joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dfa56
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x4dfadb
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.004bae20
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4dfa9e
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4dfac0
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x4dfb36
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.004df7a6
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x4dfb22
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x4dfb36
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4dfa5f
pop esi
pop ebx
leave
ret
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x43b64e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
and edi, edi
call fcn.0043b682
or edi, edi
inc edi
xor dword [ebx], esi
add edi, 1
or edi, edi
inc ebx
mov edi, ecx
dec ecx
cmp ebx, eax
jne fcn.0043b64e
mov ecx, 0x28473843
add ecx, 0x7ebe436
and ecx, ecx
ret
Function at 0x4ba3c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x75000]
push edi
jmp 0x4ba3da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ba3e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ba3d0
mov eax, 1
add ebx, ebx
jne 0x4ba3f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ba404
jne 0x4ba423
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ba423
dec eax
add ebx, ebx
jne 0x4ba410
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ba3e8
add ebx, ebx
jne 0x4ba41f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ba475
xor ecx, ecx
sub eax, 3
jb 0x4ba43b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ba4aa
sar eax, 1
mov ebp, eax
jmp 0x4ba446
add ebx, ebx
jne 0x4ba446
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ba414
inc ecx
add ebx, ebx
jne 0x4ba454
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ba414
add ebx, ebx
jne 0x4ba461
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ba456
jne 0x4ba472
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ba456
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ba494
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ba486
jmp 0x4ba3d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ba494
add edi, ecx
jmp 0x4ba3d6
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ba4b2
cmp byte [edi], 0x11
jne 0x4ba4b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ba4b7
lea edi, [esi + 0xb6000]
mov eax, dword [edi]
or eax, eax
je 0x4ba52f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc2658]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc27ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ba4e4
mov ecx, edi
jns 0x4ba513
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc27b0]
or eax, eax
je 0x4ba529
mov dword [ebx], eax
add ebx, 4
jmp 0x4ba501
call dword [esi + 0xc27c0]
mov ebp, dword [esi + 0xc27b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ba563
sub esp, 0xffffff80
jmp 0x416310
Function at 0x404a8c
Capabilities:
Create pipe
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1284
call fcn.00413e00
mov eax, dword [0x8c0ee8]
mov ecx, dword [0x8bfe3c]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x404b93
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0x8c0ee8], 0x959
jne 0x404b81
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
lea eax, [ebp - 0xa80]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x280]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x4040d8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x404128
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x1280]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.00404895
add ebx, 8
dec dword [ebp - 8]
jne 0x404ab9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4071db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80f708]
jne 0x4071e5
repz ret
jmp fcn.0040ed2c

Function at 0x410aa7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040895d
and dword [ebp - 4], 0
cmp dword [0x811a30], 0
mov ebx, eax
jne 0x410b58
push 0x40380c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410c09
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403800
push edi
call esi
test eax, eax
je 0x410c09
push eax
call fcn.004088eb
mov dword [esp], 0x4037f0
push edi
mov dword [0x811a30], eax
call esi
push eax
call fcn.004088eb
mov dword [esp], 0x4037dc
push edi
mov dword [0x811a34], eax
call esi
push eax
call fcn.004088eb
mov dword [esp], 0x4037c0
push edi
mov dword [0x811a38], eax
call esi
push eax
call fcn.004088eb
pop ecx
mov dword [0x811a40], eax
test eax, eax
je 0x410b58
push 0x4037a8
push edi
call esi
push eax
call fcn.004088eb
pop ecx
mov dword [0x811a3c], eax
mov eax, dword [0x811a3c]
cmp eax, ebx
je 0x410bb0
cmp dword [0x811a40], ebx
je 0x410bb0
push eax
call fcn.00408966
push dword [0x811a40]
mov esi, eax
call fcn.00408966
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410bb0
test edi, edi
je 0x410bb0
call esi
test eax, eax
je 0x410ba7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410ba7
test byte [ebp - 0xc], 1
jne 0x410bb0
or dword [ebp + 0x10], 0x200000
jmp 0x410be9
mov eax, dword [0x811a34]
cmp eax, ebx
je 0x410be9
push eax
call fcn.00408966
pop ecx
test eax, eax
je 0x410be9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410be9
mov eax, dword [0x811a38]
cmp eax, ebx
je 0x410be9
push eax
call fcn.00408966
pop ecx
test eax, eax
je 0x410be9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x811a30]
call fcn.00408966
pop ecx
test eax, eax
je 0x410c09
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410c0b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c4c0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43885f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x44d06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0
mov dword [ebx], 0x4485f8
mov dword [ebx + 0x60], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.0040a040
push 8
call fcn.0041ae14
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 2
call fcn.00419120
mov dword [esi + 4], eax
add esp, 4
lea eax, [ebx + 0x10]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov dword [ebp - 4], 3
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 4
push eax
call fcn.0040df20
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx esi, ax
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x40c614
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40c614
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov byte [ebp - 4], 1
cmp dword [edi + 0x38], 0
mov word [edi + 0x40], si
jne 0x40c632
mov eax, dword [edi + 0xc]
mov ecx, edi
or eax, 4
push 0
push eax
call fcn.0040a040
mov dword [ebp - 4], 6
mov eax, dword [ebx]
push ecx
push dword [ebp + 8]
lea ecx, [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x60]
mov dword [edx + ebx - 4], eax
call fcn.0040d310
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4388c8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x44d06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0041ae14
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00419120
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 1
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x10], eax
jb 0x40d3e2
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
mov ecx, 2
cmp eax, 0x7fffffff
ja 0x40d483
test eax, eax
je 0x40d463
lea ebx, [eax + eax]
cmp ebx, 0x1000
jb 0x40d424
lea eax, [ebx + 0x23]
or ecx, 0xffffffff
cmp eax, ebx
cmovbe eax, ecx
push eax
call fcn.0041ae14
add esp, 4
test eax, eax
je 0x40d488
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x40d437
test ebx, ebx
je 0x40d435
push ebx
call fcn.0041ae14
add esp, 4
mov esi, eax
jmp 0x40d437
xor esi, esi
push ebx
push dword [ebp + 8]
push esi
call fcn.0041c6c0
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + esi]
mov dword [edi + 0x38], eax
add esp, 0xc
mov eax, dword [edi + 0xc]
mov dword [eax], esi
mov eax, dword [edi + 0x1c]
mov dword [eax], esi
mov eax, dword [edi + 0x2c]
mov dword [eax], ecx
mov ecx, 3
jmp 0x40d46a
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00418c0d
call fcn.0041fc7c
int3
Function at 0x40d4d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4388f0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x44d06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0041ae14
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00419120
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d6e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x40d711
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x40d700
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x410960
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x410b7d
cmp eax, 0x7c
je 0x410b7d
cmp eax, 0x29
jne 0x4109a1
cmp dword [esi + 0x10], 0
jne 0x410b7d
cmp eax, eax
jne 0x4109a1
test dword [esi + 0x50], 0x10000000
je 0x410b8a
jmp 0x410b36
cmp eax, 0x2e
jne 0x4109b2
push 5
lea ecx, [esi + 0x24]
call fcn.00410be0
jmp 0x410a2e
cmp eax, 0x5c
jne 0x410a11
mov ecx, esi
call fcn.00410910
test byte [esi + 0x50], 0x80
je 0x410a05
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x4109e3
push 4
lea ecx, [esi + 0x24]
call fcn.00410be0
mov ecx, esi
call fcn.00410910
jmp 0x410b6f
cmp eax, 0x42
jne 0x410a05
push 4
lea ecx, [esi + 0x24]
call fcn.00410be0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00410910
jmp 0x410b6f
mov ecx, esi
call fcn.00411f70
jmp 0x410b68
cmp eax, 0x5b
jne 0x410a7e
mov ecx, esi
call fcn.00410910
mov ecx, esi
call fcn.00411e80
cmp dword [esi + 0x4c], 0x5d
jne 0x410b98
mov edx, dword [esi + 8]
mov eax, dword [esi]
cmp eax, edx
je 0x410a72
cmp word [eax], 0x5c
jne 0x410a6d
lea ecx, [eax + 2]
cmp ecx, edx
je 0x410a6d
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x410a59
movzx edi, word [ecx]
cmp edi, 0x28
je 0x410a6b
cmp edi, 0x29
je 0x410a6b
test dl, 0x10
jne 0x410a6d
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x410a6b
cmp edx, 0x7d
jne 0x410a6d
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.0040f5f0
jmp 0x410b68
cmp eax, 0x28
jne 0x410af2
mov ecx, esi
call fcn.00410910
mov ecx, esi
call fcn.00412110
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x410b8a
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x410ae1
cmp word [eax], 0x5c
jne 0x410adc
lea ecx, [eax + 2]
cmp ecx, edx
je 0x410adc
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x410ac8
movzx edi, word [ecx]
cmp edi, 0x28
je 0x410ada
cmp edi, 0x29
je 0x410ada
test dl, 0x10
jne 0x410adc
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x410ada
cmp edx, 0x7d
jne 0x410adc
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.0040f5f0
test bl, bl
je 0x410b6f
jmp 0x410b68
cmp eax, 0x5e
jne 0x410b0a
push 2
lea ecx, [esi + 0x24]
call fcn.00410be0
mov ecx, esi
call fcn.00410910
jmp 0x410b6f
cmp eax, 0x24
jne 0x410b22
push 3
lea ecx, [esi + 0x24]
call fcn.00410be0
mov ecx, esi
call fcn.00410910
jmp 0x410b6f
cmp eax, 0x2a
je 0x410b83
cmp eax, 0x2b
je 0x410b83
cmp eax, 0x3f
je 0x410b83
cmp eax, 0x7b
je 0x410b83
cmp eax, 0x7d
jne 0x410b46
test dword [esi + 0x50], 0x10000000
je 0x410b91
jmp 0x410b54
cmp eax, 0x5d
jne 0x410b54
test dword [esi + 0x50], 0x10000000
je 0x410b98
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004123d0
mov ecx, esi
call fcn.00410910
mov ecx, esi
call fcn.00412220
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x410973
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.0040f5e0
push 5
call fcn.0040f5e0
push 6
call fcn.0040f5e0
push 4
call fcn.0040f5e0
int3
Function at 0x4156b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x44d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x415700
cmp dword [ebp - 8], 2
jl 0x4156f9
push dword [esi + 4]
call fcn.004264a6
add esp, 4
mov dword [0x44ef74], eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00401250
mov ecx, edi
call fcn.00407940
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0041ae03
mov esp, ebp
pop ebp
ret 0x10