joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408ef3
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push dword [ebp + 8]
call dword [0x41a0ec]
mov dword [ebp - 4], 2

Function at 0x40931e
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x4092a7
push ebp
mov word [esi], bx
Function at 0x409a8f
Capabilities:
Authenticate hmac

Disassembly:
mov eax, dword [0x41a4c8]
cmp eax, 2
je 0x40b193
cmp eax, ebx
je 0x408bac
cmp eax, 1

Function at 0x40a0cd
Capabilities:
Authenticate hmac
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
lea edi, [edi + 0x485]
or eax, edi
push dword [ebp - 0x5c]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x5c], esp
add esp, 0xffffffd0
mov dword [ebp - 0x68], edi
push dword [ebp - 0x14]
sub esi, dword [ebp - 0x10]
push dword [ebp - 0x70]
cmp dword [ebp - 0x40], 1
je 0x40a103
lea eax, [esp + 0x48]
push eax
push 0x41a28d
and dword [ebp - 0x74], eax
push dword [ebp - 0xc]
test dword [ebp - 0x54], 0
je 0x40a11f
mov byte [edi + eax + 4], cl
jae 0x40a131
cmp byte [ebp + 0x13], 0
lea edi, [ebp - 0xc]
push edi
mov edi, dword [ebp - 0x5c]
push dword [edi + 8]
call fcn.00403e4e
lea ecx, [ecx - 0x48]
lea edi, [esi + edx*4 + 0x1280]
mov eax, dword [ebp - 0x5c]
xor esi, dword [ebp - 0x1c]
mov dword [eax - 0x30], 0
mov esi, dword [ebp - 0x5c]
mov dword [esi - 0x10], 0x400
and dword [ebp - 0x64], edi
mov edi, dword [ebp - 0x5c]
cmp dword [ebp - 0x40], 0x6b
jne 0x40a175
mov edi, dword [esp + 0x58]
lea ecx, [ecx]
mov eax, dword [esi - 4]
mov ecx, 0x41a249
sub ecx, eax
mov dword [edi - 0xc], 0
cmp dword [ebp - 0x40], 1
je 0x40a199
pop edi
push dword [esp + 8]
mov eax, dword [esi + 0x14]
push dword [eax + 0x1c]
call fcn.004128ee
pop esi
push 0x40
test dword [ebp - 0x54], 0
je 0x40a1ae
mov ecx, dword [esp + 4]
push 0x3000
or dword [ebp - 0x2c], ecx
or dword [ebp - 0x20], 0xe4a
cmp dword [ebp - 0x40], 0x5e
jne 0x40a1df
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x1c]
call fcn.004169fe
cmp dword [eax + 0x84], 0
jle 0x40a210
call fcn.004052e1
mov ebx, dword [ebp - 0x6c]
cmp dword [ebp - 0x54], 0x400002
jne 0x40a1f5
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov esi, dword [ebp - 0x5c]
xor ecx, edx
lea ebx, [esi - 0x10]
mov dword [ebp - 0x6c], ebx
cmp dword [ebp - 0x40], 1
je 0x40a212
mov edi, dword [ebx]
and ecx, dword [ebp - 8]
and edi, esi
or ecx, edi
push dword [ebp - 0x6c]
cmp dword [ebp - 0x54], 0
je 0x40a220
cmp ebx, edx
Function at 0x40a88a
Capabilities:
Authenticate hmac
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
je 0x40f963
and dword [ebp - 0x68], 0
mov eax, dword [ebp + 0x3e0]
Function at 0x40b0f8
Capabilities:
Authenticate hmac

Disassembly:
push eax
call dword [0x41a050]
lea ecx, [esp + 0x40]
call fcn.0040be69
lea ecx, [esp + 0x38]
Function at 0x40b37b
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + 0x1390], 0x5c
mov dword [esp + 0x38], ebx

Function at 0x40bb5c
Capabilities:
Encrypt data using speck
Parse credit card information

Disassembly:
add eax, 0x9432
push dword [ebp - 0x5c]
mov dword [ebp - 0x5c], esp
cmp dword [ebp - 0x54], 0x400002
jne 0x40bb7d

Function at 0x40c7ab
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push dword [ebp - 0x5c]
mov dword [ebp - 0x5c], esp
add dword [ebp - 0x50], 0xff1
cmp dword [ebp - 0x40], 0x400002
jne 0x40c7ce

Function at 0x40c7c4
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ecx + esi]
mov dword [ecx + edx], eax
xor eax, eax
inc eax
pop esi
sub edi, eax
or edi, dword [ebp - 0x20]
push dword [ebp - 0xc]

Function at 0x40ce9d
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov cl, byte [edi + 4]
and cl, 0x82
cmp cl, 0x82
Function at 0x40ea7b
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push esi
push dword [ebp - 0x1c]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 0xc]
add ebx, edx
and esi, edx
test dword [ebp - 0xc], eax
lea ebx, [ebp - 0x14]
push ebx
mov ebx, dword [ebp - 0x5c]
push dword [ebx + 8]
call fcn.00403e4e
je 0x40ef03

Function at 0x40fd44
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x41a599
or ebx, 0x41a5b0
mov dword [ebp - 0x14], 0x64000
and dword [ebp - 0x20], edi
sub edx, dword [ebp - 0x68]
Function at 0x410026
Capabilities:
Authenticate hmac

Disassembly:
lea ecx, [ebp - 0x14]
lea ecx, [ebp + 0x10]
mov eax, 0x41a305
mov ecx, dword [ebp - 0x10]
add ecx, 0xc

Function at 0x41045a
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x58], ebx
or edx, dword [ebp - 0x28]
push dword [ebp - 0x5c]
lea edx, [eax + 0x689]
lea eax, [ecx + ebx*8 + 0x13a5]
mov dword [ebp - 0x5c], esp
add esp, 0xffffff7c
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x5c]
push dword [ecx + 8]
call fcn.00403e4e
add word [ebp - 0x50], 0xca3
lea edi, [ebp - 0x70]
cmp dword [ebp - 0x54], 0x400002
jne 0x4104a2

Function at 0x41049d
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push 0x41a2f5
push edi
mov dword [0x41a4bc], eax
mov eax, dword [0x41a49e]
push edi
and ebx, dword [ebp - 0x64]
push dword [ebp - 0x70]
and ebx, esi
cmp dword [ebp - 0x40], 1
je 0x4104ba
test eax, eax
je 0x4104b4
cmp edi, esi
call fcn.00403f5c
or dword [ebp - 0x64], ebx
lea ebx, [eax + 0x3b]
cmp dword [ebp - 0x54], 0x400002
jne 0x4104de
je 0x406ba1
and byte [ebp - 0x1359], 0xdf
push 0x18
add ecx, edi
xor dword [ebp - 0x4c], 0x777
mov eax, dword [ebp - 0x6c]
xor ebx, esi
cmp dword [ebp - 0x54], 0xffffffda
jne 0x41050a
call dword [eax + 0x4c]
push dword [ebp + 0x20]
mov eax, dword [ebx]
push ebx
call dword [eax + 0x48]
cmp dword [edi + 8], 1
mov edi, dword [ebp - 0x5c]
lea eax, [edi - 0x18]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x54], 0x400002
jne 0x410525
push dword [ebp - 0x6c]
add ebx, 0xeeed
xor dword [ebp - 0x68], esi
add eax, dword [ebp - 0x44]
cmp dword [ebp - 0x54], 0
je 0x41054d
mov esp, ebp
pop ebp
mov edi, dword [0x41a3cc]
xor esi, esi

Function at 0x41110e
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
or dword [ebp - 0x24], edx
cmp dword [ebp - 0x54], 0x400002
jne 0x411128

Function at 0x411218
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
mov ecx, dword [ebp - 0x20]
call fcn.0040d90d
mov eax, 0x41a202
jmp 0x4113cc

Function at 0x4118ec
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx

Function at 0x412974
Capabilities:
Get os information via kuser_shared_data

Disassembly:
cmp dword [ebp - 0x40], 1
je 0x412984

Function at 0x41297d
Capabilities:
Get os information via kuser_shared_data

Disassembly:
lea ecx, [esp + 0x14]
and ebx, 0xffffffef
push dword [ebp - 0x5c]
mov dword [ebp - 0x5c], esp
add dword [ebp - 0x58], 0xffffffc4
add esp, 0xfffffed4
lea edi, [ebx]
cmp dword [ebp - 0x40], 1
je 0x4129a9
Function at 0x413323
Capabilities:
Authenticate hmac
Check os version
Get number of processors

Disassembly:
push dword [ebp - 0x5c]
mov dword [ebp - 0x24], 0xc41
xor edx, dword [ebp - 0x18]
mov dword [ebp - 0x5c], esp
add eax, ebx
add esp, 0xfffffff0
cmp dword [ebp - 0x40], 1
je 0x413356

Function at 0x414025
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push ecx
mov ecx, dword [esp + 0x38]
jmp 0x41408b

Function at 0x414271
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
cmp dword [ebp - 0x54], 0
je 0x414288
push 0
push 2
call esi
test eax, eax
jne 0x414251
lea edx, [esp + 0x54]
push dword [ebp - 0x5c]
and word [ebp - 0x64], 0xa01
sub esi, dword [ebp - 0x44]
mov dword [ebp - 0x5c], esp
add esp, 0xfffffff4
cmp dword [ebp - 0x40], 1
je 0x4142ac
jle 0x4100b6
add edi, ebx
push dword [ebp - 0x14]
push dword [ebp - 0x70]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x5c]
push dword [eax + 0x14]
call fcn.00403e4e
or esi, dword [ebp - 0x28]
and ebx, ecx
mov ebx, 0x6cba7fa5
mov ebx, edx
mov esi, dword [ebp - 0x5c]
lea esi, [esi - 0xc]
push esi
push dword [ebp - 0x38]
call fcn.00403e4e
or edi, esi
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x5c]
push dword [ecx + 0x10]
call fcn.00403e4e
or dword [ebp - 0x20], ebx
xor edx, edi
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x5c]
push dword [edx + 8]
call fcn.00403ed7
lea edx, [ebp - 0x70]
push edx
mov edx, dword [ebp - 0x5c]
push dword [edx + 0xc]
call fcn.00403e4e
lea edx, [ebp - 0x6c]
push edx
mov edx, dword [ebp - 0x5c]
push dword [edx + 0x18]
call fcn.00403e4e
lea edx, [ebp - 0x60]
test dword [ebp - 0x54], 0
je 0x41433c
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push edx
push dword [ebp - 0x60]
and dword [ebp - 0x68], 0x17
or dword [ebp - 0x48], eax
call fcn.00403f5c
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x5c]
push dword [edx + 0x1c]
call fcn.00403e4e
cmp dword [ebp - 0x40], 1
je 0x414373
call dword [0x41a054]
add esi, 0x41a2e6
dec edi
jne 0x4143d3
jmp 0x41459e
Function at 0x414637
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
xor eax, dword [ebp - 0x68]
mov word [ebp - 0x44], 0x123
push dword [ebp - 0x5c]
mov dword [ebp - 0x5c], esp
cmp dword [ebp - 0x40], 1
je 0x41465d
cmp esi, dword [eax + 0x24]
je 0x4146b7
cmp esi, dword [0x41a50e]
je 0x414672
push esi
add esp, 0xffffffe0
cmp dword [ebp - 0x54], 0x400002
jne 0x414679
pop eax
push 2
mov ecx, 0x41a1ef
cmp eax, ecx
push dword [ebp - 0xc]
lea edi, [ebp - 0xc]
push edi
mov edi, dword [ebp - 0x5c]
push dword [edi + 0xc]
call fcn.00403e4e
sub edx, eax
cmp dword [ebp - 0x54], 0x36
jne 0x41469a
mov eax, esi
je 0x4146b5
push 0
xor dword [ebp - 0x1c], eax
cmp dword [ebp - 0x40], 0x32
jne 0x4146bd
cmp esi, 0x20
mov ebx, 0x41a4be
jae 0x41465a
mov ecx, esi
shr ebx, cl
lea esi, [esi + eax + 4]
push 0
cmp dword [ebp - 0x54], 0xffffffd3
jne 0x4146cd
mov ebp, esp
add edi, esi
add dword [ebp - 0x54], 0
je 0x4146e3
and ebx, 0x41a2fc
call fcn.00408ef3
mov ebx, dword [ebp - 0x6c]
xor dword [ebp - 0x50], 0xffffffa1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x54], 5
jne 0x4146ff

Function at 0x4148a0
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push dword [ebp - 0x5c]
sub edi, dword [ebp - 0x50]
sub ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x5c], esp
and esi, dword [ebp - 0x28]
add esp, 0xfffffc78
mov ecx, esi
cmp dword [ebp - 0x40], 5
jne 0x4148c3
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]

Function at 0x414cc9
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
cmp eax, dword [0x41a3cb]
jne 0x414c74
mov eax, dword [esi + 0xc]

Function at 0x4156f5
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jne 0x4156fb
cmp dword [ebx + 0x1c], 0
jne 0x415702
call fcn.0040c1ca
cmp dword [eax + 0x7c], 0
je 0x414b0f
add edx, esi
test dword [ebp - 0x54], 0
je 0x41571d

Function at 0x416089
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push dword [ebp - 0x5c]
add edx, 0xcd60
lea edi, [eax]
mov dword [ebp - 0x5c], esp
xor ecx, edi
or dword [ebp - 0x48], 0xed
or dword [ebp - 0x10], 0x60c
and esi, dword [ebp - 0x68]
push dword [ebp - 0x70]
mov dword [ebp - 0x50], ebx
and ecx, dword [ebp - 0x1c]
lea ebx, [ebp - 0x60]
push ebx
mov ebx, dword [ebp - 0x5c]
push dword [ebx + 8]
call fcn.00403e4e
cmp dword [ebp - 0x54], 0xffffffe2
jne 0x4160d1
Function at 0x4160cb
Capabilities:
Authenticate hmac
Check os version
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
call fcn.0041049d
pop ecx
lea esi, [ebp - 0x60]
push esi
mov esi, dword [ebp - 0x60]
push dword [esi + 0x3c]
call fcn.00403ed7
mov esi, dword [ebp - 0x60]
push dword [esi + 0x54]
add esi, dword [ebp - 0x64]
lea esi, [ecx + esi*8 + 0x433]
mov ebx, dword [ebp - 0x5c]
push dword [ebx + 8]
mov eax, dword [ebp - 0x5c]
add ebx, dword [ebp - 0x74]
add esi, 0x43ac
push dword [eax + 0xc]
cmp dword [ebp - 0x54], 0x400002
jne 0x416128
mov eax, dword [0x41a34a]
mov dword [ebp - 0x3c], eax
and dword [ebp - 0x38], 0
test edx, edx
mov eax, dword [ebp - 0x3c]
jle 0x416668
call fcn.004177d4
lea esi, [ebp - 0x38]
push esi
mov esi, dword [ebp - 0x60]
push dword [esi + 6]
call fcn.00403e4e
cmp dword [ebp - 0x40], 9
jne 0x416148
Function at 0x416390
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop ecx
push ebx
push eax
sub dword [ebp], 4
mov dword [ebp], edi
mov ebx, dword [ebp]
or ecx, dword [ebp]
mov eax, dword [esp + 0xc]
or ecx, ebx
mov dword [ebx], eax
or ecx, dword [ebp]
jmp 0x403db1
pop eax
pop ebx
ret 4
cmp dword [ebp - 0x40], 1
je 0x416394
xor eax, eax
call fcn.004179bc
push ebp
mov ebp, esp
push ecx
push dword [ebp - 0x5c]
cmp dword [ebp - 0x40], 0x13
jne 0x4163a7
cmp ecx, 8
jb 0x416354
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x5c], esp
sub edx, dword [ebp - 0x34]
push dword [ebp - 0x38]
xor esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [ebp - 0x5c]
push dword [ecx + 8]
call fcn.00403e4e
cmp dword [ebp - 0x54], 0xffffffa1
jne 0x4163db
xor esi, esi
cmp edi, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
je 0x403d5f
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x5c]
push dword [ecx + 0xc]
call fcn.00403e4e
add ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x40], 1
je 0x4163f9
push dword [esi + 4]
sub dword [ebp - 0x38], 1
cmp dword [ebp - 0x40], 1
je 0x41640c
je 0x4098a4
lea edi, [ebp - 0x6c]
cmp dword [ebp - 0x54], 0x400002
jne 0x41641e
xor eax, eax
inc eax
push edi
push dword [ebp - 0x38]
call fcn.00403ed7
cmp dword [ebp - 0x40], 1
je 0x416440
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
mov esi, dword [ebp - 0x38]
sub ecx, edi
add edi, 0x444
not esi
mov dword [ebp - 0x38], esi
add dword [ebp - 0x50], 0x2f1
mov edi, dword [ebp - 0x38]
add ebx, edx
sub ebx, dword [ebp - 0x48]
and dword [ebp - 0x6c], edi
add ebx, dword [ebp - 0x48]
lea edi, [ebx + ecx*2 - 0x5c]
pop dword [ebp - 0x38]
and ecx, dword [ebp - 0x68]
cmp dword [ebp - 0x40], 0x24
jne 0x416480
push edi
mov esi, dword fs:[0]
mov ebx, dword [ebp - 0x5c]
cmp dword [ebp - 0x40], 1
je 0x416495
or dword [ebp - 4], 0xffffffff
call fcn.00410a70
mov esp, ebx
add esi, dword [ebp - 0x4c]
sub ebx, esi
xor dword [ebp - 0x50], esi
add edi, dword [ebp - 0x48]
pop dword [ebp - 0x5c]
and edi, edx
or dword [ebp - 0x48], edx
and eax, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x4c]
ret 8
Function at 0x4164c2
Capabilities:
Authenticate hmac

Disassembly:
int3
or esi, dword [ebp - 0x34]
mov dword [ebp - 0x48], 0xdfc
push dword [ebp - 0x5c]
mov dword [ebp - 0x5c], esp
cmp dword [ebp - 0x40], 1
je 0x4164e4
jne 0x4164c5
mov eax, esi
and eax, 0xff
add esp, 0xffffffbc
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x74], ecx
push dword [ebp - 0xc]
sub edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c]
add ebx, edi
and esi, dword [ebp - 0x34]
push dword [ebp - 0x14]
cmp dword [ebp - 0x40], 0x7d
jne 0x41650c
mov esi, ecx
push dword [ebp - 0x70]
lea esi, [ebp - 0xc]
mov dword [ebp - 0x58], 0x11d
or dword [ebp - 0x34], eax
push esi
add dword [ebp - 0x34], 0x45
push dword [ebp - 0xc]
call fcn.00403f5c
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x5c]
push dword [eax + 0xc]
call fcn.00403e4e
mov eax, ecx
mov byte [ebp - 0x44], 0x9a
lea ebx, [ebp - 0x60]
push ebx
mov ebx, dword [ebp - 0x5c]
push dword [ebx + 8]
call fcn.00403e4e
cmp dword [ebp - 0x40], 1
je 0x416560
mov eax, ebx
cmp eax, esi
jg 0x40e657
push 0
cmp dword [ebp - 0x54], 0x400002
jne 0x416574

Function at 0x41694d
Capabilities:
Authenticate hmac
Check os version
Get number of processors
Resolve function by parsing pe exports

Disassembly:
test dl, cl
je 0x416912
cmp dword [edi + 8], 1
jne 0x4137be
mov ecx, dword [ebp + 0x20]
Function at 0x416fa5
Capabilities:
Authenticate hmac
Check os version
Encode data using base64
Encrypt data using speck
Get number of processors
Inspect section memory permissions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push dword [ebp - 0x5c]
or edi, esi
and dword [ebp - 0x64], 0xec5
mov dword [ebp - 0x5c], esp
and esi, dword [ebp - 0x20]
add esp, 0xfffffff8
xor ecx, dword [ebp - 0x74]
and edi, edx
cmp dword [ebp - 0x54], 0
je 0x416fcc
push ebx
push dword [ebp - 0xc]
mov byte [ebp - 0x50], 0x70
push dword [ebp - 0x14]
mov edi, ebx
push dword [ebp - 0x70]
mov dword [ebp - 0x34], edi
or dword [ebp - 0x10], ecx
or word [ebp - 0x58], 0xcf2
push dword [ebp - 0x60]
add word [ebp - 0x44], 0x81c
xor edx, ebx
mov edx, 0x7a3cf94e
mov edx, ecx
lea esi, [ebp - 0xc]
push esi
mov esi, dword [ebp - 0x5c]
push dword [esi + 8]
call fcn.00403e4e
or ebx, dword [ebp - 0x24]
and edi, dword [ebp - 0x28]
lea edi, [ebp - 0xc]
push edi
mov edi, dword [ebp - 0xc]
push dword [edi + 0x3c]
call fcn.00403ed7
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [ebp - 0xc]
push dword [ecx + 0x7c]
call fcn.00403e4e
mov esi, dword [ebp - 0x5c]
lea esi, [esi - 4]
push esi
push dword [ebp - 0x6c]
call fcn.00403e4e
or eax, dword [ebp - 0x68]
lea ebx, [ebp - 0xc]
push ebx
mov ebx, dword [ebp - 0xc]
push dword [ebx + 0x78]
call fcn.00403e4e
cmp dword [ebp - 0x40], 1
je 0x41705f
pop esi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x5c]
push dword [ecx + 8]
call fcn.00403ed7
and ecx, edx
mov ebx, dword [ebp - 0x5c]
lea ebx, [ebx - 4]
push ebx
push dword [ebp - 0xc]
call fcn.00403ed7
add dword [ebp - 0x68], 0x3b
lea ebx, [ebp - 0x70]
push ebx
mov ebx, dword [ebp - 0xc]
push dword [ebx + 0x20]
call fcn.00403e4e
mov edi, eax
lea eax, [ebp - 0x70]
push eax
mov eax, dword [ebp - 0x5c]
push dword [eax + 8]
call fcn.00403ed7
xor ebx, dword [ebp - 0x10]
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x14]
push eax
or dword [ebp - 0x48], 0xd5a
add edi, ecx
push dword [ebp - 0x14]
call fcn.00403f5c
add edx, dword [ebp - 0x24]
test dword [ebp - 0x54], 0
je 0x4170d6
mov byte [edi + 2], al
mov eax, dword [ebp + 8]
pop esi
pop edi
nop
jmp 0x417245
Function at 0x418104
Capabilities:
Authenticate hmac

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push eax
push esi
jmp 0x403c83
add dword [ebp - 0x30], 4
or ecx, dword [ebp - 0x50]
pop esi
pop eax
ret 4
push eax
call fcn.00410026
pop ecx
pop ecx
mov eax, dword [esi + 0x50]
cmp eax, dword [0x41a245]
je 0x403c41
cmp eax, edi
je 0x403c41
cmp dword [eax + 0xb4], edi
jne 0x403c9d
push eax
call fcn.00409434
push dword [esi + 0x50]
call fcn.0040fd44
push ebx
mov dword [ebp - 0x10], edx
jmp 0x403d09
xor ebx, ebx
mov dword [ebp - 0x50], edx
add ebx, 4
sub edi, dword [ebp - 0x48]
add eax, 0x41d9
add dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], edx
add eax, 0x1792
pop ebx
ret 8
xor ecx, ebx
mov ecx, ebx
push dword [ebp - 0x5c]
cmp dword [ebp - 0x40], 0x400002
jne 0x41811f
jne fcn.004180ed
sub ecx, 0
je 0x4180c0
dec ecx
mov dword [ebp - 0x5c], esp
push dword [ebp - 0xc]
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x5c]
push dword [edx + 0xc]
call fcn.00403e4e
and esi, ebx
mov esi, dword [ebp - 0x38]
shr esi, 2
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [ebp - 0x5c]
push dword [ecx + 0x10]
call fcn.00403e4e
cmp dword [ebp - 0x40], 1
je 0x418159
test esi, esi
lea ebx, [ebp - 0x60]
push ebx
mov ebx, dword [ebp - 0x5c]
push dword [ebx + 8]
call fcn.00403e4e
lea edx, [ebp - 0xc]
cmp dword [ebp - 0x40], 1
je 0x418191
test ebx, 0x400000
mov dword [esp + 0x137c], 0xffffffff
je 0x418134
lea ecx, [esp + 0x14]
and ebx, 0x41a32a
push edx
cmp dword [ebp - 0x40], 1
je 0x4181a9
jne 0x408c25
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], ebx
push dword [ebp - 0xc]
and word [ebp - 0x44], 0xbee
call fcn.00403f5c
cmp dword [ebp - 0x54], 0x58
jne 0x4181d9
lea eax, [esi + eax*2 - 0x30]
mov dword [ebp - 0x2e4], eax
cmp esi, 0x4e
jg 0x403ca3
je 0x40fea8
push dword [ebp - 0x60]
push dword [ebp - 0x6c]
call fcn.00403f5c
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x60]
push dword [ecx]
call fcn.00403ed7
lea eax, [ebp - 0x6c]
add dword [ebp - 0x2c], edx
push eax
push dword [ebp - 0xc]
call fcn.00403ed7
or eax, dword [ebp - 0x2c]
or ebx, dword [ebp - 0x58]
or edi, ecx
add eax, dword [ebp - 0x68]
mov edi, 4
add dword [ebp - 0x60], edi
add dword [ebp - 0x44], eax
cmp dword [ebp - 0x40], 0x400002
jne 0x418241
mov dword [edi + 0x2a8], eax
mov dword [0x41a1d9], edi
mov dword [esp + 0x38], eax
mov dword [edi + 0x2ac], eax
mov dword [edi + 0x2b0], eax
je 0x41822f
sub dword [ebp - 0x38], 1
jne 0x4181d9
pop dword [ebp - 0xc]
mov esi, dword [ebp - 0x5c]
xor edx, dword [ebp - 0x2c]
and eax, dword [ebp - 0x18]
mov esp, esi
cmp dword [ebp - 0x40], 1
je 0x418277
push eax
mov byte [esp + 0x245ac], 6
call fcn.0040d0f1
lea ecx, [esp + 0x280]
add edx, dword [ebp - 0x58]
pop dword [ebp - 0x5c]
or dword [ebp - 0x18], 0xc88
and ecx, dword [ebp - 0x4c]
and ecx, edi
cmp dword [ebp - 0x40], 0x400002
jne 0x41829a
call fcn.0041530f
ret 0xc