joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421369
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, 0x3f
push ebx
mov ebx, dword [ebp + 0xc]
sar edx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [edx*4 + 0x43ac20]
mov dword [ebp - 8], edx
mov edx, dword [eax + edi + 0x18]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4213ad
push 0xa
pop esi
cmp word [ebx], si
jne 0x4213ad
or byte [eax + edi + 0x28], 4
jmp 0x4213b2
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + edx*2]
mov eax, ebx
mov dword [ebp - 0x10], edx
mov esi, ebx
cmp ebx, edx
jae 0x42151d
movzx edx, word [eax]
mov ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, cx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
cmp edx, 0x1a
je 0x4214f5
lea ebx, [eax + 2]
mov dword [ebp - 4], ebx
push 0xd
pop ebx
cmp dx, bx
mov ebx, dword [ebp + 0xc]
je 0x4213ff
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 4]
movzx ebx, bx
mov dword [ebp - 4], ebx
jmp 0x421429
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x421448
push 0xa
pop ebx
cmp word [edx], bx
jne 0x421416
push ebx
add eax, 4
pop edx
jmp 0x42141e
mov eax, edx
mov edx, dword [ebp - 0xc]
movzx edx, dx
movzx edx, dx
mov dword [ebp - 4], edx
mov edx, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
mov word [esi], cx
mov esi, dword [ebp - 0xc]
add esi, edx
cmp eax, dword [ebp - 0x10]
jb 0x4213c4
jmp 0x42151d
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4214f0
cmp dword [ebp - 0x14], 0
je 0x4214f0
mov eax, dword [ebp - 8]
push 0xa
mov eax, dword [eax*4 + 0x43ac20]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x4214cc
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x421494
mov word [esi], ax
jmp 0x42151a
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebp - 8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov eax, dword [eax*4 + 0x43ac20]
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x43ac20]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x43ac20]
pop ecx
mov byte [eax + edi + 0x2c], cl
jmp 0x42151a
cmp word [ebp - 4], ax
jne 0x4214d6
cmp esi, ebx
je 0x42148c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00421da8
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x42151d
push 0xd
pop eax
jmp 0x42148c
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
mov edi, dword [eax*4 + 0x43ac20]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x421517
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x42151d
mov word [esi], dx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4236fd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42379a
push ebx
push esi
call fcn.004236c6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004223ba
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x423747
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x423799
push edi
push eax
call fcn.0041b310
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x423767
call fcn.0041b2c0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x423798
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004223ba
add esp, 0x20
test eax, eax
jne 0x423786
push edi
call fcn.0041b2c0
jmp 0x42378e
push ebx
call fcn.0041b2c0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x425d8f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041b0e8
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x425dfe
cmp esi, dword [ebp - 4]
je 0x425df9
cmp dword [ebp + 0xc], 0
je 0x425df9
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x425dd6
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004258e4
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x425e00
xor eax, eax
inc eax
jmp 0x425e00
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x425e6b
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.0041b0e8
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0041b0e8
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x425ee2
cmp word [ecx], dx
je 0x425ee2
mov eax, dword [0x431cbc]
push edi
dec eax
push eax
push 0x431ba8
call fcn.00425e04
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x425f55
cmp word [eax], dx
je 0x425f55
mov eax, dword [edi]
test eax, eax
je 0x425f06
cmp word [eax], dx
je 0x425f06
lea eax, [ebp - 0x10]
push eax
call fcn.004257ea
jmp 0x425f0f
lea eax, [ebp - 0x10]
push eax
call fcn.00425885
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x425f7f
mov eax, dword [0x431ba4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x431898
call fcn.00425e04
add esp, 0xc
test al, al
je 0x425f7f
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x425f4a
cmp word [eax], di
je 0x425f4a
lea eax, [ebp - 0x10]
push eax
call fcn.004257ea
pop ecx
jmp 0x425f81
lea eax, [ebp - 0x10]
push eax
call fcn.00425885
jmp 0x425f47
mov eax, dword [edi]
test eax, eax
je 0x425f6c
cmp word [eax], dx
je 0x425f6c
lea eax, [ebp - 0x10]
push eax
call fcn.0042579f
pop ecx
jmp 0x425f7f
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x42604a
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00425c89
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42604a
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x42604a
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x42604a
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x425fd7
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0041e5f0
test ebx, ebx
je 0x426045
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0041e5f0
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42604a
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x42604a
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00429779
add esp, 0x10
xor eax, eax
inc eax
jmp 0x42604c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d818
leave
ret
Function at 0x42b590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42b5bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42b5bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x3759e85
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebx + esi - 0x5eac5834], edx
not word [esp + ebx - 0x5eac582e]
xchg bh, bl
mov ebx, dword [esp + ebx - 0x5eac3448]
push 0xeebee293
lea esp, [esp + 0x18]
jmp fcn.03757bef

Function at 0x385b7cb
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.03757bef

Function at 0x38690b5
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0xdd19ad86
sub esi, 4
push 0x51230f13
push 0x6ba92711
mov dword [esi], edx
not word [esp + 0xd]
jmp 0x415f066
not dword [esp + 4]
lea esp, [esp + 0x10]
jmp fcn.03757bef

Function at 0x387fc5a
Capabilities:
Encode data using base64

Disassembly:
push 0x251031bf
not cx
jmp 0x418a365
jmp 0x507bcaf
not dword [esp + 8]
mov word [ebp], cx
call fcn.0414c052

Function at 0x38806da
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x1c]
jmp fcn.03757bef

Function at 0x3888779
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.03757bef
jmp 0x375b8be
dec eax
mov dword [esp], 0x57892b96
call fcn.0418177e
mov word [esi], ax
mov dword [esp + 8], 0xb803dd1a
jmp 0x38654e7

Function at 0x3e6de1b
Capabilities:
Encode data using base64

Disassembly:
mov ebx, esp
mov ebp, dword [esp + ebp*4 - 0x3e8e4]
call fcn.04140ea6
out dx, al
cmc
movsb byte es:[edi], byte [esi]
xchg byte [esi - 0x98f0705], dh
mov ah, 0x58
inc esi
js 0x3e6deb2
pop ss
jbe 0x3e6dde1
mov eax, dword [0xadc9]
or eax, 0x1d50cbe6
daa
not byte [edi - 0x26]
stosb byte es:[edi], al
ljmp 0x2718
fadd st(6)
inc edi
mov cl, 0xa7
cmp byte [ecx + 0x5e], 0xa4
xor eax, 0x25cf3354
inc ebp
or al, 0xde
and edi, esi
jmp dword [edi + 0x42]

Function at 0x4135ae4
Capabilities:
Encode data using base64

Disassembly:
add ax, 0xbd20
jmp 0x418499d
jmp 0x5010a69
xor ax, 0xa30a
mov dword [esp], 0x8684288b
mov dword [esp + 4], 0x4fb35500
sub ax, 0x1c34
ror byte [esp], 0xe1
push 0xb831b784
push 0x48110f8d
not ax
push 0x5a124db4
xor bx, ax
sub esi, 2
jmp 0x41c9168
Function at 0x413754f
Capabilities:
Encode data using xor

Disassembly:
inc edi
sal ax, 0xe8
bswap edx
sub dx, ax
neg edi
push eax
xor edi, 0xeabdde3f
cwd
mov dword [esp + eax - 0x11b41000], ecx
not eax
xchg dl, al
cbw
add edi, esi
movsx ecx, al
xor edx, 0x4c1551a4
sar eax, 0xe
mov dword [esp + edx - 0x6ca55143], ebp
rol cl, 0x86
cdq
lea ebp, [esp + ecx - 4]
xor eax, edx
push esi
cmovbe edx, eax
cdq
mov dword [esp + eax - 0x46b3], ebx
lea eax, [ebp + eax*2 - 0x8e82]
mov esp, eax
aam 0x51
or byte [eax], al
dec dword [esp]
shr ax, cl
mov word [ebp], ax
not dword [esp]
lea esp, [esp + 4]
jmp fcn.04143412
mov dword [esp + eax - 0x11b405b0], esi
rol ax, 0x67
sal al, 0xa3
mov esi, eax
mov esi, 0
push edx
movsx edx, ax
push edi
movsx edi, ax
mov edi, dword [esp + eax*2 - 0x2369b008]
bts dx, 0xbb
and dl, 0x3d
add dx, dx
not edi
bt dx, dx
jae 0x38271a1
daa
sbb byte [0xc5b062b4], dh
in al, 0xe3
pop edx
in al, 0x1e
adc esi, dword [ecx + esi]
mov byte [0x37339c5a], al
xor dword [edx + 0x37339c5a], esp
les ecx, [edx - 0x33]
push cs
xchg ah, cl
jecxz 0x4137533
pop ds
popfd
push esp
loope 0x4137598
rcl dword [esi + 0x39], cl
outsb dx, byte [esi]
mov dh, byte [edx + ebx*2]
dec ecx
jg 0x413760c
out dx, eax
invalid
popal
dec esi
adc eax, 0x9a3b9598
sub al, 0xf6
wait
lcall 0x4350, 0x2f951afa
enter 0xffffffffffffde62, 0x64
add byte [esi], cl
xchg esi, eax
call 0x8727e0c7
cli
cmp al, 0xa
adc ebp, dword [eax + edi]
cmpsb byte [esi], byte es:[edi]
int3

Function at 0x41394b9
Capabilities:
Encode data using base64

Disassembly:
xor al, bl
sal word [esp + 6], 0xd
jae 0x385df3d
push 0xd1a1018e
inc al
mov dword [esp + 4], 0xa9221e94
sal dword [esp + 8], 0xc7
rol al, 1
neg al
inc dword [esp]
shl dword [esp + 8], 0x6d
dec dword [esp + 8]
rol al, 1
dec dword [esp + 8]
add al, 0x8f
call fcn.03759f58
sysenter
push edx
pushfd
mov edx, 0x55266f1d
mov edx, dword [esp + edx - 0x55266f19]
mov dword [esp + 4], 0xbee3e5f5
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.041950d5
mov dword [esp + 4], 0x9db5329a
jmp 0x377a94e

Function at 0x4148f8a
Capabilities:
Check for software breakpoints

Disassembly:
call fcn.041bf4b7
mov eax, 0x899395b6
movzx ecx, al
mov eax, dword [ecx + esi - 0xb6]
not cx
mov cl, byte [esi + ecx*8 - 0x7fa44]
jmp 0x5067791

Function at 0x418dde2
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x1c]
jmp fcn.03757bef
jmp 0x41708dc

Function at 0x41a9d8f
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x6b150ab8
sal dword [esp], 0x1b
adc esi, 3
rol dword [esp], 0xf7
mov edi, ecx
mov ebp, esi
jae 0x41cde1d
pop esi
jae 0x38271f7

Function at 0x41d14a2
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + edi - 0x485e272d], 0x8a14f1a1
mov esi, edx
rol word [esp + edi - 0x485e2727], 0xe1
inc edi
sar dword [esp + edi - 0x485e272a], 0xe1
mov edi, eax
cld
inc byte [esp + 7]
not dword [esp + 4]
rep movsb byte es:[edi], byte [esi]
js 0x5062c3c
mov esi, dword [esp + 4]
push dword [esp + 8]
popfd
lea esi, [esi + esi*4 - 0x36c9087f]
xchg dword [esp + 4], esi
mov esi, dword [esp + esi - 0x36a1ec5d]
push 0x338b1c84
lea esp, [esp + 0x14]
jmp fcn.04143412
Function at 0x41e1b59
Capabilities:
Encode data using base64

Disassembly:
jnp 0x415e036
call fcn.03778ad3
mov dword ss:[edx], eax
push 0x691b2237
lea esp, [esp + 0x10]
jmp fcn.0415cb60
call fcn.03781d6b
mov eax, 0xd39d4230
mov eax, dword [ebp]
mov edx, 0xacabdd00
or dl, dh
sub edx, 0x9199c88e
mov dx, word [ebp + edx*2 - 0x36242a9a]
jns 0x4145a81

Function at 0x5012c2f
Capabilities:
Encode data using base64

Disassembly:
mov word [esi], ax
lea esp, [esp + 0x18]
jmp fcn.03757bef

Function at 0x50173ac
Capabilities:
Encode data using base64

Disassembly:
ja 0x503e9cb
adc ebp, 6
mov dword [esp], 0x8d8adea0
push 0xb28b0e05
mov byte es:[eax], dl
lea esp, [esp + 8]
jmp fcn.041946e3

Function at 0x5039134
Capabilities:
Encode data using base64

Disassembly:
or ecx, 0x65826a3a
mov dword [esp + edi - 0x6028bc60], edx
sbb ecx, eax
sub di, di
or cx, di
push esi
ror ecx, cl
movsx edx, di
shr di, 0x21
mov dword [esp + edx + 8], ebx
jle 0x503335b
bswap ecx
xor ebp, 0xc886a310
xor edi, 0x5c118025
shl ax, 0xc2
neg eax
lea ebp, [ebp + ecx*2 + 0x2cc221cc]
sal al, 0xa5
jns 0x384bf9d
adc ebp, ebx
dec edi
btc edi, 0xae
not al
mov esi, esp
lea eax, [edi + esi - 0x6027c0db]
movzx ebx, cx
call fcn.03e6f751
xor ebx, ecx
call fcn.0506d61e
ror dl, 1
dec dl
xor dword [esp], eax
xor bl, dl
push eax
lea edx, [esp + edx + 8]
ror ax, 0x87
xor eax, eax
or al, byte [edx + eax]
ror byte [esp + 4], 0xe4
sbb esi, 1
call fcn.05073bfb
adc esi, 1
push 0xa80a16b1
call fcn.03841bfd
outsd dx, dword [esi]
aad 0xcb
and byte [ebx - 0x1c], bh
mov bl, 0x4b
out 0x16, al
xchg esi, eax
js 0x5037957
xchg ebp, eax
mov esi, 0x338e3a7d
and edi, 0x47
jb 0x503790c
or al, 2
leave
xchg edx, eax
adc eax, 0xbc4c999
xlatb
cmp al, byte [edx + 0x4527f1d4]
invalid
push ebx
push eax
mov eax, 0xb3b23ea0
push ecx
push eax
push eax
lea ecx, [eax + eax + 0x6815b791]
pushfd
pop eax
mov dword [esp + 4], eax
not dword [esp]
shr dword [esp], 0xfb
mov dword [esp], edx
push ebp
ror ecx, 0xe9
mov ebx, 0xe8180a95
mov ebx, 0
mov dword [esp + ecx - 0x68e7bd02], edi
movsx edi, cx
jbe 0x5037921
lea eax, [ecx + edi*4 + 0x4782d700]
mov ebp, dword [esp + ecx - 0x68e7bcfe]
rol ebp, 1
lea eax, [eax*2 + 0x7327e3a]
add edi, 0x3c397f3f
add eax, ecx
neg ebp
cwde
jmp 0x41bab3b

Function at 0x5039541
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x20]
jmp fcn.03757bef

Function at 0x505a1fa
Capabilities:
Encode data using base64

Disassembly:
not word [esp + 5]
push 0x518a0f91
lea esp, [esp + 0x10]
jmp fcn.03757bef

Function at 0x508ef9b
Capabilities:
Encode data using base64

Disassembly:
mov word [esi], ax
lea esp, [esp + 0x18]
jmp fcn.03757bef
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1da202f8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6deb0f1f
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x1000c400
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse credit card information
Parse pe header
Resume thread

Disassembly:
jmp 0x10017d21
mov dword [ebp - 0x228], eax
jmp loc.1008aceb
push ebp
dec ax
sar ax, cl
mov ebp, esp
sbb ax, si
rcl eax, cl
push ebx
clc
cmp bp, bp
push edi
stc
push esi
btr ax, 0x18
adc ax, bp
rcl ax, 0x27
sub esp, 0x21c
rcr al, cl
mov eax, dword [0x10086c80]
test bl, 3
cmp ah, 0xbc
xor eax, ebp
stc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x224], 0xbb9ab2f4
mov eax, dword [ebp - 0x224]
jmp 0x1000d9f4

Function at 0x1002ae9a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002aed9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002aed9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002aed9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002aed9
cmp dword [ecx + 0x74], 0xe
jbe 0x1002aed9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002d864
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002d901
push ebx
push esi
call fcn.1002d82d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002d7c1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002d8ae
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002d900
push edi
push eax
call fcn.1002c162
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002d8ce
call fcn.1002c1b0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002d8ff
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002d7c1
add esp, 0x20
test eax, eax
jne 0x1002d8ed
push edi
call fcn.1002c1b0
jmp 0x1002d8f5
push ebx
call fcn.1002c1b0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002db6e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036300
push 0x100362f8
push str.FlsAlloc
push 0x1f
call fcn.1002da8a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002dba2
push dword [ebp + 8]
mov ecx, esi
call dword [0x10034154]
call esi
jmp 0x1002dba8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1002dbec
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036310
push 0x10036308
push str.FlsGetValue
push 0x21
call fcn.1002da8a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002dc23
push dword [ebp + 8]
mov ecx, esi
call dword [0x10034154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1002dc2b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10036318
push 0x10036310
push str.FlsSetValue
push 0x22
call fcn.1002da8a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002dc65
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10034154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10033170
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003319d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003319d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4026b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor edx, edx
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x4026bd
mov dword [edx*4 + 0x423458], ecx
inc edx
cmp edx, 0x100
jb 0x4026b8
mov esi, 0x800
jmp 0x402705
mov ecx, dword [edx*4 + 0x423058]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x423458]
mov dword [edx*4 + 0x423458], ecx
inc edx
cmp edx, esi
jb 0x4026e9
mov dword [0x425458], 0x402962
call fcn.004025dc
mov ecx, dword [0x425458]
test eax, eax
mov edx, 0x4029fb
cmove ecx, edx
mov dword [0x425458], ecx
pop esi
ret

Function at 0x402783
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov esi, dword [edi]
test esi, esi
je 0x4027dd
and dword [edi], 0
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0
push eax
mov edx, 0x400000
mov eax, esi
cmp esi, edx
cmova eax, edx
push eax
push ebx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add ebx, ecx
add dword [edi], ecx
sub esi, ecx
test eax, eax
je 0x4027d5
test ecx, ecx
je 0x4027dd
test esi, esi
je 0x4027dd
mov ecx, dword [ebp - 4]
jmp 0x40279b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4027df
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret