joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b3b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x49b3d6
mov eax, esp
push eax
push 0x49b378
call sub.user32.dll_EnumWindows
jmp 0x49b3e9
mov eax, esp
push eax
push 0x49b358
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x49b4ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x49b4fc]
test bl, 4
je 0x49b4c0
or si, 1
test bl, 8
je 0x49b4c9
or si, 4
test bl, 1
je 0x49b4d2
or si, 8
test bl, 2
je 0x49b4db
invalid
or si, 0x10
test bl, 0x10
je 0x49b4e4
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x49b4f4
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x49b500
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x49b53c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x49b51b
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
Function at 0x4a4100
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4a4112
add esp, 0xfffffff0
call fcn.004052c4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043af10
mov eax, dword [0x4b5054]
mov dword [eax + 4], ebx
mov dword [eax], 0x4a455c
mov eax, dword [0x4b5060]
mov dword [eax + 4], ebx
mov dword [eax], 0x4a4568
mov eax, ebx
call fcn.004a4574
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x424578]
call fcn.00404d78
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x424578]
call fcn.00404d78
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x424578]
call fcn.00404d78
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x424578]
call fcn.00404d78
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x424578]
call fcn.00404d78
mov dword [ebx + 0x78], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x44], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x5c]
push eax
mov eax, 0x49eea8
push eax
push 0
push 0
mov eax, dword [0x4b51fc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4457a0]
call fcn.0044a7a8
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4457a0]
call fcn.0044a7a8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4457a0]
call fcn.0044a7a8
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x4457a0]
call fcn.0044a7a8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4457a0]
call fcn.0044a7a8
mov dword [ebx + 0x8c], eax
mov eax, ebx
call fcn.004a4acc
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a493c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a493c
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a493c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a493c
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4a493c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4a428d
call fcn.0040531c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a46dc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a4889
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4a486a
mov dl, 1
mov eax, dword [0x426b40]
call fcn.00432988
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00406838
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4a4859
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00486e04
test al, al
je 0x4a484c
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4a4898
lea eax, [ebp - 0x394]
call fcn.00411b90
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a484c
xor eax, eax
push ebp
push 0x4a4845
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4a4908
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a482e
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406a20
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4a482e
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a484c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4a474f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.004328c4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4890
lea eax, [ebp - 0x3a0]
call fcn.00406828
ret

Function at 0x4a53e8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4bb280]
cmp byte [eax + 0xad], 0
jne 0x4a545a
cmp dword [0x4bb298], 0
jne 0x4a541a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4b4e8c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4bb298], eax
cmp dword [0x4bb294], 0
jne 0x4a5435
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4bb294], eax
cmp dword [0x4bb29c], 0
jne 0x4a545a
push esp
push 0
push 0
mov eax, dword [0x4b4e88]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4bb29c], eax
pop edx
ret
Function at 0x4a5780
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4a5797
add esp, 0xfffffff0
call fcn.004052c4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043af10
mov eax, dword [0x4b4f80]
cmp byte [eax], 0
jne 0x4a57c4
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4b51dc]
cmp word [eax + 2], 0
jne 0x4a57de
mov eax, dword [0x4b51dc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004a7878
mov eax, dword [0x4b52b4]
cmp word [eax + 2], 0
jne 0x4a57f8
mov eax, dword [0x4b52b4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004a7a88
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x4457a0]
call fcn.0044a7a8
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4a8038
mov dl, 1
mov eax, dword [0x424578]
call fcn.00404d78
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x424578]
call fcn.00404d78
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x448e38]
call fcn.004515a0
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4a59d8
mov eax, dword [0x4b50d0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00451a34
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4a8320
mov dl, 1
mov eax, dword [0x424578]
call fcn.00404d78
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4b50d0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004119dc
test eax, eax
je 0x4a5909
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.004117c0
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004119c0
test eax, eax
je 0x4a5921
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406a20
push ebx
push 0x4a7248
call fcn.0049b490
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4b4f80]
cmp byte [eax], 0
jne 0x4a5972
mov eax, ebx
call fcn.004a5b4c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004a854c
mov eax, ebx
call fcn.004a9180
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4a59cf
call fcn.0040531c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a5e20
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4a5ec2
cmp dword [ebx + 0x94], 0
jne 0x4a5ebc
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4a5d6c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4a5ebc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4a5e82
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4a5ebc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0042f34c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4a5e91
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4a60e0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4bb280]
cmp dword [eax + 0x170], 0
je 0x4a6245
test bl, bl
jne 0x4a6193
cmp dword [esi + 0x9c], 0
jne 0x4a6188
mov eax, esi
call fcn.004a8fd0
push eax
push 0x4a5fec
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4a6159
mov eax, dword [0x4bb280]
cmp byte [eax + 0xd3], 0
je 0x4a6159
mov eax, dword [esi + 0xd8]
call fcn.00407e3c
mov edi, eax
cmp edi, 0
jl 0x4a6159
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a6142
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a6188
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0042f34c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a6168
inc dword [esi + 0x9c]
jmp 0x4a6245
cmp dword [esi + 0x9c], 0
jle 0x4a6245
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4a6245
cmp dword [esi + 0x44], 0
je 0x4a61f0
mov eax, dword [0x4bb280]
cmp byte [eax + 0xd3], 0
je 0x4a61f0
mov eax, dword [esi + 0xd8]
call fcn.00407e3c
mov edi, eax
cmp edi, 0
jl 0x4a61f0
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a61d9
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a621f
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0042f34c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a61ff
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x499368]
call fcn.00407ffc
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4a6e94
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4a6eff
cmp byte [ebx + 0xd3], 0
jne 0x4a6eff
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406974
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4a6eec
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a6f0c
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406838
jmp 0x4a6f0c
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406838
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4a8734
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4a87a2
mov eax, esi
call fcn.00480d60
test al, al
je 0x4a87a2
mov eax, dword [ebx + 0x84]
call fcn.004809b4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a87a2
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4a8796
push 0
mov eax, dword [ebx + 0x84]
call fcn.004809b4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00477988
jmp 0x4a87a2
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004a856c
pop esi
pop ebx
ret
Function at 0x4157ed
Capabilities:
Access peb ldr_data

Disassembly:
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.0045cf60
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x41586f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x4e08a0
push eax
lea ecx, [ebp - 0x24]
call fcn.0047ae43
push 0x51bd2c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x50b790
push eax
call fcn.0047b046
push edi
push esi
call fcn.0045e28c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047b037
mov esp, ebp
pop ebp
ret 4

Function at 0x423444
Capabilities:
Encode data using xor

Disassembly:
inc cl
out dx, eax
add ecx, dword [edi]
mov dh, 0xd
or al, byte [ebx - 0x37ccf712]
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
dec edi
jne 0x423449
pop edi
test esi, esi
je 0x423525
movzx ecx, byte [0x1528d0a]
xor ecx, eax
mov dh, 0xd
or cl, byte [ebp - 0x37ccfeae]
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4e8210]
dec esi
jne 0x42350b
in eax, 0xf7
rcr byte [esi + 0x5d], 1
not eax
pop esi
pop ebp
ret

Function at 0x425873
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
mov ecx, esi
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov ecx, dword [edi]
shr eax, 8
xor dl, al
movsx eax, dl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x4e8210]
xor eax, ecx
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, esi
shr esi, 8
and eax, 0xff
xor esi, dword [eax*4 + 0x4e8210]
mov al, dl
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
ret

Function at 0x43868e
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5f94
pop edi
dec ebp
add byte [ecx], ah
add byte [eax], al
add byte [eax], al
Function at 0x46996a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov esi, dword [ebp + 8]
movzx eax, byte [edx + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x46996d
pop esi
mov eax, ecx
pop ebp
ret

Function at 0x47d0b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
in al, dx
cmp dword [0x530f30], 0
xor byte [edi], cl
push ebx
add byte [eax], al

Function at 0x4885ef
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [esi + edx - 0x76], dh
or eax, 0x1c2830a
xor cl, bl
je 0x488670
sub eax, 1
je 0x488635
test edx, 3
jne 0x4885f5
sub eax, 4
jb 0x488622
push edi
mov edi, ebx
shl ebx, 8
add ebx, edi
mov edi, ebx
shl ebx, 0x10
add ebx, edi
jmp 0x48863c
add eax, 4
je 0x488635
mov cl, byte [0x1c2830a]
or eax, 0x1c2830a
xor cl, bl
je 0x488671
sub eax, 1
jne 0x488628
pop ebx
pop ebx
ret
in eax, 0x8b
or eax, 0xbfcb330a
invalid
enter 0xffffffffffff8d5f, 0x42
call [ebx - 0x3d]
invalid
pop edi
lea eax, [edx - 1]
pop ebx
ret

Function at 0x4986a8
Capabilities:
Enumerate pe sections

Disassembly:
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4986e3
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4986db
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4986e8
or al, byte [edx - 0x7d]
shr byte [eax], 0x3b
sal dword [edx - 0x18], cl
xor eax, eax
pop edi
pop esi
call 0x5ea9471b
pop ebx
pop ebp
ret

Function at 0x4aeaed
Capabilities:
Parse credit card information

Disassembly:
add byte [ebx + 0xbafc4d], cl
add bh, bh
jmp dword [ecx]

Function at 0x4aeaef
Capabilities:
Parse credit card information

Disassembly:
add byte [ebx + 0xbafc4d], cl
add bh, bh
jmp dword [ecx]

Function at 0x4aeaf2
Capabilities:
Parse credit card information

Disassembly:
add byte [ebx + 0xbafc4d], cl
add bh, bh
jmp dword [ecx]

Function at 0x4b5316
Capabilities:
Hash data using fnv

Disassembly:
rol bl, 0x55
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
invalid
invalid
popfd
invalid

Function at 0x4b5324
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ecx, ecx
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x4b5326
mov eax, edx
xor edx, edx
div dword [ebp + 0xc]
pop esi
mov eax, edx
pop ebp
ret
Function at 0x40ac81
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x44], eax
xor eax, eax
xor esi, esi
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x40], 0x40
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
push 0x20
stosd dword es:[edi], eax
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x100020
lea eax, [ebp - 4]
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
call dword [0x10a14]
push dword [ebp - 4]
lea eax, [ebp - 0x4c]
push 0x1000000
push 0x10
push esi
push eax
push 0xf001f
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x44], esi
call dword [0x10a10]
push 4
push 0x100000
push 1
lea eax, [ebp - 0x14]
push eax
push esi
push 0x3e8
push esi
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [0x10a0c]
push dword [ebp - 4]
call dword [0x10a08]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
mov esi, dword [ecx + eax + 0x78]
push dword [ebp + 8]
add esi, eax
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
add ecx, eax
mov dword [ebp - 0xc], eax
add edi, eax
add ebx, eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x18], ecx
call dword [0x10a04]
and dword [ebp + 0xc], 0
cmp dword [esi + 0x14], 0
jbe 0x40ada2
mov eax, dword [ebp + 0xc]
mov eax, dword [ebx + eax*4]
add eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x10a04]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
movzx eax, word [eax + ecx*2]
add eax, dword [ebp - 0x1c]
push 1
mov eax, dword [edi + eax*4 - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x10a00]
test eax, eax
je 0x40adb6
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [esi + 0x14]
jb 0x40ad58
xor esi, esi
push dword [ebp - 0x10]
call dword [0x10a08]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov esi, dword [ebp + 8]
jmp 0x40ada4
Function at 0x100069c3
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [section..data]
add dword [0x1000e22c], 0x132a0029
imul eax, eax, 0x2a62
sub dword [0x1000e554], 0x462
push esi
push edi
mov edi, 0x2600
push 0x2a62
mov dword [0x1000e054], edi
sub edi, dword [0x1000e22c]
push 0x1e79
mov dword [section..data], eax
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov ecx, dword [0x1000e460]
mov dword [str.9], eax
imul ecx, ecx, 0x26fb
mov eax, dword [0x1000e054]
add eax, 0x42
imul eax, eax, 0x26fb
push 0x40
push 0x1000
mov esi, 0x108
sub esi, edi
push 0x8000
xor edi, edi
push edi
mov dword [0x1000e460], ecx
mov dword [0x1000e054], eax
mov dword [0x1001a61c], 0x1e79
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1001a614], eax
lea ecx, [esi - 0x2e69]
mov eax, 0x2fff
sub eax, ecx
cmp dword [0x1000e004], edi
mov dword [0x1000e550], eax
mov eax, 0x174936a
jne 0x10006a98
cmp dword [0x1000e554], edi
jne 0x10006a98
sub dword [section..data], 0x174d162
sub dword [0x1000e4ec], eax
jmp 0x10006a9d
mov eax, 0x300f10b0
add dword [0x1001a618], 0x3df8
sub eax, 0xb12
xor eax, dword [0x1000e118]
pop edi
pop esi
ret
Function at 0x10defc18
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10defc22
pushal
call 0x10defc28
pop ebp
sub ebp, 0x10
sub ebp, 0xdefc18
jmp 0x10defc3e
mov eax, 0xdefc18
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ff
mov edx, 0xf9571a79
xor byte [eax], dl
inc eax
dec ecx
jne 0x10defc55
jmp 0x10defc68
mov ah, 0xf2
invalid