joyce8/EMBER2024-capa huggingface dataset:
Function at 0x805e60
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805e66
pop ebp
sub ebp, 6
sub ebp, 0x405e60
jmp 0x805ec4
jmp 0x805ecd
mov eax, 0x405e60
add eax, ebp
add eax, 0x93
mov ecx, 0x623
mov edx, 0xe3ee1910
xor byte [eax], dl
inc eax
dec ecx
jne 0x805ee4
jmp 0x805ef7
jp 0x805f49
js 0x805f0b
add byte [eax], dl
adc byte [eax + 0x10], bh
fdivr qword [eax + edx]
and edx, eax
inc eax
out dx, eax
test dword [eax], edx
shl dword [esi], 0x10
inc eax
wait
adc byte [eax - 0x65], al
fstp qword [ebx + 0x10102c99]
adc byte [ecx + 0x1010e8d1], dl
adc byte [ebx], dl
invalid
adc al, bh
adc eax, 0xf9101010
adc byte [eax], dl
stc
cmp byte [eax], dl
adc byte [eax], dl
inc ebp
wait
cld
wait
xchg ebp, eax
sbb byte [eax], dl
adc byte [eax], dl
wait
test dword [eax + edx], ebx
adc byte [eax], dl
wait
popfd
add byte [eax], dl
adc byte [eax], dl
sar ecx, 1
adc ah, byte [ecx]
adc dl, byte [ebx + 0x1f5914d2]
xchg ebp, eax
in al, 0xef
out dx, eax
out dx, eax
dec ebp
rcr byte [eax + edx], cl
wait
pushfd
xor al, 0x14
adc byte [eax], dl
adc byte [eax - 0x5f], bh
sbb dword es:[eax], edx
js 0x805f45
aaa
daa
adc byte [ecx], dl
cmp al, 0x34
inc ecx
clc
adc eax, 0xf9101010
das
adc dl, byte [eax]
adc byte [ebp + 0x44], al
dec ebp
out dx, eax
sbb al, 0xef
sbb al, bh
bound edx, qword [eax]
adc byte [eax], dl
wait
lodsd eax, dword [esi]
sbb byte [eax], dl
adc byte [eax], dl
xchg ecx, eax
loope 0x805ffa
add dl, bl
and edx, dword [ecx - 0x25ffb31f]
and esp, dword [ebx]
fldenv [ebx]
ret 0xf893
clc
adc al, 0xf9
lodsd eax, dword [esi]
out dx, eax
out dx, eax
out dx, eax
cmp dword [ecx + ebp + 0x12], eax
xchg ebx, eax
rcl dword [esi]
xchg ebx, eax
cli
adc al, 0x93
clc
adc eax, 0xefefbbf9
out dx, eax
dec ebp
rcr byte [eax + edx], cl
inc ebp
wait
cld
inc esi
inc edi
inc ebp
wait
sbb al, 0x9b
insd dword es:[edi], dx
sbb ah, ch
mov byte [0x91169a90], al
salc
adc dword [eax], edx
adc byte [eax], dl
cwde
pop ss
xchg ecx, eax
xlatb
adc dword [eax], edx
adc byte [eax], dl
stosd dword es:[edi], eax
adc dl, byte [eax]
adc byte [eax], dl
adc al, dl
pop ds
xchg ebp, eax
adc eax, 0x9a101010
push es
push esi
add al, dl
pop ds
xchg ebx, eax
enter 0xffffffffffffefef, 0xffffffffffffffef
adc al, dl
pop ds
xchg ebp, eax
adc eax, 0x9a101010
push es
push esi
add al, dl
pop ds
xchg ebx, eax
jp 0x80606f
adc byte [eax], dl
and edx, eax
adc al, dl
pop ds
xchg ebp, eax
adc eax, 0x9a101010
push es
push esi
add al, dl
pop ds
xchg ebx, eax
cmp dl, byte [ecx]
adc byte [eax], dl
adc al, dl
pop ds
xchg ebp, eax
adc eax, 0x9a101010
push es
push esi
add al, dl
add edx, eax
adc al, dl
pop ds
xchg ebp, eax
adc eax, 0x9a101010
push es
push esi
add al, dl
add edx, eax
adc al, dl
pop ds
xchg ebp, eax
adc eax, 0x9a101010
push es
push esi
add al, dl
add edx, eax
adc al, dl
pop ds
xchg ebp, eax
adc eax, 0x9a101010
push es
push esi
add al, dl
add edx, eax
pop ds
xchg esp, eax
push ss
adc byte [eax], dl
adc byte [ebx - 0x6537c431], bl
adc ebx, dword [eax + 0x12ab5717]
adc byte [eax], dl
adc cl, bh
pushal
out dx, eax
out dx, eax
out dx, eax
test al, 0x11
adc byte [eax], dl
adc byte [edx], dl
ret 0x951f
ret 0x931f
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x290e1699
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x33fc3f88
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40107e
Capabilities:
Delete file
Manipulate console buffer
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1044
call fcn.0040dcf0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [eax + 4]
xor ebx, ebx
cmp dword [0x440674], 0x594
push edi
mov dword [ebp - 0x14], ecx
jne 0x4010b6
push ebx
lea eax, [ebp - 0x844]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x431338]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x43133c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x38], 0x9e3779b9
call fcn.00401077
mov eax, dword [0x431340]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x28], eax
mov eax, dword [0x431344]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x20
jmp 0x4010fb
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [ebp - 0x14]
shl eax, 4
cmp dword [0x440674], 0xc
mov dword [ebp - 4], eax
jne 0x401156
push ebx
lea eax, [ebp - 0x844]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push ebx
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
xor eax, eax
mov word [ebp - 0x20], ax
lea edi, [ebp - 0x1e]
stosw word es:[edi], ax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x1044]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [0x440674]
cmp eax, 0xfa9
jne 0x401172
mov dword [0x440670], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401198
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4405c8], ebx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add eax, edx
shr edx, cl
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [0x44066c], 0xf4ea3dee
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add eax, esi
shr esi, cl
mov dword [ebp - 0x1c], eax
add esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
cmp dword [0x440674], 0xb03
jne 0x401211
push str.yacey_jutesepage_vomebawaridamuzixobonawodewagim
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
xor dword [ebp - 4], esi
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
sub dword [ebp - 8], eax
dec dword [ebp - 0x24]
jne 0x4010f8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x40145c
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4292e1
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
cmp dword [0x440674], 0x400
push edi
jne 0x40151d
push 0xf
pop esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
push ecx
push ecx
mov eax, esp
mov dword [esp + 0x44], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401c00
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401940
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.004015f0
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.0040194a
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401720
fstp st(0)
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00401ac0
fstp st(0)
or dword [esp + 0x44], 0xffffffff
add esp, 8
cmp dword [esp + 0x2c], 0x10
jb 0x401511
push dword [esp + 0x18]
call fcn.00401970
pop ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
call esi
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d51
jg 0x401540
inc edi
cmp edi, 0x4eed4
jl 0x401525
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
cmp esi, 0x2b257f
jg 0x40155a
inc esi
cmp esi, 0x118bb
jl 0x401542
xor esi, esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
cmp esi, 0x2afdec
jle 0x40157a
cmp dword [esp + 0x10], 0x787c7e45
jne 0x401583
inc esi
cmp esi, 0x42f7
jl 0x40155c
mov eax, dword [0x433c8c]
mov dword [0x440674], eax
call fcn.0040124c
mov esi, 0x3078f
cmp dword [0x440674], 0x51f
jne 0x4015ac
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
dec esi
jne 0x401597
mov ecx, dword [esp + 0x34]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403420
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4301c8]
jne 0x40342a
repz ret
jmp fcn.0040800e
Function at 0x407c3b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040492b
and dword [ebp - 4], 0
cmp dword [0x43562c], 0
mov ebx, eax
jne 0x407cec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407d9d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407d9d
push eax
call fcn.004048b9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43562c], eax
call esi
push eax
call fcn.004048b9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435630], eax
call esi
push eax
call fcn.004048b9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435634], eax
call esi
push eax
call fcn.004048b9
pop ecx
mov dword [0x43563c], eax
test eax, eax
je 0x407cec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004048b9
pop ecx
mov dword [0x435638], eax
mov eax, dword [0x435638]
cmp eax, ebx
je 0x407d44
cmp dword [0x43563c], ebx
je 0x407d44
push eax
call fcn.00404934
push dword [0x43563c]
mov esi, eax
call fcn.00404934
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407d44
test edi, edi
je 0x407d44
call esi
test eax, eax
je 0x407d3b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407d3b
test byte [ebp - 0xc], 1
jne 0x407d44
or dword [ebp + 0x10], 0x200000
jmp 0x407d7d
mov eax, dword [0x435630]
cmp eax, ebx
je 0x407d7d
push eax
call fcn.00404934
pop ecx
test eax, eax
je 0x407d7d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407d7d
mov eax, dword [0x435634]
cmp eax, ebx
je 0x407d7d
push eax
call fcn.00404934
pop ecx
test eax, eax
je 0x407d7d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43562c]
call fcn.00404934
pop ecx
test eax, eax
je 0x407d9d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407d9f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x438c86
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
add eax, 0xac2869ba
call fcn.00438cc7
dec eax
or esi, esi
xor dword [ebx], edx
and eax, esi
add esi, esi
add esi, esi
inc ebx
sub eax, 0x6130eb04
add esi, 0x18b088f6
sub esi, 0x23bffea4
cmp ebx, ecx
jne fcn.00438c86
add esi, 0x42fed9fb
mov esi, eax
ret
Function at 0x416c80
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x4171a0
test edx, edx
je 0x4171a0
call fcn.00416c97
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x4171e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00416c80
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x417251
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x417216
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x41b72f
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x667950
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x704034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
lea edi, [ebx + 4]
lea esi, [ebp + 0xc]
mov dword [ebx], eax
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x18]
push 0x6c38e0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebx + 0x10], 0
and dword [ebx + 0x14], 0
call fcn.00429293
push 0x6cddaf
lea ecx, [ebx + 0x30]
call fcn.00429293
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41c763
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41c7be
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41c7af
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x41c7ab
cmp esi, ecx
jae 0x41c7af
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x41c799
cmp esi, ecx
jb 0x41c7b3
xor eax, eax
jmp 0x41c7bd
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4246e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x704034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov edx, dword [ebp + 8]
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42475a
cmp dword [ebp - 8], 1
je 0x424732
cmp dword [ebp - 8], 2
je 0x424732
push 0xd
pop eax
jmp 0x42475a
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x424754
test ecx, ecx
je 0x42474f
test cl, 1
jne 0x42472d
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x424754
jmp 0x42472d
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00620676
mov esp, ebp
pop ebp
ret 0xc
Function at 0x430560
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
test edx, edx
jne 0x430574
xor eax, eax
jmp 0x430697
push ebx
mov eax, edx
xor edx, edx
push 3
pop ecx
div ecx
mov ecx, eax
mov ebx, edx
xor eax, eax
mov dword [ebp - 4], ecx
test ebx, ebx
mov dword [ebp - 8], ebx
setne al
add eax, ecx
xor ecx, ecx
shl eax, 2
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0063e7be
mov edx, eax
mov dword [ebp - 0xc], edx
pop ecx
test edx, edx
je 0x430696
cmp dword [ebp - 4], 0
push esi
mov esi, edx
jbe 0x430621
mov ebx, dword [ebp - 4]
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
movzx edx, byte [edi + 2]
add edi, 3
shl eax, 8
shl ecx, 0x10
or ecx, eax
or edx, ecx
mov eax, edx
shr eax, 0x12
mov al, byte [eax + 0x6c3cb0]
mov byte [esi], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x6c3cb0]
mov byte [esi + 1], al
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
mov al, byte [eax + 0x6c3cb0]
mov byte [esi + 2], al
mov al, byte [edx + 0x6c3cb0]
mov byte [esi + 3], al
add esi, 4
sub ebx, 1
jne 0x4305c0
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp ebx, 1
jne 0x43064d
movzx ecx, byte [edi]
mov eax, ecx
and ecx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + 0x6c3cb0]
mov byte [esi], al
mov al, byte [ecx + 0x6c3cb0]
mov byte [esi + 1], al
mov word [esi + 2], 0x3d3d
jmp 0x43068d
cmp ebx, 2
jne 0x430690
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0xa
mov al, byte [eax + 0x6c3cb0]
mov byte [esi], al
mov eax, ecx
shr eax, 4
and eax, 0x3f
and ecx, 0xf
mov al, byte [eax + 0x6c3cb0]
mov byte [esi + 1], al
mov al, byte [ecx*4 + 0x6c3cb0]
mov byte [esi + 2], al
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
mov eax, edx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x433e7f
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x433fe8
mov edx, 0x10000000
cmp eax, 0x7c
je 0x433fe8
cmp eax, 0x29
jne 0x433eb8
cmp dword [esi + 0x10], 0
jne 0x433fe8
test dword [esi + 0x50], edx
je 0x433fee
cmp eax, 0x2e
jne 0x433ed3
push 5
lea ecx, [esi + 0x24]
call fcn.004340e2
mov ecx, esi
call fcn.00433e5a
jmp 0x433fd2
cmp eax, 0x5c
jne 0x433f30
mov ecx, esi
call fcn.00433e5a
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x433f06
cmp word [esi + 0x48], 0x62
jne 0x433f06
push 4
lea ecx, [esi + 0x24]
call fcn.004340e2
mov ecx, esi
call fcn.00433e5a
jmp 0x433fd9
test eax, eax
je 0x433f24
cmp word [esi + 0x48], 0x42
jne 0x433f24
push 4
lea ecx, [esi + 0x24]
call fcn.004340e2
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x433efa
mov ecx, esi
call fcn.00434454
jmp 0x433fd2
cmp eax, 0x5b
jne 0x433f54
mov ecx, esi
call fcn.00433e5a
mov ecx, esi
call fcn.00434408
cmp dword [esi + 0x4c], 0x5d
je 0x433ec7
push 4
jmp 0x433ff0
cmp eax, 0x28
jne 0x433f78
mov ecx, esi
call fcn.00433e5a
mov ecx, esi
call fcn.0043454c
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x433fee
mov ecx, esi
call fcn.00433e5a
jmp 0x433fce
cmp eax, 0x5e
jne 0x433f84
push 2
jmp 0x433ef2
cmp eax, 0x24
jne 0x433f90
push 3
jmp 0x433ef2
cmp eax, 0x2a
je 0x433fe4
cmp eax, 0x2b
je 0x433fe4
cmp eax, 0x3f
je 0x433fe4
cmp eax, 0x7b
je 0x433fe4
cmp eax, 0x7d
jne 0x433fae
test dword [esi + 0x50], edx
je 0x433fe0
cmp eax, 0x5d
jne 0x433fb8
test dword [esi + 0x50], edx
je 0x433f4d
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00434702
mov ecx, esi
call fcn.00433e5a
mov bl, 1
test bl, bl
je 0x433fd9
mov ecx, esi
call fcn.0043463e
mov cl, 1
jmp 0x433e86
push 6
jmp 0x433ff0
push 0xa
jmp 0x433ff0
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.0060aad6
int3