joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420305
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov al, byte [0x5d4d46]
sub esp, 0x10
push esi
push edi
mov edi, ecx
test al, al
jne 0x420335
mov eax, dword [edi]
push ecx
mov ecx, dword [eax*4 + 0x48db50]
call fcn.0046921c
pop ecx
test al, al
je 0x42038a
mov byte [0x5d4d46], 1
jmp 0x42038a
cmp al, 1
jne 0x42038a
push ecx
mov ecx, 0x48cfb8
call fcn.0046921c
and dword [ebp - 4], 0
lea edx, [ebp - 8]
pop ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 0x46
call fcn.0042b25b
mov ecx, eax
call fcn.0042ebde
mov esi, 0x48d878
push dword [esi]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x42037f
mov eax, dword [esi]
mov dword [edi], eax
mov byte [0x5d4d46], 0
add esi, 4
cmp esi, 0x48db50
jne 0x420367
pop edi
pop esi
leave
ret
Function at 0x42173f
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push esi
call fcn.0042131f
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor esi, esi
push esi
push esi
push 0x48cfd8
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x42176c
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push edi
push 0
push 2
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x22c], 0x22c
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42180d
push esi
mov ecx, ebx
lea eax, [ebp - 0x208]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4217d0
test dx, dx
je 0x4217cc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4217d0
add eax, 4
add ecx, 4
test dx, dx
jne 0x4217aa
xor eax, eax
jmp 0x4217d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4217fa
push dword [ebp - 0x224]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x22c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4217a2
pop esi
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
leave
ret
Function at 0x429e90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x429eb3
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x429f86
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x2c]
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x24], edi
test ecx, ecx
je 0x429ee0
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x429ee6
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x429f4e
jg 0x429efd
test esi, esi
je 0x429f4e
test ecx, ecx
jl 0x429f48
jg 0x429f07
test eax, eax
je 0x429f48
cmp edi, ecx
jg 0x429f1b
jl 0x429f11
cmp esi, eax
jae 0x429f1b
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov ebp, dword [esp + 0x2c]
push eax
push ebp
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
add ebp, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x429f52
mov ebp, dword [esp + 0x2c]
jmp 0x429f5c
mov ebp, dword [esp + 0x2c]
test edi, edi
jl 0x429f77
jg 0x429f5c
test esi, esi
je 0x429f77
cmp dword [ebx + 0x4c], 0
je 0x429f77
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x429f90
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, ecx
test esi, esi
jg 0x429fb1
jl 0x429fa8
test ebx, ebx
jne 0x429fb1
xor eax, eax
xor edx, edx
jmp 0x42a078
cmp dword [ebp + 0x38], 0
je 0x429fc8
push esi
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x42a078
mov eax, dword [ebp + 0x1c]
push edi
mov edi, ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x42a00d
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x42a00d
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push ecx
push dword [esp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
sub edi, esi
add eax, esi
add esp, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x2c]
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x20]
jmp 0x42a015
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
cmp dword [ebp + 0x4c], 0
je 0x42a06e
mov ecx, ebp
call fcn.0042aabe
mov ecx, dword [esp + 0x10]
mov edx, edi
mov eax, 0xfff
cmp edi, eax
jbe 0x42a058
push dword [ebp + 0x4c]
push eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, dword [esp + 0x20]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x10], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x42a06e
jmp 0x42a028
test edx, edx
je 0x42a06e
push dword [ebp + 0x4c]
push edi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x42a320
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x34]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x42a33a
xor eax, eax
jmp 0x42a408
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x42a363
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x42a363
lea ecx, [ebp - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x42a3d2
cmp dword [esi + 0x4c], 0
je 0x42a405
mov ecx, esi
call fcn.0042aabe
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42a380
movsx eax, bl
jmp 0x42a3c1
lea eax, [esp + 0x14]
mov byte [esp + 0x13], bl
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x27]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x42a3d6
sub eax, 1
je 0x42a3d6
dec eax
sub eax, 1
jne 0x42a405
movsx eax, byte [esp + 0x13]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
pop ecx
pop ecx
cmove ebx, edi
mov eax, ebx
jmp 0x42a407
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x1c]
sub ebp, eax
je 0x42a3f6
push dword [esi + 0x4c]
push ebp
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebp, eax
jne 0x42a405
lea eax, [esp + 0x13]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x18], eax
cmovne edi, ebx
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 4

Function at 0x42a6c8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
or dword [ecx + 0x1384], 0xffffffff
mov edx, dword [esp + 4]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jb 0x42a6e4
pop edi
pop esi
mov dword [ecx], ebx
mov eax, ecx
pop ebx
ret 4
Function at 0x42aae1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x38], ebx
je 0x42ab3b
cmp byte [edi + 0x3d], bl
je 0x42ab3b
mov eax, dword [edi]
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x48b5bc]
mov ecx, edi
call esi
cmp eax, 0xffffffff
je 0x42ab6b
mov ecx, dword [edi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x42ab42
sub eax, 1
je 0x42ab45
dec eax
sub eax, 1
jne 0x42ab6b
mov byte [edi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [edi + 0x3d], bl
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x42ab63
push dword [edi + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x42ab6b
cmp byte [edi + 0x3d], bl
sete al
jmp 0x42ab3d
xor al, al
jmp 0x42ab3d

Function at 0x42ebba
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x42ebc6
pop esi
mov eax, edx
ret 4

Function at 0x42f09f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x42f0e7
lea edx, [esi + 8]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x42f0af
jmp 0x42f0f4
cmp dword [esi], 0x4e0
jb 0x42f0f4
call fcn.0042f12e
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret
Function at 0x42f12e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x42f141
lea edi, [esi + 0xd50]
mov ebp, 0x18c
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ecx, eax
lea edi, [edx + 4]
mov ebx, dword [edi]
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x42f188
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [esi], ebp
and eax, 0x9908b0df
shr ecx, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x430935
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [0x5d50e1], 0
push esi
jne 0x430975
cmp dword [0x5d3b6c], 0xffffffff
jne 0x430955
mov ecx, str.Set_HotKey
jmp 0x430961
mov eax, dword [0x5d359c]
mov ecx, dword [eax*4 + 0x48e108]
push ecx
call fcn.0046921c
pop ecx
test al, al
je 0x4309d5
mov byte [0x5d50e1], 1
jmp 0x4309d5
push ecx
mov ecx, 0x48cfb8
call fcn.0046921c
and dword [ebp - 4], 0
lea edx, [ebp - 8]
pop ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 8], 1
call fcn.0042b25b
mov ecx, eax
call fcn.0042ebde
xor esi, esi
push dword [esi*4 + 0x48de30]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4309bd
inc esi
cmp esi, 0xb6
jb 0x4309a0
jmp 0x4309d5
mov eax, dword [esi*4 + 0x48de30]
mov dword [0x5d359c], eax
mov dword [0x5d3b6c], eax
mov byte [0x5d50e1], 0
pop esi
leave
ret

Function at 0x4309d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0043276d
xor edx, edx
mov cl, byte [eax + edx + 1]
xor cl, byte [eax]
mov byte [edx + 0x5d7bc0], cl
inc edx
cmp edx, 0x16
jb 0x4309ec
mov ecx, 0x5d7bc0
mov byte [0x5d7bd6], 0
call fcn.0046afcc
call fcn.0041ff22
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x42be0000
mov dword [ebp - 4], 0x41e00000
call fcn.00430935
call fcn.0044f24e
push dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00432803
xor edx, edx
mov cl, byte [eax + edx + 1]
xor cl, byte [eax]
mov byte [edx + 0x5d7c4c], cl
inc edx
cmp edx, 0x12
jb 0x430a3d
push 0x5d4e15
push 0x5d7c4c
mov byte [0x5d7c5e], 0
call fcn.00478fa3
call fcn.0044f2a2
mov ecx, 0x48bd5e
call fcn.0046afcc
xorps xmm0, xmm0
call fcn.00451a09
leave
ret
Function at 0x4315e4
Capabilities:
Delete file

Disassembly:
mov eax, 0x489500
call fcn.00488604
sub esp, 0xb8
cmp byte [ebp + 8], 0
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x431688
sub esp, 0xc
lea ecx, [ebp - 0xc0]
push str.log.config
call fcn.0042ac4f
and dword [ebp - 4], 0
cmp dword [ebp - 0x70], 0
je 0x431675
mov edx, edi
lea ecx, [ebp - 0xc0]
call fcn.0042b32b
mov edi, 0x42b340
mov ecx, eax
push edi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, esi
lea ecx, [ebp - 0xc0]
call fcn.0042b32b
push edi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [ebp + 8]
lea ecx, [ebp - 0xc0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool_]
push edi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0xc0]
call fcn.0042a4a4
lea ecx, [ebp - 0x58]
call fcn.0042a4c5
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x431694
push str.log.config
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x433f19
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x433ff7
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x433f52
cmp dword [ebp - 8], ebx
jne 0x433ff7
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5e53b0]
cmp eax, dword [ecx + 4]
jle 0x433f9f
mov esi, 0x5e53b0
push esi
call fcn.004872c7
cmp dword [0x5e53b0], 0xffffffff
pop ecx
jne 0x433f9f
push str.NtQueryInformationProcess
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov dword [0x5e53ac], eax
call fcn.00487276
pop ecx
mov esi, dword [0x5e53ac]
test esi, esi
je 0x433ff3
push ebx
push 0x18
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, esi
call dword [0x48b5bc]
call esi
test eax, eax
js 0x433ff3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x433ff3
push ebx
push 1
lea ecx, [ebp - 1]
mov byte [ebp - 1], bl
push ecx
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x433ff3
mov al, byte [ebp - 1]
and al, 1
jmp 0x433ff9
xor al, al
jmp 0x433ff9
mov al, 1
pop esi
pop ebx
leave
ret

Function at 0x43460c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x434630
xor al, al
jmp 0x43467d
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x43466c
lea eax, [ebp - 0x208]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x434672
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x43464a
jmp 0x434674
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434a1c
Capabilities:
Hide graphical window

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x434a35
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp dword [sym.imp.KERNEL32.dll_FreeConsole]
ret
Function at 0x43a647
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x489e5e
call fcn.00488604
push ecx
push ecx
push ebx
push esi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x10], esi
mov edx, ecx
mov ebx, dword [ebp + 8]
push edi
mov edi, ebx
mov dword [ebp - 0x14], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
mov cx, word [edx + 0xc]
mov eax, 0xff
and cx, ax
xor cx, word [edx + esi*2]
movzx ecx, cx
push ecx
mov ecx, ebx
call fcn.0043215d
mov edx, dword [ebp - 0x14]
inc esi
cmp esi, 5
jb 0x43a684
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x43a8a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 0x811c9dc5
push esi
push edi
mov edi, dword [esp + 0xc]
push 0
pop esi
sub edx, edi
je 0x43a8c7
movzx eax, byte [edi + esi]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, edx
jb 0x43a8b6
pop edi
mov eax, ecx
pop esi
ret 8
Function at 0x43f857
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x48a0c8
call fcn.00488604
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi], eax
lea ecx, [esi + 0x14]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ebp - 0x14], ecx
mov dword [ecx + 0xc], ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.0043fae2
xor edi, edi
inc edi
push 0x24
mov dword [ebp - 4], edi
call fcn.0048732b
mov dword [ebp - 0x14], eax
pop ecx
mov ecx, esi
mov dword [eax + 4], 0x14
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax], vtable.std::_Root_node.0
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0x100
mov dword [esi + 0x38], 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x50], 0x8775dfb
call fcn.0043fb45
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x44072d
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4408c3
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4408c3
cmp eax, 0x29
jne 0x440799
cmp dword [esi + 0x10], 0
jne 0x4408c3
test dword [esi + 0x50], edx
je 0x4408c9
cmp eax, 0x5d
jne 0x440774
test dword [esi + 0x50], edx
je 0x440859
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004413b7
mov bl, 1
mov ecx, esi
call fcn.00440705
test bl, bl
je 0x440795
mov ecx, esi
call fcn.004412d2
mov cl, 1
jmp 0x440734
cmp eax, 0x2e
jne 0x4407b1
push 5
lea ecx, [esi + 0x24]
call fcn.00440990
mov ecx, esi
call fcn.00440705
jmp 0x44078e
cmp eax, 0x5c
jne 0x4407fd
mov ecx, esi
call fcn.00440705
test byte [esi + 0x50], 0x80
je 0x4407f4
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x4407dd
push 4
lea ecx, [esi + 0x24]
call fcn.00440990
mov ecx, esi
call fcn.00440705
jmp 0x440795
cmp al, 0x42
jne 0x4407f4
push 4
lea ecx, [esi + 0x24]
call fcn.00440990
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4407d4
mov ecx, esi
call fcn.0044116b
jmp 0x44078e
cmp eax, 0x5b
jne 0x44085d
mov ecx, esi
call fcn.00440705
lea ecx, [esi + 0x24]
call fcn.0044239a
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x44082a
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00440705
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x440848
cmp eax, 0x5d
jne 0x440848
push eax
lea ecx, [esi + 0x24]
call fcn.004423e2
mov ecx, esi
call fcn.00440705
mov ecx, esi
call fcn.00442061
cmp dword [esi + 0x4c], 0x5d
je 0x4407a8
push 4
jmp 0x4408cb
cmp eax, 0x28
jne 0x44087d
mov ecx, esi
call fcn.00440705
mov ecx, esi
call fcn.00441243
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4408c9
jmp 0x440783
cmp eax, 0x5e
jne 0x440889
push 2
jmp 0x4407cc
cmp eax, 0x24
jne 0x440895
push 3
jmp 0x4407cc
cmp eax, 0x2a
je 0x4408bf
cmp eax, 0x2b
je 0x4408bf
cmp eax, 0x3f
je 0x4408bf
cmp eax, 0x7b
je 0x4408bf
cmp eax, 0x7d
jne 0x440766
test dword [esi + 0x50], edx
jne 0x440774
push 6
jmp 0x4408cb
push 0xa
jmp 0x4408cb
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.0043fb3a
int3

Function at 0x4438d1
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48a262
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x30]
test edi, edi
je 0x443902
mov ecx, edi
call fcn.0044361f
mov ecx, edi
call fcn.00448b02
mov edi, dword [esi + 0x34]
test edi, edi
je 0x443917
mov ecx, edi
call fcn.0044361f
mov ecx, edi
call fcn.00448b02
and dword [ebp - 4], 0
lea eax, [esi + 0x64]
push 0x457ab0
push 2
push 0xc
push eax
call fcn.004875e8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x445450
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
mov edx, dword [esp + 8]
push edi
mov edi, ecx
not edx
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x48e640]
inc edi
sub esi, 1
jne 0x44545c
pop edi
not edx
pop esi
mov eax, edx
ret