joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410d63
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ae06
and dword [ebp - 0x14], 0
cmp dword [0x815fb0], 0
mov dword [ebp - 0x18], eax
jne 0x410e16
push 0x4038dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410ebe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4038d0
push ebx
call edi
test eax, eax
je 0x410ebe
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4038c0
push ebx
mov dword [0x815fb0], eax
call edi
push eax
call esi
push 0x4038ac
push ebx
mov dword [0x815fb4], eax
call edi
push eax
call esi
push 0x403890
push ebx
mov dword [0x815fb8], eax
call edi
push eax
call esi
mov dword [0x815fc0], eax
test eax, eax
je 0x410e16
push 0x403878
push ebx
call edi
push eax
call esi
mov dword [0x815fbc], eax
mov eax, dword [0x815fbc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410e6f
cmp dword [0x815fc0], ecx
je 0x410e6f
push eax
call esi
push dword [0x815fc0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410e6f
test ebx, ebx
je 0x410e6f
call edi
test eax, eax
je 0x410e66
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410e66
test byte [ebp - 8], 1
jne 0x410e6f
or dword [ebp + 0x10], 0x200000
jmp 0x410ea2
mov eax, dword [0x815fb4]
cmp eax, dword [ebp - 0x18]
je 0x410ea2
push eax
call esi
test eax, eax
je 0x410ea2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410ea2
mov eax, dword [0x815fb8]
cmp eax, dword [ebp - 0x18]
je 0x410ea2
push eax
call esi
test eax, eax
je 0x410ea2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x815fb0]
call esi
test eax, eax
je 0x410ebe
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410ec0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408a41
leave
ret
Function at 0x4134e0
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.004118d0
cmp dword [0xb99d4c], 0x37
jne 0x41357a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov ecx, dword [0xb9ad40]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x81ad9c]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x413800
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0xb99d4c]
sub esp, 0x974
push ebx
push ebp
push esi
mov esi, dword [0x81ad9c]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x4139ff
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
jmp 0x413836
mov esi, dword [esp + 0x20]
xor edi, edi
cmp dword [0xb99d4c], 0x1c
jne 0x41384d
lea eax, [esp + 0x38]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x811c18]
mov ebx, dword [0x811c20]
mov ebp, dword [0x811c24]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x811c1c]
mov dword [esp + 0x18], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 0x20
jmp 0x413896
mov eax, dword [esp + 0x18]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x1c], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0xb99cbc], edi
mov eax, dword [esp + 0x1c]
add dword [0xb99cbc], eax
mov eax, dword [0xb99cbc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x34]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x30]
add dword [esp + 0x10], eax
cmp dword [0xb99d4c], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x41392d
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x2c]
cmp dword [0xb99d4c], 0x979
mov dword [0xb99cc0], 0xff6b3619
mov dword [0xb99cc4], 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x413977
push 0
lea ecx, [esp + 0x184]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x1c]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
mov eax, dword [0xb99d4c]
cmp eax, 0x93
je 0x41399d
add esi, 0x61c88647
dec dword [esp + 0x28]
jne 0x413890
cmp eax, 0x8d4
jne 0x4139b4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0xb99d4c], 0x17
jne 0x4139ee
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x40]
push edx
push 0x404080
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esi, 8
dec dword [esp + 0x24]
mov dword [esp + 0x20], esi
jne 0x413830
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x974
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4110eb
Capabilities:
Terminate process

Disassembly:
jmp 0x414be0
jmp fcn.00415ec0
cmp ecx, dword [0x42119c]
jne 0x414bea
repz ret
jmp 0x411334

Function at 0x4137b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, esp
call fcn.004116b8
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.004116b8
mov esp, ebp
pop ebp
ret
Function at 0x4138f0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
push ebx
push esi
push edi
lea edi, [ebp - 0x350]
mov ecx, 0xd4
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x42119c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xffffffff
mov esi, esp
push 0x200
lea eax, [ebp - 0x214]
push eax
push str._ALLUSERSPROFILE__bug.log
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp esi, esp
call fcn.004116b8
test eax, eax
jne 0x41394d
jmp 0x413a8d
mov esi, esp
push 0
push 0
push 4
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp esi, esp
call fcn.004116b8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x413985
jmp 0x413a8d
mov esi, esp
push 2
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, esp
call fcn.004116b8
cmp eax, 0xffffffff
jne 0x4139ad
jmp 0x413a8d
mov esi, esp
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp esi, esp
call fcn.004116b8
movzx eax, word [ebp - 0x220]
mov esi, esp
push eax
movzx ecx, word [ebp - 0x222]
push ecx
movzx edx, word [ebp - 0x224]
push edx
movzx eax, word [ebp - 0x226]
push eax
movzx ecx, word [ebp - 0x22a]
push ecx
movzx edx, word [ebp - 0x22c]
push edx
push str._4.4d__2.2d__2.2d__2.2d:_2.2d:_2.2d:
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
cmp esi, esp
call fcn.004116b8
mov dword [ebp - 0x280], eax
mov esi, esp
push 0
lea eax, [ebp - 0x280]
push eax
mov ecx, dword [ebp - 0x280]
shl ecx, 1
push ecx
lea edx, [ebp - 0x274]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.004116b8
test eax, eax
jne 0x413a4b
jmp 0x413a8d
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.004116b8
mov dword [ebp - 0x28c], eax
mov esi, esp
push 0
lea eax, [ebp - 0x28c]
push eax
mov ecx, dword [ebp - 0x28c]
shl ecx, 1
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.004116b8
cmp dword [ebp - 0xc], 0xffffffff
je 0x413aa6
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004116b8
push edx
mov ecx, ebp
push eax
lea edx, [0x413ad8]
call fcn.004112ee
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004110eb
add esp, 0x350
cmp ebp, esp
call fcn.004116b8
mov esp, ebp
pop ebp
ret
Function at 0x40ed5f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x40eae0
mov esi, dword [esp]
add esp, 4
inc edx
sub edx, ecx
call fcn.0040ed82
inc edx
xor dword [edi], esi
inc edi
cmp edi, eax
jne fcn.0040ed5f
mov edx, 0xb3ed0897
and edx, edx
ret
Function at 0x40511a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422478], 0x44
push eax
xor eax, eax
push 0x422478
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405155
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4051df
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.0040548e
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405213
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423ee8], eax
jmp 0x4053a7
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405231
test eax, eax
je 0x405352
test byte [ebp + 0xc], 2
je 0x405352
mov esi, 0x421478
push edi
push esi
call fcn.004058ba
test ebx, ebx
je 0x40524e
push 0x409320
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405254
push edi
call fcn.004053f4
cmp byte [edi], 0
jne 0x405262
cmp byte [0x421478], 0x5c
jne 0x40526d
push 0x40900c
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405348
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.004053d8
cmp byte [eax], 0
je 0x4052b3
cmp byte [ebp - 0x18], 0
je 0x4052b3
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x4052c9
mov al, byte [esi + 1]
test al, al
je 0x405327
cmp al, 0x2e
jne 0x4052c9
cmp byte [esi + 2], 0
je 0x405327
push esi
push ebx
call fcn.004058ba
test byte [ebp - 0x148], 0x10
je 0x4052ee
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405327
push dword [ebp + 0xc]
push edi
call fcn.004051df
jmp 0x405327
push edi
call fcn.00405572
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40531f
test byte [ebp + 0xc], 4
je 0x405317
push edi
push 0xfffffffffffffff1
call fcn.00404c58
push 0
push edi
call fcn.00405608
jmp 0x405327
inc dword [0x423ee8]
jmp 0x405327
push edi
push 0xfffffffffffffff2
call fcn.00404c58
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405291
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x405352
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4053a7
cmp dword [ebp - 8], esi
jne 0x405367
inc dword [0x423ee8]
jmp 0x4053a7
push edi
call fcn.00405bb1
test eax, eax
je 0x4053a7
push edi
call fcn.004053ad
push edi
call fcn.00405572
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40539f
test byte [ebp + 0xc], 4
je 0x40535f
push edi
push 0xfffffffffffffff1
call fcn.00404c58
push esi
push edi
call fcn.00405608
jmp 0x4053a7
push edi
push 0xffffffffffffffe5
call fcn.00404c58
pop edi
pop esi
leave
ret 8
Function at 0x403b64
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b40f0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x6300f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
lea edi, [ebx + 4]
lea esi, [ebp + 0xc]
mov dword [ebx], eax
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x18]
push 0x5e8884
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebx + 0x10], 0
and dword [ebx + 0x14], 0
call fcn.004116f2
push 0x5f4bbf
lea ecx, [ebx + 0x30]
call fcn.004116f2
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404bca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404c25
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404c16
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x404c12
cmp esi, ecx
jae 0x404c16
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x404c00
cmp esi, ecx
jb 0x404c1a
xor eax, eax
jmp 0x404c24
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40cb99
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6300f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov edx, dword [ebp + 8]
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cc10
cmp dword [ebp - 8], 1
je 0x40cbe8
cmp dword [ebp - 8], 2
je 0x40cbe8
push 0xd
pop eax
jmp 0x40cc10
mov ecx, dword [ebp - 0xc]
test esi, esi
je 0x40cc0a
test ecx, ecx
je 0x40cc05
test cl, 1
jne 0x40cbe3
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x40cc0a
jmp 0x40cbe3
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570864
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418704
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
xor edx, edx
push edi
mov edi, ecx
push 0x34
lea ecx, [esi - 1]
mov dword [ebp - 0x10], ecx
mov eax, dword [edi + ecx*4]
mov dword [ebp - 4], eax
pop eax
div esi
lea ebx, [eax + 6]
xor eax, eax
cmp ecx, 1
jb 0x4187f6
jmp 0x4187ee
sub eax, 0x61c88647
xor ecx, ecx
mov dword [ebp - 0x14], eax
dec ebx
shr eax, 2
and eax, 3
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x10], ecx
jbe 0x4187ab
mov ebx, dword [ebp - 0xc]
mov edx, dword [edi + ecx*4 + 4]
mov esi, edx
shr eax, 5
mov ecx, edx
xor edx, dword [ebp - 0x14]
shl esi, 2
xor esi, eax
shr ecx, 3
mov eax, dword [ebp - 4]
shl eax, 4
xor ecx, eax
add esi, ecx
mov ecx, dword [ebp - 8]
mov eax, ecx
and eax, 3
xor eax, ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + eax*4]
xor eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
add eax, edx
xor esi, eax
add dword [edi + ecx*4], esi
mov eax, dword [edi + ecx*4]
inc ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp - 0x10]
jb 0x41875c
mov ebx, dword [ebp - 0x18]
mov edx, dword [edi]
mov esi, edx
shr eax, 5
mov ecx, edx
xor edx, dword [ebp - 0x14]
shl esi, 2
xor esi, eax
shr ecx, 3
mov eax, dword [ebp - 4]
shl eax, 4
xor ecx, eax
mov eax, dword [ebp - 8]
and eax, 3
add esi, ecx
xor eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax*4]
xor eax, dword [ebp - 4]
add eax, edx
xor esi, eax
mov eax, dword [ebp - 0x10]
add dword [edi + eax*4], esi
mov eax, dword [edi + eax*4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
test ebx, ebx
jne 0x418737
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4187ff
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 0x34
xor edx, edx
mov ebx, 0xb54cda56
mov eax, dword [edi]
lea ecx, [esi - 1]
mov dword [ebp - 4], eax
pop eax
div esi
mov dword [ebp - 0xc], ecx
imul eax, eax, 0x61c88647
sub ebx, eax
cmp ecx, 1
jb 0x4188ef
test ebx, ebx
je 0x4188ef
mov eax, ebx
mov esi, ecx
shr eax, 2
and eax, 3
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
test ecx, ecx
je 0x4188a3
mov edx, dword [edi + esi*4 - 4]
mov esi, edx
shr eax, 3
mov ecx, edx
shl esi, 4
xor esi, eax
shr ecx, 5
mov eax, dword [ebp - 4]
shl eax, 2
xor ecx, eax
mov eax, dword [ebp - 8]
add esi, ecx
and eax, 3
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + eax*4]
mov eax, ebx
xor eax, dword [ebp - 4]
xor ecx, edx
add ecx, eax
mov eax, dword [ebp - 8]
xor esi, ecx
sub dword [edi + eax*4], esi
mov esi, eax
mov eax, dword [edi + esi*4]
sub esi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
jne 0x418853
mov ecx, dword [ebp - 0xc]
mov edx, dword [edi + ecx*4]
and esi, 3
mov ecx, dword [edi + ecx*4]
xor esi, dword [ebp - 0x10]
shr eax, 3
shl edx, 4
xor edx, eax
shr ecx, 5
mov eax, dword [ebp - 4]
shl eax, 2
xor ecx, eax
mov eax, dword [ebp + 8]
add edx, ecx
mov ecx, dword [eax + esi*4]
mov eax, dword [ebp - 0xc]
xor ecx, dword [edi + eax*4]
mov eax, ebx
xor eax, dword [ebp - 4]
add ecx, eax
xor edx, ecx
mov ecx, dword [ebp - 0xc]
sub dword [edi], edx
mov eax, dword [edi]
mov dword [ebp - 4], eax
add ebx, 0x61c88647
jne 0x41883c
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4189f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
test edx, edx
jne 0x418a04
xor eax, eax
jmp 0x418b27
push ebx
mov eax, edx
xor edx, edx
push 3
pop ecx
div ecx
mov ecx, eax
mov ebx, edx
xor eax, eax
mov dword [ebp - 4], ecx
test ebx, ebx
mov dword [ebp - 8], ebx
setne al
add eax, ecx
xor ecx, ecx
shl eax, 2
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.0058e6ae
mov edx, eax
mov dword [ebp - 0xc], edx
pop ecx
test edx, edx
je 0x418b26
cmp dword [ebp - 4], 0
push esi
mov esi, edx
jbe 0x418ab1
mov ebx, dword [ebp - 4]
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
movzx edx, byte [edi + 2]
add edi, 3
shl eax, 8
shl ecx, 0x10
or ecx, eax
or edx, ecx
mov eax, edx
shr eax, 0x12
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov eax, edx
shr eax, 6
and edx, 0x3f
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
sub ebx, 1
jne 0x418a50
mov ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp ebx, 1
jne 0x418add
movzx ecx, byte [edi]
mov eax, ecx
and ecx, 3
shr eax, 2
shl ecx, 4
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov word [esi + 2], 0x3d3d
jmp 0x418b1d
cmp ebx, 2
jne 0x418b20
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0xa
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov eax, ecx
shr eax, 4
and eax, 0x3f
and ecx, 0xf
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov al, byte [ecx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
mov eax, edx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41c30f
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x41c478
mov edx, 0x10000000
cmp eax, 0x7c
je 0x41c478
cmp eax, 0x29
jne 0x41c348
cmp dword [esi + 0x10], 0
jne 0x41c478
test dword [esi + 0x50], edx
je 0x41c47e
cmp eax, 0x2e
jne 0x41c363
push 5
lea ecx, [esi + 0x24]
call fcn.0041c572
mov ecx, esi
call fcn.0041c2ea
jmp 0x41c462
cmp eax, 0x5c
jne 0x41c3c0
mov ecx, esi
call fcn.0041c2ea
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x41c396
cmp word [esi + 0x48], 0x62
jne 0x41c396
push 4
lea ecx, [esi + 0x24]
call fcn.0041c572
mov ecx, esi
call fcn.0041c2ea
jmp 0x41c469
test eax, eax
je 0x41c3b4
cmp word [esi + 0x48], 0x42
jne 0x41c3b4
push 4
lea ecx, [esi + 0x24]
call fcn.0041c572
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x41c38a
mov ecx, esi
call fcn.0041c8e4
jmp 0x41c462
cmp eax, 0x5b
jne 0x41c3e4
mov ecx, esi
call fcn.0041c2ea
mov ecx, esi
call fcn.0041c898
cmp dword [esi + 0x4c], 0x5d
je 0x41c357
push 4
jmp 0x41c480
cmp eax, 0x28
jne 0x41c408
mov ecx, esi
call fcn.0041c2ea
mov ecx, esi
call fcn.0041c9dc
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x41c47e
mov ecx, esi
call fcn.0041c2ea
jmp 0x41c45e
cmp eax, 0x5e
jne 0x41c414
push 2
jmp 0x41c382
cmp eax, 0x24
jne 0x41c420
push 3
jmp 0x41c382
cmp eax, 0x2a
je 0x41c474
cmp eax, 0x2b
je 0x41c474
cmp eax, 0x3f
je 0x41c474
cmp eax, 0x7b
je 0x41c474
cmp eax, 0x7d
jne 0x41c43e
test dword [esi + 0x50], edx
je 0x41c470
cmp eax, 0x5d
jne 0x41c448
test dword [esi + 0x50], edx
je 0x41c3dd
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041cb92
mov ecx, esi
call fcn.0041c2ea
mov bl, 1
test bl, bl
je 0x41c469
mov ecx, esi
call fcn.0041cace
mov cl, 1
jmp 0x41c316
push 6
jmp 0x41c480
push 0xa
jmp 0x41c480
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.0055acf6
int3