joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413a92
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x413ac1
push 0x9a
push str..._mpint.c
push str.x0__nw__x1__nw
call fcn.0048233d
add esp, 0xc
mov eax, dword [edi]
and ebx, 1
neg ebx
mov dword [esp], ebx
test eax, eax
je 0x413af1
xor eax, eax
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esp]
and ecx, edx
mov edx, dword [edi + 4]
xor dword [edx + eax*4], ecx
mov edx, dword [esi + 4]
xor dword [edx + eax*4], ecx
inc eax
cmp eax, dword [edi]
jb 0x413acf
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0x413d21
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
cmp esi, 0x40000000
jb 0x413d4b
push 0xfa
push str..._mpint.c
push str.hex.len_____size_t_0____4
call fcn.0048233d
add esp, 0xc
lea eax, [esi*4 + 0x1f]
shr eax, 5
xor ecx, ecx
inc ecx
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004138e8
add esp, 4
mov edi, eax
test esi, esi
je 0x413ddf
mov dword [esp], 0
xor eax, eax
mov dword [esp + 4], esi
mov ecx, dword [esp + 0x1c]
movsx ecx, byte [ecx + esi - 1]
lea ebp, [ecx - 0x61]
mov edx, edi
mov edi, 0x66
sub edi, ecx
or edi, ebp
sar edi, 0x1f
lea ebp, [ecx - 0x41]
mov esi, 0x46
sub esi, ecx
or esi, ebp
lea ebp, [ecx - 0x30]
lea ebx, [ecx - 0x57]
xor ebp, ebx
and ebp, edi
mov edi, edx
add ecx, 0xffffffc9
xor ebx, ecx
xor ebx, ebp
sar esi, 0x1f
and ebx, esi
xor ebx, ecx
and ebx, 0xf
mov esi, eax
shr esi, 3
mov edx, dword [esp]
mov ecx, edx
and cl, 0x1c
shl ebx, cl
mov ecx, dword [edi + 4]
or dword [ecx + esi*4], ebx
mov esi, dword [esp + 4]
inc eax
add edx, 4
mov dword [esp], edx
dec esi
jne 0x413d75
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x413ea2
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x413f06
mov eax, dword [eax + 4]
mov dword [esp + 8], eax
mov dword [esp], 0
xor eax, eax
dec eax
mov edx, eax
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov esi, dword [eax + ebp*4]
mov ecx, esi
shr ecx, 1
mov edi, dword [esp]
or edi, esi
and esi, 1
or esi, ecx
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
cmovne edx, edi
cmovne ebx, dword [esp]
cmovne eax, ebp
inc ebp
cmp ecx, ebp
jne 0x413ece
shl eax, 5
or eax, 1
jmp 0x413f0e
xor edx, edx
dec edx
mov eax, 0xffffffe1
mov ecx, 0x10
xor esi, esi
mov edi, edx
shr edi, cl
mov ebx, edi
neg ebx
sbb ebx, ebx
xor edi, edx
and edi, ebx
xor edx, edi
and ebx, ecx
add esi, ebx
shr ecx, 1
jne 0x413f15
add eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41428b
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x28]
test edi, edi
je 0x4142b5
lea esi, [edi - 1]
movzx eax, byte [ecx + esi]
xor eax, 0x30
dec eax
sar eax, 0x1f
xor edi, esi
and edi, eax
xor edi, esi
add esi, 0xffffffff
jb 0x41429d
jmp 0x4142b7
xor edi, edi
mov dword [esp + 8], ecx
test edx, edx
je 0x414321
xor ecx, ecx
mov dword [esp], edx
mov dword [esp + 4], edi
shr edi, cl
xor ebp, ebp
inc ebp
mov dword [esp + 0xc], ecx
shl ebp, cl
cmp ebp, edx
mov ecx, dword [esp + 8]
jae 0x41430d
mov eax, edi
and al, 1
neg al
mov dword [esp + 0x10], eax
mov esi, dword [esp]
sub esi, ebp
add ebp, ecx
xor edi, edi
mov al, byte [ecx + edi]
mov bl, byte [ebp + edi]
mov ah, bl
xor ah, al
and ah, byte [esp + 0x10]
xor al, ah
mov byte [ecx + edi], al
xor ah, bl
mov byte [ebp + edi], ah
inc edi
cmp esi, edi
jne 0x4142ee
mov ecx, dword [esp + 0xc]
inc ecx
mov edx, dword [esp]
mov eax, edx
shr eax, cl
test eax, eax
mov edi, dword [esp + 4]
jne 0x4142c8
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41b0d6
Capabilities:
Get session user name

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x38
push esi
call fcn.00403392
add esp, 8
cmp byte [eax], 0
je 0x41b0f6
push eax
call fcn.0045add3
add esp, 4
jmp 0x41b10d
push 0x39
push esi
call fcn.004031ad
add esp, 8
test al, al
je 0x41b10b
pop esi
jmp fcn.0046ccd5
xor eax, eax
pop esi
ret
Function at 0x435227
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x100
mov esi, edx
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0xfc], eax
lea eax, [edx*4]
mov ebp, eax
add ebp, 0x1c
je 0x435305
neg eax
add eax, esp
add eax, 0xc
mov dword [esp + 8], eax
xor edx, edx
xor ebx, ebx
mov dword [esp + 4], ecx
mov dword [esp], ebp
cmp ebx, esi
jae 0x435275
mov edi, dword [ecx + ebx*4]
jmp 0x4352f8
mov ebp, edx
mov edi, dword [esp + ebx*4 + 8]
mov eax, ebx
xor edx, edx
div esi
test edx, edx
je 0x4352ab
cmp esi, 8
jne 0x4352a7
mov eax, ebx
and eax, 7
cmp eax, 4
jne 0x4352a7
movd xmm0, edi
pshufd xmm0, xmm0, 0x51
aeskeygenassist xmm0, xmm0, 0
movd edi, xmm0
mov edx, ebp
jmp 0x4352ee
mov edx, ebp
cmp ebp, 0xa
jb 0x4352cf
push 0x556
push str..._sshaes.c
push str.rconpos___lenof_key_setup_round_constants_
call fcn.0048233d
mov edx, ebp
mov ecx, dword [esp + 0x10]
add esp, 0xc
movd xmm0, edi
pshufd xmm0, xmm0, 0x51
aeskeygenassist xmm0, xmm0, 0
pextrd eax, xmm0, 1
movzx edi, byte [edx + 0x49b4ac]
inc edx
xor edi, eax
mov ebp, dword [esp]
mov eax, dword [esp + 8]
xor edi, dword [eax + ebx*4]
mov dword [esp + ebx*4 + 0xc], edi
inc ebx
cmp ebp, ebx
jne 0x435269
mov edi, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
add esi, 6
xor eax, eax
xor ecx, ecx
movdqu xmm0, xmmword [esp + eax + 0xc]
movdqa xmmword [ebx + eax], xmm0
inc ecx
add eax, 0x10
cmp ecx, esi
jbe 0x43531a
lea eax, [esp + 0xc]
push 0xf0
push eax
call fcn.0046d418
add esp, 8
mov eax, esi
shl eax, 4
add edi, eax
xor eax, eax
movdqa xmm0, xmmword [ebx]
test eax, eax
je 0x435359
cmp esi, eax
je 0x435359
aesimc xmm0, xmm0
movdqa xmmword [edi], xmm0
inc eax
add ebx, 0x10
add edi, 0xfffffff0
cmp esi, eax
jae 0x435348
mov ecx, dword [esp + 0xfc]
xor ecx, esp
call fcn.00475893
add esp, 0x100
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4354e7
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, edx
mov edi, dword [esp + 0x1c]
mov dh, byte [ecx]
mov al, byte [ecx + 1]
mov dword [esp], edi
test edi, edi
jle 0x43554b
neg dword [esp]
xor edi, edi
inc edi
mov dword [esp + 4], esi
inc dh
movzx ebp, dh
movzx ebx, byte [ecx + ebp + 2]
add al, bl
movzx esi, al
mov dl, byte [ecx + esi + 2]
mov byte [ecx + ebp + 2], dl
mov byte [ecx + esi + 2], bl
mov esi, dword [esp + 4]
mov dl, al
movzx eax, byte [ecx + ebp + 2]
add eax, ebx
movzx eax, al
mov al, byte [ecx + eax + 2]
xor byte [esi + edi - 1], al
mov eax, dword [esp]
add eax, edi
inc eax
inc edi
cmp eax, 1
mov eax, edx
jne 0x43550a
mov byte [ecx], dh
mov byte [ecx + 1], al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x435f5c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x54]
imul eax, dword [esp + 0x24], 0x3e8
mov ecx, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp], edx
xor edi, edi
inc edi
mov ebx, edi
mov dword [esp + 4], ebx
mov ebx, edi
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov edi, eax
mov ebp, esi
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
push ebx
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.00435605
add esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov edi, dword [esp + 4]
add edi, ebx
setb cl
cmp eax, dword [esp]
jae 0x435ff5
test cl, cl
jne 0x435ff5
push 0
mov esi, ebp
push ebp
call fcn.0045b021
add esp, 8
jmp 0x435f81
mov eax, dword [esp + 0x28]
mov dword [eax], ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x436003
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc08
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x4c1074]
xor ecx, ebp
mov dword [esp + 0xc00], ecx
xor ecx, ecx
mov edi, dword [eax + ecx*8]
mov ebx, dword [eax + ecx*8 + 4]
xor edi, dword [edx + ecx*8]
xor ebx, dword [edx + ecx*8 + 4]
mov dword [esp + ecx*8 + 0x804], ebx
mov dword [esp + ecx*8 + 0x800], edi
inc ecx
cmp ecx, 0x80
jne 0x436028
xor edi, edi
lea eax, [esp + edi]
add eax, 0x800
lea ecx, [esp + edi + 0x400]
mov edx, 2
push 2
push eax
call fcn.00436110
add esp, 8
sub edi, 0xffffff80
cmp edi, 0x400
jne 0x43604f
xor edi, edi
lea eax, [esp + edi]
add eax, 0x400
lea ecx, [esp + edi]
mov edx, 0x10
push 0x10
push eax
call fcn.00436110
add esp, 8
add edi, 0x10
cmp edi, 0x80
jne 0x43607b
xor eax, eax
mov ecx, dword [esp + eax*8]
mov edx, dword [esp + eax*8 + 4]
xor edx, dword [esp + eax*8 + 0x804]
xor ecx, dword [esp + eax*8 + 0x800]
xor dword [esi + eax*8], ecx
xor dword [esi + eax*8 + 4], edx
inc eax
cmp eax, 0x80
jne 0x4360a3
mov esi, 0x400
lea eax, [esp + 0x800]
push esi
push eax
call fcn.0046d418
add esp, 8
lea eax, [esp + 0x400]
push esi
push eax
call fcn.0046d418
add esp, 8
mov eax, esp
push esi
push eax
call fcn.0046d418
add esp, 8
mov ecx, dword [esp + 0xc00]
xor ecx, ebp
call fcn.00475893
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x439eae
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword [esp + 0xc]
lea eax, [ecx - 1]
cmp eax, 0x15
jae 0x439ec8
mov edx, 0x18007f
bt edx, eax
jb 0x43a022
mov edx, dword [esp + 4]
cmp ecx, 0x1e
jne 0x439edc
mov eax, str.SSH2_MSG_KEXDH_INIT
cmp edx, 1
jne 0x439edc
ret
cmp ecx, 0x1f
jne 0x439eeb
mov eax, str.SSH2_MSG_KEXDH_REPLY
cmp edx, 1
je 0x439edb
cmp ecx, 0x1e
jne 0x439efa
mov eax, str.SSH2_MSG_KEX_DH_GEX_REQUEST_OLD
cmp edx, 2
je 0x439edb
cmp ecx, 0x22
jne 0x439f09
mov eax, str.SSH2_MSG_KEX_DH_GEX_REQUEST
cmp edx, 2
je 0x439edb
cmp ecx, 0x1f
jne 0x439f18
mov eax, str.SSH2_MSG_KEX_DH_GEX_GROUP
cmp edx, 2
je 0x439edb
cmp ecx, 0x20
jne 0x439f27
mov eax, str.SSH2_MSG_KEX_DH_GEX_INIT
cmp edx, 2
je 0x439edb
cmp ecx, 0x21
jne 0x439f36
mov eax, str.SSH2_MSG_KEX_DH_GEX_REPLY
cmp edx, 2
je 0x439edb
cmp ecx, 0x1e
jne 0x439f45
mov eax, str.SSH2_MSG_KEXGSS_INIT
cmp edx, 4
je 0x439edb
cmp ecx, 0x1f
jne 0x439f54
mov eax, str.SSH2_MSG_KEXGSS_CONTINUE
cmp edx, 4
je 0x439edb
cmp ecx, 0x20
jne 0x439f67
mov eax, str.SSH2_MSG_KEXGSS_COMPLETE
cmp edx, 4
je 0x439edb
cmp ecx, 0x21
jne 0x439f7a
mov eax, str.SSH2_MSG_KEXGSS_HOSTKEY
cmp edx, 4
je 0x439edb
cmp ecx, 0x22
jne 0x439f8d
mov eax, str.SSH2_MSG_KEXGSS_ERROR
cmp edx, 4
je 0x439edb
cmp ecx, 0x28
jne 0x439fa0
mov eax, str.SSH2_MSG_KEXGSS_GROUPREQ
cmp edx, 4
je 0x439edb
cmp ecx, 0x29
jne 0x439fb3
mov eax, str.SSH2_MSG_KEXGSS_GROUP
cmp edx, 4
je 0x439edb
cmp ecx, 0x1e
jne 0x439fc6
mov eax, str.SSH2_MSG_KEXRSA_PUBKEY
cmp edx, 5
je 0x439edb
cmp ecx, 0x1f
jne 0x439fd9
mov eax, str.SSH2_MSG_KEXRSA_SECRET
cmp edx, 5
je 0x439edb
cmp ecx, 0x20
jne 0x439fec
mov eax, str.SSH2_MSG_KEXRSA_DONE
cmp edx, 5
je 0x439edb
cmp ecx, 0x1e
jne 0x439fff
mov eax, str.SSH2_MSG_KEX_ECDH_INIT
cmp edx, 3
je 0x439edb
cmp ecx, 0x1f
jne 0x43a012
mov eax, str.SSH2_MSG_KEX_ECDH_REPLY
cmp edx, 3
je 0x439edb
lea eax, [ecx - 0x32]
cmp eax, 4
jae 0x43a02a
mov eax, dword [ecx*4 + 0x49cedc]
ret
mov eax, dword [ecx*4 + 0x49cf4c]
ret
mov edx, dword [esp + 8]
cmp ecx, 0x3c
jne 0x43a041
mov eax, str.SSH2_MSG_USERAUTH_PK_OK
cmp edx, 1
je 0x439edb
cmp ecx, 0x3c
jne 0x43a054
mov eax, str.SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ
cmp edx, 2
je 0x439edb
cmp ecx, 0x3c
jne 0x43a067
mov eax, str.SSH2_MSG_USERAUTH_INFO_REQUEST
cmp edx, 4
je 0x439edb
cmp ecx, 0x3d
jne 0x43a07a
mov eax, str.SSH2_MSG_USERAUTH_INFO_RESPONSE
cmp edx, 4
je 0x439edb
cmp ecx, 0x3c
jne 0x43a08d
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_RESPONSE
cmp edx, 3
je 0x439edb
cmp ecx, 0x3d
jne 0x43a0a0
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_TOKEN
cmp edx, 3
je 0x439edb
cmp ecx, 0x3f
jne 0x43a0b3
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE
cmp edx, 3
je 0x439edb
cmp ecx, 0x40
jne 0x43a0c6
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_ERROR
cmp edx, 3
je 0x439edb
cmp ecx, 0x41
jne 0x43a0d9
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_ERRTOK
cmp edx, 3
je 0x439edb
cmp ecx, 0x42
jne 0x43a0ec
mov eax, str.SSH2_MSG_USERAUTH_GSSAPI_MIC
cmp edx, 3
je 0x439edb
lea edx, [ecx - 0x50]
mov eax, str.unknown
cmp edx, 0x15
jae 0x439edb
mov eax, dword [ecx*4 + 0x49ce74]
ret
Function at 0x43a6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test ecx, ecx
je 0x43a71f
mov edx, dword [esp + 0x18]
xor esi, esi
movzx edi, byte [edx + esi]
xor edi, eax
mov eax, edi
and eax, 0xf
shr edi, 4
imul ebx, eax, 0x11111044
xor ebx, edi
imul edi, eax, 0x8840020
imul ebp, eax, 0x4220000
xor ebp, edi
xor ebp, ebx
and ebx, 0xf
shr ebp, 4
imul eax, ebx, 0x11111044
imul edi, ebx, 0x8840020
xor edi, eax
imul eax, ebx, 0x4220000
xor eax, ebp
xor eax, edi
inc esi
cmp ecx, esi
jne 0x43a6d6
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43a976
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
je 0x43a9be
mov edx, dword [edi]
xor edx, dword [ecx]
mov ebp, dword [edi + 4]
xor ebp, dword [ecx + 4]
or ebp, edx
jne 0x43a9be
mov ebp, 4
push ebp
push 0x49d008
push 0
call fcn.0043a6c0
add esp, 0xc
push ebp
push 0x49d00c
push eax
call fcn.0043a6c0
add esp, 0xc
test ebx, ebx
jle 0x43aa03
add ebx, esi
mov ebp, 4
mov ecx, dword [edi]
mov edx, dword [edi + 4]
xor ecx, dword [esi]
xor edx, dword [esi + 4]
or edx, ecx
mov ecx, 0x49d00c
mov edx, 0x49d008
cmove ecx, edx
push ebp
push ecx
push eax
call fcn.0043a6c0
add esp, 0xc
push ebp
push 0x49d00c
push eax
call fcn.0043a6c0
add esp, 0xc
add esi, 8
cmp esi, ebx
jb 0x43a9c9
test eax, eax
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43bba7
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + eax*4]
mov edi, edx
rol edi, 4
mov dword [esp + 8], edx
xor esi, edx
xor edi, dword [ebx + eax*4 + 0x40]
mov ebx, edi
shr ebx, 8
mov eax, esi
shr eax, 8
movd xmm0, esi
mov dword [esp + 4], eax
movd xmm1, eax
punpckldq xmm1, xmm0
movd xmm0, edi
movd xmm2, ebx
punpckldq xmm2, xmm0
punpcklqdq xmm1, xmm2
pand xmm1, xmmword [0x49d430]
por xmm1, xmmword [0x49d440]
mov dword [esp], ecx
pxor xmm0, xmm0
mov ebp, 0x49d22c
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_b]
movdqu xmm3, xmmword [ebp]
pshufd xmm3, xmm3, 0x1b
pand xmm3, xmm1
pxor xmm0, xmm3
paddd xmm1, xmm2
add ebp, 0x10
cmp ebp, 0x49d42c
jb 0x43bc16
pshufd xmm1, xmm0, 0xff
movd eax, xmm1
mov edx, eax
shl edx, 4
mov ebp, 0x40004
and edi, ebp
imul edi, edi, 0x3c00
and edi, edx
xor edi, eax
pshufd xmm1, xmm0, 0xee
movd eax, xmm1
mov edx, eax
shl edx, 4
and ebx, ebp
imul ebx, ebx, 0x3c00
and ebx, edx
xor ebx, eax
pshufd xmm1, xmm0, 0x55
movd eax, xmm1
mov edx, eax
shl edx, 4
and esi, ebp
imul esi, esi, 0x3c00
and esi, edx
xor esi, eax
mov eax, dword [esp + 4]
and eax, ebp
movd ecx, xmm0
mov edx, ecx
shl edx, 4
imul ebp, eax, 0x3c00
and ebp, edx
xor ebp, ecx
shr ebx, 4
and ebx, 0xf000f00
shr esi, 8
and esi, 0xf000f0
or esi, ebx
and ebp, 0xf000f000
shr edi, 0xc
and edi, 0xf000f
or esi, ebp
or edi, esi
shr esi, 4
xor esi, edi
and esi, 0x7030702
xor edi, esi
shl esi, 4
xor esi, edi
mov eax, esi
shr eax, 8
xor eax, edi
and eax, str.Lm_Z
xor esi, eax
shl eax, 8
xor eax, esi
mov edx, eax
shr edx, 0x10
xor edx, eax
and edx, 0xd9d3
xor eax, edx
shl edx, 0x10
xor edx, eax
mov eax, edx
shr eax, 4
xor eax, edx
and eax, 0x5040004
mov esi, eax
shl eax, 4
xor eax, dword [esp]
xor esi, edx
shr edx, 1
xor edx, esi
xor eax, esi
and edx, 0x4045015
xor eax, edx
add edx, edx
xor edx, eax
mov eax, dword [esp + 8]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44019b
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov dword [edi + 4], 0
mov edx, dword [edi + 8]
test edx, edx
je 0x4401fb
xor ecx, ecx
sub edx, ecx
add ecx, dword [edi]
push ebx
push edx
push 1
push ecx
call fcn.004844f2
add esp, 0x10
mov esi, eax
push ebx
call fcn.00483eea
add esp, 4
test eax, eax
jne 0x4401eb
mov ecx, dword [edi + 4]
test esi, esi
je 0x4401f2
add ecx, esi
mov dword [edi + 4], ecx
mov edx, dword [edi + 8]
cmp edx, ecx
ja 0x4401b6
jmp 0x4401f5
mov eax, 2
jmp 0x440227
mov edx, dword [edi + 8]
xor eax, eax
cmp ecx, edx
jne 0x440211
push ebx
call fcn.00484239
add esp, 4
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov ecx, dword [edi + 4]
mov edx, dword [edi]
lea esi, [edi + 0xc]
mov dword [edi + 0xc], edx
mov dword [edi + 0x14], ecx
xor ecx, ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], esi
pop esi
pop edi
pop ebx
ret
Function at 0x443ddd
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov dword [esp + 8], edx
mov esi, dword [esp + 0xa8]
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x88], eax
push ecx
mov dword [esp + 8], ecx
call dword [ecx]
add esp, 4
mov edi, eax
test eax, eax
je 0x443e19
mov eax, dword [edi]
push edi
call dword [eax + 4]
add esp, 4
mov dword [esp], edi
test esi, esi
jle 0x443ec1
mov eax, esi
mov esi, dword [esp + 0xa4]
xor ebp, ebp
mov edi, dword [esp]
mov dword [esp + 0xc], ebp
mov ebp, dword [esp + 4]
mov ebx, dword [ebp + 0x14]
cmp eax, ebx
mov dword [esp + 0x10], eax
cmovbe ebx, eax
mov eax, dword [edi]
push edi
call dword [eax + 4]
add esp, 4
cmp dword [ebp + 0x14], 0x73
jb 0x443e6c
push 0x393
push str..._sshrsa.c
push str.h__hlen___MAX_HASH_LEN
call fcn.0048233d
add esp, 0xc
push dword [esp + 0xa0]
push dword [esp + 0xc]
push dword [edi + 4]
call fcn.004110a4
add esp, 0xc
mov ebp, dword [esp + 0xc]
push ebp
push dword [edi + 4]
call fcn.004111aa
add esp, 8
mov eax, dword [edi]
lea ecx, [esp + 0x16]
push ecx
push edi
call dword [eax + 0xc]
add esp, 8
test ebx, ebx
jle 0x443eb2
xor eax, eax
mov cl, byte [esp + eax + 0x16]
xor byte [esi + eax], cl
inc eax
cmp ebx, eax
jne 0x443ea6
inc ebp
add esi, ebx
mov eax, dword [esp + 0x10]
sub eax, ebx
jg 0x443e32
mov ecx, dword [esp]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x10]
add esp, 4
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00475893
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4562cb
Capabilities:
Encode data using base64
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x1120], 2
jl 0x45630b
mov eax, dword [esp + 0xc]
cmp dword [esi + 0x1118], eax
jne 0x45630b
mov dword [esi + 0xe20], 0
xorps xmm0, xmm0
movups xmmword [esi + 0xe2c], xmm0
push esi
call fcn.0044d3e4
add esp, 4
cmp dword [esi + 0xe20], 2
jne 0x45630d
pop esi
ret
mov ecx, esi
pop esi
jmp fcn.004527be

Function at 0x45b29b
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [esp + 0x28]
mov edx, dword [0x4c1074]
xor edx, esp
mov dword [esp + 0x10], edx
xor edx, edx
xor esi, esi
dec esi
movsx ebx, byte [ecx + edx]
mov eax, ebx
add al, 0xbf
cmp al, 0x19
ja 0x45b2c8
add ebx, 0xffffffbf
jmp 0x45b305
mov eax, ebx
add al, 0x9f
cmp al, 0x19
ja 0x45b2d5
add ebx, 0xffffffb9
jmp 0x45b305
mov eax, ebx
add al, 0xd0
cmp al, 9
ja 0x45b2e2
add ebx, 4
jmp 0x45b305
cmp bl, 0x2b
je 0x45b2fc
cmp bl, 0x3d
je 0x45b303
cmp bl, 0x2f
jne 0x45b388
mov ebx, 0x3f
jmp 0x45b305
mov ebx, 0x3e
jmp 0x45b305
mov ebx, esi
mov dword [esp + edx*4], ebx
inc edx
cmp edx, 4
jne 0x45b2b7
mov ebx, dword [esp]
xor esi, esi
cmp ebx, 0xffffffff
je 0x45b38a
mov edx, dword [esp + 4]
cmp edx, 0xffffffff
je 0x45b38a
mov edi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
cmp edi, 0xffffffff
je 0x45b37b
mov esi, 2
shl ebx, 0x12
shl edx, 0xc
or ebx, edx
mov ebp, edi
shl ebp, 6
shr ebx, 0x10
mov eax, dword [esp + 0x2c]
mov byte [eax], bl
cmp ecx, 0xffffffff
jne 0x45b353
cmp edi, 0xffffffff
je 0x45b363
mov eax, ebp
and eax, 0xf00
or eax, edx
mov edx, dword [esp + 0x2c]
mov byte [edx + 1], ah
cmp ecx, 0xffffffff
je 0x45b38a
and ecx, 0x3f
or ecx, ebp
mov eax, dword [esp + 0x2c]
mov byte [eax + 2], cl
mov esi, 3
jmp 0x45b38a
cmp ecx, 0xffffffff
jne 0x45b38a
xor esi, esi
inc esi
xor ecx, ecx
dec ecx
jmp 0x45b333
xor esi, esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00475893
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x45b627
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x45b65f
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
xor edi, edi
xor edx, edx
mov bl, byte [ecx + edi]
xor bl, byte [esi + edi]
movzx ebx, bl
or edx, ebx
inc edi
cmp eax, edi
jne 0x45b63e
mov eax, 0x100
sub eax, edx
cmp eax, 0xff
seta al
jmp 0x45b661
mov al, 1
pop esi
pop edi
pop ebx
ret
Function at 0x461159
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c1cfc]
test eax, eax
jne 0x46118e
push 0
push 0x461196
push dword [esp + 0xc]
push 0x6e
push dword [0x4c2224]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4c1cfc], eax
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4c1cfc]
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
ret

Function at 0x461dc0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
sub esp, 0x98
mov eax, dword [0x4c1074]
xor eax, esp
mov dword [esp + 0x94], eax
cmp dword [0x4c2214], 0
je 0x461df0
xor ebx, ebx
cmp dword [0x4c2208], 0
setne bl
jmp 0x461f13
lea esi, [esp + 4]
push 0x90
push 0
push esi
call fcn.00478e90
add esp, 0xc
mov dword [esi - 4], 0x94
mov esi, esp
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [esi + 0x10], 2
sete al
mov dword [0x4c2218], eax
push str.USER32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x461edd
mov esi, eax
push 0x4a9a8f
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c21f8], eax
test eax, eax
je 0x461edd
push str.MonitorFromWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c21fc], eax
test eax, eax
je 0x461edd
push str.MonitorFromRect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c2200], eax
test eax, eax
je 0x461edd
push str.MonitorFromPoint
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c2204], eax
test eax, eax
je 0x461edd
push str.EnumDisplayMonitors
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c220c], eax
test eax, eax
je 0x461edd
push str.GetMonitorInfoA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c2208], eax
test eax, eax
je 0x461edd
push str.EnumDisplayDevicesA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4c2210], eax
test eax, eax
je 0x461edd
mov dword [0x4c2214], 1
xor ebx, ebx
inc ebx
jmp 0x461f13
xor ebx, ebx
mov dword [0x4c21f8], ebx
mov dword [0x4c21fc], ebx
mov dword [0x4c2200], ebx
mov dword [0x4c2204], ebx
mov dword [0x4c2208], ebx
mov dword [0x4c220c], ebx
mov dword [0x4c2210], ebx
mov dword [0x4c2214], 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00475893
mov eax, ebx
add esp, 0x98
pop esi
pop ebx
ret
Function at 0x462c39
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.004668c5
push dword [0x4c2da0]
call fcn.00411739
add esp, 4
mov eax, dword [0x4c2da4]
test eax, eax
je 0x462c5d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [esp + 8]
call fcn.0046db38
push 2
push dword [0x4c2228]
call fcn.0040324d
add esp, 8
cmp eax, 3
jne 0x462c80
call fcn.00442aec
call fcn.0046bd80
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call fcn.00480cfd