joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc3169f
Capabilities:
Encode data using xor

Disassembly:
invalid
xchg ebp, eax
lcall 0x74b4, 0xf11b7d53
push esi
rcl ebp, 0x49
push ss
fxch st(7)
shr dl, cl
dec edx
add dword [edi], edx
mov esp, 0x5c2d18d3
das
add byte [ebx - 0x23d567d3], bl
mul esp
js 0xc315e0
lodsd eax, dword [esi]
ror byte [ebx - 0x31eebef4], 0x8e
jae 0xc316a3
or bl, dh
inc ebx
jge 0xc316e9
mov dl, 0x8c
sbb dword [edx - 0x1ec141f3], eax
inc ebp
inc esi
dec edx
salc
mov al, byte [esi - 0x13]
cwde
invalid
lds ebx, [ebp + esi*4 - 0x512c74e1]
mov edx, ebx
scasb al, byte es:[edi]
jno 0xc31639
fidiv word [edx]
and eax, 0x8acac157
in eax, 0x6c
jae 0xc31723
pushfd
push edx
sub edi, dword [edx + edx + 0x21d11f37]
cmc
mov ebp, 0x5acdd42d
jo 0xc3172c
lodsd eax, dword [esi]
pop ebx
mov bl, 0x8c
das
fnsave dword [ebx - 0x6547e7aa]
aaa
movsd dword es:[edi], dword [esi]
and edx, dword gs:[eax + 0x24618807]
stosd dword es:[edi], eax
add dword [ecx + 0x58763984], esp
bound edx, qword [ebp + 0x513e85cd]
xchg ebp, eax
int 0x85
push ecx
test al, 0x11
shl byte [edi], 0xa
adc byte [esi + ecx + 0x7d9023c8], bh
or dl, byte [eax]
mov esp, 0x9023c80e
jge 0xc316ed
enter 0xffffffffffff9023, 0x7d
sti
inc ebx
and esp, dword [ebx]
xlatb
lds ecx, [ebp - 0x21]
popal
out 0x2f, al
ficom dword [ebx - 0x1a022dd9]
sub al, 0xf5
pop edi
jno 0xc31751
and ah, byte [edx - 0x4f]
jo 0xc316e0
xchg edi, eax
mov ah, 0x53
movsd dword es:[edi], dword es:[esi]
test al, 0x88
sbb al, 0xdf
and dl, bl
sub byte [edi + ebx*4], ch
lodsd eax, dword [esi]
test byte [edx - 0x639af112], bh
mov edx, 0x9c650eee
cmp byte [eax + 0x1b673885], bh
mov eax, 0x1b673885
mov edx, 0x7096ecca
out dx, eax
jo 0xc3171d
sub al, 0x4f
loop 0xc31749
mov ecx, 0xe22d4244
ficomp word [edx + 0x7fe0d5dc]
mov dl, 0x5f
cli
xchg ecx, eax
add al, 0x98
imul ecx, dword [eax + edx*4], 0xffffffc1
xchg ebp, eax
mov dword [0x1d91952e], eax
xor byte [ebp + 0x397fa6a0], al
xchg ebp, eax
xchg ecx, eax
sbb eax, 0xa6a08530
jg 0xc3178c
jnp 0xc3173d
aam 0x29
insd dword es:[edi], dx
lcall 0x8414, 0x6f2f603d
or al, 0x98
sub esp, esp
test dh, 0xf8
pop edi
cli
inc ebx
dec edi
movsx ebx, byte [ecx]
sbb ch, dl
arpl word [ebx + edx + 0x499478f8], bp
enter 0xfffffffffffff956, 0xffffffffffffffb4
and al, 0xc2
jmp 0xd54be82f
dec edi
imul dh
xor dword [edx + 0x6bf41193], esi
inc edi
movsd dword es:[edi], dword [esi]
mov dl, 0xe6
cwde
cmp eax, 0x87f057d9
insb byte es:[edi], dx
sub eax, 0x406fdf56
xchg ebp, eax
dec esp
push eax
outsb dx, byte [esi]
dec edx
inc eax
xchg edi, eax
and al, 0xcd
mov dl, 0x1c
hlt
Function at 0x401cce
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, ecx
push str.Py_Initialize
push edi
call esi
push str.PySys_SetArgv
push edi
mov ebx, eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 0x18], eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 0x10], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 0x14], eax
call esi
push str.PyCFunction_New
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0x1c], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 8], eax
call esi
xor esi, esi
cmp ebx, esi
je 0x401ead
cmp dword [ebp - 0x18], esi
je 0x401ead
cmp dword [ebp - 0x10], esi
je 0x401ead
cmp dword [ebp - 0x14], esi
je 0x401ead
cmp dword [ebp - 0xc], esi
je 0x401ead
cmp dword [ebp - 8], esi
je 0x401ead
cmp eax, esi
je 0x401ead
cmp dword [ebp - 0x1c], esi
je 0x401ead
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x401ea6
cmp byte [eax], 0
je 0x401ea6
push esi
push eax
call fcn.004212cf
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x401dcb
push dword [ebp + 8]
push str.Could_not_open_postinstall_script__s_n
call fcn.0040891e
add eax, 0x40
push eax
call fcn.00408778
add esp, 0xc
push 3
pop eax
jmp 0x401eb0
push str.Running_Script...
push 0x3ec
push dword [0x432818]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
call ebx
mov eax, edi
call fcn.00401bbf
push 0x400
push esi
mov esi, 0x4302a8
push esi
call fcn.004076c0
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
jle 0x401e2b
mov edi, dword [ebp + 0x10]
mov ebx, esi
sub ebx, edi
mov dword [ebp - 0xc], eax
mov eax, dword [edi]
test eax, eax
je 0x401e1e
push eax
call fcn.004016b1
pop ecx
jmp 0x401e20
xor eax, eax
mov dword [ebx + edi], eax
add edi, 4
dec dword [ebp - 0xc]
jne 0x401e0f
push esi
push dword [ebp + 0xc]
call dword [ebp - 0x18]
xor esi, esi
cmp dword [ebp + 0xc], esi
pop ecx
pop ecx
jle 0x401e53
mov eax, dword [esi*4 + 0x4302a8]
test eax, eax
je 0x401e4d
push eax
call fcn.00407f30
pop ecx
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x401e3b
push 3
pop ebx
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 8]
call fcn.00408421
pop ecx
pop ecx
test eax, eax
jne 0x401e96
mov edi, dword [ebp - 0x38]
lea eax, [edi + 5]
call fcn.00408ae0
mov esi, esp
push edi
push esi
push dword [ebp - 8]
call fcn.00421f65
add esp, 0xc
test eax, eax
jle 0x401e96
add eax, esi
push esi
mov byte [eax], 0xa
mov byte [eax + 1], 0
call dword [ebp - 0x10]
pop ecx
mov ebx, eax
call dword [ebp - 0x14]
push dword [ebp - 8]
call fcn.0041524b
pop ecx
mov eax, ebx
jmp 0x401eb0
push 2
jmp 0x401dc5
xor eax, eax
inc eax
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407875
leave
ret
Function at 0x40de60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov eax, dword [esp + 8]
mov cx, word [0x48202e]
movsx ecx, cx
or ecx, 0xd23ddf38
xor ecx, 0x2dc220c6
cmp ecx, 0xdbba813a
jb 0x40dea6
mov ecx, dword [0x488a80]
add ecx, 0xd1293b3f
and ecx, 0x8273736d
mov edx, dword [0x48bc80]
imul edx, ecx
mov dword [0x48bc80], edx
jmp 0x40ded3
mov ecx, dword [0x48666c]
mov edx, dword [0x488734]
lea esi, [edx - 1]
mov dword [0x488734], esi
lea ecx, [ecx + edx - 0x8678d93]
mov dx, word [0x480158]
imul edx, ecx
mov word [0x480158], dx
mov ecx, dword [0x487590]
and ecx, 0xfb8866d6
mov edx, dword [0x48df18]
sub edx, ecx
mov dword [0x48df18], edx
mov ecx, dword [0x483a30]
not ecx
imul ecx, ecx, 0xa9baa863
or dword [0x48b6b0], ecx
mov dword [0x483c24], 0x935cd5d1
mov cx, word [0x47f584]
movsx ecx, cx
and ecx, 0x257d1feb
xor ecx, 0x66e6bf64
mov edx, dword [0x485d74]
imul edx, ecx
xor ecx, ecx
dec eax
mov dword [0x485d74], edx
je 0x40df8e
xor dword [0x4888c8], 0x6e1fbcb
mov ecx, 0x1f
test eax, eax
js 0x40df84
mov edx, 0x80000000
nop
nop
nop
mov esi, dword [0x48b8c0]
dec esi
mov dword [0x48b8c0], esi
xor esi, 0x98d5cdef
and dword [0x485e0c], esi
dec ecx
mov si, word [0x481d70]
xor esi, 0xb333
mov word [0x481d70], si
shr edx, 1
test edx, eax
je 0x40df50
mov dword [0x484040], 0x7cd117e2
mov eax, dword [0x48e4f4]
lea edx, [eax - 1]
mov dword [0x48e4f4], edx
add eax, 0x308770e8
mov edx, dword [0x485424]
or edx, eax
add dword [0x4853c0], edx
inc dword [0x4893b8]
cmp ecx, 0x1f
jb 0x40dfd9
xor dword [0x48dc1c], 0x8701f518
mov ax, word [0x47ec9a]
xor dword [0x486e74], 0x75b6ebfc
mov ecx, 0xffffffff
mov eax, dword [0x485d5c]
imul eax, eax, 0x431d8075
cmp eax, 0x55fe6d23
jg 0x40e007
mov eax, dword [0x489640]
inc eax
mov dword [0x489640], eax
mov edx, dword [0x488584]
imul edx, eax
mov dword [0x488584], edx
jmp 0x40e035
mov eax, dword [0x487c24]
dec eax
mov dword [0x487c24], eax
imul eax, eax, 0xbb10f72f
or eax, 0x4d60d077
cmp eax, 0x4e4ef753
jl 0x40e035
mov ax, word [0x482436]
add eax, 0x1156
mov word [0x482436], ax
mov eax, dword [0x484d48]
imul eax, eax, 0xb71f7bef
mov dword [0x484d48], eax
inc ecx
mov eax, 1
shl eax, cl
pop esi
ret
Function at 0x43e080
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
mov eax, dword [0x488f84]
mov ecx, dword [0x48a0d8]
imul ecx, ecx, 0xb5bd5292
xor ecx, eax
cmp ecx, 0xc441b4bf
jl 0x43e0df
mov eax, dword [0x484c8c]
inc eax
mov dword [0x484c8c], eax
xor eax, 0xc5886ba4
cmp eax, 0xaf44a162
jg 0x43e0c0
mov eax, dword [0x48356c]
jmp 0x43e0df
mov ax, word [0x47d2f8]
cwde
mov cx, word [0x47e47c]
movsx ecx, cx
imul eax, eax, 0x3fb8b1d8
add eax, ecx
add dword [0x48df04], eax
mov ax, word [0x47d2ea]
lea ecx, [eax - 1]
mov word [0x47d2ea], cx
cwde
and eax, 0x49e309c0
mov ecx, dword [0x485d60]
imul ecx, eax
mov dword [0x485d60], ecx
mov eax, dword [0x485f30]
lea ecx, [eax + 1]
mov dword [0x485f30], ecx
mov ecx, dword [0x488b10]
lea eax, [eax + ecx - 0x78e4babc]
mov dword [0x488b10], eax
mov dword [esp], esi
call fcn.0044b260
mov cx, word [0x47e020]
movsx ecx, cx
add ecx, 0xe99553f1
mov edx, dword [0x48c618]
lea edi, [edx + 1]
mov dword [0x48c618], edi
cmp ecx, edx
jg 0x43e178
mov ecx, dword [0x48ab40]
lea edx, [ecx + 1]
mov dword [0x48ab40], edx
add ecx, 0xf5695c52
mov edx, dword [0x48a130]
or edx, ecx
or edx, 0x561c5395
mov dword [0x48a130], edx
xor dword [0x488708], 0x3d6a8e5b
movzx ecx, byte [eax + esi - 1]
cmp ecx, 0x22
jne 0x43e232
and dword [0x48d3f4], 0xe4edef41
mov byte [esi], 0x22
mov cx, word [0x481070]
dec ecx
mov word [0x481070], cx
mov edx, dword [0x489324]
shr edx, 0xa
mov di, word [0x47f226]
imul edx, ecx
imul ecx, edx, 0x4e2d8534
add ecx, edi
mov word [0x47f226], cx
mov byte [esi + eax - 1], 0
or dword [0x486220], 0x6f5adac2
nop
nop
nop
mov ecx, dword [0x487474]
xor ecx, 0xa42266ad
add dword [0x48ab6c], ecx
mov dword [0x487e5c], 0x1695d72c
movzx ecx, byte [esi + eax - 2]
dec eax
cmp ecx, 0x22
jne 0x43e1e0
mov cx, word [0x480bf8]
xor ecx, 0xfe2d
mov word [0x480bf8], cx
mov ecx, dword [0x486d04]
imul ecx, ecx, 0x5e928430
mov dword [0x486d04], ecx
jmp 0x43e32f
and dword [0x48dbe0], 0x18200cce
mov byte [esi], 0x20
mov ecx, dword [0x4833ec]
add ecx, 0xbc845d6e
cmp ecx, 0xbd0c55a5
jg 0x43e280
mov ecx, dword [0x48b930]
sar ecx, 6
mov edx, dword [0x48c624]
sub ecx, edx
mov edx, dword [0x4839b0]
imul edx, ecx
mov dword [0x4839b0], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [0x4883d0]
mov cx, word [0x47e350]
and ecx, 0xffffe0d5
mov dx, word [0x47e9b0]
or edx, ecx
mov word [0x47e9b0], dx
mov ecx, dword [0x486cdc]
add ecx, 0x86dd5a43
mov edx, dword [0x489a74]
mov edi, 0xd32da4a6
sub edi, edx
cmp ecx, edi
jg 0x43e304
mov ecx, dword [0x48526c]
sar ecx, 8
mov edx, dword [0x4882d0]
add edx, 0xd1c84bd2
and edx, ecx
cmp edx, 0xffff6f5d
jne 0x43e2f0
dec dword [0x4893c0]
dec dword [0x48a9d4]
jmp 0x43e304
mov cx, word [0x48106a]
add ecx, 0xffffa8ff
mov word [0x48106a], cx
movzx ecx, byte [esi + eax - 2]
dec eax
cmp ecx, 0x20
jne 0x43e280
xor dword [0x486fb0], 0x52d298fd
mov ecx, dword [0x488c6c]
add ecx, 0xb68b710c
xor dword [0x482f84], ecx
add esi, eax
and dword [0x48a704], 0xbe6fa774
mov eax, esi
add esp, 4
pop esi
pop edi
ret
Function at 0x4440c0
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [esp + 0x14]
mov eax, dword [0x486100]
xor eax, 0xf14a1050
add dword [0x48aa14], eax
mov eax, dword [0x48e734]
mov eax, dword [0x48cc54]
xor eax, 0xfc7514ea
mov dword [0x48ac04], eax
mov dword [esp], edi
call fcn.0044b260
or dword [0x48c63c], 0x87c1a513
mov ecx, dword [0x48bef8]
lea edx, [ecx + 1]
mov dword [0x48bef8], edx
or dword [0x485568], ecx
mov dword [esi], 0
mov ecx, dword [0x486a8c]
lea edx, [ecx - 1]
mov dword [0x486a8c], edx
cmp ecx, 0x3a25d09e
jl 0x444151
mov cx, word [0x47df96]
movsx ecx, cx
imul ecx, ecx, 0x38ac2c3f
cmp ecx, 0x62385b4e
jne 0x444151
mov ecx, dword [0x488ec0]
mov dword [esi + 4], 0
mov ecx, dword [0x48b14c]
mov dword [0x48c050], 0xee8a3e18
mov dword [esi + 8], 0x67452301
mov ecx, dword [0x48c040]
mov edx, dword [0x484f9c]
imul edx, ecx
mov dword [0x484f9c], edx
mov dword [esi + 0xc], 0xefcdab89
mov cx, word [0x47d01c]
imul ecx, ecx, 0x38e
mov word [0x47d01c], cx
mov dword [esi + 0x10], 0x98badcfe
xor dword [0x489780], 0xf7fffef1
mov dword [esi + 0x14], 0x10325476
mov ecx, dword [0x48ce08]
add ecx, 0x80ca408e
cmp ecx, 0xbae4a09b
jg 0x4441d5
add dword [0x48a354], 0xac6ac2cc
mov ecx, dword [0x489120]
imul ecx, ecx, 0xcd7a7a8d
cmp ecx, 0x20b0611a
jl 0x444201
mov ecx, dword [0x483d24]
mov ecx, dword [0x48c450]
imul ecx, ecx, 0x21201d08
mov dword [0x48c450], ecx
mov dword [esp + 4], eax
mov dword [esp], edi
mov ecx, esi
call fcn.00401170
sub esp, 8
mov eax, dword [0x48bcbc]
shl eax, 4
mov ecx, dword [0x487f10]
inc ecx
mov dword [0x487f10], ecx
and ecx, eax
mov ax, word [0x482652]
or eax, ecx
mov word [0x482652], ax
mov ecx, esi
call fcn.00442e20
mov eax, dword [0x48e984]
xor eax, 0x98df2cc6
cmp eax, 0xd5fffd6f
jl 0x444276
mov eax, dword [0x483930]
imul eax, eax, 0xec570f07
cmp eax, 0xeb0474a4
jne 0x444276
mov eax, dword [0x48ab30]
mov cx, word [0x47e58a]
sub ecx, eax
mov word [0x47e58a], cx
mov ecx, esi
call fcn.00446980
mov ax, word [0x47d0fe]
and eax, 0xe161
mov word [0x47d0fe], ax
add esi, 0xb9
mov eax, esi
add esp, 8
pop esi
pop edi
ret 4
Function at 0x45608e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47bdc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00453c9d
mov dword [ebp - 0x14], eax
cmp dword [0x48fdd4], esi
jne 0x456181
push 0x800
push esi
push 0x46d1f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x45610e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x456261
push esi
push esi
push 0x46d1f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x456261
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x456261
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x48fdd4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x48fdd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x48fddc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x48fde4], eax
test eax, eax
je 0x45617e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x48fde0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4561a6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x456199
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4561bb
push 4
pop eax
jmp 0x456263
cmp dword [ebp - 0x14], esi
je 0x4561bb
push dword [0x48fdd4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4561a0
mov eax, dword [0x48fde0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x456219
cmp dword [0x48fde4], edi
je 0x456219
push eax
call ebx
push dword [0x48fde4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x456219
test eax, eax
je 0x456219
call ecx
test eax, eax
je 0x45620e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x45620e
test byte [ebp - 8], 1
jne 0x456219
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x456249
mov eax, dword [0x48fdd8]
cmp eax, edi
je 0x456246
push eax
call ebx
test eax, eax
je 0x456246
call eax
mov esi, eax
test esi, esi
je 0x456246
mov eax, dword [0x48fddc]
cmp eax, edi
je 0x456246
push eax
call ebx
test eax, eax
je 0x456246
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x48fdd4]
call ebx
test eax, eax
je 0x456261
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x456263
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456292
mov esp, ebp
pop ebp
ret
Function at 0x4013d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4013e9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4013fd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40141e
cmp esi, eax
jae 0x4013f7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401410
cmp esi, eax
jae 0x4013f7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403b04
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
push edi
push edx
and edx, 0x10a01
xor edx, 0x12ae5
xor edx, 0x1132f
jmp 0x403b2c
pop edx
push ebx
push ebx
add esp, 4
add ebx, 0x15fd4
pop ebx
push ebx
jmp 0x403b41
pop ebx
mov eax, 0x6b
mov word [ebp - 0x2b0], ax
mov ecx, 0x65
mov word [ebp - 0x2ae], cx
mov edx, 0x72
mov word [ebp - 0x2ac], dx
mov eax, 0x6e
mov word [ebp - 0x2aa], ax
mov ecx, 0x65
mov word [ebp - 0x2a8], cx
mov edx, 0x6c
mov word [ebp - 0x2a6], dx
mov eax, 0x33
mov word [ebp - 0x2a4], ax
mov ecx, 0x32
mov word [ebp - 0x2a2], cx
mov edx, 0x2e
mov word [ebp - 0x2a0], dx
mov eax, 0x64
mov word [ebp - 0x29e], ax
mov ecx, 0x6c
mov word [ebp - 0x29c], cx
mov edx, 0x6c
mov word [ebp - 0x29a], dx
xor eax, eax
mov word [ebp - 0x298], ax
mov dword [ebp - 0x1b0], 0
push ebx
add ebx, 0x1674f
pop ebx
push edi
push ebx
add esp, 4
jmp 0x403bf9
jmp 0x403bfe
pop edi
push edx
push eax
add esp, 4
xor edx, 0x1dc6
and edx, 0xf04e
or edx, 0xd719
pop edx
mov byte [ebp - 0x198], 0x47
mov byte [ebp - 0x197], 0x65
mov byte [ebp - 0x196], 0x74
mov byte [ebp - 0x195], 0x4d
mov byte [ebp - 0x194], 0x6f
mov byte [ebp - 0x193], 0x64
mov byte [ebp - 0x192], 0x75
mov byte [ebp - 0x191], 0x6c
mov byte [ebp - 0x190], 0x65
mov byte [ebp - 0x18f], 0x48
mov byte [ebp - 0x18e], 0x61
mov byte [ebp - 0x18d], 0x6e
mov byte [ebp - 0x18c], 0x64
mov byte [ebp - 0x18b], 0x6c
mov byte [ebp - 0x18a], 0x65
mov byte [ebp - 0x189], 0x45
mov byte [ebp - 0x188], 0x78
mov byte [ebp - 0x187], 0x57
mov byte [ebp - 0x186], 0
mov ecx, dword [ebp - 0x4b0]
mov dword [ebp - 0x1b4], ecx
push edx
push esi
add esp, 4
or edx, 0x10e07
or edx, 0x106f9
pop edx
push edx
and edx, 0x7ca8
add edx, 0x56bb
call fcn.00403cd6
add byte [ebx], dh
dec edi
inc eax
dec edi
xor eax, 0x49393948
Function at 0x403fe7
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or eax, 0x1d56
call 0x403fe7
add byte [ebp + 0x49], cl
dec eax
cmp byte [edi + 0x36], cl
cmp al, 0x3c
cmp byte [ebx + 0xf5804c4], al
mov bh, 0x55
clc
test edx, edx
jne 0x404008
movzx eax, word [ebp - 0x54]
movzx ecx, word [ebp - 8]
sub eax, ecx
mov dword [ebp - 0x370], eax
jmp 0x40408b
movzx edx, word [ebp - 0x54]
movzx eax, word [ebp - 8]
cmp edx, eax
je 0x403f01
movzx ecx, word [ebp - 0x54]
xor ecx, 0x20
movzx edx, word [ebp - 8]
cmp ecx, edx
je 0x403f01
push ebx
push eax
add esp, 4
and ebx, 0x4fe9
add ebx, 0x1606c
and ebx, 0x4ed2
pop ebx
push eax
xor eax, 0xdd74
or eax, 0x203
pop eax
push ecx
push esi
add esp, 4
and ecx, 0xd2d2
pop ecx
movzx eax, word [ebp - 0x54]
movzx ecx, word [ebp - 8]
cmp eax, ecx
jge 0x404075
mov dword [ebp - 0x36c], 0xffffffff
jmp 0x40407f
mov dword [ebp - 0x36c], 1
mov edx, dword [ebp - 0x36c]
mov dword [ebp - 0x370], edx
cmp dword [ebp - 0x370], 0
jne 0x4040d4
push eax
push esi
add esp, 4
xor eax, 0x11aad
add eax, 0x1845b
add eax, 0xfdc0
pop eax
push esi
and esi, 0xb907
add esi, 0x16e68
pop esi
push edi
push edx
add esp, 4
add edi, 0x9cd9
pop edi
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x6c], eax
jmp 0x40416b
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov dword [ebp - 0xc4], edx
push ebx
call 0x4040f1
add byte [eax], bh
dec edi
dec ecx
inc esp
cmp byte [edi + 0x4f], al
cmp dword [ebx + 0xbe804c4], eax
add byte [eax], al
add byte [eax], al
dec edx
dec eax
xor ecx, dword [eax + 0x48]
inc ebp
dec ebx
xor al, 0x4e
inc eax
add esp, 4
add ebx, 0x11ca1
sub ebx, 0xd79c
pop ebx
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x1ec]
je 0x404132
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x30], 0
jne 0x403e76
push edi
call 0x40413f
add byte [0x3f364d3d], dh
aas
add esp, 4
xor edi, 0xf6a3
pop edi
push ebx
push ebx
add esp, 4
or ebx, 0x2532
jmp 0x40415b
jmp 0x404163
pop ebx
mov dword [ebp - 0x6c], 0
Function at 0x4040f1
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or eax, 0x1d56
call 0x403fe7
add byte [ebp + 0x49], cl
dec eax
cmp byte [edi + 0x36], cl
cmp al, 0x3c
cmp byte [ebx + 0xf5804c4], al
mov bh, 0x55
clc
test edx, edx
jne 0x404008
movzx eax, word [ebp - 0x54]
movzx ecx, word [ebp - 8]
sub eax, ecx
mov dword [ebp - 0x370], eax
jmp 0x40408b
movzx edx, word [ebp - 0x54]
movzx eax, word [ebp - 8]
cmp edx, eax
je 0x403f01
movzx ecx, word [ebp - 0x54]
xor ecx, 0x20
movzx edx, word [ebp - 8]
cmp ecx, edx
je 0x403f01
push ebx
push eax
add esp, 4
and ebx, 0x4fe9
add ebx, 0x1606c
and ebx, 0x4ed2
pop ebx
push eax
xor eax, 0xdd74
or eax, 0x203
pop eax
push ecx
push esi
add esp, 4
and ecx, 0xd2d2
pop ecx
movzx eax, word [ebp - 0x54]
movzx ecx, word [ebp - 8]
cmp eax, ecx
jge 0x404075
mov dword [ebp - 0x36c], 0xffffffff
jmp 0x40407f
mov dword [ebp - 0x36c], 1
mov edx, dword [ebp - 0x36c]
mov dword [ebp - 0x370], edx
cmp dword [ebp - 0x370], 0
jne 0x4040d4
push eax
push esi
add esp, 4
xor eax, 0x11aad
add eax, 0x1845b
add eax, 0xfdc0
pop eax
push esi
and esi, 0xb907
add esi, 0x16e68
pop esi
push edi
push edx
add esp, 4
add edi, 0x9cd9
pop edi
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x6c], eax
jmp 0x40416b
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov dword [ebp - 0xc4], edx
push ebx
call 0x4040f1
add byte [eax], bh
dec edi
dec ecx
inc esp
cmp byte [edi + 0x4f], al
cmp dword [ebx + 0xbe804c4], eax
add byte [eax], al
add byte [eax], al
dec edx
dec eax
xor ecx, dword [eax + 0x48]
inc ebp
dec ebx
xor al, 0x4e
inc eax
add esp, 4
add ebx, 0x11ca1
sub ebx, 0xd79c
pop ebx
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x1ec]
je 0x404132
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x30], 0
jne 0x403e76
push edi
call 0x40413f
add byte [0x3f364d3d], dh
aas
add esp, 4
xor edi, 0xf6a3
pop edi
push ebx
push ebx
add esp, 4
or ebx, 0x2532
jmp 0x40415b
jmp 0x404163
pop ebx
mov dword [ebp - 0x6c], 0