joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009e780
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp cx, word [eax]
jne 0x1009e801
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x1009e801
mov ecx, dword [ecx + eax + 0x88]
test ecx, ecx
je 0x1009e801
add eax, ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
push ecx
push eax
call fcn.100a11e0
add esp, 0xc
test eax, eax
je 0x1009e801
mov edx, dword [ebp + 8]
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1009e7d2
sub eax, esi
sar eax, 1
add eax, eax
push eax
mov eax, dword [ebp - 8]
push edx
add eax, 0xfffffffc
push eax
push dword [ebp - 4]
call fcn.100a1230
add esp, 0x10
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x1009e8b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10116f80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [ebx]
jne 0x1009e8fe
mov ecx, dword [ebx + 0x3c]
cmp dword [ecx + ebx], 0x4550
jne 0x1009e8fe
mov eax, dword [ecx + ebx + 0xd8]
mov ecx, dword [ecx + ebx + 0xdc]
add eax, ebx
add ecx, eax
cmp eax, ecx
jae 0x1009e8fe
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x1009e90f
add eax, 4
cmp eax, ecx
jb 0x1009e8f3
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1009e8fe
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0xc], ax
je 0x1009e985
push esi
push edi
mov edi, dword [ebp + 0x10]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x1009e970
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
nop dword [eax]
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x1009e951
cmp dl, 0x11
jne 0x1009e96a
inc eax
cmp eax, 6
jl 0x1009e940
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x1009e937
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push ebx
push 6
push eax
call fcn.1009f1f0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop ebx
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
Function at 0x1009ea50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10116f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x1009ea9d
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x1009ea9d
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x1009ea9d
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x1009eaad
add eax, 4
cmp eax, ecx
jb 0x1009ea92
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1009ea9d
mov cl, byte [ebp + 0x1c]
test cl, cl
je 0x1009eac1
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x1009eac7
mov word [ebp - 0xc], 0x15ff
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
je 0x1009eb35
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x1009eb20
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
nop dword [eax]
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x1009eb01
cmp dl, 0x11
jne 0x1009eb1a
inc eax
cmp eax, 6
jl 0x1009eaf0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x1009eae7
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push 6
push eax
call fcn.1009f1f0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret

Function at 0x1009eb60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, 0x5a4d
sub esp, 0xc
cmp ax, word [edx]
jne 0x1009eba3
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x1009eba3
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x1009eba3
mov edx, dword [ebp + 0xc]
cmp dword [eax], edx
je 0x1009ebbe
add eax, 4
cmp eax, ecx
jb 0x1009eb98
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x1009eba3
mov cl, byte [ebp + 0x20]
test cl, cl
je 0x1009ebd2
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x1009ebd8
mov word [ebp - 0xc], 0x15ff
push dword [ebp + 0x18]
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 6
push eax
push dword [ebp + 8]
call fcn.1009e5b0
mov eax, dword [ebp + 8]
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x1009f2d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.1009f220
add esp, 0x18
test eax, eax
je 0x1009f2f9
inc eax
cmp byte [eax], 0xcc
je 0x1009f2f3
pop ebp
ret
Function at 0x1009f500
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.1009f440
add esp, 0x18
test eax, eax
je 0x1009f529
inc eax
cmp byte [eax], 0xcc
je 0x1009f523
pop ebp
ret

Function at 0x100a6cdc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100a6d03
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100a6d06
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100a6cb8
pop esi
leave
ret 8

Function at 0x100ac171
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x100ac194
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x100ac182
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x100b8fef
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.100cff54
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100b9032
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100b9032
sub eax, 1
je 0x100b902d
sub eax, 1
je 0x100b9029
xor eax, eax
leave
ret
push 3
jmp 0x100b9034
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x100d8081
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10100f6c
push 0x10100f64
push str.FlsAlloc
push 0x1e
call fcn.100d7eac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100d80b5
push dword [ebp + 8]
mov ecx, esi
call dword [0x100ef39c]
call esi
jmp 0x100d80bb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100d80ff
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10100f7c
push 0x10100f74
push str.FlsGetValue
push 0x20
call fcn.100d7eac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100d8136
push dword [ebp + 8]
mov ecx, esi
call dword [0x100ef39c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100db568
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100db605
push ebx
push esi
call fcn.100db531
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100d9c98
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100db5b2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100db604
push edi
push eax
call fcn.100d685a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100db5d2
call fcn.100d6820
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100db603
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100d9c98
add esp, 0x20
test eax, eax
jne 0x100db5f1
push edi
call fcn.100d6820
jmp 0x100db5f9
push ebx
call fcn.100d6820
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100db608
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100db619
pop esi
ret
push ebx
push edi
push esi
call fcn.100db531
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100d685a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100db641
push ebx
push esi
push edi
call fcn.100bac30
add esp, 0xc
push 0
call fcn.100d6820
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100dba05
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100db656
Function at 0x100e37b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100e37dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100e37dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x4010e4
jmp 0x401040
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x401040
add eax, 4
jle 0x401185
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x40117f
movd dword [edi], mm4
je 0x401185
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret

Function at 0x4450a0
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x61
fiadd dword [0x9eec0187]
cmp edi, dword [0xf32c4bff]
jnp 0x4450bc
or dword [eax - 0x7b498913], esp
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
in eax, dx
pop eax
pop ds
invalid

Function at 0x46c35e
Capabilities:
Encode data using xor

Disassembly:
les ebp, [ecx - 0x3666e19]
adc dl, ah
fsub qword [eax + ebx]
sub edi, eax
jns 0x46c3e4
cmp ebx, dword [ebp + 0x1a]
cmp byte [esi], 0xa2
pxor mm5, qword [esi - 0x124db999]
daa
dec esp
js 0x46c36d
mov al, byte [0xf0d028a4]
xchg ecx, eax
pop esp
adc ecx, esp
aad 0x98
and ebx, ebp
int3
push edx
aaa
jmp 0xbb4028f9
Function at 0x629581
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6333e0
cmp edx, dword [eax]
je 0x6295a3
add eax, 8
inc ecx
cmp eax, 0x633470
jl 0x629594
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6333e0]
jne 0x6296d1
mov eax, dword [0x63bd88]
cmp eax, 1
je 0x6296ab
test eax, eax
jne 0x6295d4
cmp dword [0x633308], 1
je 0x6296ab
cmp edx, 0xfc
je 0x6296d1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62960b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629f60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a3f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62964e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a3f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62eea4
push edi
call fcn.0062c2c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629f60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629f70
lea eax, [ebp - 0xa0]
push 0x62ee84
push eax
call fcn.00629f70
push dword [esi + 0x6333e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629f70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c234
add esp, 0x2c
pop edi
jmp 0x6296d1
lea eax, [ebp + 8]
lea esi, [esi + 0x6333e4]
push 0
push eax
push dword [esi]
call fcn.0062a3f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x7ffe536a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
inc esi
dec esi
pushf
popf
and al, 0xff
xor eax, ecx
xor eax, ecx
push eax
pop eax
pushf
popf
push eax
pop eax
push bx
inc esp
inc esp
push es
pop ds
push bx
inc esp
inc esp
inc esi
dec esi
xor eax, ecx
xor eax, ecx
and al, 0xff
push bx
inc esp
inc esp
add al, 0
add al, 4
sub al, 4
push eax
pop eax
not eax
not eax
push es
pop ds
xor eax, ecx
xor eax, ecx
and al, 0xff
add al, 4
sub al, 4
push es
pop ds
xor eax, ecx
xor eax, ecx
push eax
pop eax
xor eax, ecx
xor eax, ecx
push eax
pop eax
push bx
inc esp
inc esp
and al, 0xff
add al, 4
sub al, 4
add al, 0
pushf
popf
push es
pop ds
push bx
inc esp
inc esp
inc esi
dec esi
xor eax, ecx
xor eax, ecx
push eax
pop eax
not eax
not eax
push es
pop ds
pushf
popf
push es
pop ds
add al, 4
sub al, 4
push es
pop ds
not eax
not eax
and al, 0xff
push bx
inc esp
inc esp
push es
pop ds
add al, 4
sub al, 4
push eax
pop eax
pushf
popf
inc esi
dec esi
pushf
popf
and al, 0xff
not eax
not eax
stc
inc esi
dec esi
call 0x7ffe541a
pop edx
xor dx, dx
cld
push eax
pop eax
add edx, 0xd5e0
push eax
pop eax
pushf
popf
xor ecx, ecx
and al, 0xff
push edx
cdq
pop edx
mov cl, 0x1e
and al, 0xff
add al, 0
xor byte [ecx + edx], 0x17
loop 0x7ffe543a
and al, 0xff
add al, 4
sub al, 4
cld
push dword fs:[0x24]
inc esi
dec esi
pop dword [edx + 0xa]
nop
mov cl, 0xff
pushf
popf
push edx
loop 0x7ffe545a
inc esi
dec esi
not eax
not eax
clc
mov dword [edx + 0x11], 0xffffacbb
add al, 4
sub al, 4
inc esi
dec esi
xor eax, ecx
xor eax, ecx
mov ecx, dword [eax + 0x2c]
and al, 0xff
clc
push es
pop ds
mov dword [edx + 0x1b], ecx
mov dword [edx + 0x100], ecx
cld
push es
pop ds
mov dword [eax + 0x2c], esp
add al, 4
sub al, 4
push eax
pop eax
push 0
pushf
popf
stc
push 0
push 0
xor eax, ecx
xor eax, ecx
push es
pop ds
pushf
popf
stc
push 0
and al, 0xff
push 0x30
push es
pop ds
xor eax, ecx
xor eax, ecx
push edx
cdq
pop edx
push 0x20
add al, 4
sub al, 4
inc esi
dec esi
push eax
pop eax
push 0
inc esi
dec esi
pushf
popf
stc
push 0
push es
pop ds
add edx, 0xffff7f2f
cld
push edx
push edx
pushf
popf
add al, 0
pushf
popf
nop
push 0
pushf
popf
push eax
pop eax
call dword [edx + 0x8214]
cld
add esp, 0x3f8
xor eax, eax
add eax, 0
inc eax
add al, 4
sub al, 4
inc esi
dec esi
ret 0xc
Function at 0x406ce4
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x406e37
mov edx, 0x10000000
cmp eax, 0x7c
je 0x406e37
cmp eax, 0x29
jne 0x406d1d
cmp dword [esi + 0x10], 0
jne 0x406e37
test dword [esi + 0x50], edx
je 0x406e3d
cmp eax, 0x2e
jne 0x406d38
push 5
lea ecx, [esi + 0x24]
call fcn.00406f07
mov ecx, esi
call fcn.00406cbb
jmp 0x406e21
cmp eax, 0x5c
jne 0x406d8d
mov ecx, esi
call fcn.00406cbb
test byte [esi + 0x50], 0x80
je 0x406d81
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x406d69
push 4
lea ecx, [esi + 0x24]
call fcn.00406f07
mov ecx, esi
call fcn.00406cbb
jmp 0x406e28
cmp eax, 0x42
jne 0x406d81
push 4
lea ecx, [esi + 0x24]
call fcn.00406f07
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x406d5d
mov ecx, esi
call fcn.00407820
jmp 0x406e21
cmp eax, 0x5b
jne 0x406dad
mov ecx, esi
call fcn.00406cbb
mov ecx, esi
call fcn.004077d4
cmp dword [esi + 0x4c], 0x5d
je 0x406d2c
push 4
jmp 0x406e3f
cmp eax, 0x28
jne 0x406dca
mov ecx, esi
call fcn.00406cbb
mov ecx, esi
call fcn.004078f9
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x406e3d
jmp 0x406e16
cmp eax, 0x5e
jne 0x406dd3
push 2
jmp 0x406d55
cmp eax, 0x24
jne 0x406ddf
push 3
jmp 0x406d55
cmp eax, 0x2a
je 0x406e33
cmp eax, 0x2b
je 0x406e33
cmp eax, 0x3f
je 0x406e33
cmp eax, 0x7b
je 0x406e33
cmp eax, 0x7d
jne 0x406dfd
test dword [esi + 0x50], edx
je 0x406e2f
cmp eax, 0x5d
jne 0x406e07
test dword [esi + 0x50], edx
je 0x406da6
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00407a62
mov bl, 1
mov ecx, esi
call fcn.00406cbb
test bl, bl
je 0x406e28
mov ecx, esi
call fcn.0040797a
mov cl, 1
jmp 0x406ceb
push 6
jmp 0x406e3f
push 0xa
jmp 0x406e3f
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.00406309
int3
Function at 0x3566321
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3578084]
jne 0x356632b
repz ret
jmp fcn.035675f2

Function at 0x356c2be
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x3578084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.03567d28
and dword [ebp - 0x14], 0
cmp dword [0x3579fa0], 0
mov dword [ebp - 0x18], eax
jne 0x356c371
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x356c419
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x356c419
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x3579fa0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x3579fa4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x3579fa8], eax
call edi
push eax
call esi
mov dword [0x3579fb0], eax
test eax, eax
je 0x356c371
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x3579fac], eax
mov eax, dword [0x3579fac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x356c3ca
cmp dword [0x3579fb0], ecx
je 0x356c3ca
push eax
call esi
push dword [0x3579fb0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x356c3ca
test ebx, ebx
je 0x356c3ca
call edi
test eax, eax
je 0x356c3c1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x356c3c1
test byte [ebp - 8], 1
jne 0x356c3ca
or dword [ebp + 0x10], 0x200000
jmp 0x356c3fd
mov eax, dword [0x3579fa4]
cmp eax, dword [ebp - 0x18]
je 0x356c3fd
push eax
call esi
test eax, eax
je 0x356c3fd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x356c3fd
mov eax, dword [0x3579fa8]
cmp eax, dword [ebp - 0x18]
je 0x356c3fd
push eax
call esi
test eax, eax
je 0x356c3fd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x3579fa0]
call esi
test eax, eax
je 0x356c419
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x356c41b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.03566321
leave
ret
Function at 0x364f403
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ebp, edx
jmp 0x35b5516
push ebp
ret
inc edx
ror edx, 3
test ebp, ebp
clc
xor ebx, edx
test ax, bp
clc
jmp 0x359f0b7
not edx
jmp 0x3608ac9
push edx
push ebx
mov dh, al
cwd
cmovp bx, di
push ebp
movsx ebx, cx
push eax
rdtsc
xchg bh, bh
movsx ebx, sp
push ecx
lahf
cwd
push edi
mov edx, edi
push esi
movzx eax, bx
rdtsc
pushfd
mov eax, ebp
mov edx, 0x3160000
lahf
push edx
mov edi, dword [esp + 0x28]
xor edi, 0x1ba85032
and si, di
sbb si, 0x7c80
sub edi, 0x1fda1e7f
ror edi, 3
not edi
sal ebx, cl
adc ebp, 0x24c5131e
add edi, edx
cbw
or ax, si
mov esi, esp
movsx eax, dx
mov bh, 0x4a
sub dh, ch
sub esp, 0xc0
mov ebx, edi
btc eax, 0xd
mov eax, 0x3160000
sub ebx, eax
bts edx, esi
lea ebp, [0x364f47c]
test sp, ax
rcl dl, 0x4f
setge dl
lea edi, [edi - 4]
rcl dx, cl
test ah, 0x3a
cdq
mov edx, dword [edi]
xor edx, ebx
jmp 0x36a76cb
bswap edx
jmp 0x363aead

Function at 0x43515a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x435168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43514a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x435145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x435145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret