joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7e99d7
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop esi
sub esp, 4
mov byte [esp + 1], ah
jmp 0x7e99b5
mov esi, edi
lea esi, [esi*4]
lea esi, reloc.VERSION.dll_GetFileVersionInfoSizeA
mov edi, dword [esi]
jmp 0x7e9976
push ebp
jmp 0x7e9a33
and ebx, ecx
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.VERSION.dll_GetFileVersionInfoSizeA]
mov bx, word [esp]
jmp 0x7e999f
lea esp, [esp + 2]
push esi
jmp 0x7e998c
pushal
pop dword [esp]
mov byte [esp + 8], cl
and edx, ecx
sub esp, 0x1f
jmp 0x7e9a13
add ebp, 0xe
movzx ebx, byte [ebp]
pop ebp
mov ebx, dword [ebx*4 + reloc.VERSION.dll_GetFileVersionInfoSizeA]
jmp 0x7e99de
pop word [esp + 0x17]
lea esp, [esp + 1]
mov edx, dword [edx*4 + reloc.VERSION.dll_GetFileVersionInfoSizeA]
call fcn.007e9a63
add eax, 0x996a0f9f
bound esi, qword [edx + 0x6d]
jl 0x7e9a81
salc
pushal
xchg cx, bx
xchg edx, ebp
mov dword [esp + 8], esi
popal
jmp 0x7e9a02
add dword [eax], eax
add byte [esi - 5], dh
add byte [eax], al
jbe 0x7e9a80
imul ecx, dword [esi], reloc.VERSION.dll_GetFileVersionInfoSizeA
pop esp
fdiv qword [edx + 0x15]
in al, 0x5a
test eax, 0xcf216bc8

Function at 0x7e9a42
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ecx
push word [esp]
mov byte [esp + 3], bh
jmp 0x7e9a7a

Function at 0x7e9a63
Capabilities:
Encrypt data using aes

Disassembly:
call 0x7e9ab2
bswap ebx
mov bx, word [esp]
mov dh, cl
xchg ebx, edx
jmp 0x7e9963
mov edx, dword [esi]
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + reloc.VERSION.dll_GetFileVersionInfoSizeA]
add esi, 0x10
jmp 0x7e954f
and ebx, ecx
call fcn.007e9a40
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + reloc.VERSION.dll_GetFileVersionInfoSizeA]
call fcn.007e9a42
lea esp, [esp + 2]
jmp 0x7e9be6
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x7b6d81
je 0x7b6c8a
and edx, ecx
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.VERSION.dll_GetFileVersionInfoSizeA]
jmp 0x7e9aff

Function at 0x8cd098
Capabilities:
Execute anti-debugging instructions

Disassembly:
setb cl
bsf eax, ebp
push edx
not ch
xchg dx, cx
not cx
jmp 0x8cd03e
xchg byte [esp + 2], ch
xchg dword [esp], ecx
add esp, 0
mov dword [esp + 1], eax
xchg cx, ax
not eax
jmp 0x8ccffd
lea edx, reloc.VERSION.dll_GetFileVersionInfoSizeA
bswap edx
bts ecx, edi
mov cx, si
cld
jmp 0x8cd06a
lea ecx, [ebp + ebp]
lea eax, [edi*4]
bswap ecx
xchg al, dh
add cl, 0xe7
and ah, ch
jmp 0x8cd028
bswap edx
btr ecx, edi
mov ecx, 0xf092a1d1
bsf ax, cx
jmp 0x8cd078
mov eax, esp
stc
rdtsc
neg eax
rdtsc
lea ecx, [ebx + esi]
jmp 0x8cd054
mov cx, dx
cmc
bsr ax, sp
pushfd
pop ax
rcl dh, 4
jmp 0x8cd0da
jmp 0x8cd013
bswap eax
call 0x8cd09d
mov dx, 0x71a7
bswap eax
mov ecx, 0xe5ad786b
mov ah, cl
xchg ch, al
lea edx, [edx + ebp]
jmp 0x8cd0b3
Function at 0x8cd277
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 8]
mov dword [esp + 1], edx
xchg dx, ax
xchg byte [esp + 5], ch
xchg byte [esp + 2], dl
jmp 0x8cd2b7
rdtsc
bswap eax
mov dl, 0xfd
bswap edx
mov byte [esp + 1], dl
jmp 0x8cd2df
lea eax, [edx + esi]
xchg byte [esp + 4], dh
pop dx
xchg dl, ch
pop ecx
mov dx, 0x8733
jmp 0x8cd2a1
mov cx, word [esp + 1]
call fcn.008cd37a
inc edi
je 0x8cd31d
imul ebp, dword [ebp + 0x54], reloc.VERSION.dll_GetFileVersionInfoSizeA
mov cx, 0xfcc6
add esp, 0
rdtsc
lea edx, [eax + esi]
push bp
push dword [esp + 3]
jmp 0x8cd2c9
retf 0x9465

Function at 0x8cd97d
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc dx
mov cl, byte [esp + 0xc]
xchg dh, ch
mov word [esp + 4], di
jmp 0x8cd565

Function at 0x8cdaf1
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
setg ah
xchg dx, ax
jmp 0x8cdb34
xchg ecx, edx
mov byte [esp + 0xe], bl
pop dx
mov cl, ah
mov cx, sp
push dword [esp + 2]
jmp 0x8cdb1e

Function at 0x8cddb7
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 0x29], cl
sub esp, 0xe
lea esp, [esp + 0x45]
mov ecx, ebp
pop edx
mov ah, 0x59
xchg dword [esp + 0x24], ecx
lea esp, [esp + 5]
jmp 0x8cdda1

Function at 0x8d27c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov ax, si
pop dword [esp + 5]
push dword [esp + 5]
jmp 0x8d27fe
mov word [esp + 8], cx
xchg bl, ah
mov word [esp + 0xa], bp
pop ebx
pop edx
rdtsc
jmp 0x8d27e8

Function at 0x8d28ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 6], ax
ror dh, cl
xchg bl, dl
xchg bh, al
sub esp, 0xf
cld
jmp 0x8d28b1
push ebx
jmp 0x8d2898
pop word [esp + 0x16]
xchg dword [esp + 0x1a], eax
mov al, byte [esp + 0x18]
not al
jmp 0x8d297b
mov ax, word [esp]
sub dx, 0x9902
mov bh, 0xba
rdtsc
shl dl, 5
jmp 0x8d294a
lea esp, [esp + 0x50]
mov ebx, 0xc5be8f20
bsr bx, sp
xchg ebx, edx
mov ebx, 0x2ecb2d65
mov edx, ecx
jmp 0x8d28e5
bsr dx, si
mov ax, word [esp + 1]
mov eax, edi
call fcn.008d295d
bound ebx, qword [ebp + 0x71c6ffec]
mov edx, ebx
mov bl, byte [esp]
mov ebx, ebp
push si
bswap eax
mov bx, cx
jmp 0x8d2913
add dh, cl
bt ebx, edx
xchg ebx, edx
mov dl, byte [esp]
mov edx, dword [esp]
bsr dx, cx
jmp 0x8d2929
xchg dword [esp + 0x17], eax
neg dx
xor ah, 0x99
rdtsc
clc
sub esp, 0x1c
jmp 0x8d28fb
Function at 0x8d2c3a
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg ah
mov dx, 0xa5b0
pop dword [esp]
mov ebx, ecx
lea edx, [edx*4]
lea edx, [edi*4]
jmp 0x8d2b25
ror bl, 7
not edx
rdtsc
mov edx, ecx
xchg bh, ah
mov ebx, dword [esp + 5]
jmp 0x8d2b64
mov bx, sp
jmp 0x8d2be6

Function at 0x8d2e35
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, esi
push dx
add esp, 4
jmp 0x8d2e59
push word [esp + 4]
mov word [esp], di
mov byte [esp + 0xa], al
rdtsc
btc bx, dx
jmp 0x8d2e95
neg al
pop word [esp]
pop dword [esp]
xchg word [esp + 1], dx
jmp 0x8d2ec3
lea edx, [eax - 0x8c]
mov edx, edi
pop dword [esp + 4]
btr ax, di
rdtsc
mov byte [esp + 1], dh
jmp 0x8d2e7f
dec edx
mov edx, 0xd56de319
dec bx
std
lea eax, [edx + 0xe8]
jmp 0x8d2ef5
mov byte [esp], ch
mov word [esp], di
mov bl, byte [esp + 3]
lea edx, reloc.VERSION.dll_GetFileVersionInfoSizeA
lea ebx, [esi*4]
mov byte [esp], dl
jmp 0x8d2ead
dec dh
mov ebx, ebp
not ax
rdtsc
mov dh, 0xfc
mov ax, word [esp + 3]
jmp 0x8d2f90

Function at 0x8d2fcf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bx, bp
pop eax
mov dh, byte [esp + 1]
mov bx, word [esp]
xchg edx, ebx
bswap eax
jmp 0x8d2fa1
setae dl
xchg bx, ax
xchg bx, ax
mov ah, byte [esp + 6]
lea ebx, reloc.VERSION.dll_GetFileVersionInfoSizeA
jmp 0x8d2fb7

Function at 0x8d32bf
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, ax
sub esp, 2
clc
sbb edx, 0x6c987aaf
xchg byte [esp + 0x3c], ah
jmp 0x8d3278

Function at 0x8d34a3
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop word [esp + 5]
push ebx
mov dword [esp + 0x28], edi
lea esp, [esp + 0x28]
jmp 0x8d34e3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x8d34cd
Function at 0x106ce
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0001388a
push edi
cmp dword [ebp - 8], 5
jne 0x10753
cmp dword [ebp - 4], 2
jne 0x1070f
mov ecx, ecx
mov edx, edx
jmp 0x106f9
jmp 0x106fb
mov edx, edx
mov esi, esi
jne 0x10701
mov ebx, ebx
mov dword [0x11234], 0x193
leave
ret
cmp dword [ebp - 4], 1
jne 0x10731
mov edi, edi
push edx
pop edx
mov edi, edi
mov eax, eax
push edx
pop edx
mov esi, esi
push eax
pop eax
push edx
pop edx
mov dword [0x11234], 0x194
leave
ret
cmp dword [ebp - 4], 0
jne 0x10779
je 0x10739
mov ecx, ecx
jne 0x1073d
push esi
pop esi
je 0x10741
mov esi, esi
push ebx
pop ebx
push eax
pop eax
mov dword [0x11234], 0x189
leave
ret
cmp dword [ebp - 8], 6
jne 0x10779
cmp dword [ebp - 4], 1
jne 0x10779
push eax
pop eax
pushfd
popfd
pushfd
popfd
push edx
pop edx
pushal
popal
mov edx, edx
push edx
pop edx
jmp 0x1076f
mov dword [0x11234], 0x1a7
leave
ret

Function at 0x15031
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not eax
lahf
pushal
shld ax, bp, cl
mov dword [esp + 0x1c], ebp
test esp, ecx
rol bp, 6
test dh, 0x5e
lea ebp, [esp + 0x1c]
bswap ax
rol ah, 3
pushal
sub esp, 0xffffffdc
shld eax, esi, 0x14
shrd ax, di, cl
adc ax, 0xc150
push esi
sbb ah, ah
push edi
push ebx
clc
mov dword [esp], ebx
inc ax
stc
shr ah, cl
push edx
btc ax, ax
aaa
mov ah, ch
cmc
mov eax, dword [ebp + 8]
jmp 0x191e1
je 0x166fe
cmp bl, 1
sar si, 0xe
sbb si, ax
mov esi, dword [eax + 0x3c]
bsr dx, di
bsf edx, ebp
lea edx, [edi + 0x73da04]
rol dh, 7
add esi, eax
bswap dx
mov edx, dword [esi + 0x78]
cmp dx, bp
test edx, edx
pushfd
push 0x6c8aa0e2
lea esp, [esp + 8]
je 0x166fe
dec cl
add ch, al
btc cx, 1
call fcn.000199ef
push dword [esp + 4]
stc
cmp eax, edx
push ebp
lea esp, [esp + 0x28]
jb 0x1670b
cmc
jmp 0x19bc9
test eax, eax
jmp 0x1911b
Function at 0x403a7d
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x467be4
call fcn.00449908
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], esi
call fcn.004032ce
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 1
cmp dword [ebp + 0x10], esi
je 0x403bca
mov edi, dword [ebp + 0xc]
mov al, byte [edi]
dec dword [ebp + 0x10]
mov byte [ebp + esi - 0x10], al
mov bl, byte [ebp - 0xf]
inc esi
inc edi
cmp esi, 3
jne 0x403b26
mov al, byte [ebp - 0x10]
shr al, 2
mov byte [ebp - 0x14], al
mov al, byte [ebp - 0x10]
and al, 3
shl al, 4
mov cl, bl
shr cl, 4
add al, cl
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0x13], al
mov al, bl
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x12], al
mov al, byte [ebp - 0xe]
and al, 0x3f
mov byte [ebp - 0x11], al
xor esi, esi
movzx eax, byte [ebp + esi - 0x14]
push eax
mov ecx, 0x492834
call fcn.00402c96
mov al, byte [eax]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.0040335f
inc esi
cmp esi, 4
jl 0x403afc
xor esi, esi
cmp dword [ebp + 0x10], 0
jne 0x403ab2
xor edi, edi
cmp esi, edi
je 0x403bca
cmp esi, 3
jge 0x403b52
push 3
pop ecx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x10]
push edi
push eax
call fcn.0044b690
mov bl, byte [ebp - 0xf]
add esp, 0xc
mov al, byte [ebp - 0x10]
mov cl, al
shr cl, 2
mov byte [ebp - 0x14], cl
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0xe]
and bl, 0xf
mov cl, al
shl bl, 2
shr cl, 6
add bl, cl
mov byte [ebp - 0x12], bl
and al, 0x3f
lea ebx, [esi + 1]
mov byte [ebp - 0x11], al
test ebx, ebx
jle 0x403bb2
movzx eax, byte [ebp + edi - 0x14]
push eax
mov ecx, 0x492834
call fcn.00402c96
mov al, byte [eax]
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 0x1c], al
push dword [ebp - 0x1c]
push 1
call fcn.0040335f
inc edi
cmp edi, ebx
jl 0x403b8b
push 3
pop edi
cmp esi, edi
jge 0x403bca
sub edi, esi
mov ecx, dword [ebp - 0x18]
push 0x3d
push 1
call fcn.0040335f
dec edi
jne 0x403bbb
mov eax, dword [ebp - 0x18]
call fcn.004499e0
ret

Function at 0x4095c4
Capabilities:
Create process on windows

Disassembly:
push 0x14
mov eax, 0x4688aa
call fcn.0044993b
xor esi, esi
mov dword [ebp - 4], esi
push str.openUrlOnDefaultBrowser
mov ecx, 0x492ae8
call fcn.0040184b
mov byte [ebp - 4], 1
push 1
push esi
push esi
push dword [ebp + 8]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040141e
call fcn.004499e0
ret 4
Function at 0x418297
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x46b0bb
call fcn.00449971
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x4183a7
cmp byte [esi + 0x41], 0
je 0x4183a7
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x4182cd
xor al, al
jmp 0x4183a9
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040867f
mov dword [ebp - 4], edi
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040652b
mov ecx, eax
call fcn.00401edd
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040652b
mov ecx, eax
call fcn.00401edd
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x418341
dec eax
je 0x418345
dec eax
dec eax
je 0x4183a3
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040148e
mov al, bl
jmp 0x4183a9
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040652b
mov ecx, eax
call fcn.00401edd
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x418385
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040652b
mov ecx, eax
call fcn.00401edd
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0044df07
add esp, 0x10
cmp edi, eax
jne 0x41832b
cmp byte [esi + 0x41], 0
je 0x4183a3
test edi, edi
jne 0x4182db
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040335f
jmp 0x4182db
mov bl, 1
jmp 0x41832d
mov al, 1
call fcn.004499f4
ret
Function at 0x418b5e
Capabilities:
Read file on windows

Disassembly:
push 0xec
mov eax, 0x46b259
call fcn.00449971
mov esi, ecx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push 0x4743d0
mov ecx, 0x492ae8
call fcn.0040184b
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x58], esp
push eax
call fcn.004016b8
mov byte [ebp - 4], 2
mov eax, dword [esi]
lea ecx, [ebp - 0x54]
push ecx
mov byte [ebp - 4], 1
mov ecx, esi
call dword [eax + 0x20]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 8]
call fcn.004065b9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.0040141e
push dword [ebp + 8]
lea ecx, [ebp - 0xf8]
call fcn.00407bde
mov byte [ebp - 4], 4
push dword [eax]
lea ecx, [ebp - 0x48]
call fcn.00401925
mov byte [ebp - 4], 6
lea eax, [ebp - 0xf4]
cmp dword [ebp - 0xf8], eax
je 0x418bf9
push dword [ebp - 0xf8]
call fcn.0044b877
pop ecx
cmp dword [ebp - 0x30], 0x10
mov eax, dword [ebp - 0x44]
jae 0x418c05
lea eax, [ebp - 0x44]
push 0x4743cc
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0044f337
xor ebx, ebx
add esp, 0xc
cmp eax, ebx
jne 0x418d63
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], ebx
jne 0x418c5d
mov byte [ebp - 0x49], 1
mov byte [ebp - 4], 1
push ebx
push edi
lea ecx, [ebp - 0x48]
call fcn.0040148e
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.0040141e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040141e
mov al, byte [ebp - 0x49]
call fcn.004499f4
ret 8
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.004013c2
mov byte [ebp - 4], 7
push 2
push ebx
push dword [ebp - 0x50]
call fcn.0044eb28
push dword [ebp - 0x50]
call fcn.0044f205
add esp, 0x10
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00417da0
push dword [ebp - 0x50]
call fcn.0044efa2
pop ecx
push dword [ebp - 0x50]
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x18]
push edi
push ebx
call fcn.00402c96
push eax
call fcn.0044ef85
push dword [ebp - 0x50]
call fcn.0044ec69
add esp, 0x14
push dword [ebp + 0xc]
lea ecx, [ebp - 0xf8]
call fcn.00407bde
mov byte [ebp - 4], 8
push dword [eax]
lea ecx, [ebp - 0x74]
call fcn.00401925
mov byte [ebp - 4], 9
cmp dword [eax + 0x18], 0x10
jb 0x418ce6
mov eax, dword [eax + 4]
jmp 0x418ce9
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x58], esp
push eax
call fcn.00401925
mov byte [ebp - 4], 0xa
sub esp, 0x1c
lea eax, [ebp - 0x2c]
mov ecx, esp
mov dword [ebp - 0x54], esp
push eax
call fcn.00403a54
mov byte [ebp - 4], 0xb
mov eax, dword [esi]
mov byte [ebp - 4], 9
mov ecx, esi
call dword [eax + 0x28]
mov byte [ebp - 0x49], al
mov byte [ebp - 4], 8
push ebx
push edi
lea ecx, [ebp - 0x74]
call fcn.0040148e
mov byte [ebp - 4], 7
lea eax, [ebp - 0xf4]
cmp dword [ebp - 0xf8], eax
je 0x418d4a
push dword [ebp - 0xf8]
call fcn.0044b877
pop ecx
mov byte [ebp - 4], 6
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040148e
mov al, byte [ebp - 0x49]
mov byte [ebp - 0x49], al
jmp 0x418c2d
mov byte [ebp - 0x49], bl
jmp 0x418c2d
Function at 0x41a6a0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push 0x258
mov eax, 0x46b700
call fcn.00449971
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x471b4c
mov ecx, 0x492ae8
call fcn.0040184b
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x260], esp
push eax
call fcn.004016b8
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp - 0x258]
push ecx
mov byte [ebp - 4], bl
mov ecx, esi
call dword [eax + 0x20]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp + 8]
call fcn.004065b9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x258]
call fcn.0040141e
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x250]
call fcn.004040da
mov byte [ebp - 4], 3
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x250]
call fcn.00417d5a
mov esi, eax
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x250]
call fcn.00417d38
push dword [esi + 4]
lea ecx, [ebp - 0x234]
push dword [esi]
push dword [eax + 4]
push dword [eax]
call fcn.004189de
mov byte [ebp - 4], 4
cmp dword [ebp - 0x21c], 0x10
mov eax, dword [ebp - 0x230]
jae 0x41a786
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41a7d5
mov byte [ebp - 0x251], bl
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x234]
call fcn.0040148e
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x250]
call fcn.004029a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040141e
mov al, byte [ebp - 0x251]
call fcn.004499f4
ret 4
test al, 0x10
je 0x41a792
mov byte [ebp - 0x251], 1
jmp 0x41a798
Function at 0x41cd36
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x4c]
xor al, al
mov bl, 1
cmp ecx, 0xffffffff
je 0x41cebb
push edi
mov edi, 0x10000000
cmp ecx, 0x7c
je 0x41ceba
cmp ecx, 0x29
jne 0x41cd7a
cmp dword [esi + 0x1c], 0
jne 0x41ceba
test dword [esi + 0x50], edi
jne 0x41cd7a
push 5
call fcn.00466331
pop ecx
jmp 0x41cea3
cmp ecx, 0x2e
jne 0x41cd95
push 5
lea ecx, [esi + 0x24]
call fcn.004162b5
mov ecx, esi
call fcn.00417550
jmp 0x41cea3
cmp ecx, 0x5c
jne 0x41cdf2
mov ecx, esi
call fcn.00417550
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x41cdc7
cmp byte [esi + 0x4a], 0x62
jne 0x41cdc7
push 4
lea ecx, [esi + 0x24]
call fcn.004162b5
mov ecx, esi
call fcn.00417550
jmp 0x41ceaa
test eax, eax
je 0x41cde6
cmp byte [esi + 0x4a], 0x42
jne 0x41cde6
push 4
lea ecx, [esi + 0x24]
call fcn.004162b5
mov eax, dword [esi + 0x28]
add eax, 8
or dword [eax], 1
jmp 0x41cdbb
mov ecx, esi
call fcn.0041b3f0
jmp 0x41cea3
cmp ecx, 0x5b
jne 0x41ce15
mov ecx, esi
call fcn.00417550
mov ecx, esi
call fcn.0041ccea
push 4
push 0x5d
mov ecx, esi
call fcn.004175e0
jmp 0x41cea3
cmp ecx, 0x28
jne 0x41ce37
mov ecx, esi
call fcn.00417550
mov ecx, esi
call fcn.00417603
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.004175e0
jmp 0x41ce9f
cmp ecx, 0x5e
jne 0x41ce43
push 2
jmp 0x41cdb3
cmp ecx, 0x24
jne 0x41ce4f
push 3
jmp 0x41cdb3
cmp ecx, 0x2a
je 0x41ce97
cmp ecx, 0x2b
je 0x41ce97
cmp ecx, 0x3f
je 0x41ce97
cmp ecx, 0x7b
je 0x41ce97
cmp ecx, 0x7d
jne 0x41ce74
test dword [esi + 0x50], edi
jne 0x41ce74
push 6
jmp 0x41cd6f
cmp ecx, 0x5d
jne 0x41ce85
test dword [esi + 0x50], edi
jne 0x41ce85
push 4
jmp 0x41cd6f
movzx eax, byte [esi + 0x4a]
push eax
lea ecx, [esi + 0x24]
call fcn.0041ab33
jmp 0x41cd89
push 0xa
call fcn.00466331
pop ecx
test bl, bl
je 0x41ceaa
mov ecx, esi
call fcn.0041aea9
mov ecx, dword [esi + 0x4c]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x41cd50
pop edi
pop esi
pop ebx
ret
Function at 0x421de9
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xc
mov eax, 0x46c722
call fcn.0044993b
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x8c], edi
je 0x421e34
call fcn.004219ec
test eax, eax
je 0x421e3c
lea eax, [ebp - 0x18]
push eax
push 4
push esi
push 0x421cde
push edi
push edi
call fcn.0044f7ae
add esp, 0x18
mov dword [esi + 0xa8], eax
cmp eax, edi
je 0x421e34
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
call fcn.004499e0
ret
mov eax, dword [esi + 0xb0]
cmp eax, edi
je 0x421e34
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax]
push edi
mov edx, dword [ebp - 0x14]
neg edx
push edx
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push edi
push dword [esi + 0x68]
push dword [esi + 0x64]
push edi
push edi
push dword [esi + 0x90]
push eax
call dword [ecx + 0x20]
test eax, eax
jne 0x421e34
push edi
mov ecx, esi
call fcn.00421305
xor eax, eax
inc eax
jmp 0x421e36

Function at 0x4228f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x46c7e2
call fcn.0044993b
mov dword [ebp - 0x14], ecx
and dword [ebp - 4], 0
call fcn.00433293
mov eax, dword [eax + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x42295c
call fcn.00433293
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42295c
call fcn.00433293
mov eax, dword [eax + 0xc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x422966
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
call fcn.004499e0
ret 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp + 0xc], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4229b3
cmp dword [ebp + 0xc], 0
je 0x4229b3
push edi
push eax
push dword [ebp + 0xc]
call fcn.0044ccf0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push esi
mov ecx, dword [ebp - 0x14]
call fcn.004225d4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
jmp 0x42295e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x422955
Function at 0x422a80
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4913c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
mov dword [ebp - 0x218], ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x422ab5
xor eax, eax
inc eax
jmp 0x422b8c
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x422af3
cmp eax, 2
jne 0x422ae1
push str.Key_not_found._n
call fcn.0044f5e8
pop ecx
jmp 0x422aad
push str.Error_opening_key._n
call fcn.0044f5e8
pop ecx
xor eax, eax
jmp 0x422b8c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [edi + eax*2]
cmp word [esi - 2], 0x5c
je 0x422b37
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
xor eax, eax
mov word [esi], ax
jmp 0x422b37
lea eax, [ebp - 0x20c]
push eax
push 0x208
push esi
call fcn.004229eb
mov ecx, dword [ebp - 0x218]
push edi
push ebx
call fcn.00422d9a
test eax, eax
je 0x422b6c
lea eax, [ebp - 0x220]
push eax
xor eax, eax
push eax
push eax
push eax
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x422b14
xor eax, eax
mov word [esi - 2], ax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004498f9
leave
ret 8