joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x40
push 0x1000
mov eax, dword [ebp + 0xc]
add eax, 5
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.10026db0
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov byte [ecx + eax], 0xe9
mov edx, dword [ebp + 8]
add edx, dword [ebp + 0xc]
sub edx, dword [ebp - 4]
sub edx, 5
mov eax, dword [ebp - 4]
mov dword [eax + 1], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x10023130
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1005606c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0xc], 0xe9
mov byte [ebp - 0xb], 0x90
mov byte [ebp - 0xa], 0x90
mov byte [ebp - 9], 0x90
mov byte [ebp - 8], 0x90
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0x10], eax
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 0x10]
mov dword [ebp + ecx - 0xc], edx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov cl, byte [ebp - 8]
mov byte [edx + 4], cl
push 0
mov edx, dword [ebp - 0x14]
push edx
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10024f16
mov esp, ebp
pop ebp
ret

Function at 0x100231b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1005606c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0xc], 0xe8
mov byte [ebp - 0xb], 0x90
mov byte [ebp - 0xa], 0x90
mov byte [ebp - 9], 0x90
mov byte [ebp - 8], 0x90
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0x10], eax
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 0x10]
mov dword [ebp + ecx - 0xc], edx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov cl, byte [ebp - 8]
mov byte [edx + 4], cl
push 0
mov edx, dword [ebp - 0x14]
push edx
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10024f16
mov esp, ebp
pop ebp
ret
Function at 0x100232b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x100232ce
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x10]
jge 0x10023307
mov eax, dword [ebp - 4]
and eax, 0xff
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx]
xor eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
shr eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
xor edx, dword [ecx*4 + 0x10051cf8]
mov dword [ebp - 4], edx
jmp 0x100232c5
mov eax, dword [ebp - 4]
xor eax, 0xffffffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x10023320
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0x10]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov word [ebp - 4], cx
mov edx, dword [ebp - 0x10]
mov ax, word [edx + 6]
mov word [ebp - 8], ax
jmp 0x10023371
mov cx, word [ebp - 4]
add cx, 1
mov word [ebp - 4], cx
mov edx, dword [ebp - 0xc]
add edx, 0x28
mov dword [ebp - 0xc], edx
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
cmp eax, ecx
jge 0x100233b8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
cmp eax, dword [ebp + 0xc]
ja 0x100233b6
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
add edx, dword [eax + 8]
cmp edx, dword [ebp + 0xc]
jbe 0x100233b6
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
sub edx, dword [ecx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x14]
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 0xc]
jmp 0x100233bb
jmp 0x1002335c
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x100233c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
jmp fcn.10447488

Function at 0x100385fb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003829d
Function at 0x403570
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x4c822c]
mov ecx, dword [0x4c5138]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403663
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4c822c], 0x959
jne 0x403649
push 0
push 0
call esi
push 0
lea eax, [esp + 0x43c]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
push 0
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
push 0
push 0x402bf8
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.004033b0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x4035b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret
Function at 0x403f70
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x459c68
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
xor ebx, ebx
cmp dword [0x4c822c], 0x84
jne 0x403ffc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
push ebx
mov dword [esp + 0x2c], ebx
call fcn.00405699
push ebx
push ebx
call fcn.00405727
add esp, 0xc
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x1c], 0x10
jb 0x403fec
mov eax, dword [esp + 8]
push eax
call fcn.0040590e
add esp, 4
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
cmp byte [0x45e0e0], bl
jle 0x40400c
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [0x45d284]
mov edx, dword [0x45d258]
mov dword [0x4c822c], ecx
mov dword [0x4c8bcc], edx
call fcn.004036b0
mov ecx, dword [esp + 0x20]
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0x10

Function at 0x406eec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45b238]
jne 0x406ef6
repz ret
jmp fcn.0040b125
Function at 0x40bc1f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409756
and dword [ebp - 4], 0
cmp dword [0x45dfd0], 0
mov ebx, eax
jne 0x40bcd0
push 0x40241c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bd81
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402410
push edi
call esi
test eax, eax
je 0x40bd81
push eax
call fcn.004096e4
mov dword [esp], 0x402400
push edi
mov dword [0x45dfd0], eax
call esi
push eax
call fcn.004096e4
mov dword [esp], 0x4023ec
push edi
mov dword [0x45dfd4], eax
call esi
push eax
call fcn.004096e4
mov dword [esp], 0x4023d0
push edi
mov dword [0x45dfd8], eax
call esi
push eax
call fcn.004096e4
pop ecx
mov dword [0x45dfe0], eax
test eax, eax
je 0x40bcd0
push 0x4023b8
push edi
call esi
push eax
call fcn.004096e4
pop ecx
mov dword [0x45dfdc], eax
mov eax, dword [0x45dfdc]
cmp eax, ebx
je 0x40bd28
cmp dword [0x45dfe0], ebx
je 0x40bd28
push eax
call fcn.0040975f
push dword [0x45dfe0]
mov esi, eax
call fcn.0040975f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bd28
test edi, edi
je 0x40bd28
call esi
test eax, eax
je 0x40bd1f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bd1f
test byte [ebp - 0xc], 1
jne 0x40bd28
or dword [ebp + 0x10], 0x200000
jmp 0x40bd61
mov eax, dword [0x45dfd4]
cmp eax, ebx
je 0x40bd61
push eax
call fcn.0040975f
pop ecx
test eax, eax
je 0x40bd61
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bd61
mov eax, dword [0x45dfd8]
cmp eax, ebx
je 0x40bd61
push eax
call fcn.0040975f
pop ecx
test eax, eax
je 0x40bd61
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45dfd0]
call fcn.0040975f
pop ecx
test eax, eax
je 0x40bd81
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bd83
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10162598
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101cb5e0]
jne 0x101625a2
repz ret
jmp fcn.10162fb8

Function at 0x10166f7f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10162a4c
and dword [ebp - 4], 0
cmp dword [0x101cd12c], 0
mov ebx, eax
jne 0x10167030
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x101670e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x101670e1
push eax
call fcn.101629da
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101cd12c], eax
call esi
push eax
call fcn.101629da
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101cd130], eax
call esi
push eax
call fcn.101629da
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101cd134], eax
call esi
push eax
call fcn.101629da
pop ecx
mov dword [0x101cd13c], eax
test eax, eax
je 0x10167030
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.101629da
pop ecx
mov dword [0x101cd138], eax
mov eax, dword [0x101cd138]
cmp eax, ebx
je 0x10167088
cmp dword [0x101cd13c], ebx
je 0x10167088
push eax
call fcn.10162a55
push dword [0x101cd13c]
mov esi, eax
call fcn.10162a55
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10167088
test edi, edi
je 0x10167088
call esi
test eax, eax
je 0x1016707f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1016707f
test byte [ebp - 0xc], 1
jne 0x10167088
or dword [ebp + 0x10], 0x200000
jmp 0x101670c1
mov eax, dword [0x101cd130]
cmp eax, ebx
je 0x101670c1
push eax
call fcn.10162a55
pop ecx
test eax, eax
je 0x101670c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x101670c1
mov eax, dword [0x101cd134]
cmp eax, ebx
je 0x101670c1
push eax
call fcn.10162a55
pop ecx
test eax, eax
je 0x101670c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101cd12c]
call fcn.10162a55
pop ecx
test eax, eax
je 0x101670e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101670e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10168110
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101cb308]
sub eax, 0x151e
mov dword [0x101cb30c], eax
mov dword [ebp - 8], 0
mov eax, dword [0x101cb308]
sub eax, 0x1836
mov dword [0x101cb308], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [0x101cb308], 0x256b
mov dword [ebp - 0x10], 0
jmp 0x1016816b
jmp 0x1016829f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x104
jge 0x1016819d
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x1016818e
jmp 0x1016819d
jmp 0x10168190
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x1016816b
mov eax, dword [0x101cb308]
sub eax, 0x1d85
mov dword [0x101cb308], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x101682a7
mov dword [0x101cb308], 0xe40
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
jne 0x101682a5
mov eax, dword [0x101cb308]
add eax, 0x15ef
mov dword [0x101cb30c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax - 0x16]
cmp ecx, 0x61
jne 0x101682a3
mov eax, dword [0x101cb308]
sub eax, 0x74a
mov dword [0x101cb308], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx + eax*2 - 0x14]
cmp eax, 0x64
jne 0x101682a1
mov dword [0x101cb308], 0xf06
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x1016829f
mov dword [0x101cb308], 0x2a3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x10168166
mov dword [0x101cb308], 0x1286
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x1016829a
mov dword [ebp - 4], 1
jmp 0x101682bd
jmp 0x10168166
jmp 0x101682a1
jmp 0x101682a3
jmp 0x101682a5
jmp 0x101682a7
mov eax, dword [0x101cb30c]
add eax, 0xa08
mov dword [0x101cb308], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x1c
pop ebp
ret
Function at 0x101684b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.101684b0]
mov dword [0x101cb30c], 0x24b3
mov dword [ebp - 4], eax
mov dword [0x101cb308], 0xbe4
jmp 0x101684f3
mov eax, dword [ebp - 4]
add eax, 0x3c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
cmp dword [edx + ecx], 0x4550
je 0x10168509
jmp 0x10168511
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x101684d5
jmp 0x10168513
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x1016854b
jmp 0x10168513
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov dword [0x101cb308], 0xd54
mov al, 1
test al, 1
jne 0x101684f3
jmp 0x10168535
mov eax, dword [0x101cb308]
sub eax, 0x72
mov dword [0x101cb30c], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add esp, 0x10
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x11f73043
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x55597b35
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x46c400
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [esp + 0xec]
mov edx, dword [esp + 0xfc]
push 1
push eax
mov eax, dword [edx + 0x34]
lea ecx, [esp + 0x18]
push edi
push ecx
call fcn.00469c20
add esp, 0x10
cmp dword [edi], 0
mov esi, eax
jne 0x46d4b6
mov ecx, esi
neg ecx
cmp ecx, 5
jne 0x46c4bf
lea esi, [ecx + 3]
mov edi, dword [esp + 0x10]
cmp ecx, 0x1a
jne 0x46c4e3
mov edi, dword [esp + 0x10]
cmp byte [edi + 1], 0x5c
jne 0x46c4d9
cmp byte [edi + 2], 0x45
jne 0x46c4d9
add edi, 2
jmp 0x46c532
mov dword [esp + 0x50], 1
jmp 0x46c532
cmp ecx, 0x19
je 0x46c52e
test esi, esi
jns 0x46c43d
mov eax, dword [esp + 0xfc]
mov eax, dword [eax + 8]
mov edx, 2
add dword [esp + 0x18], edx
add ecx, 0xfffffffa
cmp ecx, 0xf
ja case.0x46c50f.12
jmp dword [ecx*4 + 0x46ed0c]
xor esi, esi
jmp 0x46c520
mov cl, byte [eax + esi + 0x40]
or byte [esp + esi + 0x70], cl
inc esi
cmp esi, 0x20
jl 0x46c520
mov edi, dword [esp + 0x10]
mov dword [esp + 0x20], 1
xor esi, esi
mov dl, byte [eax + esi + 0x40]
not dl
or byte [esp + esi + 0x70], dl
inc esi
cmp esi, 0x20
jl 0x46c5a4
jmp 0x46c52e
xor esi, esi
jmp 0x46c5c0
mov cl, byte [eax + esi + 0xa0]
or byte [esp + esi + 0x70], cl
inc esi
cmp esi, 0x20
jl 0x46c5c0
jmp 0x46c52e
mov dword [esp + 0x20], 1
xor esi, esi
mov dl, byte [eax + esi + 0xa0]
not dl
or byte [esp + esi + 0x70], dl
inc esi
cmp esi, 0x20
jl 0x46c5e0
jmp 0x46c52e
mov edi, eax
lea eax, [esp + 0x70]
xor esi, esi
sub edi, eax
lea ecx, [esp + esi + 0x70]
mov dl, byte [edi + ecx]
or byte [ecx], dl
inc esi
cmp esi, 0x20
jl 0x46c602
and byte [esp + 0x71], 0xf7
jmp 0x46c52e
mov edi, eax
lea eax, [esp + 0x70]
xor esi, esi
mov dword [esp + 0x20], 1
sub edi, eax
lea ecx, [ecx]
lea ecx, [esp + esi + 0x70]
mov dl, byte [edi + ecx]
not dl
or byte [ecx], dl
inc esi
cmp esi, 0x20
jl 0x46c630
or byte [esp + 0x71], 8
jmp 0x46c52e
or byte [esp + 0x71], dl
or byte [esp + 0x74], 1
or byte [esp + 0x84], 1
add byte [eax], al
add byte [ecx], al
jmp 0x46c52e
xor eax, eax
mov ecx, eax
dec ecx
mov edx, 0xff
je 0x46c67e
sub ecx, 3
je 0x46c677
sub ecx, 0x10
jne 0x46c683
mov edx, 0xfe
jmp 0x46c683
mov edx, 0xfd
or byte [esp + eax + 0x70], dl
inc eax
cmp eax, 0x20
jl 0x46c663
jmp 0x46c52e
or byte [esp + 0x71], 0x3c
or byte [esp + 0x80], 0x20
jmp 0x46c52e
xor eax, eax
mov ecx, eax
dec ecx
mov edx, 0xff
je 0x46c6bc
sub ecx, 0xf
jne 0x46c6c1
mov edx, 0xdf
jmp 0x46c6c1
mov edx, 0xc3
or byte [esp + eax + 0x70], dl
inc eax
cmp eax, 0x20
jl 0x46c6a6
jmp 0x46c52e
test byte [esp + 0x2c], 0x40
jne 0x46e879
mov edi, dword [esp + 0x10]
sub dword [esp + 0x18], edx
movzx esi, byte [edi]
jmp 0x46c441

Function at 0x46d02c
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov dh, 0x4d
add dword [edi], ecx
mov dh, 0x55
add cl, byte [ecx - 0x76e3dbb4]
push esp
and al, 0x24
Function at 0x4759ff
Capabilities:
Read file on windows

Disassembly:
clc
pop ecx
inc edi
add byte [ebx - 0x3dfbdbbc], cl
add al, 0
push ebp
mov ebp, esp
sub esp, 0x540
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x540]
call fcn.0047608e
lea eax, [ebp - 0x13c]
push 0x104
push eax
push 0
call dword [0x48d290]
lea eax, [ebp - 0x13c]
push 0x49c010
push eax
call fcn.0047a3c6
pop ecx
mov dword [esi], eax
test eax, eax
pop ecx
jne 0x475a4d
push 1
pop eax
jmp 0x475bdd
xor eax, eax
mov cl, byte [eax + 0x49c008]
mov byte [ebp + eax - 0x24], cl
mov cl, byte [eax + 0x49c000]
mov byte [ebp + eax - 0x1c], cl
inc eax
cmp eax, 8
jl 0x475a4f
mov edi, dword [ebp + 0xc]
push edi
call fcn.0047b350
and dword [esi + 0x110], 0
pop ecx
lea ecx, [esi + 0x110]
xor edx, edx
test eax, eax
jle 0x475a91
movsx ebx, byte [edx + edi]
add dword [ecx], ebx
inc edx
cmp edx, eax
jl 0x475a86
push 2
push 0xfffffffffffffff8
push dword [esi]
call fcn.0047b2c8
push dword [esi]
lea edi, [esi + 4]
push 1
pop ebx
push ebx
push 4
push edi
call fcn.0047b221
push dword [esi]
call fcn.0047af72
push dword [esi]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push ebx
push 4
push eax
call fcn.0047b221
push 0
push 0
push dword [esi]
call fcn.0047b2c8
and dword [ebp + 0xc], 0
add esp, 0x3c
cmp dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
jle 0x475b10
mov ecx, dword [esi]
test byte [ecx + 0xc], 0x10
jne 0x475b10
push ecx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0047b221
add esp, 0x10
lea ecx, [ebp - 0x540]
push dword [ebp - 0x14]
call fcn.004760cd
inc dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 8]
jl 0x475ae0
xor eax, 0xaaaaaaaa
cmp dword [ebp - 0x10], eax
jne 0x475b51
push 0
push dword [edi]
push dword [esi]
call fcn.0047b2c8
push dword [esi]
lea eax, [ebp - 0x34]
push ebx
push 0x10
push eax
call fcn.0047b221
add esp, 0x1c
test eax, eax
je 0x475b51
xor eax, eax
mov cl, byte [ebp + eax - 0x34]
cmp cl, byte [ebp + eax - 0x24]
jne 0x475b4c
inc eax
cmp eax, 0x10
jl 0x475b3c
cmp eax, 0x10
je 0x475b55
push 3
jmp 0x475b6d
push dword [esi]
lea eax, [ebp - 1]
push ebx
push ebx
push eax
call fcn.0047b221
add esp, 0x10
cmp byte [ebp - 1], 3
je 0x475b7a
push 4
pop edi
push dword [esi]
call fcn.0047a61b
pop ecx
mov eax, edi
jmp 0x475bdd
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047b221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xfac1
lea ebx, [esi + 0xc]
push edi
push 1
push ebx
call fcn.0047b221
add esp, 0x20
lea eax, [edi + 0xc3d2]
mov ecx, esi
push eax
push edi
push ebx
call fcn.00475bf2
and byte [edi + esi + 0xc], 0
lea eax, [esi + 0x110]
xor ecx, ecx
cmp edi, ecx
mov dword [eax], ecx
jle 0x475bd0
movsx edx, byte [ebx + ecx]
add dword [eax], edx
inc ecx
cmp ecx, edi
jl 0x475bc5
push dword [esi]
call fcn.0047af72
mov dword [esi + 8], eax
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x8049a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x848e10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x862014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0x8630ec
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.008180c0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0x862a8c
push eax
call fcn.008180c0
mov esi, dword [0x8630fc]
xor ebx, ebx
mov edi, dword [0x863100]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0x866390], bl
mov eax, ebx
mov ecx, 0x8630ec
cmovae ecx, dword [0x8630ec]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0x8664a0], al
inc ebx
cmp ebx, 0x100
jl 0x804a20
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0x866390]
movzx eax, byte [esi + 0x8664a0]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x804a74
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x866390]
mov byte [esi + 0x866390], al
inc esi
mov byte [edi + 0x866390], dl
cmp esi, 0x100
jl 0x804a50
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.00804690
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x804ac9
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x804abf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x804b1f
push edx
push ecx
call fcn.0081d663
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x804b0b
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x804b01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x804b1f
push edx
push ecx
call fcn.0081d663
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00836c6a
int3