joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48444c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48458b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x1c]
sub edx, dword [ebx + 0x18]
lea eax, [ebp - 8]
call sub.rtl70.bpl__System__LStrSetLength_qqrv
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x44b
mov eax, esi
call sub.vcl70.bpl__Controls_TControl_Perform_qqruiii
mov eax, dword [ebx + 0xc]
cmp eax, 0x201
jne 0x484505
test byte [ebx + 0x10], 1
je 0x484505
mov byte [esi + 0x3b6], 1
lea eax, [ebp - 0x11]
push eax
call sub.user32.dll_GetCursorPos
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x11]
mov eax, esi
call sub.vcl70.bpl__Controls_TControl_ScreenToClient_qqrrx12Types_TPoint
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x11], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xd], eax
lea eax, [ebp - 0x11]
push eax
push 0
push 0xd7
mov eax, esi
call sub.vcl70.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_SendMessageA
cmp eax, dword [ebx + 0x1c]
jg 0x4844fc
cmp eax, dword [ebx + 0x18]
jge 0x484575
mov byte [esi + 0x3b6], 0
jmp 0x484575
cmp eax, 0x202
jne 0x484575
cmp byte [esi + 0x3b6], 0
je 0x484575
mov byte [ebp - 9], 1
mov byte [esi + 0x3b6], 0
lea ecx, [ebp - 9]
mov edx, dword [ebp - 8]
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x110]
cmp byte [ebp - 9], 0
je 0x484575
mov eax, dword [sym.imp.vcl70.bpl__Forms_Screen]
mov eax, dword [eax]
mov dx, 0xfff5
call sub.vcl70.bpl__Forms_TScreen_SetCursor_qqr16Controls_TCursor
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call sub.rtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x484598
mov eax, esi
call sub.vcl70.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [sym.imp.vcl70.bpl__Forms_Screen]
mov eax, dword [eax]
xor edx, edx
call sub.vcl70.bpl__Forms_TScreen_SetCursor_qqr16Controls_TCursor
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484592
lea eax, [ebp - 8]
call sub.rtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x4eea74
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
push esi
push edi
lea esi, [ebp - 0x100]
lea edi, [ebp - 0x200]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
movzx eax, si
mov byte [ebp + eax - 0x200], 0x81
movzx esi, bx
mov byte [ebp + esi - 0x200], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push esi
push pe_nt_image_headers32
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401060
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
xor edi, edi
cmp dword [0x845368], 0x594
mov dword [ebp - 8], eax
jne 0x40108c
push edi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov ecx, dword [0x4260c8]
mov edx, dword [0x4260cc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], edx
call fcn.00401050
mov eax, dword [0x4260d0]
mov ecx, dword [str.3_]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], ecx
mov ebx, 0x20
jmp 0x4010d0
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x845368]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401156
push edi
lea edx, [ebp - 0x470]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push edi
lea eax, [ebp - 0x34]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push 0x30
lea ecx, [ebp - 0x6c]
push edi
push ecx
mov dword [ebp - 0x70], edi
call fcn.00403280
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetCommConfig]
xor ecx, ecx
xor edx, edx
lea eax, [ebp - 0x3c]
push eax
mov word [ebp - 0x1c], cx
mov word [ebp - 0x1a], dx
mov ecx, dword [ebp - 0x1c]
push ecx
push edi
push str.Jahuk
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov eax, dword [ebp - 4]
mov ecx, dword [0x845368]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x401170
mov dword [0x844904], 0xedeb2e40
jmp 0x401190
cmp ecx, 0x3eb
jne 0x401190
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x8442b4], edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov edx, esi
shr edx, cl
add eax, esi
mov dword [ebp - 0x14], eax
mov dword [0x844900], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov ecx, dword [ebp - 8]
shl ecx, 4
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
mov ecx, dword [ebp - 4]
add eax, dword [ebp - 0x30]
xor eax, dword [ebp - 0x14]
xor ecx, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ecx
sub esi, ecx
call fcn.00401040
sub ebx, 1
jne 0x4010d0
cmp dword [0x845368], 0xa6d
mov ebx, dword [ebp + 8]
mov dword [ebx], esi
jne 0x401233
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 8]
pop edi
pop esi
mov dword [ebx + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407764
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040445a
and dword [ebp - 4], 0
cmp dword [0x426cf8], 0
mov ebx, eax
jne 0x407815
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4078c6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4078c6
push eax
call fcn.004043e8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x426cf8], eax
call esi
push eax
call fcn.004043e8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x426cfc], eax
call esi
push eax
call fcn.004043e8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x426d00], eax
call esi
push eax
call fcn.004043e8
pop ecx
mov dword [0x426d08], eax
test eax, eax
je 0x407815
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004043e8
pop ecx
mov dword [0x426d04], eax
mov eax, dword [0x426d04]
cmp eax, ebx
je 0x40786d
cmp dword [0x426d08], ebx
je 0x40786d
push eax
call fcn.00404463
push dword [0x426d08]
mov esi, eax
call fcn.00404463
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40786d
test edi, edi
je 0x40786d
call esi
test eax, eax
je 0x407864
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407864
test byte [ebp - 0xc], 1
jne 0x40786d
or dword [ebp + 0x10], 0x200000
jmp 0x4078a6
mov eax, dword [0x426cfc]
cmp eax, ebx
je 0x4078a6
push eax
call fcn.00404463
pop ecx
test eax, eax
je 0x4078a6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4078a6
mov eax, dword [0x426d00]
cmp eax, ebx
je 0x4078a6
push eax
call fcn.00404463
pop ecx
test eax, eax
je 0x4078a6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426cf8]
call fcn.00404463
pop ecx
test eax, eax
je 0x4078c6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4078c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433005
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.LoadLibraryA
push str.kernelbase.dll
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x407850
push str.kernelbase.dll
mov dword [ebp - 4], eax
call edi
push eax
call ebx
push str.RtlUserThreadStart
push str.ntdll.dll
mov dword [ebp - 8], eax
call edi
push eax
call ebx
push str.x86getFunc
push 0
push 0xf001f
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0x28
push 0
push 0
push 0xf001f
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov esi, eax
mov eax, dword [ebp - 4]
push str.OpenFileMappingW
push str.kernelbase.dll
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
call edi
push eax
call ebx
push 0x4078a0
push str.kernelbase.dll
mov dword [esi + 0xc], eax
call edi
push eax
call ebx
push 0x4078b0
push str.kernelbase.dll
mov dword [esi + 0x10], eax
call edi
push eax
call ebx
push str.VirtualAlloc
push str.kernelbase.dll
mov dword [esi + 0x14], eax
call edi
push eax
call ebx
push str.VirtualFree
push str.kernelbase.dll
mov dword [esi + 0x18], eax
call edi
push eax
call ebx
push 0x4078dc
push str.kernelbase.dll
mov dword [esi + 0x1c], eax
call edi
push eax
call ebx
push str.memcpy
push str.ntdll.dll
mov dword [esi + 0x20], eax
call edi
push eax
call ebx
push esi
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40111d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409004]
jne 0x401127
repz ret
jmp fcn.004012c0
Function at 0x40315b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x409004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004020b3
and dword [ebp - 0x14], 0
cmp dword [0x40a744], 0
mov dword [ebp - 0x18], eax
jne 0x40320e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4032b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4032b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40a744], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40a748], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40a74c], eax
call edi
push eax
call esi
mov dword [0x40a754], eax
test eax, eax
je 0x40320e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40a750], eax
mov eax, dword [0x40a750]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403267
cmp dword [0x40a754], ecx
je 0x403267
push eax
call esi
push dword [0x40a754]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403267
test ebx, ebx
je 0x403267
call edi
test eax, eax
je 0x40325e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40325e
test byte [ebp - 8], 1
jne 0x403267
or dword [ebp + 0x10], 0x200000
jmp 0x40329a
mov eax, dword [0x40a748]
cmp eax, dword [ebp - 0x18]
je 0x40329a
push eax
call esi
test eax, eax
je 0x40329a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40329a
mov eax, dword [0x40a74c]
cmp eax, dword [ebp - 0x18]
je 0x40329a
push eax
call esi
test eax, eax
je 0x40329a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40a744]
call esi
test eax, eax
je 0x4032b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4032b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040111d
leave
ret
Function at 0xd42058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd421a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd4207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd4206a
add dl, dl
jne 0xd42089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd420dc
xor eax, eax
add dl, dl
jne 0xd42096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd4217d
add dl, dl
jne 0xd420a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd420b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd420bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd420c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd420d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd42075
mov eax, 1
add dl, dl
jne 0xd420ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd420f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd420e1
sub eax, ebx
mov ebx, 1
jne 0xd42128
mov ecx, 1
add dl, dl
jne 0xd4210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd42119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd42105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd42075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd4213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd4214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd42136
cmp eax, 0x7d00
jae 0xd4216d
cmp eax, 0x500
jb 0xd42168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd42075
cmp eax, 0x7f
ja 0xd42170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd42075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd4219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd42075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40ad00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421db0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42a520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
lea eax, [ebp - 0x18]
push reloc.kernel32.dll_ReadConsoleW
xor edi, edi
push eax
xor esi, esi
mov dword [ebp - 4], edi
call fcn.004097b0
mov ecx, dword [ebp - 0x18]
add esp, 8
cmp dword [ecx - 0xc], edi
je 0x40add5
cmp edi, 2
jge 0x40add5
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
xor eax, eax
push 2
test edi, edi
push 0
setne al
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40adcc
mov esi, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebp - 0x28], ecx
test ebx, ebx
jne 0x40ad98
lea eax, [ebx + 0xd]
jmp 0x40adb8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x42692c
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test ecx, ecx
je 0x40adcc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
inc edi
jmp 0x40ad51
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x717643ff
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1315138a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x433a01
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x441480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00426e53
and dword [ebp - 0x14], 0
cmp dword [0x444984], 0
mov dword [ebp - 0x18], eax
jne 0x433ab4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x433b5c
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x433b5c
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x444984], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x444988], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44498c], eax
call edi
push eax
call esi
mov dword [0x444994], eax
test eax, eax
je 0x433ab4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x444990], eax
mov eax, dword [0x444990]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x433b0d
cmp dword [0x444994], ecx
je 0x433b0d
push eax
call esi
push dword [0x444994]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x433b0d
test ebx, ebx
je 0x433b0d
call edi
test eax, eax
je 0x433b04
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x433b04
test byte [ebp - 8], 1
jne 0x433b0d
or dword [ebp + 0x10], 0x200000
jmp 0x433b40
mov eax, dword [0x444988]
cmp eax, dword [ebp - 0x18]
je 0x433b40
push eax
call esi
test eax, eax
je 0x433b40
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x433b40
mov eax, dword [0x44498c]
cmp eax, dword [ebp - 0x18]
je 0x433b40
push eax
call esi
test eax, eax
je 0x433b40
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x444984]
call esi
test eax, eax
je 0x433b5c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x433b5e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420bc6
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d7a
nop
sub eax, 0x403d20
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp int.00401219
Function at 0x4c9077
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov ebx, dword [esp + 4]
shr ah, cl
shr cx, cl
mov ecx, dword [esp + 8]
movzx ax, al
mov byte [ebp - 2], dl
sub ax, cx
bsr eax, ebp
btc ax, 0xe
bts ax, dx
cmp ecx, 4
lea eax, [ebx*8 + 0x7c43f7fe]
mov eax, ecx
mov byte [esp + 4], 0xd9
lea esp, [esp + 0xc]
jb 0x4ca947
shr ah, cl
jmp 0x55b21a

Function at 0x402496
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x404080]
or dl, 1
imul edx, eax
mov eax, dword [0x404080]
sub eax, edx
mov ebx, esi
mov edx, eax
mov eax, 0x404084
call fcn.004023df
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x40365c
push eax
sub edi, fcn.00402e06
push edi
push fcn.00402e06
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x402512
mov eax, fcn.00402e06
mov ebx, esi
mov edx, edi
call fcn.004023df
mov edx, 0x1c000
mov eax, 0x404084
mov ebx, esi
call fcn.004019bc
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.00401250
lea edx, [esi + 0x1c000]
add edx, esi
lea eax, [esi - 1]
lea ebx, [ebp - 2]
and eax, 0x404084
call fcn.00402e06
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret