joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b49ac
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b49da
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b49f8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b4912
jmp 0x4b49f8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b49f8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b4912
test edi, edi
mov eax, edi
jne 0x4b49e2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x7c0b5e93
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x109239ae
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401154
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x465008]
jne 0x40115e
repz ret
jmp fcn.00401f74

Function at 0x413649
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409429
and dword [ebp - 4], 0
cmp dword [0x467d7c], 0
mov ebx, eax
jne 0x4136fa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4137ab
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4137ab
push eax
call fcn.004093b7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x467d7c], eax
call esi
push eax
call fcn.004093b7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x467d80], eax
call esi
push eax
call fcn.004093b7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x467d84], eax
call esi
push eax
call fcn.004093b7
pop ecx
mov dword [0x467d8c], eax
test eax, eax
je 0x4136fa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004093b7
pop ecx
mov dword [0x467d88], eax
mov eax, dword [0x467d88]
cmp eax, ebx
je 0x413752
cmp dword [0x467d8c], ebx
je 0x413752
push eax
call fcn.00409432
push dword [0x467d8c]
mov esi, eax
call fcn.00409432
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413752
test edi, edi
je 0x413752
call esi
test eax, eax
je 0x413749
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413749
test byte [ebp - 0xc], 1
jne 0x413752
or dword [ebp + 0x10], 0x200000
jmp 0x41378b
mov eax, dword [0x467d80]
cmp eax, ebx
je 0x41378b
push eax
call fcn.00409432
pop ecx
test eax, eax
je 0x41378b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41378b
mov eax, dword [0x467d84]
cmp eax, ebx
je 0x41378b
push eax
call fcn.00409432
pop ecx
test eax, eax
je 0x41378b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x467d7c]
call fcn.00409432
pop ecx
test eax, eax
je 0x4137ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4137ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4583c0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov dword [esp], 0x20
add dword [esp], 0x20
mov al, 0x65
mov byte [0x467e69], al
mov byte [0x467e6c], al
mov al, 0x6c
push 0x467e68
mov byte [0x467e68], 0x6b
mov byte [0x467e6a], 0x72
mov byte [0x467e6b], 0x6e
mov byte [0x467e6d], al
mov byte [0x467e6e], 0x33
mov byte [0x467e6f], 0x32
mov byte [0x467e70], 0x2e
mov byte [0x467e71], 0x64
mov byte [0x467e72], al
mov byte [0x467e73], al
mov byte [0x467e74], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x469650]
mov edx, dword [0x468368]
lea eax, [esp + 4]
push eax
push 0x40
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
ret
Function at 0x458690
Capabilities:
Clear file content
Compare security identifiers

Disassembly:
sub esp, 0x424
mov eax, dword [0x465008]
xor eax, esp
mov dword [esp + 0x41c], eax
mov eax, dword [0x469650]
push esi
mov esi, dword [0x468368]
push edi
mov edi, eax
cmp eax, 0x5dd
jne 0x4586c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
mov eax, dword [0x465ff0]
push eax
call fcn.00458550
add esp, 4
cmp dword [0x469650], 0x2f
jne 0x458750
xor edx, edx
xor ecx, ecx
mov word [esp + 0x12], dx
xor eax, eax
mov word [esp + 0xe], cx
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x10], ax
mov eax, dword [esp + 0x10]
push eax
mov word [esp + 0x18], cx
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelDeviceWakeupRequest]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call fcn.004585c0
add esp, 4
cmp dword [0x469650], 0x568
jne 0x458772
push str.ximawazudikahefafopoporifozib_kadamuzayecep_hizujajugejusawaharidam_wunoguzazapeguvecazageganuzi
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
call fcn.00401154
add esp, 0x424
ret
Function at 0x40dfae
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
ja 0x43564e
jbe 0x407dd4
mov dh, 0xd8
sbb bh, bh
insb byte es:[edi], dx
and cl, byte [edi]
xchg byte [eax + ebx*8 + 2], dh
add byte [edx + 0x5448b29], al
add byte [ebx - 0x7499f7a2], cl
add byte [ebp + 0x11660c76], cl
inc esp
sbb eax, 0xad26ff00
dec esp
mov bx, bx
mov eax, dword [esi + 4]
mov ebp, ebp
mov eax, dword [ebp + eax]
shr bx, 0x40
jbe 0x43564e
sub byte [ecx], 0x8b
inc esp
add eax, 0x85e8b00
mov ax, word [eax]
lea esi, [esi + 0xc]
adc word [ebp + ebx], ax
jmp dword [esi]
lea esp, [esp + 4]
mov byte [esi + 0xba], bl
shr cl, 0x40
mov byte [esi + 0xbb], dl
xchg ebp, edx
shr ebx, 0x40
xchg edx, ebp
mov word [esi + 0xbc], di
mov cx, cx
call fcn.00428cef
mov cl, byte [ebp + 0xc]
mov di, di
shl ch, 0x20
xchg bl, ch
mov bx, bx
xchg ch, bl
mov dx, word [ebp + 0x10]
jne 0x42f235
je 0x40dff6
mov cl, 0xe8
jg 0x40e006
je 0x42f235
test byte [ecx], bh
adc al, byte [edx]
add byte [esp + esi*8], dh
xor al, 0xf4
mov al, byte [0x4326]
inc eax
add byte [eax], al
sub byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [ecx], al
popal
add byte [eax + 0x2c], al
add byte [ecx], ah
add byte [eax], al
push cs
add byte [eax], al
add dh, al
popal
inc edx
add byte [edx + 0x3c00425c], ch
add byte [eax], al
add byte [edx], ah
das
inc ecx
add byte [esi], al
lahf
inc ebx
add al, bl
pop edi
call fcn.0041f808
lea edx, [edx]
mov ah, ah
mov al, byte [ebp + 0xb]
mov dh, dh
jmp 0x41c0dc
push esi
mov byte [esi + 0xba], bl
mov bp, bp
jmp 0x407dc6
xchg dh, ch
mov edi, edi
shl ebp, 0x20
push esi
mov eax, eax
mov byte [esi + 0xba], cl
shr ch, 0x40
mov bx, bx
mov byte [esi + 0xbb], 0
xchg dl, ch
xchg ch, dl
mov word [esi + 0xbc], dx
jne 0x41c0cd
xchg cx, bx
xchg bx, cx
je 0x4298d5
and al, 0xa8
push 0x27f2840f
invalid
je 0x41c0cd
invalid
fidivr dword [ecx - 0x7f]
les ecx, [eax]
add byte [eax], al
add byte [edi + 0x5e], bl
pop ebx
xchg esi, ebp
xchg ebp, esi
mov esp, ebp
pop ebp
ret
push eax
mov eax, eax
jne 0x440058
je 0x42f243
aam 0x27
je 0x440058
test byte [edi], cl
push cs
add dword [eax], eax
xor al, 0xfe
shl edx, 0x20
je 0x42f267
jbe 0x42f244
mov dl, 0xf
test al, ah
jo 0x42f26b
je 0x42634d
invalid
inc dword [edx + 0x7d81662d]
cld
add dword [ecx], esi
call fcn.004213ef
fidivr dword [0x66084d8b]
xchg edi, eax
xchg di, ax
inc edi
mov al, byte [edi + ecx]
test al, al
jb 0x42b487
sub byte [0xfc7d8166], 1
xor eax, ebp
jne 0x42f299
invalid
jne 0x4216dd
push eax
pop eax
mov cx, cx
leave
je 0x42f2a1
inc edi
adc ch, dh
cmp al, 0x74
shr di, 0x40
mov byte [esi + 0xbb], al
shl di, 0x20
mov di, di
mov word [esi + 0xbc], di
call fcn.0044253b
shr bx, 0x40
shl ch, 0x20
mov cl, byte [ebp + 0xc]
xchg al, dl
xchg dl, al
push 0x438407
ret
jmp 0x42989f

Function at 0x40ebc5
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
ja 0x4297c4
jbe 0x40ebd3
mov dl, 0x35
mov ch, 0x29
ret
jbe 0x4297c4
fsub dword [ebp - 0x7b274af]
jmp 0x4297c5
push ebp
Function at 0x40f656
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
or dword [ebx + 0x26ff0476], 0x850f9856
xchg ebx, eax
or al, byte [ebx]
add byte [ebx + eax - 0x72], dh
cmpsd dword [esi], dword es:[edi]
mov cl, byte [edi]
test byte [eax - 0x7dfffcf6], cl
cli
add esi, 0
jno 0x40de01
xchg ebp, esi
pop esp
xchg ebx, eax
pop ds
dec eax
jno 0x443442
fiadd dword [ecx]
lea esp, [esp + 4]
add dx, 0
cmp al, 2
jne 0x40ddf6
xchg ebp, edx
shr ecx, 0x40
xchg edx, ebp
je 0x40f675
ret 0xdf65
shl bh, 0x20
mov ebp, ebp
mov ax, dx
clc
add edx, 0
add ecx, 0x47
shr ax, 0xe
shr ah, 0x40
xchg edx, ebx
xchg ebx, edx
shl edx, 2
or eax, edx
jb 0x436a53
stc
jb 0x40f6a8
popal
int3
jb 0x438596
sub byte [edx - 0x73], 0x64
and al, 4
mov dword [ebp - 4], eax
jge 0x439646
shl dx, 0x20
jl 0x40f6c9
cmp esp, dword [eax + ecx*4 - 0x16e91b72]
inc ebp
jg 0x40f6ce
jmp fcn.00427613
add byte [esi], ch
aaa
aaa
call fcn.00439627
invalid
push ds
call 0x1030f3bf
lea ecx, [0x7c000000]
add al, 0xa0
add byte [ecx + 0x68], dl
lea esi, [esi + 8]
jmp dword [esi]
push 0x4232ec
ret
test al, al
jb 0x4097d6
jne 0x437918
je 0x443454
jae 0x443462
add edi, 0
and ecx, 0xffff
jb 0x4097de
js 0x4434c7
cld
jmp dword [esi - 0x77]
mov si, si
xchg edi, ebp
xchg ebp, edi
mov eax, ecx
push 0x43790f
ret
pop esi
or byte [esi - 0x77], ah
leave
mov al, byte [ebp + eax]
mov di, di
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
adc byte [ebx], al
jmp dword [esi]

Function at 0x410f37
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
cmp ecx, eax
mov byte [ebp - 8], 0
mov dword [ebp + 0xc], eax
ja 0x436401
shl ah, 0x20
mov esp, ebp
call 0x40e104
invalid
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
je 0x40ec66
jne 0x436414
in eax, dx
push 0xffffffffffffffbe
sub dword [edi], esp
lea ecx, [ebp - 4]
shr ax, 0x40
jmp 0x43641c
push ecx
jno 0x42a789
jo 0x43642c
pushfd
out 0xbe, eax
xor dword [ebx], 0xffffffb5
jo 0x42a789
fidiv dword [ebx + 0x6c087f81]
push 0x840f6873
sar dword [ebp + edi*8 - 1], 1
jne 0x436447
or al, 0xf6
popfd
in al, dx
mov dword [edi + 0x30], 0xfffffff7
mov dh, dh
pop edi
mov cl, cl
pop esi
pop ebx
ja 0x42b476
jbe 0x436460
pop eax
fnstenv [ebp + 0xf]
xchg byte [eax], dl
push eax
invalid
jbe 0x42b476
xor al, 0x52
sub ch, byte [ecx]
inc esp
add byte [ebx], al
add byte [eax], al
and al, 0
add byte [eax], al
mov bl, 0x52
inc ebx
add byte [eax], ah
add byte [eax], al
add byte [eax + eax], ah
add byte [eax], al
stosb byte es:[edi], al
pop esp
inc edx
add byte [eax], bh
add byte [eax], al
add byte [ebp + 0x490043c1], dl
lea esp, [esi - 0x77]
mov cx, cx

Function at 0x412a1f
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
push edi
shl bx, 0x20
mov eax, dword [esi]
push eax
call fcn.00429dde
jno 0x431a60
jo 0x412a3e
nop
cpuid
ret
jo 0x431a60
xor byte [esi - 0x73], 0x76
or dh, dh
sub al, 0x3b
mov dword [ebp + 0x24], eax
jmp dword [esi]
Function at 0x418ffa
Capabilities:
Check os version
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
mov esp, ebp
pop ebp
shl ecx, 0x20
ret
push 0x47599d
mov dword [0x4759a9], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jb 0x42d510
mov dword [0x4757e8], eax
je 0x40fc7a
jne 0x40fc70
out 0xba, al
scasd eax, dword es:[edi]
nop
insd dword es:[edi], dx
sbb byte [eax + 0x475790], bh
mov eax, 0x475790
mov dword [0x4757e8], eax
ret
pop dword [esp - 4]
call fcn.00440684
xchg bh, cl
xchg cl, bh
mov cl, byte [ebp + 0xc]
xchg ch, bl
xchg bl, ch
xchg dh, bl
xchg bl, al
push eax
mov ax, dx
nop
pop eax
xchg di, ax
xchg di, ax
mov cx, cx
xchg al, bl
xchg bl, dh
mov dx, word [ebp + 0x10]
call fcn.00441b09
js 0x4341f3
jns 0x419037
xlatb
sub dword [edi], ecx
mov dword [esi + 0x340001b1], esi
sbb al, 0x50
jns 0x4341f3
xor al, 0x1c
push eax
xchg ebp, esi
xchg esi, ebp
call fcn.0042556a
mov ebx, eax
add esp, 0x30
test bx, bx
jb 0x41c7c9
mov dl, dl
je 0x404e54
jne 0x419066
leave
mov eax, 0xe8f7ffeb
mov eax, 0x89000121
in eax, dx
jmp 0x419067
push edi
call fcn.0042b226
mov ebp, ebp
mov ecx, dword [esi]
push ebx
push ecx
call fcn.00443cfe
add esp, 0xc
pop edi
lea ebx, [ebx]
mov si, si
pop esi
lea edx, [edx]
pop ebx
ja 0x404e4b
jbe 0x419094
invalid
jbe 0x404e4b
add eax, 0x425caa6b
add byte [eax], bh
add byte [eax], al
add byte [ebp + 0x7a0043c1], dl
xchg edx, eax
popal
sbb byte [ebx], al
sub dword [eax], eax
add byte [eax], al
sub dword [eax], eax
add byte [eax], al
sub ch, byte [ecx]
inc esp
add byte [ecx + 0x24000000], dh
add byte [eax], al
add byte [ecx + 0x18], ah
inc ebx
add byte [eax], ch
add byte [eax], al
add byte [eax], ch
add byte [eax], al
add byte [edx + 0x3800425c], ch
add byte [eax], al
add byte [edi + 0x40004228], ch
add byte [eax], al
add byte [0x95000000], ah
rol dword [ebx], 0x9e
mov byte [ebp - 0x5bdb9c], cl
lea esp, [esp - 0x5c]
push ebp
mov dl, dl
push 0x58
push 0x475790
mov cl, cl
jne 0x40fc40
je 0x419b4e
cdq
adc al, byte [edi - 0x7bf080b5]
in al, dx
pushal
invalid
je 0x40fc40
add eax, 0xffff25f7
add byte [eax], al
jb 0x433584
mov dword [esi + 0x28], eax
jmp fcn.0042e3be
fld dword [ebx]
mov eax, eax
mov esp, ebp
pop ebp
ret
cmp al, 1
xchg ebp, edx
xchg edx, ebp
call fcn.00423745
cmp cl, 0xa1
call 0xc343895d
int 0x11
jmp 0x419b36
Function at 0x41bacc
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
xor eax, 0xe8ed89c0
inc byte [esi]
add eax, dword [eax]
test eax, eax
jb 0x40b389
je 0x406fb6
jne 0x406f48
nop
cpuid
ret
push str.ProcessIdToSessionId
mov di, di
push ebx
call esi
shl ax, 0x20
mov edi, eax
test edi, edi
jb 0x40b391
je 0x43eee9
jne 0x406f6b
jae 0x406fa9
push 0x47577c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ch, ch
jmp 0x406f79
push eax
push edi
pop edi
call edi
test eax, eax
jb 0x432701
shl esi, 0x20
je 0x43eee9
jne 0x406f95
add eax, 0xd3db6e6c
fadd dword [ecx - 0x3dbbb71]
invalid
jne 0x43a08a
shr edx, 0x40
je 0x41bada
jle 0x41ba7c
or byte [edi], cl
test byte [edx - 0x38fffe1b], ch
cmpsd dword [esi], dword es:[edi]
rcl dword [edx + 0x43], cl
add byte [0x28000000], cl
add byte [eax], al
add dl, ah
fadd qword [edx]
invalid
je 0x43a08a
invalid
adc al, al
mov al, al
stc
jb 0x43270c
test bl, bh
pop edi
ljmp 0xfffe
jb 0x412a90
or byte [eax - 0x40], 0xe9
inc eax
jmp dword [esi]
push ebp
mov ebp, esp
mov edi, edi
push ecx
shr si, 0x40
push esi
mov esi, dword [ebp + 0xc]
and esi, 0xffff
jb 0x406f2b
push edi
mov dword [ebp - 4], 0
mov ax, word [esi*4 + 0x475718]
test ax, ax
jb 0x406f69
js 0x41cf00
jns 0x43a0ca
fisubr word [edi - 0x3a]
xchg edi, eax
je 0x43a0da
jns 0x41cf00
mov dword [eax], esi
invalid
fcom dword [edi - 0x45563a09]
pop ecx
xlatb
test al, 1
jb 0x427d70
je 0x43a0ee
jne 0x43a0ea
insd dword es:[edi], dx
rol dword [eax + 0x66], 1
mov edx, edx
inc eax
mov dx, dx
lea edx, [eax + esi + 0x10]
mov dword [ebp + 0x1c], edx
shl al, 0x20
push 0x4319e1
ret
Function at 0x41f705
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp + ebx], eax
jmp dword [esi]
mov edx, dword [esi + 4]
mov ebx, dword [esi + 8]
mov eax, dword [eax + edx]
lea esi, [esi + 0xc]
sub esi, 0
jae 0x416479
div dword [ebp + ecx*2 - 0x7cf083be]
mov byte [edi + 0xb82ffff], dh
jae 0x411c07
pop dword [esp - 4]
mov ecx, dword [esi]
push 0
push ecx
ja 0x42e4e8
jbe 0x41f718
invalid
jbe 0x42e4e8
fidivr dword [esi + 0x66]
sbb dword [ebx], eax
xchg dl, al
xchg al, dl
mov di, word [edi + 8]
inc eax
mov eax, dword [ebp + 0x38]
jno 0x416463
xchg cx, dx
xchg dx, cx
jo 0x42e4cf
jo 0x416463
sbb byte [edx], 0x56
shl si, 0x20
call fcn.00417df0
ja 0x424058
jbe 0x42e4fe
jae 0x42e4bb
cmpsb byte [esi], byte es:[edi]
and dh, ah
jbe 0x424058
add eax, 0x20e4c074
Function at 0x422ede
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
cmpsb byte [esi], byte es:[edi]
sbb al, al
out 0x20, eax
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
js 0x422ed7
jns 0x40ca86
push 0x890f2436
dec ebx
add dword fs:[eax], eax
jns 0x422ed7
fisubr dword [ebx - 0x17fb8975]
xchg cl, dh
add byte [eax], al
add eax, 0xd289661d
sub cl, 0x34
mov dh, 0x71
call fcn.0042db68
fst dword [ebp + ecx*4 + 0x64]
and al, 4
push eax
call fcn.0040ebc5
mov edi, eax
add esp, 0xc
stc
test edi, edi
jb 0x43fbda
je 0x42e635
jne 0x422f05
mov ah, 0xd6
mov dl, 0x8d
sbb ecx, dword [ebx - 0x7272f7ab]
invalid
lea ebx, [ebx]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x210]
push esi
mov ebp, ebp
jmp 0x422f15
push ecx
jmp 0x422f18
push edi
push edx
call int.00431eaa
mov esi, eax
add esp, 0x10
test esi, esi
jb 0x43fbe1
je 0x43fc01
jne 0x422f3d
nop
cpuid
ret 0xf6ff
push esi
call fcn.0041fde7
inc eax
push eax
lea ecx, [ecx]
push esi
mov esi, dword [ebp + 0xc]
jne 0x427c1c
je 0x422f5a
sbb cl, byte [eax - 0x7bf0b0ff]
mov esp, 0x8200004c
add al, 0x66
mov esi, esi
je 0x427c1c
add byte [esi], 0x89
test byte [ecx + 0x75893465], 0x3c
xchg bl, dl
xchg dl, bl
push ebp
mov ebp, esp
shr bh, 0x40
push esi
mov cx, cx
mov esi, dword [ebp + 8]
jmp 0x425b7e
push edi
mov ecx, 0xfe
mov ax, word [esi + 0xbc]
mov dx, word [ecx + esi]
mov edi, edx
cmc
xor edi, ecx
jb 0x4319ac
sub eax, edi
jmp 0x44216b
shl edi, 0xf
shr ax, 1
or eax, edi
jb 0x40ca70
add edx, eax
mov word [ecx + esi], dx
dec ecx
cmp ecx, 0xbd
jg 0x425b8c
mov ah, ah
jle 0x42a406
nop
cpuid
ret 0x9166
xchg cx, ax
xchg cx, ax
mov ecx, 0xb8
mov dx, word [ecx + esi]
call fcn.00409597
add eax, 0xec758b26
xchg bp, ax
xchg bp, ax
lea edx, [eax + ecx]
cmp edx, esi
jbe 0x42a452
ja 0x42a432
mov edx, 0x5335bb1c
push ebx
call fcn.0042b226
add esp, 4
mov ax, 0xa
pop edi
pop esi
pop ebx
mov esp, ebp
xchg ebx, edi
xchg edi, ebx
pop ebp
ret
push eax
mov si, si
lea eax, [ebx + ecx]
call fcn.0042665f
cmp byte [eax + eax*4 - 0x3e99fd05], 0xe2
and byte [edi], cl
test dword [edx - 0x3fffff8f], esp
out dx, al
inc eax
shl ebx, 0x20
mov ax, ax
je 0x42a47c
nop
cpuid
ret 0xff89
mov edi, edi
mov cl, byte [esi + 0xbc]
add bp, 0
xor eax, eax
jb 0x41aa16
js 0x415b4b
jns 0x42a49e
sahf
lodsd eax, dword [esi]
cmp eax, 0x890f6c1e
cmpsd dword [esi], dword es:[edi]
mov dh, 0xfe
push dword [ebx + ecx*8]
jns 0x415b4b
xor al, 0xcb
pop ds
inc ecx
jmp loc.00432f3c
add eax, 0x45e8bbe
mov ax, ax
jne 0x42766e
je 0x43fbf6
cld
int 0xc1
je 0x42766e
mov edi, eax
js 0x42a3dd
mov edx, edx
jns 0x442179
push cs
add eax, 0x825e890f
invalid
jns 0x42a3dd
xor al, 0xb2
Function at 0x423745
Capabilities:
Check os version

Disassembly:
cmp al, 2
js 0x43fa08
mov bp, bp
mov word [esi + 0xbc], cx
jmp 0x438e1a
sub edi, 0
shl dh, 0x20
jno 0x41996b
dec edx
sbb al, 0x20
inc eax
pop ds
fisttp dword [edi]
cmp dword [edx + 0x76], 0x1a05ffff
jno 0x410feb
add eax, 0xbb86881a
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
pop dword [esp - 4]
mov byte [esi + 0xba], al
shr bh, 0x40
mov byte [esi + 0xbb], 0
jmp 0x416e29
jne 0x41995d
mov edi, edi
mov al, al
je 0x438e2c
xor eax, eax
jb 0x43a2a6
push 0x420a2d
ret
Function at 0x43157a
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
or byte [edi + 0x41d0d8], 1
lodsb al, byte [esi]
inc ebx
add byte [0x86004459], ch
adc eax, 0x48e50042
fsubr qword [esi - 0x18]
sub eax, 0x1004459
lodsb al, byte [esi]
inc ebx
add byte [ecx + edi*2], dh
adc al, 0xc9
shl bl, 0x20
mov eax, dword [esi + 4]
xchg ah, dl
xchg dl, ah
mov ebx, dword [esi + 8]
movzx eax, word [ebp + eax]
lea esi, [esi + 0xc]
mov dword [ebp + ebx], eax
jmp dword [esi]
mov cx, cx
call fcn.004548c0
test eax, eax
jb 0x42156f
jne 0x43d7d1
je 0x431596
mov ds, word [ebp + esi*4 + 0x1c]
jmp 0x43ee67
jne 0x43d7d1
call 0x43d7e1
neg eax
sbb eax, eax
inc eax
shl dl, 0x20
ret
call 0x454930
test eax, eax
jb 0x42b79b
mov ch, ch
ja 0x43d7b8
jbe 0x43ee82
imul ecx, dword [edi], 0x860fc3a2
xor cl, ch
invalid
jbe 0x43d7b8
fdivr dword [esi - 0x75]
je 0x43eec2
add byte [esi - 0x79], ah
aad 0x66
xchg edx, ebp
mov edx, edx
mov esi, dword [esi]
jmp dword [esi]
inc eax
jmp dword [esi]