joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30158d20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x40
cmp eax, 0x20
jl 0x30158ecd
push ebx
push ebp
mov al, 0xf
mov dl, 0x57
push esi
mov byte [esp + 0x2e], dl
mov byte [esp + 0x30], al
mov byte [esp + 0x38], al
mov byte [esp + 0x43], dl
mov edx, dword [esp + 0x50]
mov byte [esp + 0xc], al
mov al, 0xda
push edi
mov cl, 0x5a
lea esi, [esp + 0x11]
mov edi, edx
mov byte [esp + 0x18], al
mov byte [esp + 0x1b], al
mov ebp, esi
mov byte [esp + 0x39], cl
mov byte [esp + 0x19], cl
xor eax, eax
sub edi, esi
mov byte [esp + 0x30], 0xff
mov byte [esp + 0x31], 0x68
mov byte [esp + 0x33], 0xdb
mov byte [esp + 0x35], 0x47
mov byte [esp + 0x36], 0x5c
mov byte [esp + 0x37], 0xb9
mov byte [esp + 0x38], 0xf4
mov byte [esp + 0x3a], 0x2b
mov byte [esp + 0x3b], 0xb
mov byte [esp + 0x3d], 0xfd
mov byte [esp + 0x3e], 0xc3
mov byte [esp + 0x3f], 0xce
mov byte [esp + 0x40], 0x77
mov byte [esp + 0x41], 0xa0
mov byte [esp + 0x42], 0x27
mov byte [esp + 0x43], 0xe8
mov byte [esp + 0x44], 0x14
mov byte [esp + 0x45], 0x3a
mov byte [esp + 0x46], 0xb2
mov byte [esp + 0x48], 0xc0
mov byte [esp + 0x49], 0x75
mov byte [esp + 0x4a], 0xd9
mov byte [esp + 0x4b], 0xa6
mov byte [esp + 0x4c], 0x6a
mov byte [esp + 0x4d], 0xf6
mov byte [esp + 0x4e], 0xae
mov byte [esp + 0x4f], 0xd7
mov byte [esp + 0x11], 0x86
mov byte [esp + 0x12], 0x95
mov byte [esp + 0x13], 0x91
mov byte [esp + 0x14], 0x8f
mov byte [esp + 0x15], 0x2f
mov byte [esp + 0x16], 0xe2
mov byte [esp + 0x17], 0x51
mov byte [esp + 0x1a], 0xfb
mov byte [esp + 0x1c], 0xd
mov byte [esp + 0x1d], 0x63
mov byte [esp + 0x1e], 0xbd
mov byte [esp + 0x1f], 0x99
mov byte [esp + 0x20], 0x19
mov byte [esp + 0x21], 0x4c
mov byte [esp + 0x22], 0x7a
mov byte [esp + 0x23], 0xc5
mov byte [esp + 0x24], 0x3d
mov byte [esp + 0x25], 0xba
mov byte [esp + 0x26], 0xdd
mov byte [esp + 0x27], 0xfc
mov byte [esp + 0x28], 0x53
mov byte [esp + 0x29], 0xcd
mov byte [esp + 0x2a], 0x3f
mov byte [esp + 0x2b], 0x90
mov byte [esp + 0x2c], 0xa5
mov byte [esp + 0x2d], 0x1d
mov byte [esp + 0x2e], 0x9f
mov byte [esp + 0x2f], 0x79
lea ecx, [edx + 2]
sub ebp, edx
lea ebx, [esp + 0x31]
sub ebx, edx
mov edi, edi
mov dl, byte [esp + eax + 0x10]
xor dl, byte [esp + eax + 0x30]
lea esi, [esp + eax + 0x11]
mov byte [edi + esi], dl
mov dl, byte [esp + eax + 0x31]
xor dl, byte [esi]
add eax, 4
mov byte [ecx - 1], dl
mov dl, byte [esp + eax + 0xe]
xor dl, byte [esp + eax + 0x2e]
add ecx, 4
mov byte [ecx - 4], dl
mov dl, byte [ebx + ecx - 4]
xor dl, byte [ecx + ebp - 4]
cmp eax, 0x20
mov byte [ecx - 3], dl
jl 0x30158e90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x30159f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push edi
mov edi, ecx
mov byte [eax], 0
mov eax, dword [edi]
xor esi, esi
test eax, eax
mov dword [esp + 8], edi
je 0x3015a02e
call fcn.30159df0
mov eax, dword [edi]
test eax, eax
je 0x30159f41
mov byte [eax + 0x18], 0
mov eax, dword [eax]
test eax, eax
jne 0x30159f37
push ebx
push ebp
mov ecx, dword [edi]
test ecx, ecx
je 0x3015a02c
lea ecx, [ecx]
mov al, byte [ecx + 0x18]
test al, al
jne 0x30159f7f
test esi, esi
je 0x30159f7d
fild dword [edi + 0x78]
fild dword [ecx + 0x14]
fild dword [ecx + 0x10]
fdiv st(2)
fdivp st(1)
fild dword [esi + 0x14]
fild dword [esi + 0x10]
fdiv st(3)
fdivp st(1)
fcompp
fnstsw ax
fstp st(0)
test ah, 0x41
jne 0x30159f7f
mov esi, ecx
mov ecx, dword [ecx]
test ecx, ecx
jne 0x30159f50
test esi, esi
je 0x3015a02c
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x30159ff2
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ebp, [esi + 0x3c]
push ebp
lea ecx, [esi + 0x38]
push ecx
push edx
push eax
call dword [esi + 4]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x30159fc9
lea edi, [esi + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov byte [esi + 0x1a], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [esp + 0x10]
test ebx, ebx
mov dword [esi + 0x34], ebx
je 0x30159fe0
mov ecx, dword [esp + 0x18]
mov byte [ecx], 1
mov edx, dword [edi + 0xa0]
sub dword [ebp], edx
mov eax, dword [esi + 0x34]
test eax, eax
jne 0x30159ff2
mov byte [esi + 0x18], 1
xor esi, esi
jmp 0x30159f43
inc dword [esi + 0x14]
mov eax, dword [edi]
test eax, eax
je 0x3015a013
mov ecx, dword [edi + 0x74]
movsx ecx, byte [ecx + edi + 0x10]
cmp dword [eax + 0x44], ecx
je 0x3015a010
mov eax, dword [eax]
test eax, eax
jne 0x3015a003
jmp 0x3015a013
dec dword [eax + 0x14]
mov edx, dword [edi + 0x74]
mov al, byte [esi + 0x44]
mov byte [edx + edi + 0x10], al
mov eax, dword [edi + 0x74]
inc eax
cdq
mov ecx, 0x64
idiv ecx
mov dword [edi + 0x74], edx
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret 4
Function at 0x30163080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebx, eax
mov eax, dword [esp + 0x10]
cmp eax, 3
mov ecx, 0x9e3779b9
push edi
mov ebp, eax
mov edi, ecx
mov esi, edx
jb 0x30163121
mov eax, 0xaaaaaaab
mul ebp
shr edx, 1
add ecx, dword [ebx + 4]
add esi, dword [ebx + 8]
mov eax, dword [ebx]
sub eax, esi
sub eax, ecx
add eax, edi
sub ecx, esi
mov edi, esi
shr edi, 0xd
xor eax, edi
sub ecx, eax
mov edi, eax
shl edi, 8
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 0xd
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 0xc
xor eax, edi
sub ecx, esi
sub ecx, eax
mov edi, eax
shl edi, 0x10
xor ecx, edi
sub esi, ecx
sub esi, eax
mov edi, ecx
shr edi, 5
xor esi, edi
sub eax, esi
sub eax, ecx
mov edi, esi
shr edi, 3
xor eax, edi
sub ecx, esi
mov edi, eax
shl eax, 0xa
sub ecx, edi
xor ecx, eax
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 0xf
xor esi, eax
add ebx, 0xc
sub ebp, 3
dec edx
jne 0x301630a7
mov eax, dword [esp + 0x14]
add esi, eax
dec ebp
je 0x3016312c
dec ebp
jne 0x3016312e
add ecx, dword [ebx + 4]
add edi, dword [ebx]
sub edi, esi
sub edi, ecx
sub ecx, esi
mov edx, esi
shr edx, 0xd
xor edi, edx
sub ecx, edi
mov eax, edi
shl eax, 8
xor ecx, eax
sub esi, ecx
sub esi, edi
mov edx, ecx
shr edx, 0xd
xor esi, edx
sub edi, esi
sub edi, ecx
mov eax, esi
shr eax, 0xc
xor edi, eax
sub ecx, esi
sub ecx, edi
mov edx, edi
shl edx, 0x10
xor ecx, edx
sub esi, ecx
mov eax, ecx
sub esi, edi
shr eax, 5
xor esi, eax
mov eax, esi
sub edi, eax
sub edi, ecx
mov edx, eax
shr edx, 3
xor edi, edx
sub ecx, eax
mov edx, edi
sub ecx, edi
shl edx, 0xa
xor ecx, edx
sub eax, ecx
sub eax, edi
pop edi
pop esi
shr ecx, 0xf
pop ebp
xor eax, ecx
pop ebx
ret
Function at 0x30163650
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x3016376d
push ebx
mov ebx, dword [edi + 0x20]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push ebx
mov edx, 0x12311998
mov eax, ebp
call fcn.30163080
and eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x30]
mov esi, dword [ecx + eax*8]
add esp, 4
test esi, esi
je 0x3016376a
xor eax, eax
test ebx, ebx
lea ecx, [esi + 0x14]
jbe 0x301636a1
mov edx, dword [ecx]
add ecx, 4
cmp edx, dword [ebp + eax*4]
jne 0x301636f6
inc eax
cmp eax, ebx
jb 0x30163691
cmp dword [edi + 0x34], esi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
jne 0x301636af
mov dword [edi + 0x34], eax
cmp dword [edi + 0x38], esi
jne 0x301636b7
mov dword [edi + 0x38], ecx
test eax, eax
je 0x301636be
mov dword [eax + 0xc], ecx
test ecx, ecx
je 0x301636c5
mov dword [ecx + 8], eax
mov eax, dword [esi]
test eax, eax
je 0x301636d1
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x301636dc
mov edx, dword [esi]
mov dword [eax], edx
mov ecx, dword [edi + 0x18]
test ecx, ecx
mov eax, dword [esi + 0x10]
mov ebx, dword [esp + 0x14]
jne 0x30163701
push eax
push ebx
call fcn.3015d050
add esp, 8
jmp 0x30163723
mov esi, dword [esi]
test esi, esi
jne 0x30163688
pop esi
pop ebp
pop ebx
pop edi
ret
mov cx, word [eax]
movzx edx, word [eax + 4]
neg cx
sbb ecx, ecx
and ecx, 3
inc ecx
imul ecx, edx
movzx edx, word [eax + 2]
movzx eax, word [eax + 6]
imul ecx, edx
lea eax, [ecx + eax*4 + 0x14]
mov ecx, dword [edi + 0x2c]
mov ebp, dword [edi + 4]
mov edx, dword [edi + 0xc]
add ecx, eax
sub ebp, ecx
mov ecx, dword [edi + 0x18]
dec edx
test ecx, ecx
mov dword [edi + 4], ebp
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0x10]
push eax
push ebx
jne 0x30163759
call fcn.30059fa0
add esp, 8
push esi
call fcn.30208320
add esp, 4
pop esi
pop ebp
pop ebx
pop edi
ret
call fcn.30163060
add esp, 8
push esi
call fcn.30208320
add esp, 4
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x30170360
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0xa8
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x18]
mov esi, dword [eax + 0x10]
mov al, byte [esi + 0x1b1c]
xor ebx, ebx
test al, al
mov dword [ebp + 0x4c], edi
mov byte [ebp + 0x63], 0
mov dword [ebp + 0x48], esi
jne 0x301703b9
mov eax, dword [esi + 0x1840]
cmp eax, ebx
je 0x301703b9
mov cl, byte [eax + 0x974]
test cl, cl
jne 0x301703b9
mov cl, byte [eax + 0x975]
test cl, cl
jne 0x301703b9
cmp esi, dword [eax + 0x24]
jne 0x301703b9
mov eax, 1
jmp 0x301703bb
xor eax, eax
test al, al
je 0x301704a6
push str._focusEvent_
push esi
lea ecx, [ebp - 0x44]
call fcn.301c7701
mov eax, dword [esi + 8]
push ebx
lea ecx, [ebp + 0x50]
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], eax
call fcn.3016e590
mov edx, dword [ebp + 0x6c]
lea ecx, [ebp + 0x50]
push ecx
push ebx
push edx
mov ecx, edi
call fcn.3016f660
test al, al
je 0x30170518
mov eax, dword [ebp + 0x44]
and eax, 0xfffffff0
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0x44], eax
call fcn.301c5f6e
mov eax, dword [ebp + 0x44]
and eax, 0xfffffff2
lea ecx, [ebp - 4]
or eax, 2
push ebx
push ecx
mov dword [ebp + 0x44], eax
call fcn.301c609d
mov esi, dword [ebp + 0x48]
mov edi, dword [esi + 0x17c4]
add esp, 8
cmp eax, ebx
jne 0x30170500
mov edx, dword [esi + 0x1b5c]
mov eax, dword [edx + 0x2a8]
cmp eax, ebx
jne 0x3017045c
push 0xaa
mov ecx, esi
call fcn.3018a8f0
mov ebx, dword [ebp + 0x4c]
push eax
mov eax, ebx
or eax, 1
push eax
mov ecx, esi
call fcn.301c29a7
test al, al
je 0x3017048e
mov edi, dword [ebp + 0x78]
test edi, edi
je 0x301704b4
mov ecx, edi
or ecx, 1
push 0xaa
push ecx
mov ecx, esi
call fcn.3000ece0
test al, al
jne 0x301704b4
lea ecx, [ebp - 0x10]
call fcn.301c5fbe
lea ecx, [ebp + 0x50]
call fcn.301671a0
lea ecx, [ebp - 0x44]
call fcn.301c7748
xor al, al
pop edi
pop esi
pop ebx
add ebp, 0x64
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [esi + 0x1840]
mov edx, dword [ecx]
call dword [edx + 0x3c]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0x7c]
push ecx
movzx ecx, byte [ebp + 0x70]
test ax, ax
setl al
movzx edx, al
movzx eax, byte [ebp + 0x74]
push edx
mov edx, dword [ebp + 0x6c]
push edi
push eax
push ecx
push edx
push str.Sbbobi
push 0x72
lea eax, [ebp + 0x63]
push eax
lea ecx, [ebp + 0x50]
push ecx
push ebx
call fcn.30170150
add esp, 0x2c
xor ebx, ebx
jmp 0x30170510
lea ecx, [ebp - 0x10]
call fcn.301c5ff0
push edi
mov ecx, esi
call fcn.3018a130
lea ecx, [ebp - 0x10]
call fcn.301c5fbe
mov ecx, dword [ebp + 0x5c]
cmp ecx, ebx
je 0x3017052a
mov edx, dword [ebp + 0x50]
push edx
call fcn.302095c0
jmp 0x30170536
mov eax, dword [ebp + 0x50]
push eax
call fcn.30208320
add esp, 4
lea ecx, [ebp - 0x44]
mov dword [ebp + 0x50], ebx
call fcn.301c7748
mov al, byte [ebp + 0x63]
pop edi
pop esi
pop ebx
add ebp, 0x64
mov esp, ebp
pop ebp
ret 0x14
Function at 0x301bb0d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x2c]
add edx, edx
add esi, esi
test ecx, ecx
mov dword [esp + 0xc], edx
jle 0x301bb269
mov eax, dword [esp + 0x28]
sub eax, edx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x24]
sub eax, edx
mov edx, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x34], eax
push ebp
mov eax, ebx
sub eax, esi
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x28]
lea edx, [edx + eax*4]
mov ebp, edi
sub ebp, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x48]
add eax, ecx
lea eax, [edx + eax*4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
jmp 0x301bb141
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [edx*4 + 0x302c4060]
lea eax, [edi + esi*2]
push eax
lea edx, [esi + edi]
push edx
push edi
push ebp
mov dword [esp + 0x30], ecx
call fcn.301bad20
lea eax, [edi + esi*2 + 0x10]
push eax
lea ecx, [esi + edi + 0x10]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [edi + 0x10]
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.301bad20
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
lea eax, [ebx + esi*2]
push eax
add ebp, 0x20
lea ecx, [esi + ebx]
push ecx
mov dword [esp + 0x48], ebp
mov ebp, dword [edx*4 + 0x302c4060]
mov edx, dword [esp + 0x60]
push ebx
push edx
mov ecx, ebp
add edi, 0x20
call fcn.301bad20
lea eax, [ebx + esi*2 + 0x10]
push eax
mov eax, dword [esp + 0x6c]
lea ecx, [esi + ebx + 0x10]
push ecx
lea edx, [ebx + 0x10]
push edx
add eax, 0x10
push eax
mov ecx, ebp
call fcn.301bad20
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x58]
add eax, 0x20
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x70]
lea edx, [eax + ecx*2]
add esp, 0x40
push edx
add ecx, eax
push ecx
push eax
mov eax, dword [esp + 0x48]
push eax
mov ecx, ebp
add ebx, 0x20
call fcn.301bad20
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x28]
lea edx, [eax + ecx*2]
push edx
add ecx, eax
push ecx
push eax
mov eax, dword [esp + 0x6c]
push eax
mov ecx, ebp
call fcn.301bad20
mov ebp, dword [esp + 0x50]
mov edx, dword [esp + 0x5c]
mov eax, 0x10
add ebp, eax
add esp, 0x20
mov dword [esp + 0x30], ebp
add edx, eax
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x50]
add ecx, eax
add ebp, eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x14]
mov eax, 4
add edx, eax
add ecx, eax
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x50], ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
jne 0x301bb13d
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret
Function at 0x301bc750
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ebx, edx
shl edi, 0xe
add edi, 0x303799f0
lea esi, [ebx + 4]
mov dword [esp + 0x10], 0
lea ecx, [eax + 8]
sub ebx, eax
mov dword [esp + 0x14], 0x10
lea esp, [esp]
mov eax, dword [ecx - 8]
mov edx, dword [edi + eax*4]
mov dword [esi - 4], edx
mov eax, dword [ecx - 4]
mov edx, dword [edi + eax*4]
mov dword [esi], edx
mov eax, dword [ecx]
mov edx, dword [edi + eax*4]
mov dword [ebx + ecx], edx
mov eax, dword [ecx + 4]
mov eax, dword [edi + eax*4]
mov dword [esi + 8], eax
cdq
mov ebp, eax
mov eax, dword [ebx + ecx]
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [esi]
cdq
xor eax, edx
sub eax, edx
add ebp, eax
mov eax, dword [esi - 4]
cdq
xor eax, edx
sub eax, edx
add eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add eax, ebp
add ecx, 0x10
add esi, 0x10
dec edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jne 0x301bc780
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x301be6f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
push edi
push esi
xor ebx, ebx
call dword [0x303f9a14]
mov ecx, eax
add ecx, 0x20
add esp, 8
sar ecx, 6
mov dword [esp + 0xc], 2
movzx eax, byte [esi + 7]
sub eax, ecx
cdq
mov ebp, eax
xor ebp, edx
movzx eax, byte [esi + 6]
sub eax, ecx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 5]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 4]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 3]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 1]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add eax, ebx
lea ebx, [eax + ebp]
movzx eax, byte [esi + edi + 7]
sub eax, ecx
cdq
mov ebp, eax
movzx eax, byte [esi + edi + 6]
add esi, edi
sub eax, ecx
xor ebp, edx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 5]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 4]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 3]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 1]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add eax, ebx
lea ebx, [eax + ebp]
movzx eax, byte [esi + edi + 7]
sub eax, ecx
cdq
mov ebp, eax
movzx eax, byte [esi + edi + 6]
sub eax, ecx
xor ebp, edx
add esi, edi
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 5]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 4]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 3]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 1]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add eax, ebx
lea ebx, [eax + ebp]
movzx eax, byte [esi + edi + 7]
add esi, edi
sub eax, ecx
cdq
mov ebp, eax
movzx eax, byte [esi + 6]
xor ebp, edx
sub eax, ecx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 5]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 4]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 3]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi + 1]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
movzx eax, byte [esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add eax, ebx
lea ebx, [eax + ebp]
mov eax, dword [esp + 0xc]
add esi, edi
dec eax
mov dword [esp + 0xc], eax
jne 0x301be713
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x301bf4f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
mov eax, 2
sub eax, edi
mov dword [esp + 0xc], eax
mov eax, 3
sub eax, edi
mov dword [esp + 0x10], eax
mov eax, 4
sub eax, edi
mov dword [esp + 0x14], eax
mov eax, 5
sub eax, edi
mov dword [esp + 0x18], eax
mov eax, 7
sub eax, edi
mov dword [esp + 0x24], eax
mov ebp, 1
mov eax, 6
sub ebp, edi
mov ebx, ecx
sub eax, edi
lea ecx, [ebx + edi + 1]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 8
nop
movzx edx, byte [ebx + 1]
movzx eax, byte [ecx - 1]
add eax, edx
movzx edx, byte [ecx]
add eax, edx
movzx edx, byte [ebx]
lea eax, [eax + edx + 2]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov byte [esi], al
movzx edx, byte [ecx]
movzx eax, byte [ebx + 1]
add eax, edx
movzx edx, byte [ecx + ebp]
add eax, edx
movzx edx, byte [ecx + 1]
lea eax, [eax + edx + 2]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov byte [esi + 1], al
mov eax, dword [esp + 0xc]
movzx edx, byte [ecx + eax]
movzx eax, byte [ecx + 2]
add edx, eax
movzx eax, byte [ecx + ebp]
add edx, eax
movzx eax, byte [ecx + 1]
lea eax, [edx + eax + 2]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov byte [esi + 2], al
movzx edx, byte [ecx + 3]
mov eax, dword [esp + 0xc]
movzx eax, byte [ecx + eax]
add edx, eax
movzx eax, byte [ecx + 2]
add edx, eax
mov eax, dword [esp + 0x10]
movzx eax, byte [ecx + eax]
lea eax, [edx + eax + 2]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov byte [esi + 3], al
movzx edx, byte [ecx + 3]
mov eax, dword [esp + 0x14]
movzx eax, byte [ecx + eax]
add edx, eax
movzx eax, byte [ecx + 4]
add edx, eax
mov eax, dword [esp + 0x10]
movzx eax, byte [ecx + eax]
lea eax, [edx + eax + 2]
cdq
and edx, 3
add eax, edx
mov edx, dword [esp + 0x18]
sar eax, 2
mov byte [esi + 4], al
movzx eax, byte [ecx + edx]
movzx edx, byte [ecx + 5]
add eax, edx
mov edx, dword [esp + 0x14]
movzx edx, byte [ecx + edx]
add eax, edx
movzx edx, byte [ecx + 4]
lea eax, [eax + edx + 2]
cdq
and edx, 3
add eax, edx
mov edx, dword [esp + 0x18]
sar eax, 2
mov byte [esi + 5], al
movzx eax, byte [ecx + 6]
movzx edx, byte [ecx + edx]
add eax, edx
movzx edx, byte [ecx + 5]
add eax, edx
mov edx, dword [esp + 0x1c]
movzx edx, byte [ecx + edx]
lea eax, [eax + edx + 2]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov byte [esi + 6], al
mov eax, dword [esp + 0x24]
movzx edx, byte [ecx + eax]
movzx eax, byte [ecx + 7]
add edx, eax
movzx eax, byte [ecx + 6]
add edx, eax
mov eax, dword [esp + 0x1c]
movzx eax, byte [ecx + eax]
lea eax, [edx + eax + 2]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov byte [esi + 7], al
mov eax, dword [esp + 0x20]
add ebx, edi
add ecx, edi
add esi, edi
dec eax
mov dword [esp + 0x20], eax
jne 0x301bf550
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x301c16cf
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
je 0x301c16f3
mov ecx, dword [esp + 4]
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, word [ecx]
xor eax, esi
inc ecx
inc ecx
dec edx
jne 0x301c16de
pop esi
ret
Function at 0x301d1ce5
Capabilities:
Parse credit card information

Disassembly:
jmp 0x301d1d7f
cmp ecx, 0x4f
jne 0x301d1cfc
xor ecx, ecx
mov ch, byte [eax + 1]
mov cl, byte [eax + 2]
jmp 0x301d1d7d
cmp ecx, 0x5e
jne 0x301d1d18
xor ecx, ecx
mov ch, byte [eax + 3]
mov cl, byte [eax + 4]
cmp ecx, dword [esp + 8]
je 0x301d1d8c
movzx ecx, byte [0x302e001e]
jmp 0x301d1d7d
cmp ecx, 0x38
jl 0x301d1d45
cmp ecx, 0x3d
jle 0x301d1d36
cmp ecx, 0x40
jle 0x301d1d31
cmp ecx, 0x43
jle 0x301d1d36
cmp ecx, 0x44
jne 0x301d1d45
mov dl, byte [eax + 3]
jmp 0x301d1d39
mov dl, byte [eax + 1]
cmp dl, 0xf
je 0x301d1d43
cmp dl, 0xe
jne 0x301d1d45
inc eax
inc eax
movzx edx, byte [ecx + 0x302dffc0]
add eax, edx
cmp dword [esp + 4], 0
je 0x301d1d7f
cmp ecx, 0x1b
jl 0x301d1d7f
cmp ecx, 0x1c
jle 0x301d1d69
cmp ecx, 0x1d
jle 0x301d1d7f
cmp ecx, 0x2a
jg 0x301d1d7f
xor ecx, ecx
mov cl, byte [eax - 1]
cmp cl, 0xc0
jb 0x301d1d7f
and ecx, 0x3f
movzx ecx, byte [ecx + 0x302e0080]
add eax, ecx
movzx ecx, byte [eax]
test ecx, ecx
jne 0x301d1cea
xor eax, eax
ret