joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4d6f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x24]
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x18], cl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0
push ecx
call fcn.00788f0b
push eax
call fcn.00738729

Function at 0x402d3a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
cmovne ebp, edx
jmp fcn.006f142b

Function at 0x4476a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x4476b5
xor eax, eax
jmp 0x44772a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x4476e2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x447725
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x447723
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x44771f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x447723
xor eax, eax
jmp 0x44772a
jmp 0x4476d9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x448180
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00446a00
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x4def38], 0
jne 0x4481bd
cmp dword [0x4def34], 0
je 0x4481bd
mov eax, dword [0x4def34]
mov dword [0x4def38], eax
cmp dword [0x4def38], 0
je 0x44823a
mov ecx, dword [0x4def38]
cmp dword [ecx + 8], 0
je 0x44823a
mov edx, dword [0x4def38]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x44823a
mov ecx, dword [0x4def38]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x44823a
mov eax, dword [0x4def38]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x448209
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x448210
xor eax, eax
jmp 0x44835d
mov ecx, dword [0x4def38]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00431890
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x44835d
mov edx, dword [0x4def34]
mov dword [0x4def38], edx
jmp 0x448256
mov eax, dword [0x4def38]
mov ecx, dword [eax + 4]
mov dword [0x4def38], ecx
cmp dword [0x4def38], 0
je 0x448296
cmp dword [0x4def38], 0
je 0x448294
mov edx, dword [0x4def38]
cmp dword [edx + 8], 0
je 0x448294
mov eax, dword [0x4def38]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x448294
mov edx, dword [0x4def38]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x448294
jmp 0x4481ee
jmp 0x448248
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00446ae0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44835b
mov eax, dword [ebp - 4]
mov dword [0x4def38], eax
mov ecx, dword [0x4def38]
mov dword [ecx], 0x52727464
mov edx, dword [0x4def38]
mov dword [edx + 8], 0
mov eax, dword [0x4def38]
mov ecx, dword [0x4def34]
mov dword [eax + 4], ecx
mov edx, dword [0x4def38]
mov dword [0x4def34], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x4def38]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x448327
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x44834b
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x44831e
mov eax, dword [0x4def38]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x4481ee
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x481530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x481549
mov esi, edi
mov edi, eax
jmp 0x48154b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x48155b
mov eax, ebx
jmp 0x481565
push eax
push ebx
call fcn.00449810
add esp, 8
test eax, eax
jne 0x48156d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x481589
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x481574
cmp eax, dword [esi + 4]
jge 0x4815a0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x481590
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x4815c1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x4815be
dec eax
test eax, eax
jg 0x4815b0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x498ef0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00498c60
Function at 0x49c960
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x49c980
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x49eef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x49f0ad
call fcn.0049ef06
Function at 0x673fa1
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x742ce2
mov byte [ebp - 0x1c], 0
call edi
test esi, esi
jne 0x715856
pop edi
rcr cl, 0xa
sbb bx, 0x2e66
pop esi
cmc
rcr bx, cl
xor eax, eax
not cl
cmc
bsf bx, ax
pop ebx
ror cx, 0x25
add cx, sp
sub cx, 0x58e0
mov ecx, dword [ebp - 4]
cmp bh, 0xb
jmp 0x7abc01
push edx
push esi
mov byte [ebp - 0xdc], 0x4e
jmp 0x66572f
mov bl, 0x65
movsx esi, bx
bswap esi
push ecx
movsx esi, di
mov esi, eax
jmp 0x563de8
mov byte [ebp - 0x28], 0x6b
jmp 0x67a930
mov dword [ebp - 4], eax
jmp 0x622691
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0
jmp 0x814fc0
push esi
jmp 0x785c39
push ebx
jmp 0x610bdd
mov byte [ebp - 0xd9], 0x6e
jmp 0x67b922
mov byte [ebp - 0x1f], 0x64
jmp 0x79deff
mov byte [ebp - 0xdb], 0x74
jmp 0x6c3af1
push ebp
mov ebp, esp
rol al, 0x38
lea esp, [esp - 0x148]
xadd al, al
mov eax, dword [0x4d6f40]
cmp bh, bl
xor eax, ebp
jmp 0x5b5a96
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x6e
jmp 0x6c8931
mov byte [ebp - 0xd8], 0x6d
jmp 0x406462
mov byte [ebp - 0x22], 0x33
jmp 0x724814
mov byte [ebp - 0xda], 0x55
jmp 0x62e1e7
mov byte [ebp - 0x14], 0x6c
jmp 0x7c2bfd
mov byte [ebp - 0x24], bl
jmp 0x740463
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x6c
jmp 0x6c6711
mov byte [ebp - 0x12], 0x64
jmp 0x7828b5
test eax, eax
jmp 0x777c18
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x2e
jmp 0x62fbd7
mov byte [ebp - 0x23], 0x6c
jmp 0x6ae11f
mov byte [ebp - 0x18], 0x6e
jmp 0x7c3228
je 0x5422d3
call 0x59f425
lea edx, [ebp - 0xdc]
jmp 0x54664f
call 0x7c63ed
lea eax, [ebp - 0x18]
jmp 0x53b16b
mov byte [ebp - 0x11], 0x6c
jmp 0x6104df
push edi
jmp 0x779d1d
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x6c
jmp 0x5422c5
xor ecx, ebp
call fcn.0042d5e7
mov esp, ebp
xchg ebp, ebp
pop ebp
ret
mov byte [ebp - 0x13], 0x2e
jmp 0x706d7f
mov byte [ebp - 0x17], 0x74
jmp 0x6cccce
call edi
lea ecx, [ebp - 0x28]
mov bl, 0xdb
jmp 0x54a801
Function at 0x77d404
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lahf
cwde
setg al
push edx
rdtsc
cbw
push ebx
cmovne dx, dx
push ecx
movzx ax, bh
lahf
pushfd
push edi
adc di, bp
xor bl, cl
push ebp
movzx eax, ax
cdq
push esi
mov eax, 0
push eax
shrd edx, edi, 0xac
mov ebp, dword [esp + 0x28]
bsf edi, ecx
xor si, 0x6939
xor ebp, 0x242557cf
dec edi
rcl edi, 0xd1
neg ebp
neg bh
xor bx, 0x4d43
bswap ebp
xor dl, 0x9d
inc dx
sub ebp, 0x67476371
add ebp, eax
mov esi, esp
btr di, 0xee
add bl, 0x60
cbw
lea esp, [esp - 0xc0]
neg bh
mov ebx, ebp
btc edi, ecx
rdtsc
inc al
mov eax, 0
bt edx, edx
btr edx, edx
sub ebx, eax
lea edi, [0x77d48b]
lea ebp, [ebp - 4]
movzx edx, cx
btc edx, edi
mov edx, dword [ebp]
xor edx, ebx
jmp 0x786a46
sub edx, 0x4bdf4d67
rol edx, 2
clc
cmc
xor edx, 0x2f7e23ca
cmc
stc
rol edx, 1
xor ebx, edx
cmp bp, dx
add edi, edx
jmp 0x7d6afa
push edi
ret
Function at 0x7a0675
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x98], 0x43
jmp 0x5e1be4
mov byte [esp + 0x9f], 0x6e
mov byte [esp + 0xa0], 0x67
jmp 0x71b1bb
mov byte [esp + 0xd2], al
mov al, 0x65
jmp 0x7d6116
mov byte [esp + 0x1bf], 0x6c
jmp 0x806af5
mov byte [esp + 0x11b], 0x6d
jmp 0x7325b1
mov byte [esp + 0x99], 0x68
mov byte [esp + 0x9a], al
jmp 0x72fb79
mov byte [esp + 0x33], al
jmp 0x66abf6
mov byte [esp + 0x114], 0x6f
jmp 0x7d3278
mov byte [esp + 0xc2], 0x6e
jmp 0x7408df
mov byte [esp + 0x118], 0x66
jmp 0x79dff9
mov byte [esp + 0xd9], 0x62
mov byte [esp + 0xdc], cl
jmp 0x6c8451
mov byte [esp + 0x3a], 0x62
jmp 0x719354
mov byte [esp + 0xc1], 0x69
jmp 0x62f1b8
mov byte [esp + 0x1c4], cl
jmp 0x7ad20e
mov byte [esp + 0x9d], 0x20
jmp 0x6c3ae4
mov byte [esp + 0x10e], al
jmp 0x7708f0
mov byte [esp + 0x1c6], 0x67
jmp loc.00401915
mov byte [esp + 0x9e], 0x45
jmp 0x5444b5
mov byte [esp + 0xdd], 0x70
mov byte [esp + 0xde], 0x70
jmp 0x70f9c7
mov byte [esp + 0x1c1], al
jmp 0x77dcfe
mov byte [esp + 0xdf], bl
jmp 0x73947d
mov byte [esp + 0x3c], bl
jmp 0x62c650
mov byte [esp + 0xa1], 0x69
mov byte [esp + 0xa2], 0x6e
mov byte [esp + 0xa3], al
mov byte [esp + 0xa4], bl
jmp 0x71c732
mov byte [esp + 0x1bc], 0x54
mov byte [esp + 0x1bd], 0x56
jmp 0x76afe9
mov byte [esp + 0x9b], cl
jmp 0x78adb1
mov byte [esp + 0x11c], bl
mov byte [esp + 0xd8], 0x6f
jmp 0x6374a2
mov byte [esp + 0x30], cl
jmp 0x614311
mov byte [esp + 0xc0], 0x57
jmp 0x638ec7
mov byte [esp + 0xc3], 0x64
jmp 0x75de69
mov byte [esp + 0xc4], 0x6f
jmp 0x79cf14
mov byte [esp + 0x1be], cl
jmp 0x5a22a8
mov byte [esp + 0x10f], cl
jmp 0x5866a1
mov byte [esp + 0x1c2], 0x43
mov byte [esp + 0x1c3], 0x68
jmp 0x658266
mov byte [esp + 0x9c], 0x74
jmp 0x662d80
mov byte [esp + 0xc5], 0x77
mov byte [esp + 0xc6], bl
jmp 0x53353d
mov byte [esp + 0x119], 0x6f
jmp 0x7ceabb
push ebp
cmp di, dx
rcl bp, 0xc5
mov ebp, esp
and esp, 0xfffffff8
rcl dl, cl
lea esp, [esp - 0x4fc]
shl cl, cl
mov eax, dword [0x4d6f40]
rol cl, cl
xor eax, esp
mov dword [esp + 0x4f8], eax
mov cl, 0x5f
mov al, 0x6a
and dl, 0x55
push ebx
ror dl, 0xa1
sub ebx, ebx
mov dl, 0x72
jmp 0x738739
mov byte [esp + 0x1c5], 0x6e
jmp 0x6bce88
mov cl, 0x61
push esi
push edi
mov byte [esp + 0x39], 0x6f
jmp 0x637503
mov byte [esp + 0x11a], dl
jmp 0x5bd72d
mov byte [esp + 0x115], 0x62
jmp 0x630caf
mov byte [esp + 0xd3], cl
jmp 0x7b678f
mov byte [esp + 0x1c0], 0x75
jmp 0x7054b2
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219
Function at 0x40890b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x4085d8
add eax, 1
call fcn.00408932
xor dword [edx], esi
dec ecx
sub eax, ecx
inc edx
cmp edx, edi
jne fcn.0040890b
and ecx, eax
and ecx, eax
ret
Function at 0x406e73
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov ecx, 0x811c9dc5
cmp dword [ebp + 8], esi
jbe 0x406e96
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, dword [ebp + 8]
jb 0x406e84
mov eax, ecx
pop esi
leave
ret

Function at 0x408259
Capabilities:
Accept command line arguments

Disassembly:
push 0xfc
mov eax, 0x4160d2
call fcn.00415a6d
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x108]
sub esp, 0xc
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], eax
push edx
call fcn.00409cba
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 4]
test byte [ebp + ecx - 0xfc], 6
je 0x4082a4
and dword [edi], 0
jmp 0x40839d
push 0x34
call fcn.00414cab
mov esi, eax
pop ecx
mov dword [ebp - 0x2c], esi
push 0
mov ecx, esi
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::codecvt_unsigned_short_int__char__struct__Mbstatet_::constructor_unsigned_int_]
mov dword [esi], 0x401810
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 4]
add ecx, eax
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::locale___thiscall_std::ios_base::getloc_void_]
push esi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.0040b2f1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.00407310
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
mov eax, dword [eax + 4]
add ecx, eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::locale___thiscall_std::basic_ios_unsigned_short_int__struct_std::char_traits_unsigned_short_int__::imbue_class_std::locale_const__]
lea ecx, [ebp - 0x38]
call fcn.00407310
xor eax, eax
mov byte [ebp - 0x3c], 1
mov word [ebp - 0x3a], ax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], 7
mov eax, dword [ebp + eax - 0xd0]
test eax, eax
sete byte [ebp - 0x34]
xor edx, edx
mov byte [ebp - 0x2c], dl
xor ecx, ecx
push dword [ebp - 0x2c]
mov word [ebp - 0x32], cx
push dword [ebp - 0x3c]
mov word [ebp - 0x28], cx
lea ecx, [ebp - 0x28]
push edx
push dword [ebp - 0x34]
mov dword [ebp - 0x18], edx
push eax
call fcn.0040c2b6
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
jb 0x408381
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x30]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ecx, [ebp - 0x28]
mov dword [edi], eax
call fcn.004048db
lea ecx, [ebp - 0x48]
call fcn.00407310
lea ecx, [ebp - 0x98]
call fcn.00409c8a
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_unsigned_short_int__struct_std::char_traits_unsigned_short_int__::destructor_void_]
mov eax, edi
call fcn.00415a17
ret
Function at 0x40a5c7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x40a61f
cmp byte [esi + 0x3d], bl
je 0x40a61f
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40a659
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x40a630
sub eax, 1
je 0x40a633
dec eax
sub eax, 1
jne 0x40a659
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414c9a
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a651
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40a659
cmp byte [esi + 0x3d], bl
sete al
jmp 0x40a621
xor al, al
jmp 0x40a621

Function at 0x40a822
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x40a87e
cmp byte [esi + 0x3e], bl
je 0x40a87e
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
cmp di, ax
je 0x40a8b8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_unsigned_short_int__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x40a88f
sub eax, 1
je 0x40a892
dec eax
sub eax, 1
jne 0x40a8b8
mov byte [esi + 0x3e], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414c9a
leave
ret
mov byte [esi + 0x3e], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a8b0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40a8b8
cmp byte [esi + 0x3e], bl
sete al
jmp 0x40a880
xor al, al
jmp 0x40a880
Function at 0x40ccef
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x40ce85
mov edx, 0x10000000
cmp eax, 0x7c
je 0x40ce85
cmp eax, 0x29
jne 0x40cd28
cmp dword [esi + 0x10], 0
jne 0x40ce85
test dword [esi + 0x50], edx
je 0x40ce8b
cmp eax, 0x2e
jne 0x40cd43
push 5
lea ecx, [esi + 0x24]
call fcn.0040cf55
mov ecx, esi
call fcn.0040ccc7
jmp 0x40ce6f
cmp eax, 0x5c
jne 0x40cd95
mov ecx, esi
call fcn.0040ccc7
test byte [esi + 0x50], 0x80
je 0x40cd89
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x40cd72
push 4
lea ecx, [esi + 0x24]
call fcn.0040cf55
mov ecx, esi
call fcn.0040ccc7
jmp 0x40ce76
cmp al, 0x42
jne 0x40cd89
push 4
lea ecx, [esi + 0x24]
call fcn.0040cf55
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x40cd66
mov ecx, esi
call fcn.0040d27e
jmp 0x40ce6f
cmp eax, 0x5b
jne 0x40cdf8
mov ecx, esi
call fcn.0040ccc7
lea ecx, [esi + 0x24]
call fcn.0040e19e
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x40cdc2
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.0040ccc7
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x40cde0
cmp eax, 0x5d
jne 0x40cde0
push eax
lea ecx, [esi + 0x24]
call fcn.0040e1e8
mov ecx, esi
call fcn.0040ccc7
mov ecx, esi
call fcn.0040defd
cmp dword [esi + 0x4c], 0x5d
je 0x40cd37
push 4
jmp 0x40ce8d
cmp eax, 0x28
jne 0x40ce15
mov ecx, esi
call fcn.0040ccc7
mov ecx, esi
call fcn.0040d357
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x40ce8b
jmp 0x40ce64
cmp eax, 0x5e
jne 0x40ce21
push 2
jmp 0x40cd5e
cmp eax, 0x24
jne 0x40ce2d
push 3
jmp 0x40cd5e
cmp eax, 0x2a
je 0x40ce81
cmp eax, 0x2b
je 0x40ce81
cmp eax, 0x3f
je 0x40ce81
cmp eax, 0x7b
je 0x40ce81
cmp eax, 0x7d
jne 0x40ce4b
test dword [esi + 0x50], edx
je 0x40ce7d
cmp eax, 0x5d
jne 0x40ce55
test dword [esi + 0x50], edx
je 0x40cdf1
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0040d4c0
mov bl, 1
mov ecx, esi
call fcn.0040ccc7
test bl, bl
je 0x40ce76
mov ecx, esi
call fcn.0040d3d8
mov cl, 1
jmp 0x40ccf6
push 6
jmp 0x40ce8d
push 0xa
jmp 0x40ce8d
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.0040c5be
int3