joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44eb20
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x44eb86
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x44eb86
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x44eb67
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4657ff
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x465837
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004638b3
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046388b
jmp 0x465843
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x466eed
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x466f2f
call fcn.0046ca66
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x466f2f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x466f26
xor eax, eax
jmp 0x466f37
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00466f3d
pop edi
pop esi
pop ebx
ret 4

Function at 0x46cf96
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46cfc4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46cfe2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046cefc
jmp 0x46cfe2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46cfe2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046cefc
test edi, edi
mov eax, edi
jne 0x46cfcc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x764284
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x12]
mov dword [esp + 0x8c], edi
lea esp, [esp + 0x8c]
jmp 0x76426b
pushal
lea esp, [esp + 0x4e]
push edx
pushal
pop dword [esp + 0x16]
mov dword [esp + 0x17], esi
jmp 0x76423f
pushfd
neg bh
jne 0x76428b
stc
xchg edx, ecx
bswap edi
call fcn.007642e5
sbb bl, byte [ebp + 0x63a7540d]
insb byte es:[edi], dx
jg 0x7642c9
int1
mov word [esp + 2], dx
jmp 0x76425a
stc
jmp 0x76430e
mov dword [edi - 0x3b75dbc4], 0x53c5d7eb
ret
xchg edx, ecx
bswap edi
mov esi, dword [esp + 0x28]
jmp 0x764352
not cx
jmp 0x764335
lea edi, [esp]
neg ah
jbe 0x76439a
sub esp, 0x1c
btc eax, edi
add ecx, ebp
jmp 0x764383
lea ebp, [edi*4]
mov dl, 0x54
add al, dh
ja 0x764318
not cx
jmp 0x764335
mov ebp, esp
bsf ax, si
jb 0x76439f
cpuid
mov edx, 0x69afdcb8
rcl eax, 0x17
jmp 0x76440a
btc eax, edi
add ecx, ebp
sub esp, 0xa4
jmp 0x764364
sub esp, 0x1c
jmp 0x76437e
cpuid
jmp 0x764402
mov edx, 0x69afdcb8
rcl eax, 0x17
mov eax, esi
mov edx, 0x8d20e910
call fcn.007643eb
dec cl
lea esi, [esi - 0x73]
push esp
lea edx, [eax + 0xd9]
pop edx
xchg ecx, edx
not edx
jmp 0x76442d
xchg dword [esp], esi
mov cx, si
mov cl, byte [esp]
bswap ecx
lea ebx, [ecx + 0x63]
xchg ebx, edx
jmp 0x764542
push dword [esp]
ret 4
Function at 0x8c95ea
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x8c960c
mov eax, 0xfffffffd
jmp 0x8c96c0
mov ebx, dword [0x100f7fc8]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x8c968e
mov ebx, dword [0x100f7fc8]
add ebx, 8
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 2
jne 0x8c9660
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x8c9649
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x100f7fc8]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x8c96b6
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x8c96c0
mov esp, ebp
pop ebp
ret 4
Function at 0x908221
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret
Function at 0x92ca7a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x10104a70]
xor edx, edx
cmp eax, edx
jne 0x92caa0
xor eax, eax
mov byte [eax + 0x10104970], al
inc eax
cmp eax, 0x100
jl 0x92ca88
mov dword [0x10104a70], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x10104970
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x92cb31
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x92cb04
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x92cad2
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x92cbaa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x92cbfd
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x92cbe4
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x9fe9e4
Capabilities:
Check for software breakpoints

Disassembly:
invalid
mov al, 0x62
add byte [eax], bh
xor al, 0x9f
sbb byte [ecx + ebp*2 + 0x21], ch
cmp al, 0x12
mov al, 0xb6
std
aaa
adc esi, ebx
pop edx
add byte [ecx], 0x1f
mov esp, 0xff16b025
aaa
std
dec eax
cmpsb byte [esi], byte es:[edi]
out dx, al
insb byte es:[edi], dx
push ds
mov esp, 0xfd96b04a
aaa
ja 0x9fea8a
call 0x3cc152f4
jb 0x9fe9c5
invalid
cmp al, 0xbc
mov al, 0x82
std
aaa
aam 0xe2
aas
dec edx
push esi
and al, 0x3c
sbb al, 0xb0
into
std
aaa
xor dword [ecx + 0x1f0a8e5d], 0xffffffbc
push ecx
mov al, 0x6a
std
aaa
sal edx, cl
invalid

Function at 0xa024be
Capabilities:
Check for software breakpoints

Disassembly:
cmp byte [ebp + 0x78af04bb], dl
and dword [ecx + edx*4], edi
add eax, 0xbc201436
xlatb
mov al, 0xb2
std
aaa
loope 0xa02473
push 0xfc1f4d57
Function at 0xa06f50
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
push dword [edi]
mov bl, 0x86
xor bh, byte [ecx + 0x797c1ef4]
mov al, 0xc2
std
aaa
jno 0xa06f4d
mov word [esi - 0x4c], es
pop ds
mov esp, 0xfe6eb004
aaa
push 0x85b1414d
push ds
mov esp, 0xfd96b0f9
aaa
cmp byte [eax - 0x70], 0x6f
cmp bl, byte [edi]
cld
sahf
mov al, 0xc6
invalid

Function at 0xa08b06
Capabilities:
Encode data using xor

Disassembly:
push ds
sub ah, byte [eax]
cmp al, 0x6c
mov al, 0x8a
std
aaa
adc al, 0x32
invalid

Function at 0xa097cf
Capabilities:
Encode data using xor

Disassembly:
aaa
aaa
aad 0xf
add eax, 0xb0233c1f
and bh, bh
aaa
pop edx
xchg ecx, eax
mov byte [edi], 0xe5
pop ds
cld
scasb al, byte es:[edi]
mov al, 0x86
std
aaa
and dh, byte [ebx]
add eax, 0x7c20e3fc
xor dword [eax + 0x1937fda2], esi
push ecx
mov dl, 0x35
push edx
and dword [esp], edi
mov al, 0x76
std
aaa
xor esi, edx
cmp cl, byte [esi - 0x4503dfb8]
mov al, 0xfe
std
aaa
or al, 0x74
jge 0xa097f6
and byte [esp + ecx*4], bh
mov al, 0xa6
add byte [eax], bh
invalid

Function at 0xa0cf4f
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0xd3
mov al, 0x22
invalid
mov ecx, 0xb02c3c1e
push dword cs:[edi]
aaa
aaa
xor byte [ecx], dl
jl 0xa0cf48
pop ds
jl 0xa0cfa8
mov al, 0x82
add bh, byte [eax]
jbe 0xa0cf02
adc edx, dword [edi - 0x26c3e030]
mov al, 0x82
std
aaa
mov dl, 0x32
or al, 0xd8
and bh, byte [ebx]
mov al, 0xaa
push dword [edi]
test al, 0xbd
mov dl, 0x43
and dword [esp + edi*2], 0xfffffff7
mov al, 6
invalid
movsb byte es:[edi], byte [esi]
and al, 0x3c
or dh, byte [eax + 0x3637fd96]
add dword [ebp + 0x13], edx
and byte [eax], ah
jl 0xa0d00a
mov al, 0xae
std
aaa
ret 0x9105
cmp al, 0x40
mov al, 0xb6
std
aaa
add eax, dword [eax]
fisttp word [ebx + 0x65]
and al, 0x7c
xor dword [eax + 0x3e380122], 0x67015f00
push ds
mov esp, 0xfd82b07f
aaa
aam 0xe2
aas
dec edx
dec esi
and dword [ebx*8 + 0x37fdc6b0], edi
xchg edx, eax
mov ebx, 0x3c1fa0cf
cmp dword [eax + 0x6637ff5e], esi
dec edi
das
mov ebx, 0x5e7c2470
mov al, 0x12
invalid

Function at 0xa5068f
Capabilities:
Encode data using xor

Disassembly:
and esp, dword [ebx + 0x45f85648]
jge 0xa506e2
sub byte [edx], bh
out dx, al
mov edi, 0xe7f4ec3e
and dword [edx + 0x40d589f0], ecx
mov fs, word [edx + 0x7516505c]
sub esi, dword [ebp - 0x75]
pushfd
xchg esp, eax
mov esi, 0xd1c8bb21
stosb byte es:[edi], al
mov bl, 0xd2
xor dword [ecx - 0x76], ebp
push es
mov edi, 0x22b656b2
mov esi, 0x10f961f4
or ecx, ebx
mov ds, ebp
push 0x18
rcr ch, 0xb4
cdq
or al, 0x77
invalid
adc byte [ebx], cl
retf
xor byte [edi - 0x15], 7
std
push 0x73
fidivr word [ebx - 0x80]
out 0xfc, eax
ficomp word [ebx]
push edx
jle 0xa506c6
idiv byte [ecx + edi]
mov byte [0x6b435991], al
or ah, byte [ebp - 0x65]
adc dword [edx + 0x41], eax
add ch, cl
xor eax, 0xf7d88a9f
out dx, eax
stosb byte es:[edi], al
dec esp
jp 0xa5070d
invalid
Function at 0xa57dbc
Capabilities:
Encode data using xor

Disassembly:
push edi
pushal
pushal
mov dword [esp + 0x40], edi
mov word [esp], 0xc442
call fcn.00a5574e
add byte [ecx + 0x44], al
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x17], ah
sbb edi, esi
add byte [eax], al
mov cs, word [eax - 0x535ec38e]
cmp byte [edx - 0x30], cl
mov al, 0xaf
mov bl, 0x85
xchg ebx, eax
add ecx, 1
push edx
clc
test ah, ah
jmp 0xa58494
lea esp, [esp + 0x38]
jne 0xa59c09
jb 0xa514b5
pushfd
pushal
pushfd
mov dword [esp + 0x24], edi
pushfd
jmp 0xa5d27a
jmp 0xa6097f
mov dword [esp + 0x24], ebx
mov word [esp], si
jmp 0xa6173d
call fcn.00a52853
ljmp 0xa539

Function at 0xa5bf38
Capabilities:
Encode data using xor

Disassembly:
add edi, 1
call fcn.00a51dce
mov byte [edx + 0x68], bh
stosb byte es:[edi], al
push ebx
push es
xchg edi, eax
and esp, dword [edx - 0x18d2e6f6]
dec ecx
push ebx
jno 0xa5bf00
invalid
mov ebp, 0x6e580863
sub al, 0xbd
or eax, 0x5186c923
xchg dword [ebx], ecx
xchg ecx, eax
mov word cs:[edx + ebx*4], gs
in eax, 0xe4
cmpsb byte [esi], byte es:[edi]
xor edx, dword [eax + 0x5c146eec]
pushfd
push dword [esp]
lea esp, [esp + 0x18]
jne 0xa60073
aaa
clc
and ax, 0xd6b9
daa
xor edx, edx
pushal
pop eax
rcr ah, cl
bswap eax
mov eax, edx
sar al, 7
jmp 0xa5bf20

Function at 0xa5d1ae
Capabilities:
Encode data using xor

Disassembly:
lock adc dl, byte [edi + 0xf]
or byte [ecx - 0x64072c92], ah
mov bh, 0xbb
sahf
js 0xa5d101
call 0x1269f9fd
outsb dx, byte [esi]
mov ch, 0x69
jae 0xa5d1da
fcmovnbe st(0), st(1)
pop ss
add dword [edi - 0x6b], ebp
cmpsd dword [esi], dword es:[edi]
pop eax
jecxz 0xa5d120
adc al, 0xc8
imul dl
iretd
mov ebx, 0x284c37f8
dec esi
ja 0xa5d164
cmc
xchg ecx, eax
insb byte es:[edi], dx
mov dword [0xae4e04f], eax
pop eax
sub al, 0x9d
popfd
popfd
imul ebx, dword [ebp + 0x2a], 0x53
pop ds
rol byte [eax + 0x63e60d49], 0xdb
in eax, dx
cmpsb byte [esi], byte es:[edi]
pushfd
das
push edi
add dword [eax - 0x4e80de0f], ebx
js 0xa5d20a
inc dl
xchg ebx, eax
sbb al, 0xac
adc dword [edx - 0x27], 0x1c9c62ed
stosb byte es:[edi], al
cmp eax, 0x905a5e7f
insd dword es:[edi], dx
jp 0xa5d19c
hlt
inc ecx
cmp ebp, dword [eax]
adc al, 2
fisttp dword [ecx + 0xd]
sub byte [ebx + edi*4 + 0xaf4c887], dl
dec edi
cmp eax, 0xb96f84bb
movsd dword es:[edi], dword [esi]
fisub word [esp + ecx + 0x65a5ba97]
add dword [eax + 0x36e0a155], ecx
adc ch, byte [esi - 0x41df0c7e]
xlatb
adc ecx, eax
or al, 0x97
mov edx, 0x880165a5
push ebp
mov eax, dword [0xae1236e0]
xor bl, 0x20
mov esi, 0xc111d767
loopne 0xa5d223
push edx
push es
and dword [ecx - 0xf0ad306], eax
invalid
Function at 0xa6d0b0
Capabilities:
Get number of processors

Disassembly:
pop edi
xor esp, dword [esi + 0x33]
imul esi, dword [ebx], 0x78
xor edi, dword [ebp + 0x33]
xor byte [ebx], 0x87
xor ecx, dword [ebx + esi + 0x339b3393]
mov al, byte [0xab33a533]
xor esi, dword [edx - 0x40cc45cd]
xor eax, esp
xor ecx, ecx
xor ecx, esi
xor edx, ebx
xor ebx, ecx
xor esp, eax
xor ebp, eax
xor ebp, ebp
xor esi, edx
xor edi, eax
xor edi, edi
xor eax, dword [edi]
xor al, 0xc
xor al, 0x11
xor al, 0x17
xor al, 0x1e
xor al, 0x26
xor al, 0x2b
xor al, 0x30
xor al, 0x36
xor al, 0x3d
xor al, 0x46
xor al, 0x4e
xor al, 0x53
xor al, 0x58
pop eax

Function at 0xa6d108
Capabilities:
Get number of processors

Disassembly:
jae 0xa6d13e
js 0xa6d140
jge 0xa6d142
xor byte [ecx + ecx*4], 0x34
xchg edx, eax
xor al, 0x98
xor al, 0xa9
xor al, 0x29
xor eax, 0x36643599
xchg ebx, eax
clc
fidiv dword ss:[edi]
or bh, byte [ecx]
test eax, 0xee3b283a
cmp esp, dword [esi + 0x233cbf3c]
push ds
Function at 0xa705a2
Capabilities:
Parse credit card information

Disassembly:
je 0xa705df
js 0xa705e1
jl 0xa705e3
cmp byte [ebx], 0x84
cmp ecx, dword [eax - 0x6fc473c5]
cmp edx, dword [ebx + edi + 0x3b9c3b98]
mov al, byte [0xa83ba43b]
cmp ebp, dword [ebx + edi + 0x3bb43bb0]
mov eax, 0xc03bbc3b
cmp eax, esp
cmp ecx, eax
cmp ecx, esp
cmp edx, eax
cmp edx, esp
cmp ebx, eax
cmp ebx, esp
cmp esp, eax
cmp esp, esp
cmp ebp, eax
cmp ebp, esp
cmp esi, eax
cmp esi, esp
cmp edi, eax
cmp edi, esp
cmp eax, dword [eax]
cmp al, 4
cmp al, 8
cmp al, 0xc
cmp al, 0x10
cmp al, 0x14
cmp al, 0x18
cmp al, 0x1c
cmp al, 0x20
cmp al, 0x24
cmp al, 0x28
cmp al, 0x2c
cmp al, 0x30
cmp al, 0x34
cmp al, 0x38
cmp al, 0x3c
cmp al, 0x40
cmp al, 0x44
cmp al, 0x48
cmp al, 0x4c
cmp al, 0x50
cmp al, 0x54
cmp al, 0x58
cmp al, 0x5c
cmp al, 0x60

Function at 0xa70954
Capabilities:
Parse credit card information

Disassembly:
call 0xf8e0fd92
cmp dword [eax], eax
cmp al, byte [edx + edi]
sbb al, 0x3a
xor al, 0x3a
dec esp
cmp ah, byte [edx + edi + 0x7c]
cmp dl, byte [edx + edi + 0x3ab43ab0]
mov ah, 0x3a

Function at 0xa7096c
Capabilities:
Parse credit card information

Disassembly:
mov ah, 0x3a
mov eax, 0xc03abc3a
cmp al, ah
cmp cl, al
cmp cl, ah
cmp dl, al
cmp dl, ah
cmp bl, al
cmp bl, ah
cmp ah, al
cmp ah, ah
cmp ch, al
cmp ch, ah
cmp dh, al
cmp dh, ah
cmp bh, al
cmp bh, ah
cmp al, byte [eax]
cmp eax, dword [ebx + edi]
Function at 0xa70996
Capabilities:
Parse credit card information

Disassembly:
or byte [ebx], bh
or al, 0x3b
adc byte [ebx], bh
adc al, 0x3b
sbb byte [ebx], bh
sbb al, 0x3b
and byte [ebx], bh
and al, 0x3b
sub byte [ebx], bh
sub al, 0x3b
xor byte [ebx], bh
xor al, 0x3b
cmp byte [ebx], bh
cmp al, 0x3b
inc eax
cmp eax, dword [ebx + edi + 0x48]
cmp ecx, dword [ebx + edi + 0x50]
cmp edx, dword [ebx + edi + 0x58]
cmp ebx, dword [ebx + edi + 0x60]
cmp esp, dword [ebx + edi + 0x68]
cmp ebp, dword [ebx + edi + 0x70]
cmp edi, dword [eax + 0x3b]
jl 0xa70a0b
xchg esp, eax
cmp esi, dword [eax - 0x47c44bc5]
cmp edi, dword [ebx + edi + 0x3bc43bc0]
enter 0xffffffffffffcc3b, 0x3b
sar byte [ebx], 1
aam 0x3b
fdivr dword [ebx]
fdivr qword [ebx]
loopne 0xa70a27
in al, 0x3b
call 0xf0e2f62e
cmp esi, esp
cmp edi, eax
cmp edi, esp
cmp eax, dword [eax]
cmp al, 4
cmp al, 8
cmp al, 0xc
cmp al, 0x10
cmp al, 0x14
cmp al, 0x18
cmp al, 0x1c
cmp al, 0x20
cmp al, 0x24
cmp al, 0x28
cmp al, 0x2c
cmp al, 0x30
cmp al, 0x34
cmp al, 0x38
cmp al, 0x3c
cmp al, 0x40
cmp al, 0x44
cmp al, 0x48
cmp al, 0x4c
cmp al, 0x50
cmp al, 0x54
cmp al, 0x58
cmp al, 0x5c
cmp al, 0x60
cmp al, 0x64
cmp al, 0x68
cmp al, 0x6c
cmp al, 0x70
cmp al, 0x78
cmp al, 0x7c
cmp al, 0x94
cmp al, 0xac
cmp al, 0xc4
cmp al, 0xdc
cmp al, 0xf4
cmp al, 0xc
cmp eax, 0x3d3c3d24
push esp
cmp eax, 0x3d843d6c
pushfd
cmp eax, 0x3dcc3db4
in al, 0x3d
cld
cmp eax, 0x3e2c3e14
inc esp
pop esp
js 0xa70aa0
jl 0xa70aa2
cmp byte [esi], 0x84
mov byte ds:[esi], bh
invalid
clc
cld
cld
add byte ds:[edi], bh
add al, 0x3f
or byte [edi], bh
or al, 0x3f
adc byte [edi], bh
adc al, 0x3f
sbb byte [edi], bh
sbb al, 0x3f
and byte [edi], bh
and al, 0x3f
sub byte [edi], bh
sub al, 0x3f
xor byte [edi], bh
xor al, 0x3f
cmp byte [edi], bh
cmp al, 0x3f
inc eax
aas
inc esp
aas
mov eax, 0xd43fbc3f
aas
in al, dx
aas
add byte [eax], al
add byte [eax + 0x2a0000d], dh
add byte [eax], al
add al, 0x30

Function at 0xa70c7d
Capabilities:
Get number of processors

Disassembly:
pushal
push 0x70366c36
je 0xa70cc0
js 0xa70cc2
jl 0xa70cc4
xor byte [esi], 0x84
mov byte ss:[esi], dh
invalid
sub al, 0x3b
inc esp
cmp ebx, dword [ebx + edi + 0x74]
invalid
invalid
invalid
movsb byte es:[edi], byte [esi]
invalid
invalid
pop esp
cmp esi, dword [ebx + edi - 0x74]
invalid
movsb byte es:[edi], byte [esi]
invalid
invalid

Function at 0xa71120
Capabilities:
Get number of processors
Parse credit card information

Disassembly:
cmp al, 0xc
cmp eax, 0x3d3c3d24
push esp
cmp eax, 0x3d803d6c
test byte [0x3ea03e9c], bh
movsb byte es:[edi], byte [esi]
test al, 0x3e
lodsb al, byte [esi]
mov al, 0x3e
mov ah, 0x3e
mov eax, 0xc03ebc3e
mov esp, 0xc43ec03e
enter 0xffffffffffffcc3e, 0x3e
sar byte [esi], 1
aam 0x3e
fdivr dword [esi]
fdivr qword [esi]
loopne 0xa71172
in al, 0x3e
call 0xf0e5fd79
hlt
test byte [edi], bh
mov byte [edi], bh
invalid

Function at 0xa713ee
Capabilities:
Parse credit card information

Disassembly:
inc esp
xor eax, 0x354c3548
xor eax, 0x3594357c
lodsb al, byte [esi]
xor eax, 0x35dc35c4
hlt
Function at 0xd047be
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, ah
mov dword [esp + 3], eax
lea esp, [esp + 3]
xchg dword [esp], esi
lea edx, [eax + edx]
setle dh
jmp 0xd0476f
seto dh
lea edx, [esi - 0x25d82803]
push edx
not edx
jmp 0xd04789

Function at 0xd0622e
Capabilities:
Get number of processors
Parse pe header

Disassembly:
mov dword [esp + 0x15], ebp
push word [esp + 0x1f]
mov word [esp + 0x12], dx
mov word [esp + 0xe], sp
jmp 0xd0625b
push dword [esp + 0x20]
jmp 0xd06215
pop dword [esp + 0xa]
push dword [esp + 0x1a]
lea esp, [esp + 2]
mov dword [esp + 0x50], edi
jmp 0xd062c6
push eax
jmp 0xd06003
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xd0628a
lea esp, [esp + 0x50]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xd062a4
Function at 0x40234f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push edi
xor eax, eax
push eax
xor eax, eax
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
test eax, eax
jne 0x402381
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
push 8
pop eax
push eax
call dword [0x482e54]
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edi + 4], eax
mov esi, dword [ebp + 8]
mov dword [esi], edi
add esp, 4
mov eax, dword [edi]
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ffb0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47506b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004695cc
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x410032
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00466c8d
mov eax, dword [eax]
push 0x48d1d0
push eax
call fcn.004590b4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00469857
test bl, bl
je 0x410032
push 0x48d1d0
lea ecx, [esp + 0xc]
call fcn.00469be7
push 0x490d4c
lea ecx, [esp + 0xc]
call fcn.00469be7
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41006e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00469857
jmp 0x410139
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4100f2
lea edx, [esp + 0x7c]
push 0x490d48
push edx
call fcn.004590b4
add esp, 8
test eax, eax
je 0x4100f2
lea eax, [esp + 0x7c]
push 0x490d44
push eax
call fcn.004590b4
add esp, 8
test eax, eax
je 0x4100f2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x410082
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00469857
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x410930
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x410992
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc