joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405dd0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 8
jb 0x405de1
mov eax, dword [esi]
jmp 0x405de3
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405dfb
test al, 0x10
je 0x405dfb
mov eax, 1
pop esi
pop ebp
ret
cmp dword [esi + 0x14], 8
jb 0x405e03
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebp
ret

Function at 0x405e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412d9b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x234]
xor eax, eax
mov dword [ebp - 0x23c], 0
push 0xffffffffffffffff
push eax
push 0x41a054
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
call fcn.004027d0
push 0xb
push str.InstallPath
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0
call fcn.004031b0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405f27
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x405f1b
push 0x4143f4
mov ecx, esi
call fcn.00401220
jmp 0x405f6e
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
cmp word [ebp - 0x218], ax
jne 0x405f47
xor ecx, ecx
jmp 0x405f5f
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405f50
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004028f0
cmp dword [ebp - 0x220], 8
jb 0x405f85
push dword [ebp - 0x234]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
Function at 0x4060b0
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412e32
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x238], 0
mov ax, word [0x4145b0]
movdqu xmm0, xmmword [0x414598]
mov word [ebp - 0x14], ax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x232]
movdqu xmmword [ebp - 0x2c], xmm0
push eax
movq xmm0, qword [0x4145a8]
mov dword [ebp - 0x23c], esi
movq qword [ebp - 0x1c], xmm0
call sub.MSVCR120.dll_memset
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x234]
push eax
push 0x104
mov dword [ebp - 0x238], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4061fd
cmp word [ebp - 0x234], 0
jne 0x406179
xor ecx, ecx
jmp 0x406191
lea ecx, [ebp - 0x234]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406182
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x234]
mov ecx, esi
push eax
call fcn.004028f0
cmp word [ebp - 0x2c], 0
jne 0x4061ab
xor ecx, ecx
jmp 0x4061c0
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4061b1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.004031b0
cmp dword [esi + 0x14], 8
jb 0x4061d6
mov eax, dword [esi]
jmp 0x4061d8
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4061e8
test al, 0x10
jne 0x4061fd
cmp dword [esi + 0x14], 8
jb 0x4061f2
mov eax, dword [esi]
jmp 0x4061f4
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
Function at 0x406480
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412ed1
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20]
mov esi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
push 0x10
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], edi
mov byte [ebp - 0x20], 0
movq qword [ebp - 0x1f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
call sub.ADVAPI32.dll_SystemFunction036
xor eax, eax
mov dword [edi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [edi + 0x10], 0
mov ecx, edi
push esi
mov word [edi], ax
call fcn.004027d0
push 1
push 0x414594
mov ecx, edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x3c], 1
call fcn.004031b0
xor eax, eax
mov dword [ebp - 0x24], 7
push eax
push 0x4143f4
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
call fcn.004028f0
mov dword [ebp - 4], 1
xor esi, esi
mov ebx, 0x1a
movzx eax, byte [ebp + esi - 0x20]
lea ecx, [ebp - 0x38]
cdq
idiv ebx
add dl, 0x41
movsx ax, dl
movzx eax, ax
push eax
push 1
call fcn.00407250
inc esi
cmp esi, 0x10
jl 0x406554
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.004030a0
cmp dword [ebp - 0x24], 8
jb 0x406597
push dword [ebp - 0x38]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
Function at 0x4067e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412d9b
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x234]
xor eax, eax
mov dword [ebp - 0x220], 7
push 0xffffffffffffffff
push eax
push 0x41a054
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
call fcn.004027d0
xor eax, eax
mov dword [ebp - 4], 0
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
push 0x104
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.MSVCR120.dll_wcsncpy]
add esp, 0x18
lea ecx, [ebp - 0x234]
push 0xb
push str.WebResource
call fcn.004031b0
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x238]
push 0
push ecx
push 0
push 2
push 0
push 0
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4069a3
mov eax, dword [edi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x21c], eax
cmp eax, 0xffffffff
je 0x4068fd
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push str.irandom
push dword [ebp - 0x238]
call esi
test eax, eax
jne 0x406997
mov eax, dword [edi + 4]
mov dword [ebp - 0x21c], eax
cmp eax, 0xffffffff
je 0x406929
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push str.iUpdateId
push dword [ebp - 0x238]
call esi
test eax, eax
jne 0x406997
mov ecx, str.NULL
lea eax, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40695a
test dx, dx
je 0x406956
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40695a
add eax, 4
add ecx, 4
test dx, dx
jne 0x406934
xor eax, eax
jmp 0x40695f
sbb eax, eax
or eax, 1
test eax, eax
je 0x406984
push 0x208
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.tWebResourceInstallPath
push dword [ebp - 0x238]
call esi
test eax, eax
jne 0x406997
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x4069a5
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 0x220], 8
jb 0x4069bc
push dword [ebp - 0x234]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
Function at 0x406ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412f0b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x23c]
xor eax, eax
mov dword [ebp - 0x228], 7
push 0xffffffffffffffff
push eax
push 0x41a054
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x23c], ax
call fcn.004027d0
push 0xb
push str.WebResource
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], 0
call fcn.004031b0
xor eax, eax
mov dword [ebp - 0x21c], 0xffffffff
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x220], 4
cmp dword [ebp - 0x228], 8
lea ecx, [ebp - 0x240]
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406c72
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push str.irandom
push dword [ebp - 0x240]
call edi
or esi, 0xffffffff
test eax, eax
lea eax, [ebp - 0x220]
mov ecx, esi
cmove ecx, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x21c]
mov dword [ebx], ecx
push eax
push 0
push 0
push str.iUpdateId
push dword [ebp - 0x240]
call edi
test eax, eax
mov dword [ebp - 0x224], 0x208
lea eax, [ebp - 0x224]
cmove esi, dword [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [ebx + 4], esi
push eax
push 0
push 0
push str.tWebResourceInstallPath
push dword [ebp - 0x240]
call edi
test eax, eax
jne 0x406c52
lea eax, [ebp - 0x218]
lea edx, [ebx + 8]
mov ecx, eax
sub edx, ecx
lea esp, [esp]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x406c40
jmp 0x406c66
push 5
lea eax, [ebx + 8]
push str.NULL
push eax
call dword [sym.imp.MSVCR120.dll_wcsncpy]
add esp, 0xc
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x228], 8
jb 0x406c89
push dword [ebp - 0x23c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
Function at 0x406cb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412f48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x18], 7
push 0xffffffffffffffff
push eax
push 0x41a054
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.004027d0
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR120.dll__time64]
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 8
call dword [sym.imp.MSVCR120.dll_rand]
cdq
mov ecx, 0x2710
idiv ecx
push 0xb
inc edx
lea ecx, [ebp - 0x2c]
push str.WebResource
mov dword [ebp - 0x14], edx
call fcn.004031b0
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x30]
push 0
push ecx
push 0
push 2
push 0
push 0
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x406d87
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push str.irandom
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x30]
test eax, eax
je 0x406db6
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 0x18], 8
jb 0x406d9a
push dword [ebp - 0x2c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x406d89

Function at 0x406dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412c08
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push 0x41a054
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004027d0
push 0xb
push str.WebResource
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004031b0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push 0
push ecx
push 0
push 2
push 0
push 0
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x406e83
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push str.iUpdateId
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
test eax, eax
je 0x406eb2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 0x14], 8
jb 0x406e96
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x406e85
Function at 0x406ec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412f78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push 0x41a054
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.004027d0
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x406f22
mov edi, dword [esi]
jmp 0x406f24
mov edi, esi
mov esi, dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push 0xb
push str.WebResource
add esi, esi
call fcn.004031b0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push 0
push ecx
push 0
push 2
push 0
push 0
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x406f83
push esi
push edi
push 1
push eax
push str.tWebResourceInstallPath
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
test eax, eax
je 0x406fb3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [ebp - 0x14], 8
jb 0x406f96
push dword [ebp - 0x28]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x406f85

Function at 0x407860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4130bb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x41a3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x220], 7
push 0xffffffffffffffff
push eax
xor esi, esi
mov word [ebp - 0x234], ax
push 0x41a054
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x224], esi
call fcn.004027d0
push 0xb
push str.WebResource
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], esi
call fcn.004031b0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x208
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ecx
push 1
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40795c
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push esi
push str.irandom
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x238]
test eax, eax
mov ecx, 1
cmove esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], 8
jb 0x407973
push dword [ebp - 0x234]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411746
mov esp, ebp
pop ebp
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x78b718e3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x32685812
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x426e7f
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
push dword [0x5374e4]
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_GetConsoleScreenBufferInfo]
mov eax, 0
mov dword [ebp - 0xc], 0
mov eax, dword [0x5374e4]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x18], eax
mov eax, dword [0x5374e4]
mov eax, dword [eax]
shr eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x426f0e
cmp eax, 1
je 0x426f45
cmp eax, 2
je 0x426f6e
cmp eax, 4
je 0x426f89
cmp eax, 5
je 0x426fbd
cmp eax, 3
je 0x426fe5
call fcn.00426f05
mov eax, dword [0x5374e4]
mov eax, dword [eax + 4]
shr eax, 0x10
mov edx, eax
mov eax, dword [ebp - 0x18]
imul edx
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
jmp 0x427007
mov eax, dword [ebp - 0x18]
push edx
mov edx, dword [ebp - 0x1c]
imul edx
pop edx
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
jmp 0x427007
mov eax, dword [0x5374e4]
mov eax, dword [eax]
and eax, 0xffff
push eax
mov eax, dword [0x5374e4]
mov eax, dword [eax + 4]
and eax, 0xffff
pop edx
xchg edx, eax
sub eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [0x5374e4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
jmp 0x427007
mov eax, dword [0x5374e4]
mov eax, dword [eax + 4]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [0x5374e4]
mov eax, dword [eax + 4]
and eax, 0xffff0000
mov dword [ebp - 0x14], eax
jmp 0x427007
mov eax, dword [0x5374e4]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [0x5374e4]
mov eax, dword [eax + 4]
and eax, 0xffff0000
mov dword [ebp - 0x14], eax

Function at 0x427398
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4273cf
cmp eax, 2
je 0x4273ff
cmp eax, 4
je 0x42742f
call fcn.004273c6
mov eax, dword [ebp + 8]
mov al, byte [eax + 2]
cmp al, 0x5b
je 0x427416
mov eax, 0
jmp 0x427d69
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp + 8], eax
mov eax, 4
mov dword [ebp - 0x10], 4
jmp 0x42745d
mov eax, dword [ebp + 8]
mov al, byte [eax + 4]
cmp al, 0x5b
je 0x427446
mov eax, 0
jmp 0x427d69
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp + 8], eax
mov eax, 8
mov dword [ebp - 0x10], 8
Function at 0x4283ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [0x5374d4]
cmp eax, 0
je 0x42843e
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
jmp 0x428428
and eax, 0xff
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
and eax, 0xff
push eax
call fcn.00427dd6
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 0xc]
mov al, byte [esi]
cmp al, 0
jne 0x42840c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
jmp 0x428471
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
push dword [0x515004]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
xor eax, eax
push eax
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0042bb24
mov eax, dword [ebp + 8]
leave
ret 4

Function at 0x4286a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 8
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
shl eax, 1
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov eax, dword [ebp - 0xc]
dec eax
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4315d6
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x28
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0x1f
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
mov edx, eax
mov eax, dword [ebp - 0x2c]
mov cl, dl
shl eax, cl
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x38
jne 0x43164f
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
cmp eax, 0
jl 0x43164f
jmp 0x431653
xor eax, eax
jmp 0x431656
xor eax, eax
inc eax
cmp eax, 0
je 0x43168e
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
mov edx, eax
mov eax, dword [ebp - 0x28]
mov cl, dl
shl eax, cl
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
shl eax, 2
mov dword [ebp - 0x28], eax
jmp 0x4316b6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x14]
sub eax, edx
push eax
push dword [ebp - 0x10]
pop eax
bsr eax, eax
pop edx
xchg edx, eax
mov cl, dl
sar eax, cl
shl eax, 2
mov dword [ebp - 0x28], eax
mov eax, dword [0x53d66c]
mov dword [ebp - 0x20], eax
jmp 0x4317cc