joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10001013
mov eax, dword [ebp + 8]
mov dword [0x10008430], eax
jmp 0x1000104b
cmp dword [ebp + 0xc], 0
jne 0x1000104b
push 0
mov ecx, dword [0x1000843c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
mov edx, dword [0x10008440]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x1000843c], 0
mov dword [0x10008440], 0
mov eax, 1
pop ebp
ret 0xc

Function at 0x100011ac
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x100011fc
cmp dword [0x10008434], 0
je 0x100011fc
mov eax, dword [0x10008434]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
jne 0x100011e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [0x1000843c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x1000843c], 0
jmp 0x10001227
cmp dword [ebp + 8], 0
jne 0x10001227
cmp dword [0x10008434], 0
jne 0x10001227
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x10001096
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1000843c], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1000122e
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x1000127e
cmp dword [0x10008438], 0
je 0x1000127e
mov eax, dword [0x10008438]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
jne 0x10001263
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push 0
mov ecx, dword [0x10008440]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x10008440], 0
jmp 0x100012a9
cmp dword [ebp + 8], 0
jne 0x100012a9
cmp dword [0x10008438], 0
jne 0x100012a9
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x10001142
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10008440], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10001df1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10006040
cmp edx, dword [eax]
je 0x10001e13
add eax, 8
inc ecx
cmp eax, 0x100060d0
jl 0x10001e04
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10006040]
jne 0x10001f41
mov eax, dword [0x10008450]
cmp eax, 1
je 0x10001f1b
test eax, eax
jne 0x10001e44
cmp dword [0x10008454], 1
je 0x10001f1b
cmp edx, 0xfc
je 0x10001f41
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10001e7b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.100032c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.100033b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10001ebe
lea eax, [ebp - 0x1a4]
push eax
call fcn.100033b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x100053c4
push edi
call fcn.10003bd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.100032c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.100032d0
lea eax, [ebp - 0xa0]
push 0x100053a4
push eax
call fcn.100032d0
push dword [esi + 0x10006044]
lea eax, [ebp - 0xa0]
push eax
call fcn.100032d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10003b45
add esp, 0x2c
pop edi
jmp 0x10001f41
lea eax, [ebp + 8]
lea esi, [esi + 0x10006044]
push 0
push eax
push dword [esi]
call fcn.100033b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1e643353
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1fd22f20
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x161b177e
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x17135558
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401af6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b35
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b35
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b35
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b35
cmp dword [ecx + 0x74], 0xe
jbe 0x401b35
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x4a4054], 1
mov dword [0x4a4050], 1
mov dword [0x4a404c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x4a400c], eax
mov eax, dword [0x4a4060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x4a4074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x4a405c]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x457ad4], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x407490
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4074f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4a4068]
test esi, esi
jle 0x407610
mov eax, dword [0x4a406c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x407524
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4075a7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x407510
mov dword [esp], ebx
call sym.___mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x407637
mov eax, dword [0x4a406c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call sym.__GetPEImageBase
mov edx, dword [0x4a406c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x407617
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4075a0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4075b0
add dword [0x4a4068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4a406c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4075a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call sym.___report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40752e
mov eax, dword [0x4a406c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call sym.___report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call sym.___report_error
lea esi, [esi]
nop
Function at 0x407b50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4a4084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4a407c]
sub esp, 4
test ebx, ebx
je 0x407ba5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x407b9e
test esi, esi
je 0x407b9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x407b80
mov dword [esp], 0x4a4084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x407ee0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x407f05
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x407f10
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x407f05
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x407f58
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x407f4e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x407f5a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x407f40
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4051a8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp eax, edx
add byte [eax], al
pop eax
imul ecx, dword [ebp - 0xa38], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0xa38], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x1d10]
imul ecx, dword [ebp - 0xa38]
imul eax, dword [ebp - 0xa38], 0xfe
sub ecx, eax
mov dword [ebp - 0xa3c], ecx
push eax
push ecx
add esp, 4
add eax, 0x47ed
xor eax, 0x1304d
add eax, 0x16a9f
pop eax
push ecx
push esi
add esp, 4
sub ecx, 0x7fea
add ecx, 0xfc1d
pop ecx
push ebx
add ebx, 0xc90f
pop ebx
push edi
push esi
add esp, 4
jmp 0x405226
pop edi
push eax
push esi
add esp, 4
jmp 0x405233
call 0x405242
add byte [edx + 0x38], cl
cmp al, byte [edx + 0x47]
dec eax
dec ecx
push eax
add esp, 4
or eax, 0xb153
pop eax
mov dword [ebp - 0x2d4], 1
push eax
push ecx
add esp, 4
jmp 0x405260
jmp 0x405265
add eax, 0x30e7
sub eax, 0x1191c
pop eax
push eax
and eax, 0x7477
or eax, 0x17ab9
jmp 0x405287
pop eax
imul ecx, dword [ebp - 0x2d4], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2d4], 0xfe
sub ecx, edx
xor ecx, 2
imul ecx, dword [ebp - 0x2d4]
imul eax, dword [ebp - 0x2d4], 0xfe
sub ecx, eax
mov dword [ebp - 0x2d8], ecx
push eax
push ebx
add esp, 4
add eax, 0x84d1
and eax, 0xbf4a
call fcn.004052de
add byte [esp + ecx*2], bh
dec eax
cmp al, 0x48
cmp eax, dword [edi - 0x7d]
add esp, 4
pop eax

Function at 0x405242
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
cmp eax, edx
add byte [eax], al
pop eax
imul ecx, dword [ebp - 0xa38], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0xa38], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x1d10]
imul ecx, dword [ebp - 0xa38]
imul eax, dword [ebp - 0xa38], 0xfe
sub ecx, eax
mov dword [ebp - 0xa3c], ecx
push eax
push ecx
add esp, 4
add eax, 0x47ed
xor eax, 0x1304d
add eax, 0x16a9f
pop eax
push ecx
push esi
add esp, 4
sub ecx, 0x7fea
add ecx, 0xfc1d
pop ecx
push ebx
add ebx, 0xc90f
pop ebx
push edi
push esi
add esp, 4
jmp 0x405226
pop edi
push eax
push esi
add esp, 4
jmp 0x405233
call 0x405242
add byte [edx + 0x38], cl
cmp al, byte [edx + 0x47]
dec eax
dec ecx
push eax
add esp, 4
or eax, 0xb153
pop eax
mov dword [ebp - 0x2d4], 1
push eax
push ecx
add esp, 4
jmp 0x405260
jmp 0x405265
add eax, 0x30e7
sub eax, 0x1191c
pop eax
push eax
and eax, 0x7477
or eax, 0x17ab9
jmp 0x405287
pop eax
imul ecx, dword [ebp - 0x2d4], 0xfe
add ecx, 0x56f3663b
imul edx, dword [ebp - 0x2d4], 0xfe
sub ecx, edx
xor ecx, 2
imul ecx, dword [ebp - 0x2d4]
imul eax, dword [ebp - 0x2d4], 0xfe
sub ecx, eax
mov dword [ebp - 0x2d8], ecx
push eax
push ebx
add esp, 4
add eax, 0x84d1
and eax, 0xbf4a
call fcn.004052de
add byte [esp + ecx*2], bh
dec eax
cmp al, 0x48
cmp eax, dword [edi - 0x7d]
add esp, 4
pop eax

Function at 0x4052de
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ebx
xor ebx, 0x2cd0
pop ebx
push edi
or edi, 0x3677
pop edi
mov ecx, dword [ebp - 0x988]
mov edx, dword [ebp - 0x984]
mov dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x1b8], edx
jmp 0x4054e1
Function at 0x405bb0
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esp, 4
and edi, 0x390e
jmp 0x405bc0
pop edi
push eax
jmp 0x405bc8
pop eax
invalid
invalid
invalid

Function at 0x405c7c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and dh, al
test dword [edi - 0xc], esi
invalid
js 0x405c72
invalid

Function at 0x405cb8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
pop esi
push esi
or esi, 0x803d
pop esi
push esi
push edx
add esp, 4
jmp 0x405ccc
or esi, 0x140fe
sub esi, 0xec0c

Function at 0x405cd8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esi, 0x7597
pop esi
push edx
and edx, 0x15be
add edx, 0xa799
cdq
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
or edx, 0x15155
pop edx
mov dword [ebp - 0x1e2c], 0xe
push edi
push ebx
add esp, 4
and edi, 0x17751
xor edi, 0x18295
add edi, 0xc7f5
pop edi
push eax
and eax, 0x6bdc
or eax, 0x6a1
and eax, 0x2ab3
or eax, 0xfca
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb84]
mov dword [ebp - 0x154c], eax
push esi
push edi
add esp, 4
xor esi, 0x13e45
or esi, 0xaefc
sub esi, 0xd466
pop esi
push eax
and eax, 0x433d
pop eax
push edx
push ecx
add esp, 4
or edx, 0x9178
and edx, 0x3e99
pop edx
mov dword [ebp - 0x1e30], 0xffffffff
push edi
push edx
add esp, 4
jmp 0x405d8d
call 0x405d9d
add byte [ebx + 0x41], al
cmp al, byte [ebx + 0x47]
dec edi
xor ecx, dword [ebx + 0x37]
inc ebp
add esp, 4
pop edi
push edx
sub edx, 0x78ba
jmp 0x405db1
pop edx
mov ecx, dword [ebp - 0x3b8]
invalid
lea esi, [eax]
sti

Function at 0x405d9d
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esi, 0x7597
pop esi
push edx
and edx, 0x15be
add edx, 0xa799
cdq
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
or edx, 0x15155
pop edx
mov dword [ebp - 0x1e2c], 0xe
push edi
push ebx
add esp, 4
and edi, 0x17751
xor edi, 0x18295
add edi, 0xc7f5
pop edi
push eax
and eax, 0x6bdc
or eax, 0x6a1
and eax, 0x2ab3
or eax, 0xfca
pop eax
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb84]
mov dword [ebp - 0x154c], eax
push esi
push edi
add esp, 4
xor esi, 0x13e45
or esi, 0xaefc
sub esi, 0xd466
pop esi
push eax
and eax, 0x433d
pop eax
push edx
push ecx
add esp, 4
or edx, 0x9178
and edx, 0x3e99
pop edx
mov dword [ebp - 0x1e30], 0xffffffff
push edi
push edx
add esp, 4
jmp 0x405d8d
call 0x405d9d
add byte [ebx + 0x41], al
cmp al, byte [ebx + 0x47]
dec edi
xor ecx, dword [ebx + 0x37]
inc ebp
add esp, 4
pop edi
push edx
sub edx, 0x78ba
jmp 0x405db1
pop edx
mov ecx, dword [ebp - 0x3b8]
invalid
lea esi, [eax]
sti
Function at 0x405ddd
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ecx
call 0x405ddd
add byte [edx], dh
xor al, 0x4d
cmp byte [ebx + 0x47], cl
add esp, 4
pop ecx
push ebx
jmp 0x405de8
xor ebx, 0x16c06
and ebx, 0x10b4
pop ebx
push esi
push esi
add esp, 4
add esi, 0x1599b
pop esi
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x405e49
push ecx
or ecx, 0x88f4
call 0x405e27
add byte [ecx + 0x42], cl
inc edx
inc eax
aas
dec eax
push eax
add esp, 4
sub ecx, 0xdd40
pop ecx
push eax
push edx
add esp, 4
add eax, 0xf2e3
jmp 0x405e43
pop eax
jmp 0x406077
mov dword [ebp - 0xc34], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa8c], ecx
push esi
sub esi, 0x11b46
pop esi
push eax
push ebx
add esp, 4
jmp 0x405e71
sub eax, 0xe164
xor eax, 0x135d4
pop eax
push ebx
jmp 0x405e85
pop ebx
push edx
jmp 0x405e90
pop edx
mov edx, dword [ebp - 0x154c]
mov dword [ebp - 0xa88], edx
mov dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x154c]
jne 0x405ef8
push esi
push edi
add esp, 4
jmp 0x405ebf
or esi, 0x14c45
pop esi
push edi
push edx
add esp, 4
jmp 0x405ed4
and edi, 0xe023
pop edi
push esi
push eax
add esp, 4
sub esi, 0x38a
pop esi
mov ecx, dword [ebp - 0xc38]
mov dword [ebp - 0x1554], ecx
jmp 0x406029
cmp dword [ebp - 0xc34], 0
jle 0x40601d
push ecx
and ecx, 0x15e34
pop ecx
push edi
xor edi, 0xb870
call 0x405f21
add byte [ebx], bh
inc eax
inc edi
dec ebx
dec ebp
xor al, 0x3c
add esp, 4
pop edi
push eax
push esi
add esp, 4
and eax, 0xa169
push edi
or edi, 0x6fc7
pop edi
push eax
or eax, 0xe9e7
and eax, 0x11737
and eax, 0x1761c
sbb al, 0x76
add dword [eax], eax
sbb al, 0x76
add dword [eax], eax
pop eax
push ebx
xor ebx, 0xbce9
jmp 0x405fe4
and ebx, 0x77f4
pop ebx
mov edx, dword [ebp - 0xc34]
inc dword [ebx - 0x6a76fe16]
int3
invalid
invalid
dec dword [ebx - 0xa8b7b]
inc dword [ebx - 0x7a76fe40]
je 0x405ffc
invalid
invalid
invalid
invalid
invalid
Function at 0x405e27
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x4d0]
add edx, 1
mov dword [ebp - 0x4d0], edx
push ecx
call 0x405ddd
add byte [edx], dh
xor al, 0x4d
cmp byte [ebx + 0x47], cl
add esp, 4
pop ecx
push ebx
jmp 0x405de8
xor ebx, 0x16c06
and ebx, 0x10b4
pop ebx
push esi
push esi
add esp, 4
add esi, 0x1599b
pop esi
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x3b8]
cmp eax, 0xffffffff
jb 0x405e49
push ecx
or ecx, 0x88f4
call 0x405e27
add byte [ecx + 0x42], cl
inc edx
inc eax
aas
dec eax
push eax
add esp, 4
sub ecx, 0xdd40
pop ecx
push eax
push edx
add esp, 4
add eax, 0xf2e3
jmp 0x405e43
pop eax
jmp 0x406077
mov dword [ebp - 0xc34], 7
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0xa8c], ecx
push esi
sub esi, 0x11b46
pop esi
push eax
push ebx
add esp, 4
jmp 0x405e71
sub eax, 0xe164
xor eax, 0x135d4
pop eax
push ebx
jmp 0x405e85
pop ebx
push edx
jmp 0x405e90
pop edx
mov edx, dword [ebp - 0x154c]
mov dword [ebp - 0xa88], edx
mov dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x154c]
jne 0x405ef8
push esi
push edi
add esp, 4
jmp 0x405ebf
or esi, 0x14c45
pop esi
push edi
push edx
add esp, 4
jmp 0x405ed4
and edi, 0xe023
pop edi
push esi
push eax
add esp, 4
sub esi, 0x38a
pop esi
mov ecx, dword [ebp - 0xc38]
mov dword [ebp - 0x1554], ecx
jmp 0x406029
cmp dword [ebp - 0xc34], 0
jle 0x40601d
push ecx
and ecx, 0x15e34
pop ecx
push edi
xor edi, 0xb870
call 0x405f21
add byte [ebx], bh
inc eax
inc edi
dec ebx
dec ebp
xor al, 0x3c
add esp, 4
pop edi
push eax
push esi
add esp, 4
and eax, 0xa169
push edi
or edi, 0x6fc7
pop edi
push eax
or eax, 0xe9e7
and eax, 0x11737
and eax, 0x1761c
sbb al, 0x76
add dword [eax], eax
sbb al, 0x76
add dword [eax], eax
pop eax
push ebx
xor ebx, 0xbce9
jmp 0x405fe4
and ebx, 0x77f4
pop ebx
mov edx, dword [ebp - 0xc34]
inc dword [ebx - 0x6a76fe16]
int3
invalid
invalid
dec dword [ebx - 0xa8b7b]
inc dword [ebx - 0x7a76fe40]
je 0x405ffc
invalid
invalid
invalid
invalid
invalid