joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d4b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x605be0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45bc7b
je 0x45bcca
cmp ebx, 0x20
jbe 0x45bcd0
cmp ebx, 0x40
jbe 0x45bd0e
jmp 0x45bd9f
test ebx, ebx
je 0x45bcc0
add eax, 0x10
test ax, 0xff0
je 0x45bcac
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x53f320]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x53f420]
jmp 0x45bc98
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45bc98
pxor xmm1, xmmword [0x605bf0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x605bf0]
pxor xmm2, xmmword [0x605c00]
pxor xmm3, xmmword [0x605c10]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x605bf0]
pxor xmm2, xmmword [0x605c00]
pxor xmm3, xmmword [0x605c10]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45bdfe
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x605892], 0
je 0x45d4ca
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45bc40
jmp fcn.00407e60
Function at 0x45d4d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40295e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00407e60
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045c1c0
jmp 0x402920
cmp byte [0x605892], 0
je 0x45d4eb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45bc40
jmp 0x402920

Function at 0x45e200
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xba0
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call fcn.0045d430
call fcn.0045c030
ret
Function at 0x476920
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x476958
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
xor ebx, ebx
jmp 0x47694f
movzx ebp, byte [eax + ebx]
inc ebx
imul edx, edx, 0x1000193
xor edx, ebp
cmp ecx, ebx
jg 0x476942
mov dword [esp + 0x14], edx
ret
call fcn.0045c1c0
jmp fcn.00476920
Function at 0x4da550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4da6b1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4da5d7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
jne 0x4da5db
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4da5a1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4da5db
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4da5e3
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004da330
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004de850
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.0045c1c0
jmp fcn.004da550
Function at 0x40645c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406480
xor eax, eax
test eax, eax
je 0x406492
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406492
xor ecx, ecx
jmp 0x406495
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406581
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232bc], 0
push esi
jne 0x4065b8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406592
mov dword [ecx*4 + 0x4232b8], eax
inc ecx
cmp ecx, 0x100
jl 0x40658d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065e9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232b8]
xor eax, esi
inc ecx
dec edx
jne 0x4065cb
pop edi
not eax
pop esi
ret 0xc

Function at 0x4018c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x403464], eax
mov edi, 0
mov ecx, 0xa
push edi
loop 0x4018dd
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [0x403464]
mov dword [ebp - 0x1c], edx
lea ecx, str.contents
mov dword [ebp - 8], ecx
lea eax, section..text
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x66
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x403464]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403474], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403474]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019a6
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40198d
pop ebp
ret 0x10
Function at 0x4011e3
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x40120f
push ebx
pop ecx
add edi, 0xa7864b8d
push ecx
pop edx
add edx, 0x1c
xor edi, esi
mov eax, dword [edx]
sal edx, 0x1a
sub ax, ax
inc edi
push eax
push 0xca1109e
sar esi, 0xb
call dword [sym.imp.kernel32.dll_GlobalFree]
jmp 0x401268
ror si, 0xa
push edi
add cx, 0xffb4
call dword [sym.imp.kernel32.dll_SetLastError]
or dx, 0xfffd
nop
add eax, ebx
call dword [sym.imp.kernel32.dll_GetLastError]
pop eax
mov edx, 0
xor edx, 0x4010e2
mov esi, dword [edx + 0x17]
not ecx
or di, 0x39
inc eax
mov edx, dword [eax]
not ecx
not edx
sub edi, eax
add edx, esi
or cx, 0xffa5
inc edx
test edx, edx
jne 0x401298
not esi
xchg eax, edi
dec ecx
add edi, 0xfffffff8
sal esi, 0x1b
mov ax, word [edi]
inc edx
mov ebx, eax
rol ecx, 0xa
rol eax, 0x17
mov edi, dword [esp]
add edx, dword [esp]
push edi
pop esi
mov edx, 0x40104a
sub di, 0xffd6
mov edi, dword [edx + 3]
add eax, 0x1252038d
mov eax, dword [esi]
sub ecx, edx
add esi, 1
mov ecx, eax
and edx, eax
xor ecx, edi
not eax
test ecx, ecx
je 0x4012fc
add edx, ebp
jmp 0x4012e1
sub di, 0xffc3
xchg esi, ebp
add eax, 0xf3926d75
not edx
push 0x3f8357
sub esi, esi
mov ecx, ebx
shl ecx, 0x10
sar eax, 0x1d
shr ecx, 0x10
not esi
add dword [esp], ecx
and esi, esi
sub edx, edx
or ecx, 0xaa9024a5
push dword fs:[edx]
add di, 7
push esp
pop ecx
and edi, 0x665779dd
mov dword fs:[0], ecx
not esi
push edx
ror eax, 0xf
mov esi, ebp
or di, 0x48
xor edx, edx
add edx, 0xd80
sub ax, 0x2c
sub dword [edx], edi
jmp 0x40138b
and eax, esi
push 0xf600ef0b
push edx
add esi, 0x14adde5d
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
push esi
dec edi
push 0xd004a496
push edx
sub esi, 0xe6a37855
call dword [sym.imp.kernel32.dll_GetCPInfo]
xor esi, 0xbc0accb5
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4019c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov eax, dword [ebp + 8]
lea ecx, [esp + 0xe0]
mov dword [esp + 0x174], 0
mov dword [esp + 0x170], 0x7b70
mov dword [esp + 0x16c], 0x3a29
mov byte [esp + 0x16b], 0x3c
mov dword [esp + 0x4c], 0x4315
mov dword [esp + 0xdc], eax
mov eax, dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [esp + 0x3c], ecx
call eax
mov ecx, 0x3aa9
mov edx, dword [esp + 0x16c]
sub ecx, edx
mov esi, esp
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, dword [sym.imp.USER32.dll_GetClassNameA]
mov dword [esp + 0x38], edx
call eax
sub esp, 0xc
mov ecx, dword [esp + 0x16c]
xor ecx, 0x3a4e
movsx edx, byte [esp + 0xe3]
mov esi, dword [esp + 0x38]
imul edi, esi, 0x2d15
mov dword [esp + 0x18c], edi
cmp edx, ecx
mov dword [esp + 0x34], eax
je 0x401ad7
mov dword [esp + 0xd8], 0
jmp 0x401b08
movss xmm0, dword [0x405088]
ucomiss xmm0, dword [esp + 0x160]
jae 0x401b6e
mov eax, dword [esp + 0xdc]
mov ecx, eax
sub ecx, 0xffffffff
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
je 0x401b5f
jmp 0x401ab5
mov eax, dword [esp + 0x30]
sub eax, 1
mov dword [esp + 0x28], eax
je 0x401bf8
jmp 0x401ac8
mov eax, dword [esp + 0x30]
sub eax, 0xd
mov dword [esp + 0x24], eax
je 0x401b50
jmp 0x401b34
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
xorps xmm0, xmm0
movss dword [esp + 0x164], xmm0
mov dword [esp + 0x20], eax
jmp 0x401c13
mov eax, dword [esp + 0xd8]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret 4
movss xmm0, dword [0x40508c]
addss xmm0, dword [esp + 0x50]
movss dword [esp + 0x164], xmm0
jmp 0x401c13
mov dword [esp + 0xd8], 0
jmp 0x401b08
lea eax, [fcn.00403b20]
mov dword [esp + 0xd8], eax
jmp 0x401b08
lea eax, [0x401860]
mov dword [esp + 0xd8], eax
jmp 0x401b08
lea eax, [0x401720]
mov dword [esp + 0xd8], eax
jmp 0x401b08
lea eax, str.current__2.4f
lea ecx, [esp + 0x57]
movsd xmm0, qword [esp + 0x180]
movss xmm1, dword [esp + 0x164]
cvtss2sd xmm1, xmm1
movsd qword [esp + 0x180], xmm0
mov dword [esp], ecx
mov dword [esp + 4], eax
movsd qword [esp + 8], xmm1
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
xor eax, eax
mov dword [esp + 0x18c], eax
mov cl, byte [esp + 0x16b]
add cl, 6
mov dl, byte [esp + 0x16b]
add dl, 0xcf
mov byte [esp + 0xd7], cl
mov cl, byte [esp + 0xd7]
movss xmm0, dword [esp + 0x164]
movss dword [esp + 0x50], xmm0
cmp cl, dl
jb 0x401a99
jmp 0x401b18
mov eax, dword [esp + 0x16c]
xor eax, 0x1550
cmp dword [esp + 0x4c], eax
jae 0x401b41
jmp 0x401b6e
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0xec2
movss xmm0, dword [esp + 0x164]
mov eax, dword [esp + 0x170]
mov ecx, dword [esp + 0x174]
sub eax, 0x3966
adc ecx, 0xffffffff
movss dword [esp + 0x160], xmm0
sub eax, 0xec2
sbb ecx, 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jb 0x401a73
jmp 0x401a83
Function at 0x4027f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x4050b2]
mov esi, 0x19
lea edi, [esp + 0x47]
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa0], 0x798c
mov word [esp + 0x9a], 0x3b37
mov dword [esp + 0x94], 0xbcc
mov ebx, dword [esp + 0xa0]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x2c], eax
mov eax, 0x8790
sub eax, ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
sbb ebx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0x123f
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov dword [esp + 0x88], ecx
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0x19
mov dword [esp + 0x24], esi
call sub.msvcrt.dll_memcpy
mov dword [esp + 0x3c], 0
cmp dword [esp + 0x3c], 0x18
jb 0x4029d9
jmp 0x402904
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x40], edx
sub eax, 0x1075
sbb ecx, 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jb 0x4028c8
jmp 0x4028ec
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x40]
xor eax, 0xbcd
add ecx, eax
mov dword [esp + 0x3c], ecx
jmp 0x4028bb
movzx eax, word [esp + 0x9a]
mov ecx, esp
lea edx, [esp + 0x47]
mov dword [ecx], edx
mov dword [esp + 0x18], eax
call fcn.00402a40
sub esp, 4
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x90], eax
mov ecx, esp
mov dword [ecx], eax
call fcn.004039b0
sub esp, 4
mov si, ax
mov word [esp + 0x8c], si
mov word [esp + 0x8e], si
mov dword [esp + 0x84], 0
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x88]
mov edx, esp
lea edi, [esp + 0x84]
mov dword [edx + 0xc], edi
mov edi, dword [esp + 0x18]
xor edi, 0x3b37
mov dword [edx + 8], edi
lea edi, [esp + 0x8c]
mov dword [edx + 4], edi
mov dword [edx], ecx
call eax
sub esp, 0x10
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x84]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x9c]
add ecx, 0xfffff4e2
mov esi, dword [esp + 0x3c]
xor eax, ecx
mov bl, al
or edx, 0x6885
mov dword [esp + 0x9c], edx
mov byte [esp + esi + 0x47], bl
jmp 0x4028c8
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
imul eax, eax, 0xeca
xor edi, edi
mov ebx, 0xa5d8
sub ebx, edx
sbb edi, esi
movsx ecx, byte [esp + ecx + 0x47]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x6c], ecx
sub eax, ebx
sbb edx, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
jae 0x4028c8
jmp 0x4029a3
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x438ca4
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
push ebx
pop ebx
add ebx, 0xa5ae30c4
call fcn.00438cd2
sub edi, edi
sub ebx, 0xdf79bc1c
xor dword [edx], esi
mov ebx, 0x6745c19d
inc edx
and ebx, ebx
sub ebx, ebx
cmp edx, ecx
jne fcn.00438ca4
or edi, ebx
ret
Function at 0x4092e0
Capabilities:
Packed with generic packer
Parse credit card information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [edi + 0x8c]
mov edx, dword [ecx + 0x7f8]
sub esp, 0x128
test edx, edx
push ebx
push esi
mov ebx, 0x14
jne 0x4093ad
cmp dword [ecx + 0x768], edx
je 0x409335
mov eax, edx
cmp eax, 0x1e
je 0x409326
test eax, eax
jne 0x409335
mov eax, dword [ecx + 0x82c]
cmp dword [eax + 0x24], 0xf
jne 0x409335
mov dword [edi + 0x5564], 8
jmp 0x4094bb
test edx, edx
jne 0x4093ad
mov eax, dword [edi + 0x5550]
sub eax, 1
test eax, eax
jg 0x40934a
xor eax, eax
jmp 0x409354
cmp eax, 0x31
jl 0x409354
mov eax, 0x31
mov esi, dword [eax*4 + 0x6a34e8]
mov dword [edi + 0x5564], esi
cmp dword [ecx + 0x7f8], 0
jne 0x409382
mov eax, dword [ecx + 0x82c]
test eax, eax
je 0x4094bb
cmp dword [eax + 0x2c], 0
jle 0x4094bb
call fcn.00453980
test al, al
jne 0x4094bb
cmp esi, 0xa
jge 0x40939f
mov dword [edi + 0x5564], ebx
jmp 0x4094bb
add esi, 0xa
mov dword [edi + 0x5564], esi
jmp 0x4094bb
mov eax, edx
cmp eax, 1
jl 0x4093bd
cmp eax, 0xf
jle 0x409484
cmp edx, 0x1f
je 0x409489
cmp edx, 0x2b
je 0x409478
cmp edx, 0x32
je 0x409478
mov eax, ecx
call fcn.004537b0
test al, al
jne 0x409478
cmp edx, 0x1e
jne 0x4093fb
mov dword [edi + 0x5564], 0xc
jmp 0x4094bb
cmp edx, 0x11
je 0x409394
cmp edx, 0x29
je 0x409394
cmp edx, 0x2d
je 0x409394
cmp edx, 0x2c
je 0x409394
cmp edx, 0x1a
je 0x409394
cmp edx, 0x10
je 0x409394
cmp edx, 0x15
je 0x409394
call fcn.00453920
test al, al
jne 0x40946c
call fcn.004538c0
test al, al
jne 0x40946c
call fcn.00453950
test al, al
jne 0x40946c
cmp edx, 0x1b
je 0x40946c
mov eax, ecx
call fcn.00453820
test al, al
jne 0x4093ec
cmp edx, 0x20
je 0x40946c
cmp edx, 0x21
je 0x40946c
cmp edx, 0x22
je 0x409478
mov dword [edi + 0x5564], 0x28
jmp 0x4094bb
mov dword [edi + 0x5564], 0x1e
jmp 0x4094bb
mov dword [edi + 0x5564], 0x14
jmp 0x4094bb
cmp edx, 0x1f
jne 0x409490
mov eax, 0xa
jmp 0x4094b5
lea ecx, [edx - 1]
cmp ecx, 4
ja 0x40949f
mov eax, 0xa
jmp 0x4094b5
lea eax, [edx - 6]
cmp eax, 4
mov eax, ebx
jbe 0x4094b5
add edx, 0xfffffff5
cmp edx, 4
jbe 0x4094b5
mov eax, dword [esp + 0x18]
mov dword [edi + 0x5564], eax
jmp 0x7ae320
Function at 0x40ab10
Capabilities:
Packed with generic packer
Parse credit card information
Parse pe header

Disassembly:
mov eax, dword [edi + 0x8c]
cmp dword [eax + 0x768], 0
push esi
je 0x40ab8a
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x1e
je 0x40ab3b
test ecx, ecx
jne 0x40ab48
mov ecx, dword [eax + 0x82c]
cmp dword [ecx + 0x24], 0xf
jne 0x40ab48
mov esi, dword [edi + 0x160]
call fcn.00425840
pop esi
ret
cmp dword [eax + 0x768], 0
je 0x40ab8a
mov ecx, dword [eax + 0x7f8]
cmp ecx, 0x11
je 0x40ab71
cmp ecx, 0x21
je 0x40ab71
test ecx, ecx
jne 0x40ab8a
mov ecx, dword [eax + 0x82c]
cmp dword [ecx + 0x24], 5
jne 0x40ab8a
cmp dword [eax + 0x7f8], 0
jne 0x40ab3b
mov eax, dword [eax + 0x82c]
test eax, eax
je 0x40ab8a
cmp dword [eax + 0x2c], 0
jg 0x40ab3b
xor esi, esi
lea esp, [esp]
mov eax, esi
call fcn.0040d660
jmp 0x7ad755
Function at 0x40cd10
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, dword [eax + 0x138]
push esi
mov esi, dword [ebx + 0x30]
cmp esi, 0x10
push edi
jne 0x40cd45
mov eax, dword [eax + 0x8c]
mov edi, dword [eax + 0x81c]
mov eax, edi
call fcn.00521310
test eax, eax
je 0x40cd45
mov eax, edi
call fcn.00521310
mov eax, dword [eax]
pop edi
pop esi
pop ebx
ret
cmp esi, 1
je 0x40cd65
cmp esi, 2
je 0x40cd65
cmp esi, 3
je 0x40cd65
cmp esi, 4
je 0x40cd65
cmp esi, 5
je 0x40cd65
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret
jmp loc.007c0770
Function at 0x412c30
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x290
cmp dword [ebx + 0x5618], 0
push ebp
push esi
push edi
jg 0x412cd4
mov eax, dword [ebx + 0x5550]
cmp eax, 0x29
je 0x412c79
cmp eax, 0x2a
je 0x412c79
cmp eax, 0x2b
je 0x412c6f
cmp eax, 0x2c
je 0x412c6f
cmp eax, 0x2d
je 0x412c6f
mov esi, 3
lea edi, [esi + 4]
jmp 0x412c81
mov esi, 3
lea edi, [esi + 2]
jmp 0x412c81
mov esi, 2
lea edi, [esi + 1]
lea eax, [esp + 0xc]
call fcn.00412a90
mov eax, dword [esp + 0x294]
cmp esi, eax
jle 0x412c97
mov esi, eax
test eax, eax
je 0x412cd4
test esi, esi
jle 0x412cd4
mov ebp, esi
mov edx, ebx
call fcn.0040d770
mov esi, eax
jmp 0x7af260
pop edi
pop esi
pop ebp
add esp, 0x290
ret

Function at 0x412ce0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [edi + 0x8c]
mov eax, dword [eax + 0x7f8]
sub esp, 0x10
cmp eax, 0x10
push ebx
push esi
je 0x412e2a
cmp eax, 0x20
je 0x412e2a
mov eax, dword [edi + 0x554c]
cmp eax, 4
je 0x412d1d
cmp eax, 5
jne 0x412dba
mov ebx, edi
call fcn.00412c30
mov edx, edi
call fcn.00412850
lea esi, [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
call fcn.0041cad0
test al, al
je 0x412e2a
jmp 0x412d50
mov eax, dword [esp + 0xc]
cmp dword [eax + 8], 1
jne 0x412e17
cmp dword [eax + 0x18], 0x64
jl 0x412e17
mov ecx, dword [edi + 0x8c]
cmp dword [ecx + 0x7f8], 0x2d
jne 0x412d8e
mov eax, dword [edi + 0x5564]
call fcn.005af400
cmp eax, dword [edi + 0x557c]
jg 0x412e17
mov edx, edi
call fcn.0040d770
mov ebx, dword [edi + 0x557c]
mov esi, eax
lea edx, [esi*8]
sub edx, esi
cmp esi, 0x19
lea eax, [edx*4 + 0x7b872e]
mov dword [esp + 0x14], eax
jne 0x412dd4
xor eax, eax
jmp 0x412ddc
cmp eax, 2
je 0x412dc8
cmp eax, 3
jne 0x412d24
push edi
call fcn.004128f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov eax, edi
call fcn.0040dc50
jmp 0x796150
lea esi, [esp + 0xc]
mov edx, edi
call fcn.0041cad0
test al, al
jne 0x412d50
pop esi
pop ebx
mov esp, ebp
pop ebp
ret