joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100012ff
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x1000135f
cmp dword [ebp - 4], 2
jne 0x1000135f
cmp dword [esi + 0x14], 8
jb 0x10001329
mov esi, dword [esi]
mov eax, dword [eax + 4]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x10001352
test cx, cx
je 0x1000134e
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x10001352
add esi, 4
add eax, 4
test cx, cx
jne 0x1000132c
xor eax, eax
jmp 0x10001357
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000135f
mov al, 1
jmp 0x10001361
xor al, al
pop esi
leave
ret

Function at 0x10001f7f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ecx + 0x3c]
push ebx
push esi
push edi
mov esi, dword [eax + ecx + 0x78]
mov edx, dword [eax + ecx + 0x50]
add esi, ecx
mov eax, dword [eax + ecx + 0x7c]
add edx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [esi + 0x24]
mov edi, edx
mov ebx, dword [esi + 0x20]
add eax, ecx
mov dword [ebp - 0x14], eax
add ebx, ecx
mov eax, dword [esi + 0x1c]
add eax, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], eax
cmp dword [esi + 0x14], edx
jbe 0x1000201d
mov ebx, dword [ebx + edi*4]
lea eax, [ecx + 0xdc]
add eax, ebx
cmp dword [ebp - 4], eax
jbe 0x10002003
lea eax, [ebx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov al, byte [eax]
test al, al
je 0x10002003
mov esi, dword [ebp - 8]
imul ebx, ebx, 0x4e44cb31
movsx eax, al
add ebx, eax
inc esi
mov al, byte [esi]
test al, al
jne 0x10001fe6
mov esi, dword [ebp - 0xc]
cmp ebx, 0x7f68db4a
je 0x1000200e
inc edi
cmp edi, dword [esi + 0x14]
jae 0x1000201d
mov ebx, dword [ebp - 0x10]
jmp 0x10001fc5
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
movzx eax, word [eax + edi*2]
mov edx, dword [edx + eax*4]
add edx, ecx
cmp edx, esi
jb 0x1000202d
mov ecx, dword [ebp - 0x1c]
xor eax, eax
add ecx, esi
cmp edx, ecx
cmovb edx, eax
pop edi
pop esi
mov eax, edx
pop ebx
leave
ret
Function at 0x100020b1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x30]
push ebx
push esi
xor ebx, ebx
mov eax, dword [eax + 0xc]
push edi
mov edi, ebx
mov esi, dword [eax + 0x14]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x10], ecx
jmp 0x10002133
cmp word [esi + 0x24], 0x30
ja 0x10002131
mov eax, dword [esi + 0x28]
mov edx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
cmp word [eax], bx
je 0x10002124
mov edi, eax
mov esi, ebx
mov bl, byte [edi]
lea edi, [edi + 2]
lea eax, [ebx + 0x20]
lea edx, [ebx - 0x41]
movzx ecx, al
cmp dl, 0x19
movzx eax, bl
cmova ecx, eax
imul esi, esi, 0x4e44cb31
movsx ecx, cl
xor ebx, ebx
add esi, ecx
cmp word [edi], bx
jne 0x100020ed
mov ecx, dword [ebp - 0x10]
mov edi, ebx
mov dword [ebp - 4], esi
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, 0x96d214c0
je 0x10002140
cmp dword [esi + 0x10], ebx
je 0x1000213c
mov esi, dword [esi]
mov dword [ebp - 8], esi
cmp esi, ecx
jne 0x100020d2
jmp 0x10002143
mov edi, ebx
jmp 0x10002143
mov edi, dword [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
test edi, edi
jne 0x10002150
xor eax, eax
jmp 0x1000217c
mov ecx, edi
call fcn.10001f7f
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
test eax, eax
je 0x1000217a
push eax
mov edx, 0x85e6ce66
mov ecx, edi
call fcn.10002034
pop ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
test eax, eax
setne bl
mov dword [ecx], eax
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10002df6
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push str.hModule1_wweb32
push 1
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
jne 0x10002d35
push edi
call fcn.10006886
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10002d4b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10002d2f
call section..text
jmp 0x10002d2f
call fcn.10002d52
jmp 0x10002d16
Function at 0x402e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [0x44b460], 0
push ebx
push esi
push edi
je 0x402ec9
mov eax, dword [0x44b4a4]
mov ecx, 1
mov eax, dword [eax]
test eax, eax
cmove eax, ecx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x402ed0
mov eax, dword [0x44b4a4]
mov edx, esi
push dword [eax]
call fcn.00413680
mov eax, dword [0x44b4a4]
add esp, 4
mov ebx, dword [eax]
call fcn.0040b2f0
mov edi, eax
cmp edi, 0xffffffff
je 0x402ebf
push 0
lea eax, [esp + 0x10]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00413280
int3
Function at 0x407290
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0x14]
mov edx, dword [edi + 8]
cmp esi, edx
jae 0x4072bb
mov ecx, dword [edi]
mov al, byte [ecx + esi]
cmp al, 0x20
je 0x4072b4
cmp al, 9
je 0x4072b4
cmp al, 0xa
jne 0x4072b9
inc esi
cmp esi, edx
jb 0x4072a5
cmp esi, edx
je 0x407371
mov ecx, dword [edi]
mov cl, byte [ecx + esi]
call fcn.00407230
test al, al
jne 0x407371
mov eax, dword [ebx + 0xc]
mov dword [eax + 8], 0
mov eax, dword [eax]
mov byte [eax], 0
mov eax, dword [ebx + 8]
cmp esi, dword [eax + 8]
jae 0x407367
nop word [eax + eax]
mov eax, dword [eax]
mov al, byte [esi + eax]
cmp al, 0x20
je 0x407367
cmp al, 9
je 0x407367
cmp al, 0xa
je 0x407367
cmp al, 0x28
je 0x407367
cmp al, 0x29
je 0x407367
cmp al, 0x3c
je 0x407367
cmp al, 0x3e
je 0x407367
cmp al, 0x40
je 0x407367
cmp al, 0x2c
je 0x407367
cmp al, 0x3b
je 0x407367
cmp al, 0x3a
je 0x407367
cmp al, 0x5c
je 0x407367
cmp al, 0x22
je 0x407367
cmp al, 0x2f
je 0x407367
cmp al, 0x5b
je 0x407367
cmp al, 0x5d
je 0x407367
cmp al, 0x3f
je 0x407367
cmp al, 0x3d
je 0x407367
cmp al, 0x7b
je 0x407367
cmp al, 0x7d
je 0x407367
mov byte [esp + 0xc], al
lea ecx, [esp + 0xc]
mov eax, dword [ebx + 0xc]
add eax, 0xc
push 1
push ecx
push eax
mov eax, dword [eax]
call eax
mov eax, dword [ebx + 8]
inc esi
add esp, 0xc
cmp esi, dword [eax + 8]
jb 0x4072f0
pop edi
mov dword [ebx + 0x14], esi
mov al, 1
pop esi
pop ebx
pop ecx
ret
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
Function at 0x409f90
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x34
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
push 0x441208
mov ebp, ecx
call fcn.00413800
mov esi, eax
add esp, 4
test esi, esi
je 0x409fc2
mov ecx, dword [esi]
push esi
mov ecx, dword [ecx + 4]
call ecx
add esp, 4
push dword [esp + 0x4c]
mov eax, dword [esi + 4]
push dword [esp + 0x4c]
push eax
mov eax, dword [eax]
call eax
mov eax, dword [esi]
lea ecx, [esp + 0x28]
add esp, 0xc
mov eax, dword [eax + 0xc]
push ecx
push esi
call eax
mov eax, dword [esi]
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp + 0xc]
lea ebx, [ebp + 0xc]
add esp, 0xc
push 7
push str.SHA256:
push ebx
call eax
add esp, 0xc
xor esi, esi
lea eax, [esp + 0x1e]
mov edx, 0x20
add eax, esi
sub edx, esi
mov edi, eax
movzx eax, byte [eax - 2]
shl eax, 0x10
cmp edx, 3
jbe 0x40a024
mov edx, 3
jmp 0x40a029
cmp edx, 1
jle 0x40a032
movzx ecx, byte [edi - 1]
shl ecx, 8
or eax, ecx
cmp edx, 2
jle 0x40a03c
movzx ecx, byte [edi]
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + 0x14], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + 0x15], cl
cmp edx, 1
jle 0x40a08a
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + 0x16], cl
cmp edx, 2
jle 0x40a08f
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esp + 0x17], al
jmp 0x40a094
mov byte [esp + 0x16], 0x3d
mov byte [esp + 0x17], 0x3d
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebx]
push ebx
call eax
add esi, 3
add esp, 0xc
cmp esi, 0x20
jb 0x40a002
mov eax, dword [ebp + 8]
test eax, eax
je 0x40a0c8
mov ecx, dword [ebp]
cmp byte [ecx + eax - 1], 0x3d
jne 0x40a0c8
dec eax
mov dword [ebp + 8], eax
mov byte [eax + ecx], 0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043505d
add esp, 0x34
ret

Function at 0x40aed0
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
mov ecx, str.FATAL_ERROR
call fcn.0040ae40
add esp, 4
mov ecx, 1
jmp 0x40cad0
push esi
mov esi, ecx
call fcn.0040dc20
call fcn.00402e50
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop esi
int3
Function at 0x40b0b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
mov dword [esp + 0x18], ebp
push edi
test esi, esi
je 0x40b245
mov ecx, dword [esi]
call fcn.0040ebd0
mov ebx, eax
test ebx, ebx
je 0x40b245
push 0
push str.IsBold
push ebp
call fcn.004107b0
add esp, 0xc
mov dword [esp + 0x14], 4
mov ebp, eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push ebp
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b128
cmp dword [esp + 0x14], 4
jne 0x40b128
cmp dword [esp + 0x18], 4
jne 0x40b128
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
jmp 0x40b130
mov dword [esp + 0x14], 0xffffffff
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ebp, ebp
je 0x40b140
push ebp
call edi
add esp, 4
cmp dword [esp + 0x14], 0xffffffff
je 0x40b23f
push 0
push str.CharSet
push dword [esp + 0x24]
call fcn.004107b0
add esp, 0xc
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 4
push ecx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x28]
push ecx
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b19c
cmp dword [esp + 0x18], 4
jne 0x40b19c
cmp dword [esp + 0x20], 4
jne 0x40b19c
mov ebp, dword [esp + 0x24]
jmp 0x40b19f
or ebp, 0xffffffff
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40b1ad
push eax
call edi
add esp, 4
cmp ebp, 0xffffffff
je 0x40b23f
push 0
push str.Height
push dword [esp + 0x24]
call fcn.004107b0
add esp, 0xc
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 4
push ecx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x30]
push ecx
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b205
cmp dword [esp + 0x1c], 4
jne 0x40b205
cmp dword [esp + 0x28], 4
mov esi, dword [esp + 0x24]
je 0x40b20a
mov esi, 0x80000000
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40b218
push eax
call edi
add esp, 4
cmp esi, 0x80000000
je 0x40b23f
mov dl, byte [esp + 0x14]
mov ecx, ebx
push ebp
push esi
call fcn.0040b560
push ebx
mov esi, eax
call edi
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push ebx
call edi
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
Function at 0x40b250
Capabilities:
Check if file exists
Delete file

Disassembly:
push esi
mov esi, ecx
test edx, edx
jne 0x40b297
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b289
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40b289
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0040ee40
push eax
push esi
push str.Unable_to_delete__s:__s
call fcn.0040aef0
add esp, 0xc
mov eax, dword [esp + 8]
pop esi
mov dword [eax], 0xffffffff
xor al, al
ret
xor eax, eax
mov ecx, 0x80
push 0
cmp edx, 2
cmove eax, ecx
push eax
xor eax, eax
cmp edx, 2
setne al
xor ecx, ecx
add eax, 2
cmp edx, 2
push eax
push 0
mov eax, 3
cmove eax, ecx
mov ecx, 0x40000000
push eax
mov eax, 0x80000000
cmove eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 8]
cmp eax, 0xffffffff
pop esi
mov dword [ecx], eax
setne al
ret
Function at 0x40b2f0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x214
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push ebp
push esi
push edi
push 0
push str.SoftwareSimonTathamPuTTY
push 0x80000001
push 0
push 0
call fcn.0040eb20
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40b366
mov edx, str.RandSeedFile
mov ecx, esi
call fcn.0040ebd0
push esi
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x40b366
lea eax, [esp + 0x10]
mov edx, 2
push eax
mov ecx, ebp
call fcn.0040b250
push ebp
mov bl, al
call edi
add esp, 8
test bl, bl
jne 0x40b530
cmp byte [0x44b4b4], 0
jne 0x40b3ac
mov ecx, str.shell32.dll
call fcn.0040ed20
mov dword [0x44b4f0], eax
test eax, eax
je 0x40b39c
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x44b4f4], eax
mov byte [0x44b4b4], 1
jmp 0x40b3b1
xor eax, eax
mov byte [0x44b4b4], 1
mov dword [0x44b4f4], eax
jmp 0x40b3b1
mov eax, dword [0x44b4f4]
test eax, eax
je 0x40b459
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x1c
push 0
call eax
test eax, eax
js 0x40b407
push 0
lea eax, [esp + 0x18]
push str.PUTTY.RND
push eax
call fcn.004107b0
mov esi, eax
mov edx, 2
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.0040b250
add esp, 0x10
mov bl, al
test esi, esi
je 0x40b3ff
push esi
call edi
add esp, 4
test bl, bl
jne 0x40b530
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x1a
push 0
call dword [0x44b4f4]
test eax, eax
js 0x40b459
push 0
lea eax, [esp + 0x18]
push str.PUTTY.RND
push eax
call fcn.004107b0
mov esi, eax
mov edx, 2
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.0040b250
add esp, 0x10
mov bl, al
test esi, esi
je 0x40b451
push esi
call edi
add esp, 4
test bl, bl
jne 0x40b530
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x11c]
push 0x104
push eax
push str.HOMEDRIVE
call esi
mov ebx, eax
lea eax, [esp + 0x14]
push 0x104
push eax
push str.HOMEPATH
call esi
test ebx, ebx
jne 0x40b493
mov byte [esp + 0x11c], bl
jmp 0x40b49b
cmp ebx, 0x104
jae 0x40b4e2
dec eax
cmp eax, 0x102
ja 0x40b4e2
push 0
push str.PUTTY.RND
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x128]
push eax
call fcn.004107b0
mov esi, eax
mov edx, 2
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040b250
add esp, 0x14
mov bl, al
test esi, esi
je 0x40b4de
push esi
call edi
add esp, 4
test bl, bl
jne 0x40b530
push 0x104
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, 0x104
jae 0x40b536
push 0
lea eax, [esp + 0x18]
push str.PUTTY.RND
push eax
call fcn.004107b0
mov esi, eax
mov edx, 2
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.0040b250
add esp, 0x10
mov bl, al
test esi, esi
je 0x40b52c
push esi
call edi
add esp, 4
test bl, bl
je 0x40b536
mov eax, dword [esp + 0x10]
jmp 0x40b539
or eax, 0xffffffff
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043505d
add esp, 0x214
ret
Function at 0x40bdf0
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
mov ecx, str.plink
call fcn.0040ae40
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x40c340
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00413180
mov esi, eax
push esi
push str.Unidentified_build
push str.plink:__s_n_s_n
call fcn.0040bdb0
add esp, 0xc
mov ecx, esi
call fcn.00410660
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x40ebd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
lea eax, [esp + 8]
push ebx
push esi
push edi
push eax
push 0
lea eax, [esp + 0x18]
mov edi, edx
push eax
push 0
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ec5b
cmp dword [esp + 0x10], 1
jne 0x40ec5b
mov eax, dword [esp + 0x14]
mov ecx, 1
add eax, 1
cmove eax, ecx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x40ec64
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ec51
cmp dword [esp + 0x10], 1
jne 0x40ec51
mov eax, dword [esp + 0x14]
mov byte [esi + eax], 0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00413280
int3

Function at 0x40ec70
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor bl, bl
mov al, byte [esi]
test al, al
je 0x40ed1b
push edi
lea edi, [edx + 0xc]
cmp al, 0x20
je 0x40ecbe
cmp al, 0x5c
je 0x40ecbe
cmp al, 0x2a
je 0x40ecbe
cmp al, 0x3f
je 0x40ecbe
cmp al, 0x25
je 0x40ecbe
lea ecx, [eax - 0x20]
cmp cl, 0x5e
ja 0x40ecbe
cmp al, 0x2e
jne 0x40eca9
test bl, bl
je 0x40ecbe
mov byte [esp + 0xc], al
lea eax, [esp + 0xc]
push 1
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0xc
jmp 0x40ed0c
push 1
lea eax, [esp + 0x10]
mov byte [esp + 0x10], 0x25
push eax
mov eax, dword [edi]
push edi
call eax
movzx eax, byte [esi]
shr eax, 4
push 1
movzx eax, byte [eax + str.0123456789ABCDEF]
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi]
push edi
call eax
movzx eax, byte [esi]
and eax, 0xf
push 1
movzx eax, byte [eax + str.0123456789ABCDEF]
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push eax
mov eax, dword [edi]
push edi
call eax
add esp, 0x24
mov al, byte [esi + 1]
inc esi
mov bl, 1
test al, al
jne 0x40ec85
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40ed20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x44bc58]
push ebx
mov ebx, ecx
mov dword [esp + 8], ebx
push ebp
push esi
push edi
test eax, eax
jne 0x40ede6
push dword [0x44bc5c]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push eax
call edi
mov esi, dword [0x44bc5c]
mov edx, eax
cmp edx, esi
jb 0x40ede1
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebp, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
lea eax, [edx + 1]
mov ecx, 0x100
cmp esi, eax
jbe 0x40ed7e
mov eax, dword [0x44bc58]
jmp 0x40edc8
sub edx, esi
mov eax, esi
inc edx
not eax
cmp edx, 0x100
cmovb edx, ecx
mov ecx, esi
shr ecx, 4
cmp edx, ecx
cmovae ecx, edx
cmp ecx, eax
cmovbe eax, ecx
add esi, eax
cmp esi, 0x7fffffff
ja 0x40ee1a
mov eax, dword [0x44bc58]
push esi
test eax, eax
jne 0x40edb8
call ebx
add esp, 4
jmp 0x40edbe
push eax
call ebp
add esp, 8
test eax, eax
je 0x40ee1a
mov dword [0x44bc5c], esi
push esi
push eax
mov dword [0x44bc58], eax
call edi
mov esi, dword [0x44bc5c]
mov edx, eax
cmp edx, esi
jae 0x40ed6b
mov ebx, dword [esp + 0x14]
mov eax, dword [0x44bc58]
push 0
push ebx
push 0x446070
push eax
call fcn.004107b0
add esp, 0x10
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test esi, esi
je 0x40ee10
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00413280
int3

Function at 0x412ad0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov bl, byte [esi + ecx]
lea eax, [ebx - 0x41]
cmp al, 0x19
ja 0x412af7
movsx eax, bl
sub eax, 0x41
jmp 0x412b39
lea eax, [ebx - 0x61]
cmp al, 0x19
ja 0x412b06
movsx eax, bl
sub eax, 0x47
jmp 0x412b39
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x412b15
movsx eax, bl
add eax, 4
jmp 0x412b39
cmp bl, 0x2b
jne 0x412b21
mov eax, 0x3e
jmp 0x412b39
cmp bl, 0x2f
jne 0x412b2d
mov eax, 0x3f
jmp 0x412b39
cmp bl, 0x3d
jne 0x412bbb
or eax, 0xffffffff
mov dword [esp + esi*4 + 0xc], eax
inc esi
cmp esi, 4
jl 0x412ae5
mov edx, dword [esp + 0xc]
cmp edx, 0xffffffff
je 0x412bbb
mov esi, dword [esp + 0x10]
cmp esi, 0xffffffff
je 0x412bbb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ecx, 0xffffffff
jne 0x412b6b
cmp eax, ecx
jne 0x412bbb
lea ebx, [ecx + 2]
jmp 0x412b76
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
add ebx, 2
shl edx, 6
and ecx, 0x3f
or edx, esi
and eax, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [edi], al
cmp ebx, 1
jbe 0x412b9f
mov ecx, edx
shr ecx, 8
mov byte [edi + 1], cl
cmp ebx, 2
jbe 0x412ba7
mov byte [edi + 2], dl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0043505d
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043505d
add esp, 0x14
ret
Function at 0x415990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0xffffffff
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 0xffffffff
push eax
xor edx, edx
mov dword [esp + 0x20], 0
call fcn.00415870
mov esi, dword [esp + 0x1c]
add esp, 0xc
xor edi, edi
mov ecx, 0x10
mov edx, esi
shr edx, cl
mov eax, edx
xor edx, esi
neg eax
shr eax, 0x1f
neg eax
and edx, eax
and eax, ecx
xor esi, edx
add edi, eax
shr ecx, 1
jne 0x4159d4
mov eax, dword [esp + 0xc]
shl eax, 5
inc eax
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415a00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
push esi
mov eax, edx
mov edx, dword [esp + 0x18]
mov dword [esp + 8], eax
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
test edx, edx
je 0x415a42
mov esi, edx
nop dword [eax]
movzx ecx, byte [esi + edi - 1]
dec esi
xor ecx, 0x30
mov eax, esi
dec ecx
xor eax, edx
shr ecx, 0x1f
dec ecx
and ecx, eax
xor edx, ecx
test esi, esi
jne 0x415a20
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], edx
xor ebp, ebp
mov dword [esp + 0x10], ebp
test eax, eax
je 0x415ab0
push ebx
nop dword [eax]
mov ecx, ebp
mov ebx, edx
shr ebx, cl
mov edi, 1
and bl, 1
shl edi, cl
neg bl
cmp edi, eax
jae 0x415a9e
mov ecx, dword [esp + 0x18]
mov esi, ecx
mov ebp, dword [esp + 0x10]
lea eax, [edi + ecx]
sub edi, ecx
mov dl, byte [esi]
lea esi, [esi + 1]
mov cl, byte [eax]
lea eax, [eax + 1]
xor cl, dl
and cl, bl
xor dl, cl
mov byte [esi - 1], dl
xor byte [eax - 1], cl
lea ecx, [edi + esi]
cmp ecx, ebp
jb 0x415a75
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebp
mov ecx, ebp
mov dword [esp + 0x14], ebp
shr eax, cl
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x415a50
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xc
ret