
mov edi, eax
and edi, 0xff
mov al, byte [ebx + edx + 1]
and eax, 0xf
shl eax, 2
mov dword [ebp - 0x48], eax
lea eax, [edx + 2]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1c], eax
jae 0x426f5c
mov al, byte [ebx + edx + 2]
shr al, 6
movzx eax, al
mov dword [ebp - 0x4c], eax
mov al, byte [ebx + edx + 2]
and eax, 0x3f
mov dword [ebp - 0x40], eax
mov al, byte [ebp - 0x38]
shr al, 2
movzx eax, al
mov al, byte [eax + 0x65b680]
mov byte [esi + ecx], al
mov al, byte [ebp - 0x38]
and eax, 3
shl eax, 4
mov al, byte [edi + eax + 0x65b520]
mov byte [esi + ecx + 1], al
mov eax, dword [ebp - 0x3c]
mov edi, dword [ebp + 0xc]
cmp dword [edi], eax
jbe 0x426f74
mov edi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov al, byte [edi + eax + 0x65b520]
mov byte [ebp - 0x38], al
mov byte [esi + ecx + 2], al
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp + 0xc]
cmp eax, dword [edi]
jae 0x426f70
mov edi, dword [ebp - 0x40]
mov al, byte [edi + 0x65b680]
mov byte [esi + ecx + 3], al
add ecx, 4
add edx, 3
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
cmp eax, edx
jbe 0x426f80
mov al, byte [ebx + edx]
mov byte [ebp - 0x38], al
lea edi, [edx + 1]
mov dword [ebp - 0x3c], edi
cmp dword [ebp - 0x40], edi
ja 0x426e78
mov dword [ebp - 0x48], 0
xor edi, edi
lea eax, [edx + 2]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1c], eax
jb 0x426ea6
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x4c], 0
jmp 0x426ebd
mov al, 0x3d
jmp 0x426f18
mov byte [ebp - 0x38], 0x3d
mov al, byte [ebp - 0x38]
jmp 0x426f01
mov eax, dword [ebp - 0x50]
mov byte [esi + ecx], 0
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x426e22
Function at 0x437996
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x25
jne 0x437b3b
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNextChar
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParseName
mov edi, eax
test eax, eax
jne 0x4379df
mov ecx, str.xmlParsePEReference:_no_name_n
mov edx, 0x44
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
jmp fcn.0042bf2c
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3b
je 0x4379ff
xor ecx, ecx
mov edx, 0x17
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
jmp fcn.0042bda9
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNextChar
inc dword [ebx + 0x1b8]
mov eax, dword [ebx]
test eax, eax
je 0x437a2c
mov eax, dword [eax + 0x60]
test eax, eax
je 0x437a2c
mov dword [esp + 4], edi
mov edx, dword [ebx + 4]
mov dword [esp], edx
call eax
mov esi, eax
test eax, eax
jne 0x437a77
cmp dword [ebx + 0x1c], 1
je 0x437a3e
cmp dword [ebx + 0x58], 0
jne 0x437a57
cmp dword [ebx + 0x5c], 0
jne 0x437a57
mov dword [esp], edi
mov ecx, str.PEReference:____s__not_found_n
mov edx, 0x1a
mov eax, ebx
call fcn.0042bce4
jmp 0x437b34
mov dword [esp], edi
mov ecx, str.PEReference:____s__not_found_n
mov edx, 0x1b
mov eax, ebx
call fcn.0042d1ea
mov dword [ebx + 0x64], 0
jmp 0x437b34
mov eax, dword [eax + 0x30]
sub eax, 4
cmp eax, 1
jbe 0x437a9b
mov dword [esp], edi
mov ecx, str.Internal:____s__is_not_a_parameter_entity_n
mov edx, 0x1b
mov eax, ebx
call fcn.0042d1ea
jmp 0x437b34
mov eax, dword [ebx + 0x24]
cmp dword [eax + 0x28], 0x42b381
je 0x437ac2
mov edx, esi
mov eax, ebx
call fcn.0042c846
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPushInput
test eax, eax
jns 0x437b34
jmp 0x437b3b
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNewEntityInputStream
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlPushInput
test eax, eax
js 0x437b3b
cmp dword [esi + 0x30], 5
jne 0x437b34
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 0x10]
cmp byte [eax], 0x3c
jne 0x437b34
cmp byte [eax + 1], 0x3f
jne 0x437b34
cmp byte [eax + 2], 0x78
jne 0x437b34
cmp byte [eax + 3], 0x6d
jne 0x437b34
cmp byte [eax + 4], 0x6c
jne 0x437b34
mov al, byte [eax + 5]
lea edx, [eax - 9]
cmp dl, 1
jbe 0x437b1a
cmp al, 0x20
je 0x437b1a
cmp al, 0xd
jne 0x437b34
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlParseTextDecl
cmp dword [ebx + 0x54], 0x20
jne 0x437b34
mov dword [ebx + 0xac], 0xffffffff
jmp 0x437b3b
mov dword [ebx + 0x5c], 1
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x445326
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
je 0x445367
mov ebx, dword [edx]
test ebx, ebx
je 0x445367
test ecx, ecx
jne 0x44534c
mov ecx, dword [sym.imp.msvcrt.dll__iob]
add ecx, 0x20
mov dword [esp + 0xc], ecx
mov eax, dword [edx + 4]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_fwrite
add esp, 0x14
pop ebx
leave
ret

Function at 0x448afd
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ebx, edx
shr ebx, 0x1f
jne 0x448b1d
test eax, eax
je 0x448b1d
pop eax
pop ebx
leave
jmp sym.evasi0n_gui.exe_xmlNanoFTPRead
or eax, 0xffffffff
pop ebx
pop ebx
leave
ret

Function at 0x449346
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x44938a
test edx, edx
je 0x44938a
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov ebx, eax
test eax, eax
jns 0x44938d
mov edx, str.fread__
xor eax, eax
call fcn.00448e07
jmp 0x44938d
or ebx, 0xffffffff
mov eax, ebx
add esp, 0x14
pop ebx
leave
ret

Function at 0x44b82f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
or ebx, 0xffffffff
cmp dword [0x6d9514], 0
jne 0x44b8a8
mov dword [0x6d9514], 1
call sym.evasi0n_gui.exe_xmlNewMutex
mov dword [0x6d9518], eax
mov dword [esp], str.XML_MEM_BREAKPOINT
call sub.msvcrt.dll_getenv
test eax, eax
je 0x44b87e
mov dword [esp + 8], 0x6d951c
mov dword [esp + 4], 0x661a9d
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
mov dword [esp], str.XML_MEM_TRACE
call sub.msvcrt.dll_getenv
xor ebx, ebx
test eax, eax
je 0x44b8a8
mov dword [esp + 8], 0x6d9520
mov dword [esp + 4], 0x661aaf
mov dword [esp], eax
call sub.msvcrt.dll_sscanf
mov eax, ebx
add esp, 0x14
pop ebx
leave
ret
Function at 0x44bf77
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 8
mov esi, ecx
mov byte [ebp - 0xd], dl
mov ebx, dword [eax]
mov dl, byte [ebx]
lea ecx, [edx - 0x41]
cmp cl, 0x19
jbe 0x44c07e
lea ecx, [edx - 0x61]
cmp cl, 0x19
jbe 0x44c07e
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44c07e
cmp dl, 0x2d
je 0x44c07e
cmp dl, 0x2e
je 0x44c07e
cmp dl, 0x5f
je 0x44c07e
cmp dl, 0x7e
je 0x44c07e
cmp dl, 0x25
jne 0x44c026
mov cl, byte [ebx + 1]
mov byte [ebp - 0x11], cl
lea edi, [ecx - 0x61]
mov ecx, edi
cmp cl, 5
jbe 0x44bffe
mov cl, byte [ebp - 0x11]
lea edi, [ecx - 0x30]
mov ecx, edi
cmp cl, 9
jbe 0x44bffe
mov cl, byte [ebp - 0x11]
sub ecx, 0x41
cmp cl, 5
ja 0x44c026
mov cl, byte [ebx + 2]
mov byte [ebp - 0x11], cl
lea edi, [ecx - 0x61]
mov ecx, edi
cmp cl, 5
jbe 0x44c07e
mov cl, byte [ebp - 0x11]
lea edi, [ecx - 0x30]
mov ecx, edi
cmp cl, 9
jbe 0x44c07e
mov cl, byte [ebp - 0x11]
sub ecx, 0x41
cmp cl, 5
jbe 0x44c07e
cmp dl, 0x24
je 0x44c07e
cmp dl, 0x21
je 0x44c07e
cmp dl, 0x26
je 0x44c07e
cmp dl, 0x28
je 0x44c07e
cmp dl, 0x29
je 0x44c07e
cmp dl, 0x2a
je 0x44c07e
cmp dl, 0x2b
je 0x44c07e
cmp dl, 0x2c
je 0x44c07e
cmp dl, 0x3b
je 0x44c07e
cmp dl, 0x3d
je 0x44c07e
cmp dl, 0x27
je 0x44c07e
cmp dl, 0x3a
je 0x44c07e
cmp dl, 0x40
je 0x44c07e
xor eax, eax
test esi, esi
sete al
jmp 0x44c15b
cmp dl, 0x25
jne 0x44c07d
add ebx, 3
jmp 0x44c07e
inc ebx
mov dl, byte [ebx]
lea ecx, [edx - 0x41]
cmp cl, 0x19
jbe 0x44c14e
lea ecx, [edx - 0x61]
cmp cl, 0x19
jbe 0x44c14e
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44c14e
cmp dl, 0x2d
je 0x44c14e
cmp dl, 0x2e
je 0x44c14e
cmp dl, 0x5f
je 0x44c14e
cmp dl, 0x7e
je 0x44c14e
cmp dl, 0x25
jne 0x44c10d
movzx edi, byte [ebx + 1]
lea esi, [edi - 0x61]
mov ecx, esi
cmp cl, 5
jbe 0x44c0ed
lea esi, [edi - 0x30]
mov ecx, esi
cmp cl, 9
jbe 0x44c0ed
lea ecx, [edi - 0x41]
cmp cl, 5
ja 0x44c10d
movzx edi, byte [ebx + 2]
lea esi, [edi - 0x61]
mov ecx, esi
cmp cl, 5
jbe 0x44c14e
lea esi, [edi - 0x30]
mov ecx, esi
cmp cl, 9
jbe 0x44c14e
lea ecx, [edi - 0x41]
cmp cl, 5
jbe 0x44c14e
cmp dl, 0x24
je 0x44c14e
cmp dl, 0x21
je 0x44c14e
cmp dl, 0x26
je 0x44c14e
cmp dl, 0x28
je 0x44c14e
cmp dl, 0x29
je 0x44c14e
cmp dl, 0x2a
je 0x44c14e
cmp dl, 0x2b
je 0x44c14e
cmp dl, 0x2c
je 0x44c14e
cmp dl, 0x3b
je 0x44c14e
cmp dl, 0x3d
je 0x44c14e
cmp dl, 0x27
je 0x44c14e
cmp dl, 0x3a
je 0x44c14e
cmp dl, 0x40
jne 0x44c157
cmp dl, byte [ebp - 0xd]
jne 0x44c073
mov dword [eax], ebx
xor eax, eax
pop ebx
pop esi
pop ebx
pop esi
pop edi
leave
ret
Function at 0x44d4ac
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, eax
mov edi, edx
or eax, 0xffffffff
test edx, edx
je 0x44d651
mov esi, dword [edx]
jmp 0x44d4d2
cmp al, 0x25
jne 0x44d4d1
add esi, 3
jmp 0x44d4d2
inc esi
mov al, byte [esi]
lea edx, [eax - 0x41]
cmp dl, 0x19
jbe 0x44d4c8
lea edx, [eax - 0x61]
cmp dl, 0x19
jbe 0x44d4c8
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x44d4c8
cmp al, 0x2d
je 0x44d4d1
cmp al, 0x2e
je 0x44d4d1
cmp al, 0x5f
je 0x44d4d1
cmp al, 0x7e
je 0x44d4d1
cmp al, 0x25
jne 0x44d536
mov dl, byte [esi + 1]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x44d51b
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44d51b
sub edx, 0x41
cmp dl, 5
ja 0x44d536
mov dl, byte [esi + 2]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x44d4cc
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44d4cc
sub edx, 0x41
cmp dl, 5
jbe 0x44d4cc
cmp al, 0x24
je 0x44d4c8
cmp al, 0x21
je 0x44d4c8
cmp al, 0x26
je 0x44d4d1
cmp al, 0x28
je 0x44d4d1
cmp al, 0x29
je 0x44d4d1
cmp al, 0x2a
je 0x44d4d1
cmp al, 0x2b
je 0x44d4d1
cmp al, 0x2c
je 0x44d4d1
cmp al, 0x3b
je 0x44d4d1
cmp al, 0x3d
je 0x44d4d1
cmp al, 0x27
je 0x44d4d1
cmp al, 0x3a
je 0x44d4d1
cmp al, 0x40
je 0x44d4d1
cmp al, 0x2f
je 0x44d4d1
cmp al, 0x3f
je 0x44d4d1
test ebx, ebx
je 0x44d64d
test byte [ebx + 0x24], 1
je 0x44d659
cmp al, 0x7d
je 0x44d4c8
cmp al, 0x7b
je 0x44d4c8
cmp al, 0x7c
je 0x44d4d1
cmp al, 0x5c
je 0x44d4d1
cmp al, 0x5e
je 0x44d4d1
cmp al, 0x5b
je 0x44d4d1
cmp al, 0x5d
je 0x44d4d1
cmp al, 0x60
je 0x44d4d1
jmp 0x44d659
mov dword [esp], eax
call dword [sym.evasi0n_gui.exe_xmlFree]
test byte [ebx + 0x24], 2
mov eax, dword [edi]
je 0x44d60d
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrndup
jmp 0x44d625
mov dword [esp + 8], 0
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlURIUnescapeString
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x44d638
mov dword [esp], eax
call dword [sym.evasi0n_gui.exe_xmlFree]
mov eax, dword [edi]
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrndup
mov dword [ebx + 0x28], eax
mov dword [edi], esi
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x44d5ea
jmp 0x44d5f3
Function at 0x44d662
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, eax
mov edi, edx
or eax, 0xffffffff
test edx, edx
je 0x44d7da
mov esi, dword [edx]
jmp 0x44d688
cmp al, 0x25
jne 0x44d687
add esi, 3
jmp 0x44d688
inc esi
mov al, byte [esi]
lea edx, [eax - 0x41]
cmp dl, 0x19
jbe 0x44d67e
lea edx, [eax - 0x61]
cmp dl, 0x19
jbe 0x44d67e
lea edx, [eax - 0x30]
cmp dl, 9
jbe 0x44d67e
cmp al, 0x2d
je 0x44d687
cmp al, 0x2e
je 0x44d687
cmp al, 0x5f
je 0x44d687
cmp al, 0x7e
je 0x44d687
cmp al, 0x25
jne 0x44d6ec
mov dl, byte [esi + 1]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x44d6d1
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44d6d1
sub edx, 0x41
cmp dl, 5
ja 0x44d6ec
mov dl, byte [esi + 2]
lea ecx, [edx - 0x61]
cmp cl, 5
jbe 0x44d682
lea ecx, [edx - 0x30]
cmp cl, 9
jbe 0x44d682
sub edx, 0x41
cmp dl, 5
jbe 0x44d682
cmp al, 0x24
je 0x44d67e
cmp al, 0x21
je 0x44d67e
cmp al, 0x26
je 0x44d687
cmp al, 0x28
je 0x44d687
cmp al, 0x29
je 0x44d687
cmp al, 0x2a
je 0x44d687
cmp al, 0x2b
je 0x44d687
cmp al, 0x2c
je 0x44d687
cmp al, 0x3b
je 0x44d687
cmp al, 0x3d
je 0x44d687
cmp al, 0x27
je 0x44d687
cmp al, 0x3a
je 0x44d687
cmp al, 0x40
je 0x44d687
cmp al, 0x2f
je 0x44d687
cmp al, 0x3f
je 0x44d687
cmp al, 0x5b
je 0x44d687
cmp al, 0x5d
je 0x44d687
test ebx, ebx
je 0x44d7d6
test byte [ebx + 0x24], 1
je 0x44d7e2
cmp al, 0x7d
je 0x44d67e
cmp al, 0x7b
je 0x44d67e
cmp al, 0x7c
je 0x44d687
cmp al, 0x5c
je 0x44d687
cmp al, 0x5e
je 0x44d687
cmp al, 0x60
je 0x44d687
jmp 0x44d7e2
mov dword [esp], eax
call dword [sym.evasi0n_gui.exe_xmlFree]
test byte [ebx + 0x24], 2
mov eax, dword [edi]
je 0x44d7bb
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlStrndup
jmp 0x44d7d3
mov dword [esp + 8], 0
mov edx, esi
sub edx, eax
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.evasi0n_gui.exe_xmlURIUnescapeString
mov dword [ebx + 0x20], eax
mov dword [edi], esi
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
leave
ret
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x44d798
jmp 0x44d7a1
Function at 0x44dcad
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
leave
jmp fcn.0044d7eb

Function at 0x46ea9c
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov ebx, eax
jmp 0x46ec8a
cmp dword [ebx + 0x24], 0
jne 0x46eae8
mov dword [esp], 0xfde8
call dword [sym.evasi0n_gui.exe_xmlMallocAtomic]
mov dword [ebx + 0x24], eax
test eax, eax
jne 0x46ead8
mov eax, str.allocating_input
call fcn.0046ea6c
jmp 0x46eb72
mov dword [ebx + 0x34], 0xfde8
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov esi, dword [ebx + 0x30]
mov edi, dword [ebx + 0x24]
lea eax, [edi + 0x1000]
cmp esi, eax
jbe 0x46eb18
mov eax, dword [ebx + 0x2c]
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll_memmove
sub edi, esi
add dword [ebx + 0x30], edi
add dword [ebx + 0x28], edi
add dword [ebx + 0x2c], edi
mov esi, dword [ebx + 0x24]
mov eax, dword [ebx + 0x34]
mov edi, dword [ebx + 0x2c]
lea ecx, [esi + eax]
lea edx, [edi + 0x1000]
cmp ecx, edx
jae 0x46eb9e
mov edx, dword [ebx + 0x28]
mov ecx, dword [ebx + 0x30]
mov dword [ebp - 0x12c], ecx
shl eax, 1
mov dword [ebx + 0x34], eax
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [ebp - 0x130], edx
call dword [sym.evasi0n_gui.exe_xmlRealloc]
mov dword [ebx + 0x24], eax
test eax, eax
mov edx, dword [ebp - 0x130]
jne 0x46eb81
mov eax, str.allocating_input_buffer
call fcn.0046ea6c
mov dword [esp], esi
call dword [sym.evasi0n_gui.exe_xmlFree]
mov dword [ebx + 0x38], 0xffffffff
or esi, 0xffffffff
jmp 0x46ec96
sub edi, esi
lea edi, [eax + edi]
mov dword [ebx + 0x2c], edi
sub edx, esi
lea edx, [eax + edx]
mov dword [ebx + 0x28], edx
mov edx, dword [ebp - 0x12c]
sub edx, esi
add eax, edx
mov dword [ebx + 0x30], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000
mov eax, dword [ebx + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
mov esi, eax
mov dword [ebx + 0x38], eax
cmp eax, 0
jle 0x46ebd5
add dword [ebx + 0x2c], eax
jmp 0x46ec96
je 0x46ec96
cmp eax, 0xffffffff
jne 0x46ec2e
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2734
jg 0x46ebfa
cmp eax, 0x2733
jge 0x46ec2e
cmp eax, 0xb
jne 0x46ec10
jmp 0x46ec2e
cmp eax, 0x2746
je 0x46ec94
cmp eax, 0x274a
je 0x46ec94
mov dword [esp + 8], str.recv_failed_n
mov dword [esp + 4], 0
mov dword [esp], 0xa
call fcn.00448b72
jmp 0x46ec96
mov dword [ebp - 0x20], 0x3c
mov dword [ebp - 0x1c], 0
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], 1
lea edx, [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea ecx, [ebp - 0x124]
mov dword [esp + 4], ecx
inc eax
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
jg 0x46ec8a
call sub.msvcrt.dll__errno
cmp dword [eax], 4
jne 0x46ec94
test byte [ebx + 0x18], 2
jne 0x46eaaf
xor esi, esi
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret