joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4683b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad2a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ef340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
call fcn.004041d0
mov ecx, eax
test ecx, ecx
jne 0x4683f4
push 0x80004005
call fcn.00409092
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edi, edi
mov dword [ebp - 4], 0
nop
lea edx, [edi + 1]
test edx, edx
js 0x46848d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x468434
push edx
lea ecx, [ebp - 0x10]
call fcn.00409f7f
mov esi, dword [ebp - 0x10]
cmp dword [esi - 4], 1
jle 0x468448
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00409268
mov esi, dword [ebp - 0x10]
push esi
push dword [esi - 8]
call ebx
mov edi, eax
test edi, edi
je 0x468497
push dword [esi - 8]
push esi
call fcn.00443d87
add esp, 8
test eax, eax
js 0x46848d
cmp eax, dword [esi - 8]
jg 0x46848d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp edi, dword [esi - 0xc]
ja 0x468410
add esi, 0xfffffff0
push esi
call fcn.0041423a
mov edi, dword [ebp + 8]
add esp, 4
add eax, 0x10
mov dword [edi], eax
jmp 0x4684a9
push 0x80070057
call fcn.00409092
mov edi, dword [ebp + 8]
mov ecx, edi
push 0x4dbf10
call fcn.00408f27
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4684c5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46aee0
Capabilities:
Delete registry key

Disassembly:
mov dword [ecx], vtable.CoreTech::internal::CRegKeyImpl.0
jmp fcn.0046af20

Function at 0x46af20
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x46af59
cmp byte [esi + 0xc], 0
je 0x46af40
push 0x4dbf10
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov byte [esi + 0xc], 0
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
ret
xor eax, eax
mov dword [esi + 8], eax
pop esi
ret
Function at 0x46bbf0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x214], ecx
push ebx
mov dword [ebp - 0x210], eax
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp dword [ebp + 0x14], 0
je 0x46bd00
test eax, eax
jne 0x46bd00
push edi
xor edi, edi
push esi
nop word [eax + eax]
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.0043f630
add esp, 0xc
mov dword [ebp - 0x20c], 0x100
lea eax, [ebp - 0x20c]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x204]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x46bcd6
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x208]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46bcde
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x214]
push dword [ebp - 0x210]
push dword [ebp + 0xc]
push dword [ebp - 0x208]
call fcn.0046bbf0
push dword [ebp - 0x208]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46bcde
cmp esi, 0x103
je 0x46bcfc
inc edi
test esi, esi
je 0x46bc40
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 0x10
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 0x10

Function at 0x46c500
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x46c620
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af538
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ef340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004041d0
mov ecx, eax
test ecx, ecx
jne 0x46c659
push 0x80004005
call fcn.00409092
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0
sub ecx, 0
je 0x46c6b3
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
sub ecx, 1
je 0x46c69b
sub ecx, 1
je 0x46c694
push str._s__d_:__UNKNOWN_:___s_:__s_n
jmp 0x46c6a0
push str._s__d_:__ERROR_:___s_:__s_n
jmp 0x46c6a0
push 0x4d4808
push eax
call fcn.004092d4
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x10]
lea edx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46c6d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4779b6
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
je 0x4779da
push dword [esi]
sub eax, dword [esi + 4]
push eax
push 1
push dword [esi + 4]
call fcn.00452bd2
mov eax, dword [esi + 4]
add esp, 0x10
mov dword [esi + 0xc], eax
pop esi
ret

Function at 0x4784c1
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
cmp eax, dword [esi + 0xc]
jae 0x4784d2
inc eax
mov dword [esi + 0x10], eax
pop esi
ret
cmp byte [esi + 0x1c], 0
jne 0x478511
push dword [esi]
mov eax, dword [esi + 0x14]
push dword [esi + 8]
add dword [esi + 0x18], eax
push 1
push dword [esi + 4]
call fcn.00487fb6
mov edx, dword [esi + 4]
add esp, 0x10
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], edx
lea ecx, [edx - 1]
add ecx, eax
mov dword [esi + 0xc], ecx
cmp eax, dword [esi + 8]
jae 0x478511
mov byte [edx + eax], 0
inc dword [esi + 0xc]
mov byte [esi + 0x1c], 1
pop esi
ret
Function at 0x47ed10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4

Function at 0x47f430
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x47f5fe
push ebx
cmp eax, 0x7c
je 0x47f5fd
cmp eax, 0x29
jne 0x47f467
cmp dword [esi + 0x10], 0
jne 0x47f5fd
test dword [esi + 0x50], 0x10000000
je 0x47f602
cmp eax, 0x2e
jne 0x47f4c4
push 5
lea ecx, [esi + 0x24]
call fcn.00482020
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x47f4b8
cmp word [eax], 0x5c
jne 0x47f4b5
add eax, 2
cmp eax, ecx
je 0x47f4b5
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x47f4a1
movzx edx, word [eax]
cmp edx, 0x28
je 0x47f4b3
cmp edx, 0x29
je 0x47f4b3
test cl, 0x10
jne 0x47f4b5
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x47f4b3
cmp ecx, 0x7d
jne 0x47f4b5
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.00483090
jmp 0x47f5e8
cmp eax, 0x5c
jne 0x47f52b
mov ecx, esi
call fcn.004820a0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x47f4f7
cmp word [esi + 0x48], 0x62
jne 0x47f4f7
push 4
lea ecx, [esi + 0x24]
call fcn.00482020
mov ecx, esi
call fcn.004820a0
jmp 0x47f5ef
test eax, eax
je 0x47f51f
cmp word [esi + 0x48], 0x42
jne 0x47f51f
push 4
lea ecx, [esi + 0x24]
call fcn.00482020
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004820a0
jmp 0x47f5ef
mov ecx, esi
call fcn.0047f620
jmp 0x47f5e8
cmp eax, 0x5b
jne 0x47f54e
mov ecx, esi
call fcn.004820a0
mov ecx, esi
call fcn.0047fc00
push 4
push 0x5d
mov ecx, esi
call fcn.00481610
jmp 0x47f5e8
cmp eax, 0x28
jne 0x47f574
mov ecx, esi
call fcn.004820a0
mov ecx, esi
call fcn.00483390
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00481610
test bl, bl
je 0x47f5ef
jmp 0x47f5e8
cmp eax, 0x5e
jne 0x47f58c
push 2
lea ecx, [esi + 0x24]
call fcn.00482020
mov ecx, esi
call fcn.004820a0
jmp 0x47f5ef
cmp eax, 0x24
jne 0x47f5a4
push 3
lea ecx, [esi + 0x24]
call fcn.00482020
mov ecx, esi
call fcn.004820a0
jmp 0x47f5ef
cmp eax, 0x2a
je 0x47f617
cmp eax, 0x2b
je 0x47f617
cmp eax, 0x3f
je 0x47f617
cmp eax, 0x7b
je 0x47f617
cmp eax, 0x7d
jne 0x47f5c6
test dword [esi + 0x50], 0x10000000
je 0x47f609
cmp eax, 0x5d
jne 0x47f5d4
test dword [esi + 0x50], 0x10000000
je 0x47f610
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004a4f50
mov ecx, esi
call fcn.004820a0
mov ecx, esi
call fcn.004820f0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x47f442
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.0043936b
push 6
call fcn.0043936b
push 4
call fcn.0043936b
push 0xa
call fcn.0043936b
int3
Function at 0x483bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x483bfd
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x483c19
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x483c08
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x483c4f
cmp dword [ecx], edi
jne 0x483c47
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x483c57
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x483c57
cmp dword [ecx], edi
jne 0x483c5a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.0047e220
push edi
call fcn.004385e3
mov eax, dword [ebp - 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 8
Function at 0x483ca0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0df6
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp esi, dword [eax]
mov eax, dword [ebp + 0x10]
jne 0x483d0c
cmp eax, dword [edi + 4]
jne 0x483d0c
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
call fcn.004836d0
push 8
mov ecx, edi
call fcn.004a6aa0
mov ecx, dword [edi + 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x483df1
cmp esi, eax
je 0x483ded
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xc]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xd]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xe]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xf]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [edi + 0xc]
cmp dword [eax + ecx*8 + 4], esi
lea edx, [ecx*8]
jne 0x483db1
cmp dword [eax + edx], esi
jne 0x483da8
mov ecx, dword [edi + 4]
mov dword [eax + edx], ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 4]
mov dword [ecx + edx + 4], eax
jmp 0x483dbb
mov ecx, dword [esi + 4]
mov dword [eax + edx + 4], ecx
jmp 0x483dbb
cmp dword [eax + edx], esi
jne 0x483dbb
mov ecx, dword [esi]
mov dword [eax + edx], ecx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x10]
dec dword [edi + 8]
call fcn.0047e2b0
push esi
call fcn.004385e3
mov esi, dword [ebp + 0xc]
add esp, 4
cmp esi, dword [ebp + 0x10]
jne 0x483d14
mov ecx, dword [ebp - 0x14]
mov dword [ecx], esi
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 0xc
Function at 0x484260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
push esi
push edi
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x14], 8
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 8], ecx
jb 0x48428b
mov esi, dword [ebx]
jmp 0x48428d
mov esi, ebx
lea edi, [ecx + ecx]
mov edx, 0x811c9dc5
xor ecx, ecx
test edi, edi
je 0x4842b4
nop dword [eax + eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4842a0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x18]
mov esi, dword [ebp - 0xc]
and ecx, edx
mov edx, dword [eax + 0xc]
mov esi, dword [esi + 4]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov dword [ebp - 0xc], esi
mov edi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0x14], edi
lea ecx, [edx + ecx*4]
mov dword [ebp - 0x18], ecx
cmp edi, esi
jne 0x4842df
mov ecx, esi
jmp 0x4842e3
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x4843c8
cmp dword [ebx + 0x14], 8
lea edx, [eax + 8]
jb 0x4842f8
mov esi, dword [ebx]
jmp 0x4842fa
mov esi, ebx
cmp dword [edx + 0x14], 8
lea ecx, [edx + 0x10]
jb 0x484305
mov edx, dword [edx]
mov ecx, dword [ecx]
mov edi, dword [ebp - 8]
cmp ecx, edi
mov dword [ebp - 0x10], ecx
cmovb edi, ecx
test edi, edi
jne 0x484335
xor ecx, ecx
test ecx, ecx
jne 0x484328
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
cmp ecx, edx
jb 0x484328
jbe 0x484356
mov eax, dword [eax]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
jmp 0x4842d7
mov cx, word [edx]
cmp cx, word [esi]
jne 0x484348
add edx, 2
add esi, 2
sub edi, 1
jmp 0x484314
movzx ecx, word [edx]
cmp cx, word [esi]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x484318
cmp dword [eax + 0x1c], 8
lea edx, [eax + 8]
lea edi, [edx + 0x10]
jb 0x484364
mov edx, dword [edx]
cmp dword [ebx + 0x14], 8
jb 0x48436c
mov ebx, dword [ebx]
mov edi, dword [edi]
mov esi, edi
cmp dword [ebp - 8], edi
cmovb esi, dword [ebp - 8]
test esi, esi
jne 0x4843a7
xor ecx, ecx
test ecx, ecx
jne 0x48438a
mov ecx, dword [ebp - 8]
cmp ecx, edi
jb 0x48438a
jbe 0x48438d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 8
mov cx, word [ebx]
cmp cx, word [edx]
jne 0x4843ba
add ebx, 2
add edx, 2
sub esi, 1
jmp 0x484379
movzx ecx, word [ebx]
cmp cx, word [edx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x48437d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 8

Function at 0x48a4ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4a5770
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x4a5941
push ebx
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x4a5940
cmp eax, 0x29
jne 0x4a57a8
cmp dword [esi + 0x10], 0
jne 0x4a5940
test dword [esi + 0x50], 0x10000000
je 0x4a5945
cmp eax, 0x2e
jne 0x4a5805
push 5
lea ecx, [esi + 0x24]
call fcn.00482020
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4a57f9
cmp word [eax], 0x5c
jne 0x4a57f6
add eax, 2
cmp eax, ecx
je 0x4a57f6
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x4a57e2
movzx edx, word [eax]
cmp edx, 0x28
je 0x4a57f4
cmp edx, 0x29
je 0x4a57f4
test cl, 0x10
jne 0x4a57f6
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x4a57f4
cmp ecx, 0x7d
jne 0x4a57f6
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.004a7330
jmp 0x4a592d
cmp eax, 0x5c
jne 0x4a586c
mov ecx, esi
call fcn.004a6ef0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4a5838
cmp word [esi + 0x48], 0x62
jne 0x4a5838
push 4
lea ecx, [esi + 0x24]
call fcn.00482020
mov ecx, esi
call fcn.004a6ef0
jmp 0x4a5934
test eax, eax
je 0x4a5860
cmp word [esi + 0x48], 0x42
jne 0x4a5860
push 4
lea ecx, [esi + 0x24]
call fcn.00482020
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004a6ef0
jmp 0x4a5934
mov ecx, esi
call fcn.004a5970
jmp 0x4a592d
cmp eax, 0x5b
jne 0x4a588f
mov ecx, esi
call fcn.004a6ef0
mov ecx, esi
call fcn.004a5cb0
push 4
push 0x5d
mov ecx, esi
call fcn.004a69c0
jmp 0x4a592d
cmp eax, 0x28
jne 0x4a58b9
mov ecx, esi
call fcn.004a6ef0
mov ecx, esi
call fcn.004a74e0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.004a69c0
test bl, bl
je 0x4a5934
jmp 0x4a592d
cmp eax, 0x5e
jne 0x4a58d1
push 2
lea ecx, [esi + 0x24]
call fcn.00482020
mov ecx, esi
call fcn.004a6ef0
jmp 0x4a5934
cmp eax, 0x24
jne 0x4a58e9
push 3
lea ecx, [esi + 0x24]
call fcn.00482020
mov ecx, esi
call fcn.004a6ef0
jmp 0x4a5934
cmp eax, 0x2a
je 0x4a595a
cmp eax, 0x2b
je 0x4a595a
cmp eax, 0x3f
je 0x4a595a
cmp eax, 0x7b
je 0x4a595a
cmp eax, 0x7d
jne 0x4a590b
test dword [esi + 0x50], 0x10000000
je 0x4a594c
cmp eax, 0x5d
jne 0x4a5919
test dword [esi + 0x50], 0x10000000
je 0x4a5953
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004a4f50
mov ecx, esi
call fcn.004a6ef0
mov ecx, esi
call fcn.004a6f40
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x4a5780
pop ebx
mov al, cl
pop esi
ret
push 5
call fcn.0043936b
push 6
call fcn.0043936b
push 4
call fcn.0043936b
push 0xa
call fcn.0043936b
int3
Function at 0x4a7670
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ef340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x4a769d
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4a76b9
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4a76a8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x4a76ef
cmp dword [ecx], edi
jne 0x4a76e7
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x4a76f7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4a76f7
cmp dword [ecx], edi
jne 0x4a76fa
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.004a4d30
push edi
call fcn.004385e3
mov eax, dword [ebp - 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.0043cfdf
mov esp, ebp
pop ebp
ret 8
Function at 0x40141e
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov edi, dword [esp + 0x128]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or eax, 9
push eax
push dword [esp + 0x12c]
push dword [esp + 0x12c]
call fcn.00405fd9
test eax, eax
jne 0x401527
xor ebp, ebp
test byte [esp + 0x128], 2
je 0x401493
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x401503
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jmp 0x4014ce
test edi, edi
jne 0x401503
push dword [esp + 0x128]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.0040141e
test eax, eax
jne 0x4014d8
push 0x105
lea eax, [esp + 0x18]
push eax
push edi
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x4014a6
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406574
test eax, eax
jne 0x401514
push dword [esp + 0x124]
push dword [esp + 0x124]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x401527
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401527
push 0
push esi
push dword [esp + 0x12c]
push dword [esp + 0x12c]
call eax
pop edi
pop esi
pop ebp
add esp, 0x110
ret 0xc