joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x439b2d92
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x42a7045
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x407761
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
pop edi
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xab8], eax
jmp 0x4077b4

Function at 0x407cc5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
xor ebx, 0x4f1c
xor ebx, 0x33ce
add ebx, 0xf43b
pop ebx
push esi
push edx
add esp, 4
add esi, 0x8343
or esi, 0x10ac2
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x407c97
push esi
and esi, 0x228b
or esi, 0xcf51
pop esi
push edx
call 0x407cb4
add byte [esp + edi], dh
inc esp
inc ecx
cmp byte [edi + 0x37], al
add esp, 4
call 0x407cc5
add byte [eax], bh
cmp eax, 0x4f444434
cmp byte [edi], bh
add esp, 4
pop edx
cmp dword [ebp - 0x31c], 0
jne 0x4085e2
mov edx, 0x6b
mov word [ebp - 0x1774], dx
mov eax, 0x65
mov word [ebp - 0x1772], ax
mov ecx, 0x72
mov word [ebp - 0x1770], cx
mov edx, 0x6e
mov word [ebp - 0x176e], dx
mov eax, 0x65
mov word [ebp - 0x176c], ax
mov ecx, 0x6c
mov word [ebp - 0x176a], cx
mov edx, 0x33
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push ebx
call 0x407d7f
add byte [esi + 0x4b], cl
cmp dword [eax], edi
inc ebx
inc ecx
xor esi, dword [edx]
add esp, 4
and ebx, 0x171e7
and ebx, 0xd60
pop ebx
push ecx
call 0x407d9d
add byte [eax], bh
aas
inc ebx
cmp eax, 0x83354037
les eax, [ecx + ebx*2]
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
mov byte [ebp - 0x88e], 0x62
mov byte [ebp - 0x88d], 0x72
mov byte [ebp - 0x88c], 0x61
mov byte [ebp - 0x88b], 0x72
mov byte [ebp - 0x88a], 0x79
mov byte [ebp - 0x889], 0x57
mov byte [ebp - 0x888], 0
mov eax, dword fs:[0x18]
add byte [eax], al
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push edi
push ecx
add esp, 4
add edi, 0xcf31
xor edi, 0x11652
add edi, 0x85fe
pop edi
push ebx
and ebx, 0x2537
and ebx, 0x35d4
Function at 0x407d9d
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
xor ebx, 0x4f1c
xor ebx, 0x33ce
add ebx, 0xf43b
pop ebx
push esi
push edx
add esp, 4
add esi, 0x8343
or esi, 0x10ac2
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x407c97
push esi
and esi, 0x228b
or esi, 0xcf51
pop esi
push edx
call 0x407cb4
add byte [esp + edi], dh
inc esp
inc ecx
cmp byte [edi + 0x37], al
add esp, 4
call 0x407cc5
add byte [eax], bh
cmp eax, 0x4f444434
cmp byte [edi], bh
add esp, 4
pop edx
cmp dword [ebp - 0x31c], 0
jne 0x4085e2
mov edx, 0x6b
mov word [ebp - 0x1774], dx
mov eax, 0x65
mov word [ebp - 0x1772], ax
mov ecx, 0x72
mov word [ebp - 0x1770], cx
mov edx, 0x6e
mov word [ebp - 0x176e], dx
mov eax, 0x65
mov word [ebp - 0x176c], ax
mov ecx, 0x6c
mov word [ebp - 0x176a], cx
mov edx, 0x33
mov word [ebp - 0x1768], dx
mov eax, 0x32
mov word [ebp - 0x1766], ax
mov ecx, 0x2e
mov word [ebp - 0x1764], cx
mov edx, 0x64
mov word [ebp - 0x1762], dx
mov eax, 0x6c
mov word [ebp - 0x1760], ax
mov ecx, 0x6c
mov word [ebp - 0x175e], cx
xor edx, edx
mov word [ebp - 0x175c], dx
push ebx
call 0x407d7f
add byte [esi + 0x4b], cl
cmp dword [eax], edi
inc ebx
inc ecx
xor esi, dword [edx]
add esp, 4
and ebx, 0x171e7
and ebx, 0xd60
pop ebx
push ecx
call 0x407d9d
add byte [eax], bh
aas
inc ebx
cmp eax, 0x83354037
les eax, [ecx + ebx*2]
mov byte [ebp - 0x894], 0x4c
mov byte [ebp - 0x893], 0x6f
mov byte [ebp - 0x892], 0x61
mov byte [ebp - 0x891], 0x64
mov byte [ebp - 0x890], 0x4c
mov byte [ebp - 0x88f], 0x69
mov byte [ebp - 0x88e], 0x62
mov byte [ebp - 0x88d], 0x72
mov byte [ebp - 0x88c], 0x61
mov byte [ebp - 0x88b], 0x72
mov byte [ebp - 0x88a], 0x79
mov byte [ebp - 0x889], 0x57
mov byte [ebp - 0x888], 0
mov eax, dword fs:[0x18]
add byte [eax], al
mov dword [ebp - 0x195c], eax
mov ecx, dword [ebp - 0x195c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1960], edx
mov eax, dword [ebp - 0x1960]
mov dword [ebp - 0x15e4], eax
push edi
push ecx
add esp, 4
add edi, 0xcf31
xor edi, 0x11652
add edi, 0x85fe
pop edi
push ebx
and ebx, 0x2537
and ebx, 0x35d4

Function at 0x4081c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
inc eax
inc esi
cmp al, byte [ebx + 0x565b04c4]
jmp 0x4081d1
jmp 0x4081d6
pop esi
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x408216
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x40823e
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
invalid
invalid
Function at 0x4081c4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
inc eax
inc esi
cmp al, byte [ebx + 0x565b04c4]
jmp 0x4081d1
jmp 0x4081d6
pop esi
mov eax, dword [ebp - 0x750]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x760], 0
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x15f0], edx
cmp dword [ebp - 0x15f0], 0
jne 0x408216
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
mov ecx, dword [ebp - 0x15f0]
mov edx, dword [ebp - 0x320]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x15f4], edx
jne 0x40823e
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], eax
jmp 0x408507
invalid
invalid
Function at 0x4083a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
mov eax, dword [ebp - 0x754]
dec dword [ebx - 0x75773]
invalid
cmp ecx, dword [eax + 0x18]
jae 0x4084fb
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1964]
pushfd
out 0xff, al
dec dword [ebx - 0x31f73]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1968]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x196c]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x198], 0
add byte [eax], al
jmp 0x40835f
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
test eax, eax
je 0x408411
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x894]
test edx, edx
je 0x408411
test dword [eax], eax
add byte [eax], al
push ecx
or ecx, 0x11965
jmp 0x408399
or ecx, 0x16629
pop ecx
push esi
jmp 0x4083aa
cmp al, 0x4d
add esi, 0x160ad
and esi, 0x105c7
jmp 0x4083bd
pop esi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
cmp ecx, eax
je 0x408403
mov ecx, dword [ebp - 0x75c]
add ecx, dword [ebp - 0x198]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x198]
movsx ecx, byte [ebp + eax - 0x894]
cmp edx, ecx
jne 0x40840a
jmp 0x408350
jmp 0x408411
push edx
add edx, 0x6513
jmp 0x40841e
pop edx
push esi
add esi, 0xe82a
pop esi
push edx
sub edx, 0x17496
or edx, 0xaf76
pop edx
push edi
or edi, 0x8b67
sub edi, 0x5ce2
add byte [eax], al
pop edi
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x894]
cmp eax, edx
jne 0x408470
mov dword [ebp - 0xca8], 0
jmp 0x4084df
push esi
xor esi, 0x8d6f
add esi, 0x14806
and esi, 0xf7b1
pop esi
push esi
push edx
add esp, 4
or esi, 0x16538
and esi, 0xa1de
jmp 0x40849b
and esi, 0x15c51
pop esi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
or eax, 0x20
cmp ecx, eax
jge 0x4084d5
mov dword [ebp - 0xca8], 0xffffffff
jmp 0x4084df
mov dword [ebp - 0xca8], 1
cmp dword [ebp - 0xca8], 0
jne 0x4084f6
mov ecx, dword [ebp - 0x1970]
mov dword [ebp - 0x3f4], ecx
jmp 0x408507
jmp 0x4082e0
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
push ecx
add ecx, 0x10d05
add ecx, 0x71
add byte [eax], al
add byte [ecx + 0x13334c1], al
add byte [ecx + 0x5937e1], al
add byte [ecx + 0x51], bl
push eax
add esp, 4
and ecx, 0x10800
add ecx, 0xc397
sub ecx, 0x3c0a
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x197c], eax
mov ecx, dword [ebp - 0x197c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1980], edx
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x15fc], eax
push ebx
sub ebx, 0x32c
pop ebx
push ecx
push esi
add esp, 4
add ecx, 0x1234a
pop ecx
push ebx
push ecx
add esp, 4
sub ebx, 0xaff3
add byte [eax], al
and ebx, 0x129dd
and ebx, 0xedac
add byte [eax], al
Function at 0x4085dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add cl, ch
ljmp 0xc181
Function at 0x4085ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x758]
add edx, 1
mov dword [ebp - 0x758], edx
mov eax, dword [ebp - 0x754]
dec dword [ebx - 0x75773]
invalid
cmp ecx, dword [eax + 0x18]
jae 0x4084fb
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1964]
pushfd
out 0xff, al
dec dword [ebx - 0x31f73]
inc dword [ebx]
or al, 0x90
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x1968]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x196c]
mov eax, dword [ebp - 0x320]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1970], eax
mov dword [ebp - 0x198], 0
add byte [eax], al
jmp 0x40835f
mov ecx, dword [ebp - 0x198]
add ecx, 1
mov dword [ebp - 0x198], ecx
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
test eax, eax
je 0x408411
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x894]
test edx, edx
je 0x408411
test dword [eax], eax
add byte [eax], al
push ecx
or ecx, 0x11965
jmp 0x408399
or ecx, 0x16629
pop ecx
push esi
jmp 0x4083aa
cmp al, 0x4d
add esi, 0x160ad
and esi, 0x105c7
jmp 0x4083bd
pop esi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
cmp ecx, eax
je 0x408403
mov ecx, dword [ebp - 0x75c]
add ecx, dword [ebp - 0x198]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x198]
movsx ecx, byte [ebp + eax - 0x894]
cmp edx, ecx
jne 0x40840a
jmp 0x408350
jmp 0x408411
push edx
add edx, 0x6513
jmp 0x40841e
pop edx
push esi
add esi, 0xe82a
pop esi
push edx
sub edx, 0x17496
or edx, 0xaf76
pop edx
push edi
or edi, 0x8b67
sub edi, 0x5ce2
add byte [eax], al
pop edi
mov edx, dword [ebp - 0x75c]
add edx, dword [ebp - 0x198]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x198]
movsx edx, byte [ebp + ecx - 0x894]
cmp eax, edx
jne 0x408470
mov dword [ebp - 0xca8], 0
jmp 0x4084df
push esi
xor esi, 0x8d6f
add esi, 0x14806
and esi, 0xf7b1
pop esi
push esi
push edx
add esp, 4
or esi, 0x16538
and esi, 0xa1de
jmp 0x40849b
and esi, 0x15c51
pop esi
mov eax, dword [ebp - 0x75c]
add eax, dword [ebp - 0x198]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x198]
movsx eax, byte [ebp + edx - 0x894]
or eax, 0x20
cmp ecx, eax
jge 0x4084d5
mov dword [ebp - 0xca8], 0xffffffff
jmp 0x4084df
mov dword [ebp - 0xca8], 1
cmp dword [ebp - 0xca8], 0
jne 0x4084f6
mov ecx, dword [ebp - 0x1970]
mov dword [ebp - 0x3f4], ecx
jmp 0x408507
jmp 0x4082e0
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x3f4], edx
push ecx
add ecx, 0x10d05
add ecx, 0x71
add byte [eax], al
add byte [ecx + 0x13334c1], al
add byte [ecx + 0x5937e1], al
add byte [ecx + 0x51], bl
push eax
add esp, 4
and ecx, 0x10800
add ecx, 0xc397
sub ecx, 0x3c0a
pop ecx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x197c], eax
mov ecx, dword [ebp - 0x197c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1980], edx
mov eax, dword [ebp - 0x1980]
mov dword [ebp - 0x15fc], eax
push ebx
sub ebx, 0x32c
pop ebx
push ecx
push esi
add esp, 4
add ecx, 0x1234a
pop ecx
push ebx
push ecx
add esp, 4
sub ebx, 0xaff3
add byte [eax], al
and ebx, 0x129dd
and ebx, 0xedac
add byte [eax], al
Function at 0x408950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [edi + 0x51], bl
push ecx
add esp, 4
add ecx, 0x13aa6
pop ecx
mov eax, dword [ebp - 0x31c]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x324], ecx
push ebx
jmp 0x408974
and ebx, 0x8913
and ebx, 0x4c85
and ebx, 0xadc2
pop ebx
push ebx
push ecx
add esp, 4
xor ebx, 0x7b8c
xor ebx, 0x17b1f
xor ebx, 0xa3ec
pop ebx
mov dword [ebp - 0x770], 0
mov edx, dword [ebp - 0x324]
mov dword [ebp - 0x1608], edx
cmp dword [ebp - 0x1608], 0
jne 0x4089cf
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x408cc0
mov ecx, dword [ebp - 0x1608]
mov edx, dword [ebp - 0x324]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x160c], edx
jne 0x4089f7
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x510], eax
jmp 0x408cc0
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x160c]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1610], ecx
cmp dword [ebp - 0x1610], 0
jne 0x408a29
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
jmp 0x408cc0
mov eax, dword [ebp - 0x324]
add eax, dword [ebp - 0x1610]
mov dword [ebp - 0x764], eax
jne 0x408a4e
mov ecx, dword [ebp - 0x770]
mov dword [ebp - 0x510], ecx
jmp 0x408cc0
mov edx, dword [ebp - 0x764]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x1984], eax
mov ecx, dword [ebp - 0x764]
mov edx, dword [ebp - 0x324]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x1988], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1d10], ecx
mov dword [ebp - 0x768], 0
jmp 0x408aa8
Function at 0x408e1a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test esp, ecx
add byte [eax], al
push edi
xor edi, 0x2a9a
or edi, 0x140dd
add edi, 0xea35
pop edi
push ecx
push ecx
add esp, 4
and ecx, 0x12f07
and ecx, 0xc7af
pop ecx
push eax
push esi
add esp, 4
and eax, 0x8daa
pop eax
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xe
mov dword [ebp - 0x19dc], ecx
lea esp, [esi]
invalid
call dword [edx - 0x15]
invalid
call 0x408d20
add byte [eax + 0x46], al
xor ecx, dword [eax + 0x43]
dec ebp
add esp, 4
call 0x408d33
add byte [ebp + 0x48], cl
push eax
dec ebp
inc ecx
xor al, 0x3e
dec edx
aas
inc edi
add esp, 4
jmp 0x408d3e
pop edx
cmp dword [ebp - 0x3e8], 0
je 0x408d51
cmp dword [ebp - 0xab8], 0
jne 0x408d97
push edi
push edx
add esp, 4
jmp 0x408d5e
add edi, 0x8068
pop edi
push eax
jmp 0x408d6c
pop eax
push ebx
or ebx, 0x5d9c
add ebx, 0x11e88
pop ebx
push eax
or eax, 0x5965
pop eax
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push ebx
and ebx, 0x11e51
or ebx, 0xb1b4
xor ebx, 0x130e3
jmp 0x408dba
pop ebx
push edi
push eax
add esp, 4
or edi, 0x10339
or edi, 0x1921
add edi, 0x4990
pop edi
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push ecx
sub ecx, 0xa757
pop ecx
push eax
push edi
add esp, 4
call 0x408e1a
add byte [edi + 0x40], cl
cmp al, 0x49
dec edi
xor edi, dword [0xc483354e]
add al, 0x81
les eax, [ecx + eax*4]
loopne 0x408e1b
sldt word [eax]
invalid
Function at 0x3f115d09
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 0xc]
cmp cx, 0xffff
jne 0x3f115d2d
mov edx, dword [esi + 0x242e4]
movsx ecx, ax
shl ecx, 7
mov cx, word [ecx + edx + 0x3e]
test cx, cx
jne 0x3f115d45
push eax
mov ecx, esi
call dword [ebp + 0x14]
neg ax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
ret 0x10
movsx eax, word [ebp + 0x10]
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
je 0x3f115db6
cmp word [ebp + 0x10], 0
movzx edi, cx
jne 0x3f115d89
test edi, edi
je 0x3f115db0
mov ecx, dword [esi + 0x242e8]
movzx eax, di
mov eax, dword [ecx + eax*4]
mov ecx, eax
and eax, 0xffff
sar ecx, 0x10
push ecx
mov ecx, esi
mov edi, eax
call dword [ebp + 0x14]
test ax, ax
jne 0x3f115d5d
xor ax, ax
jmp 0x3f115d3f
test edi, edi
je 0x3f115d84
mov ecx, dword [esi + 0x242e8]
movzx eax, di
mov eax, dword [ecx + eax*4]
mov ecx, eax
and eax, 0xffff
sar ecx, 0x10
push ecx
mov ecx, esi
mov edi, eax
call dword [ebp + 0x14]
test ax, ax
je 0x3f115d89
mov ax, 1
jmp 0x3f115d3f
cmp word [ebp + 0x10], 1
jne 0x3f115dd1
movzx eax, cx
mov ecx, dword [esi + 0x242e8]
mov eax, dword [ecx + eax*4]
sar eax, 0x10
jmp 0x3f115d32
push ecx
mov ecx, esi
call fcn.3f105687
jmp 0x3f115d32
Function at 0x3f128a13
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov eax, ecx
shl eax, 2
cmp ecx, 6
jl 0x3f128a5b
add eax, ebx
mov ecx, dword [edi + 0xab8]
mov esi, eax
shl esi, 2
cmp dword [esi + ecx], 0
je 0x3f128a61
mov eax, dword [edi + 0xab8]
pop edi
mov eax, dword [esi + eax]
pop esi
pop ebx
ret 0xc
mov eax, dword [edi + 0xab8]
pop edi
mov eax, dword [esi + eax]
pop esi
pop ebx
ret 0xc
add eax, dword [esp + 0x18]
jmp 0x3f128a2c
add eax, 0x3e8
push 0xa
movzx eax, ax
push eax
push dword [0x3f3d5140]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x3f128a9b
push eax
push dword [0x3f3d5140]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ecx, dword [edi + 0xab8]
mov dword [esi + ecx], eax
jmp 0x3f128a4c
test ebx, ebx
jl 0x3f128a4c
cmp ebx, 2
jg 0x3f3b598b
mov eax, dword [edi + 0xab8]
mov dword [esi + eax], 0x3f128ad0
jmp 0x3f128a4c
cmp ebx, 3
jne 0x3f128a4c
mov eax, dword [edi + 0xab8]
mov dword [esi + eax], 0x3f392d64
jmp 0x3f128a4c

Function at 0x3f23e8ff
Capabilities:
Parse credit card information

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
lea edx, [eax + eax]
mov eax, dword [esp + 0xc]
mov esi, dword [ebx]
add eax, edx
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x3e
je 0x3f23e944
cmp cx, 0x7d
je 0x3f23e944
cmp cx, 0x3a
je 0x3f23e94e
cmp cx, 0x3b
je 0x3f23e94e
cmp cx, 0x38
je 0x3f23e94e
cmp cx, 0x25
je 0x3f23e94e
xor eax, eax
pop esi
pop ebx
ret 0xc
dec esi
je 0x3f23e93d
mov cx, word [eax]
inc eax
inc eax
jmp 0x3f23e925
dec esi
je 0x3f23e93d
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x2d
je 0x3f23e9ba
cmp cx, 0x5e
je 0x3f23e9ba
cmp cx, 0x28
je 0x3f23e9ab
cmp cx, 0x3e
je 0x3f23e9ab
cmp cx, 0x44
je 0x3f23e9ab
cmp cx, 0x49
je 0x3f23e9ab
cmp cx, 0x4f
je 0x3f23e9ab
cmp cx, 0x6f
je 0x3f23e9ab
cmp cx, 0x5c
je 0x3f23e9ab
cmp cx, 0x2f
je 0x3f23e9ab
cmp cx, 0x7c
je 0x3f23e9ab
cmp cx, 0x30
je 0x3f23e9ca
cmp cx, 0x29
jne 0x3f23e93d
cmp word [eax - 4], 0x38
je 0x3f23e93d
sub eax, edx
push 1
sub eax, dword [esp + 0x10]
sar eax, 1
mov dword [ebx], eax
pop eax
jmp 0x3f23e93f
dec esi
test esi, esi
je 0x3f23e93d
mov cx, word [eax]
inc eax
inc eax
jmp 0x3f23e962
cmp word [eax - 4], 0x38
jne 0x3f23e9ab
jmp 0x3f23e99e
Function at 0x3f248818
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push edi
je 0x3f3c5d4c
mov edi, dword [ebp + 0x14]
mov eax, edi
dec edi
test eax, eax
je 0x3f3c5d4c
push esi
mov esi, dword [ebp + 0xc]
movzx eax, si
shr eax, 4
inc eax
push 6
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
test eax, eax
je 0x3f248898
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
je 0x3f248898
and esi, 0xf
movzx ebx, word [eax]
inc eax
mov ecx, esi
inc eax
dec esi
test ecx, ecx
je 0x3f24887a
lea eax, [eax + ebx*2]
jmp 0x3f248869
cmp ebx, edi
jg 0x3f3c5d45
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + ebx]
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x10]
pop esi
and word [eax + ebx*2], 0
mov eax, ebx
pop edi
pop ebx
pop ebp
ret 0x10
mov ebx, edi
jmp 0x3f248882
xor eax, eax
jmp 0x3f2488a3
Function at 0x3f26ab79
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindResourceW]
push 0xa
push 0x3e7
mov esi, ecx
push dword [0x3f3d5140]
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
push dword [0x3f3d5140]
call ebx
mov ebp, dword [sym.imp.KERNEL32.DLL_LockResource]
push eax
call ebp
push 0xa
push 0x3e6
mov dword [esi + 0xab4], eax
push dword [0x3f3d5140]
call edi
push eax
push dword [0x3f3d5140]
call ebx
push eax
call ebp
push 0xa
push 0x3e5
mov dword [esi + 0xab0], eax
push dword [0x3f3d5140]
call edi
push eax
push dword [0x3f3d5140]
call ebx
push eax
call ebp
movzx eax, word [eax]
lea edi, [esi + 0xac0]
push 4
mov dword [edi], eax
shl eax, 2
push eax
call fcn.3f377535
mov dword [esi + 0xab8], eax
mov eax, dword [edi]
shl eax, 1
push eax
call fcn.3f11db93
add esp, 0xc
mov dword [esi + 0xabc], eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x3f36bd69
Capabilities:
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov edi, 0x80
push ebx
push edi
push 3
push ebx
mov esi, SysReAllocString
push 1
push esi
mov dword [eax], ebx
push dword [ebp + 8]
call fcn.3f36bd2c
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x3f3c4b90
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xc]
push eax
push 1
push ebx
push 0x3f36c138
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
je 0x3f3c4bd8
cmp dword [ebp - 4], ebx
jge 0x3f36bde9
push 0x3f36c128
call fcn.3f36be1f
cmp eax, ebx
pop ecx
je 0x3f36bde0
push eax
call fcn.3f36c097
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jl 0x3f3c4c08
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalMemoryStatus]
mov eax, dword [ebp - 0x28]
push dword [ebp + 0xc]
shr eax, 0x14
push dword [ebp - 8]
inc eax
cmp eax, dword [ebp - 4]
jl 0x3f36be18
call fcn.3f36c198
pop edi
pop esi
pop ebx
leave
ret 8
pop edi
pop esi
pop ebx
leave
ret 8
call fcn.3f36ed11
jmp 0x3f36be11
push ebx
push edi
push 3
push ebx
push 1
push esi
push dword [ebp + 8]
call fcn.3f3c60c8
push eax
call fcn.3f36bd2c
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x3f36bd9f
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
test eax, eax
jg 0x3f3c4bc7
call esi
pop edi
pop esi
pop ebx
leave
ret 8
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x3f36be11
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x3f394d5c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
jmp 0x3f36bdc2
mov dword [ebp - 4], 0x100
jmp 0x3f36bde9