joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444014
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x28
call fcn.00444e8e
cmp byte [esp + 0x2c], al
mov byte [esp + 2], al
je 0x444211
test al, al
push esi
jne 0x444065
cmp byte [esp + 0x34], al
jne 0x444065
push 0x467248
xor esi, esi
push esi
push esi
push 0x44501c
push 0x2000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x468414], eax
je 0x4440fc
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx esi, byte [esp + 0x30]
push ebx
xor eax, eax
xor ebx, ebx
cmp byte [esp + 0x38], al
push ebp
sete al
push edi
mov edi, 0x417
mov ebp, eax
push ebp
push esi
push edi
push dword [0x467248]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x4440a0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x44407f
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x13], 0
call ebp
mov dword [esp + 0x18], eax
cmp byte [esp + 0x3c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x444106
push 1
push edi
push edi
xor esi, esi
push esi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x444137
cmp dword [esp + 0x24], esi
je 0x444166
mov byte [esp + 0x13], 1
call fcn.00444e8e
test al, al
jne 0x444166
cmp byte [esp + 0x40], al
jne 0x4441e2
mov byte [esp + 0x3c], al
jmp 0x4440b1
call fcn.00444e1b
jmp 0x444210
cmp byte [esp + 0x40], 0
je 0x44411a
call fcn.00444e8e
xor esi, esi
test al, al
je 0x444166
jmp 0x444137
lea eax, [esp + 0x14]
push eax
push dword [0x468414]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
jne 0x444150
xor esi, esi
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x1f4
ja 0x444166
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4440b1
push dword [0x468414]
call ebx
and dword [0x468414], 0
call fcn.00444e1b
xor esi, esi
cmp byte [esp + 0x40], 0
jne 0x4441db
cmp dword [0x467388], esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
je 0x444192
test byte [esp + 0x12], 1
jne 0x4441a7
push str.AHK_Keybd
push esi
push esi
call edi
mov dword [0x4683f0], eax
jmp 0x4441a7
test byte [esp + 0x12], 1
je 0x4441a7
push dword [0x4683f0]
call ebx
mov dword [0x4683f0], esi
cmp dword [0x46738c], esi
je 0x4441c6
test byte [esp + 0x12], 2
jne 0x4441db
push str.AHK_Mouse
push esi
push esi
call edi
mov dword [0x4683f4], eax
jmp 0x4441db
test byte [esp + 0x12], 2
je 0x4441db
push dword [0x4683f4]
call ebx
mov dword [0x4683f4], esi
cmp byte [esp + 0x13], 0
je 0x44420d
push esi
fldz
push ecx
push ecx
fstp qword [esp]
push esi
push 0x10000
push 0x45bac0
mov dword [0x46506c], esi
call fcn.0043c205
add esp, 0x18
mov dword [0x46506c], 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret
Function at 0x4451af
Capabilities:
Check for time delay via gettickcount

Disassembly:
test byte [esp + 4], 0x10
je 0x4451b9
xor al, al
ret
cmp byte [esp + 8], 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4451ce
cmp byte [esp + 0xc], 0x10
jne 0x445223
xor cl, cl
cmp byte [esp + 0x10], cl
jne 0x445223
cmp byte [0x4683e3], cl
je 0x4451f1
call fcn.00444e04
test al, al
jne 0x4451f1
mov byte [0x4683e3], cl
xor al, al
pop esi
ret
cmp byte [0x4683dd], cl
je 0x445223
xor eax, eax
mov ax, word [0x4683e0]
push eax
xor eax, eax
mov al, byte [0x4683e2]
push eax
call fcn.0044514b
add esp, 8
test al, al
je 0x445223
call esi
sub eax, dword [0x4683d8]
cmp eax, 0x16
jb 0x4451ed
call esi
mov dword [0x4683b8], eax
mov al, 1
pop esi
ret
Function at 0x447148
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x4683dc], 0
je 0x4471c3
mov al, byte [0x4683e2]
cmp al, 0xa0
je 0x447161
cmp al, 0x10
jne 0x4471c3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4683d8]
cmp eax, 0x16
jae 0x4471c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044514b
add esp, 8
cmp byte [0x4683dd], 0
jne 0x44719b
call fcn.00444e04
test al, al
je 0x4471c3
mov byte [0x4683e3], 1
jmp 0x4471a5
cmp byte [ebp + 0x14], 0
jne 0x44718e
test al, al
je 0x4471c3
mov al, byte [0x4683d4]
mov byte [0x467272], al
mov al, byte [0x4683d3]
mov byte [0x467288], al
mov al, byte [0x4683d2]
mov byte [0x467318], al
mov al, byte [0x467272]
mov ecx, dword [0x468404]
mov byte [0x4683d4], al
mov al, byte [0x467288]
push ebx
push esi
movzx esi, byte [ebp + 0xc]
mov byte [0x4683d3], al
mov al, byte [0x467318]
mov byte [0x4683d2], al
lea eax, [esi + esi*8]
shl eax, 5
mov bl, byte [eax + ecx + 4]
test bl, bl
push edi
mov edi, dword [ebp + 8]
je 0x44730d
push dword [ebp + 0x14]
cmp dword [edi + 0x10], 0xffc3d44f
push dword [ebp + 0xc]
setne byte [ebp + 0xb]
push dword [edi + 8]
call fcn.004451af
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x4472b3
cmp byte [ebp + 0x18], 0
jne 0x447245
mov cl, bl
not cl
and byte [0x467270], cl
cmp byte [ebp + 0xb], 0
je 0x447245
and byte [0x467271], cl
test al, al
je 0x44730d
not bl
and byte [0x467272], bl
sub esi, 0xa0
mov byte [esi + 0x467318], 0
je 0x4472ac
dec esi
je 0x4472a0
dec esi
je 0x447294
dec esi
je 0x44728d
dec esi
je 0x44727e
dec esi
jne 0x44730d
mov al, byte [0x46731c]
jmp 0x447283
mov al, byte [0x46731d]
mov byte [0x46728a], al
jmp 0x44730d
mov al, byte [0x46731a]
jmp 0x447299
mov al, byte [0x46731b]
mov byte [0x467289], al
jmp 0x44730d
mov al, byte [0x467318]
mov byte [0x467288], al
jmp 0x44730d
mov al, byte [0x467319]
jmp 0x4472a5
cmp byte [ebp + 0x18], 0
jne 0x4472cb
or byte [0x467270], bl
cmp byte [ebp + 0xb], 0
je 0x4472cb
or byte [0x467271], bl
test al, al
je 0x44730d
or byte [0x467272], bl
cmp byte [ebp + 0xc], 0xa0
mov byte [esi + 0x467278], 0x80
jb 0x44730d
cmp byte [ebp + 0xc], 0xa1
jbe 0x447306
cmp byte [ebp + 0xc], 0xa3
jbe 0x4472fd
cmp byte [ebp + 0xc], 0xa5
ja 0x44730d
mov byte [0x46728a], 0x80
jmp 0x44730d
mov byte [0x467289], 0x80
jmp 0x44730d
mov byte [0x467288], 0x80
mov cx, word [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov word [0x4683e0], cx
mov ecx, dword [ebp + 0x14]
push ecx
push eax
push dword [edi + 8]
mov byte [0x4683e2], al
mov byte [0x4683dd], cl
call fcn.004451af
add esp, 0xc
mov byte [0x4683dc], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop edi
pop esi
mov dword [0x4683d8], eax
pop ebx
pop ebp
ret
Function at 0x448107
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push edi
mov edi, dword [esp + 0x114]
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44813b
cmp byte [0x46818c], al
je 0x4481d8
push 1
push eax
push 0xffffffffffffffff
push 0x45bf4c
jmp 0x4481cd
cmp byte [0x46818c], 0
push ebx
push ebp
push esi
mov ebp, 0x467b80
jne 0x448150
lea ebp, [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebp
mov esi, 0x104
push esi
call ebx
test eax, eax
je 0x4481ab
cmp byte [edi], 0
je 0x4481b6
cmp byte [edi + 1], 0x3a
jne 0x4481b6
cmp byte [edi + 2], 0
jne 0x4481b6
push ebp
push edi
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x4481b6
push edi
lea eax, [esp + 0x14]
push 0x45e784
push eax
call fcn.0040a7af
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x4481b6
push ebp
push esi
call ebx
test eax, eax
jne 0x4481b6
push esi
push edi
push ebp
call fcn.00439851
add esp, 0xc
cmp byte [0x46818c], 0
pop esi
pop ebp
pop ebx
je 0x4481d8
push 1
push 0
push 0xffffffffffffffff
push 0x45a734
mov ecx, dword [0x467b78]
call fcn.0040184e
pop edi
add esp, 0x10c
ret
Function at 0x44cced
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1f4
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, ecx
mov dword [ebp + 0x60], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x44cd1e
push 0x64
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x44cd25
mov byte [ebp - 0x84], 0
push edi
push 0x1f
mov byte [ebp - 0x20], 0
xor eax, eax
pop ecx
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esi + 0x46c]
jmp 0x44cd5f
cmp byte [edi + 0x11], 0
je 0x44cd5c
mov eax, dword [edi]
push dword [eax]
lea eax, [ebp - 0x20]
push 0x45cd30
push 0x7d
push eax
call fcn.0040a76e
add esp, 0x10
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x44cd3f
cmp byte [ebp - 0x20], 0
je 0x44cda0
lea eax, [ebp - 0x20]
push eax
call fcn.00457cb0
cmp eax, 0x7b
pop ecx
jbe 0x44cd94
mov ecx, 0x80
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x20]
push 0x45c0e0
push eax
call fcn.00439851
add esp, 0xc
jmp 0x44cda0
lea eax, [ebp + eax - 0x21]
cmp byte [eax], 0x20
jne 0x44cda0
mov byte [eax], 0
mov eax, dword [0x466f60]
xor ecx, ecx
inc ecx
cmp byte [eax + 0xce], 0
je 0x44cdbf
cmp byte [esi + 0x4ad], 0
jne 0x44cdbf
mov dword [ebp + 0x78], ecx
jmp 0x44cdc3
and dword [ebp + 0x78], 0
mov eax, dword [0x4673b8]
cmp eax, ecx
mov dword [ebp + 0x68], str.__preempted:_they_will_resume_when_the_current_thread_finishes_
jg 0x44ceaf
and dword [ebp + 0x6c], 0
mov dword [ebp + 0x68], 0x45a5d8
cmp dword [0x46738c], 0
mov edi, 0x45ba9c
mov eax, 0x45baa0
mov dword [ebp + 0x64], edi
je 0x44cdfb
mov dword [ebp + 0x64], eax
cmp dword [0x467388], 0
je 0x44ce06
mov edi, eax
lea eax, [ebp - 0x184]
push eax
push ecx
call fcn.00412558
pop ecx
push eax
call fcn.0041336d
push eax
push dword [0x4673b4]
mov eax, dword [0x4673bc]
push dword [0x4673b8]
sub eax, dword [ebp + 0x78]
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x20]
push dword [ebp + 0x6c]
push eax
push dword [esi + 0x474]
lea eax, [ebp - 0x84]
push dword [esi + 0x478]
push dword [ebp + 0x64]
push edi
push eax
push str.Window:__s_r_nKeybd_hook:__s_r_nMouse_hook:__s_r_nEnabled_Timers:__u_of__u___s__r_nInterrupted_threads:__d_s_r_nPaused_threads:__d_of__d___d_layers__r_nModifiers__GetKeyState___now____s_r_n
push dword [ebp + 0x7c]
push ebx
call fcn.0040a6d3
mov esi, dword [ebp + 0x60]
add ebx, eax
mov eax, esi
sub eax, ebx
add eax, dword [ebp + 0x7c]
add esp, 0x44
push eax
push ebx
call fcn.00444ea7
push ebx
call fcn.00457cb0
add esp, 0xc
add ebx, eax
cmp dword [0x467c8c], 0
pop edi
mov eax, str._r_nPress__F5__to_refresh.
jne 0x44ce94
mov eax, str._r_nKey_History_has_been_disabled_via_KeyHistory_0.
sub esi, ebx
add esi, dword [ebp + 0x7c]
push eax
push esi
push ebx
call fcn.0040a6d3
add esp, 0xc
pop esi
add eax, ebx
pop ebx
add ebp, 0x70
leave
ret 8
dec eax
mov dword [ebp + 0x6c], eax
jmp 0x44cde2
Function at 0x44fbdd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8958
call fcn.00458250
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x44fc5e
lea ecx, [ebp - 0x8958]
call fcn.0043bb0e
mov al, byte [ebp + 8]
mov byte [ebp - 0x8114], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8110], eax
lea eax, [ebp - 0x8958]
push eax
push 0x45022c
mov dword [ebp - 0x8118], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8128], 0
je 0x44fc5e
mov eax, dword [0x465108]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x44fc5e
cmp eax, 0x19
jge 0x44fc54
cmp byte [0x468399], 0
je 0x44fc54
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44fc5e
push 1
push eax
call fcn.0040de6e
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x4500e2
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x895c
call fcn.00458250
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x450223
push ebx
call fcn.00450437
test eax, eax
je 0x450226
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x465108]
mov ecx, edi
push eax
mov dword [ebp - 4], eax
call fcn.0044fe60
test eax, eax
je 0x450132
xor esi, esi
mov dword [0x46b480], esi
jmp 0x450138
mov esi, dword [0x46b480]
lea ecx, [ebp - 0x895c]
call fcn.0043bb0e
cmp byte [ebp + 8], bl
je 0x450152
cmp esi, ebx
mov byte [ebp - 0x8134], bl
je 0x450159
mov byte [ebp - 0x8134], 1
mov eax, dword [0x46b47c]
mov dword [ebp - 0x8124], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x811c], eax
lea eax, [ebp - 0x895c]
push eax
push 0x450338
mov dword [ebp - 0x8120], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x812c], ebx
je 0x4501f8
push dword [ebp - 0x812c]
call fcn.0043ca8c
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4501b1
push dword [ebp - 0x812c]
call fcn.00450405
pop ecx
mov dword [ebp - 0x812c], esi
push dword [ebp - 0x812c]
call fcn.0043c3f2
push dword [ebp - 0x812c]
call fcn.00450405
mov eax, dword [0x465108]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
pop ecx
pop ecx
jle 0x450222
cmp eax, 0x19
jge 0x4501ec
cmp byte [0x468399], bl
je 0x4501ec
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x450222
push 1
push eax
call fcn.0040de6e
pop ecx
pop ecx
jmp 0x450222
mov eax, dword [0x46b480]
cmp eax, ebx
je 0x450222
cmp eax, 1
setg al
cmp al, bl
mov dword [0x46b480], ebx
je 0x450222
push dword [ebp - 4]
call fcn.00450405
pop ecx
push ebx
mov ecx, edi
call fcn.004500e2
pop esi
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4
Function at 0x450529
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x469e60], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x4694a0
jne 0x450549
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00415fbd
pop ecx
mov dword [0x466208], 0x270
mov dword [0x469498], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x450568
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x45059e
mov edx, dword [0x4694a0]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x450782
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x494]
xor ebx, ebx
cmp eax, ebx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4ad], bl
mov byte [esi + 0x4ac], bl
je 0x4508ad
cmp byte [eax], bl
je 0x4508ad
push 0x10
call fcn.0044e80b
cmp eax, ebx
pop ecx
je 0x4507d0
mov dword [eax], 0x45a5d8
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x4507d2
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x240], eax
je 0x4508ad
push ebx
push ebx
push dword [esi + 0x494]
mov ecx, esi
call fcn.004481e0
cmp eax, 1
jne 0x4508ad
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
push ebx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044deb1
test eax, eax
je 0x4508ad
push dword [0x467c84]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
inc dword [esi + 0x4c]
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x240]
push ebx
push ebx
push ebx
push ebx
mov dword [eax + 4], ecx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044e24c
test eax, eax
je 0x4508ad
push ebx
push ebx
push ebx
push str.ErrorLevel
mov ecx, esi
call fcn.0040c0f7
cmp eax, ebx
mov dword [0x467b78], eax
je 0x4508ad
push 1
push ebx
push 0xffffffffffffffff
push 0x45a734
mov ecx, eax
call fcn.0040184e
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 8]
call fcn.00415fbd
mov eax, dword [esi + 8]
pop ecx
jmp 0x4508b0
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x450aba
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.00415fbd
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x450ae4
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.00415edb
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x450ace
pop esi
pop edi
ret 0xc

Function at 0x450f56
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x450f7f
add edx, edx
xor edx, 0x4c11db7
jmp 0x450f81
shl edx, 1
dec ecx
jne 0x450f6d
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x450f65
pop edi
pop esi
ret

Function at 0x452334
Capabilities:
Parse credit card information

Disassembly:
jmp 0x452397
cmp ecx, 0x4f
jne 0x452345
xor ecx, ecx
mov ch, byte [eax + 1]
mov cl, byte [eax + 2]
jmp 0x452395
cmp ecx, 0x5e
jne 0x452361
xor ecx, ecx
mov ch, byte [eax + 3]
mov cl, byte [eax + 4]
cmp ecx, dword [esp + 4]
je 0x4523a0
movzx ecx, byte [0x461616]
jmp 0x452395
cmp ecx, 0x38
jl 0x45238e
cmp ecx, 0x3d
jle 0x45237f
cmp ecx, 0x40
jle 0x45237a
cmp ecx, 0x43
jle 0x45237f
cmp ecx, 0x44
jne 0x45238e
mov dl, byte [eax + 3]
jmp 0x452382
mov dl, byte [eax + 1]
cmp dl, 0xf
je 0x45238c
cmp dl, 0xe
jne 0x45238e
inc eax
inc eax
movzx ecx, byte [ecx + 0x4615b8]
add eax, ecx
movzx ecx, byte [eax]
test ecx, ecx
jne 0x452336
xor eax, eax
ret
Function at 0x457be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x46b4e4], esi
push edi
jne 0x457c00
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x46b4e0], esi
mov byte [0x46b4dc], al
jne 0x457c66
mov ecx, dword [0x46ba90]
test ecx, ecx
je 0x457c47
mov eax, dword [0x46ba8c]
sub eax, 4
cmp eax, ecx
jmp 0x457c40
mov eax, dword [eax]
test eax, eax
je 0x457c32
call eax
mov eax, dword [0x46ba8c]
sub eax, 4
cmp eax, dword [0x46ba90]
mov dword [0x46ba8c], eax
jae 0x457c2a
mov eax, 0x465040
mov esi, 0x465048
cmp eax, esi
mov edi, eax
jae 0x457c66
mov eax, dword [edi]
test eax, eax
je 0x457c5f
call eax
add edi, 4
cmp edi, esi
jb 0x457c57
mov eax, 0x46504c
mov esi, 0x465050
cmp eax, esi
mov edi, eax
jae 0x457c85
mov eax, dword [edi]
test eax, eax
je 0x457c7e
call eax
add edi, 4
cmp edi, esi
jb 0x457c76
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x457c9f
push dword [ebp + 8]
mov dword [0x46b4e4], 1
call fcn.0043e033
pop ebp
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create thread
Encrypt data using rc4 via systemfunction032
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.SystemFunction032
push str.Advapi32
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0x41a818
mov dword [ebp - 0x20], 0x177ff
mov dword [ebp - 0x1c], 0x177ff
mov dword [ebp - 0x18], 0x403018
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x20]
push ecx
call eax
push 0x40
push 0x3000
push 0x177ff
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x4010d1
push 0x177ff
push 0x403018
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 0x177ff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4010d1
push 0
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004010e3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
pop esi
call fcn.004010e3
mov esp, ebp
pop ebp
ret

Function at 0x4018ee
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40192d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40192d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40192d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40192d
cmp dword [ecx + 0x74], 0xe
jbe 0x40192d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x55cac0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x106000]
push edi
jmp 0x55cada
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x55cae1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55cad0
mov eax, 1
add ebx, ebx
jne 0x55caf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55cb04
jne 0x55cb23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55cb23
dec eax
add ebx, ebx
jne 0x55cb10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x55cae8
add ebx, ebx
jne 0x55cb1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x55cb75
xor ecx, ecx
sub eax, 3
jb 0x55cb3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55cbaa
sar eax, 1
mov ebp, eax
jmp 0x55cb46
add ebx, ebx
jne 0x55cb46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55cb14
inc ecx
add ebx, ebx
jne 0x55cb54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55cb14
add ebx, ebx
jne 0x55cb61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x55cb56
jne 0x55cb72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x55cb56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x55cb94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x55cb86
jmp 0x55cad6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x55cb94
add edi, ecx
jmp 0x55cad6
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55cbb2
cmp byte [edi], 0x11
jne 0x55cbb2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x55cbb7
lea edi, [esi + 0x155000]
mov eax, dword [edi]
or eax, eax
je 0x55cc2f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e0378]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e04f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x55cbe4
mov ecx, edi
jns 0x55cc13
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e04f8]
or eax, eax
je 0x55cc29
mov dword [ebx], eax
add ebx, 4
jmp 0x55cc01
call dword [esi + 0x1e0508]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x55cc60
cmp al, 0xef
ja 0x55cc53
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x55cc35
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x55cc42
mov ebp, dword [esi + 0x1e04fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x55cc94
sub esp, 0xffffff80
jmp 0x427f4a