joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a365
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push esi
mov esi, ecx
test eax, eax
je 0x43a4b0
mov ecx, eax
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x43a388
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x43a4b0
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 1
push ebx
push edi
jne 0x43a406
cmp eax, 8
mov ecx, dword [esi + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], ecx
jl 0x43a4aa
shr eax, 3
mov dword [ebp + 0x10], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0043a17a
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.0043a087
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add dword [ebp + 8], 8
xor dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call fcn.0043a1d8
dec dword [ebp + 0x10]
pop ecx
pop ecx
jne 0x43a3b9
jmp 0x43a4aa
cmp dword [ebp + 0x10], 2
jne 0x43a472
cmp eax, 8
mov ecx, dword [esi + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], ecx
jl 0x43a4aa
shr eax, 3
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0043a17a
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00439f94
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add dword [ebp + 8], 8
push dword [ebp + 8]
mov edx, eax
xor eax, dword [ebp - 0x10]
mov edi, ecx
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
call fcn.0043a1d8
dec ebx
pop ecx
pop ecx
jne 0x43a426
jmp 0x43a4aa
cmp eax, 8
jl 0x43a4aa
shr eax, 3
mov edi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0043a17a
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.0043a087
add dword [ebp + 8], 8
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.0043a1d8
dec edi
pop ecx
pop ecx
jne 0x43a47c
pop edi
mov al, 1
pop ebx
jmp 0x43a4ba
push 0x464f58
call fcn.0042deab
pop esi
leave
ret 0xc
Function at 0x43a628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
push esi
mov esi, ecx
test eax, eax
je 0x43a77f
mov ecx, eax
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x43a64b
dec ecx
or ecx, 0xfffffff8
inc ecx
jne 0x43a77f
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp dword [ebp + 0x14], 1
push ebx
push edi
jne 0x43a6cd
cmp eax, 8
mov ecx, dword [esi + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], ecx
jl 0x43a779
shr eax, 3
mov dword [ebp + 0x14], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0043a17a
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 4]
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.0043a087
mov eax, dword [ebp - 0x10]
xor dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
add dword [ebp + 0xc], 8
xor dword [ebp - 4], eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call fcn.0043a1d8
add dword [ebp + 8], 8
dec dword [ebp + 0x14]
pop ecx
pop ecx
jne 0x43a67c
jmp 0x43a779
cmp dword [ebp + 0x14], 2
jne 0x43a73d
cmp eax, 8
mov ecx, dword [esi + 8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0xc], ecx
jl 0x43a779
shr eax, 3
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0043a17a
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00439f94
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add dword [ebp + 0xc], 8
push dword [ebp + 0xc]
mov edx, eax
xor eax, dword [ebp - 0x10]
mov edi, ecx
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edi
call fcn.0043a1d8
add dword [ebp + 8], 8
dec ebx
pop ecx
pop ecx
jne 0x43a6ed
jmp 0x43a779
cmp eax, 8
jl 0x43a779
shr eax, 3
mov edi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0043a17a
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.0043a087
add dword [ebp + 0xc], 8
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.0043a1d8
add dword [ebp + 8], 8
dec edi
pop ecx
pop ecx
jne 0x43a747
pop edi
mov al, 1
pop ebx
jmp 0x43a789
push 0x464f58
call fcn.0042deab
pop esi
leave
ret 0x10
Function at 0x43a98b
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x44
cmp dword [ebp + 0xc], 1
push esi
mov esi, ecx
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0xc], eax
jge 0x43a9c1
push str.Incorrect_key_length._Must_be_1_to_56.
call fcn.0042deab
jmp 0x43aac6
push 0x38
pop eax
cmp dword [ebp + 0xc], eax
jle 0x43a9cc
mov dword [ebp + 0xc], eax
push ebx
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push dword [ebp + 8]
push eax
call fcn.0044ea40
push 0x48
lea edi, [esi + 0x10]
push 0x465f80
push edi
call fcn.0044ea40
push 0x1000
lea eax, [esi + 0x58]
push 0x464f80
push eax
call fcn.0044ea40
add esp, 0x24
and dword [ebp + 0x10], 0
lea eax, [ebp - 0x44]
mov ecx, edi
mov dword [ebp - 8], 0x12
and dword [ebp - 4], 0
mov dword [ebp + 8], 4
mov edx, dword [ebp - 4]
movzx ebx, byte [eax]
dec dword [ebp + 8]
shl edx, 8
or edx, ebx
inc eax
inc dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x43aa42
and dword [ebp + 0x10], 0
lea eax, [ebp - 0x44]
cmp dword [ebp + 8], 0
jne 0x43aa1e
mov edx, dword [ebp - 4]
xor dword [ecx], edx
add ecx, 4
dec dword [ebp - 8]
jne 0x43aa13
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00439f94
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 8]
add edi, 4
inc ebx
mov dword [edi], eax
inc ebx
add edi, 4
cmp ebx, 0x12
jb 0x43aa5d
lea eax, [esi + 0x58]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], 4
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00439f94
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [ebp - 8]
add edi, 4
inc ebx
mov dword [edi], eax
inc ebx
add edi, 4
cmp ebx, 0x100
jl 0x43aa91
add dword [ebp + 0xc], 0x400
dec dword [ebp + 0x10]
jne 0x43aa8c
pop edi
mov al, 1
pop ebx
pop esi
leave
ret 0xc

Function at 0x43b527
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
test eax, eax
je 0x43b548
cmp byte [eax], 0
je 0x43b548
push dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_wvsprintfA]
jmp 0x43b54f
mov edi, dword [esp + 0xc]
mov byte [edi], 0
push edi
call fcn.004519c0
pop ecx
lea esi, [eax + edi]
push edi
mov byte [esi], 0xa
mov byte [esi + 1], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov byte [esi], 0
pop esi
ret
Function at 0x43e7a5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x45e41a
call fcn.0044e550
push ecx
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x43e7f4
push esi
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.0043e440
add esp, 0x14
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x43e7f0
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
jmp 0x43e810
mov ecx, dword [ebp + 0xc]
call fcn.0042b66e
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], esi
je 0x43e80e
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x441ba6
Capabilities:
Get process image filename

Disassembly:
mov eax, 0x45e5ae
call fcn.0044e550
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov esi, 0x12c
push esi
lea ecx, [ebp - 0x14]
call fcn.004311d6
mov byte [ebp - 4], 1
push dword [ebp + 8]
mov byte [ebp - 0xd], bl
push ebx
cmp dword [0x473f74], ebx
je 0x441c4c
test dword [ebp + 0x10], 0x201
push 0x1000
mov dword [ebp - 0x1c], esi
setne byte [ebp - 0xe]
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, ebx
je 0x441c60
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
xor eax, eax
cmp byte [ebp - 0xe], bl
sete al
push eax
push esi
call dword [0x473f74]
test eax, eax
je 0x441c60
push 0x7e
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x441cf8
cmp byte [ebp - 0xe], bl
jne 0x441cf4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push ebx
push esi
call dword [0x473f74]
jmp 0x441cf0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, ebx
jne 0x441c8b
test dword [ebp + 0x10], 0x101
jne 0x441cc0
mov esi, dword [ebp + 0xc]
push 0x200
push esi
push dword [ebp + 8]
push 0x441a60
call fcn.00441eb8
add esp, 0x10
test al, al
je 0x441cc0
jmp 0x441d24
test dword [ebp + 0x10], 0x201
jne 0x441cb1
push esi
push dword [ebp - 0x14]
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x441cb1
push 0x7e
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x441cf8
push esi
push dword [ebp - 0x14]
push ebx
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x441ce5
mov ecx, dword [ebp + 0xc]
push ebx
push ebx
call fcn.0042b85f
mov byte [ebp - 4], bl
push dword [ebp - 0x14]
call fcn.0043d2ed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004014ed
xor al, al
jmp 0x441d45
push 0x7e
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x441cf8
mov byte [ebp - 0xd], 1
mov esi, dword [ebp + 0xc]
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0042c1fe
cmp byte [ebp - 0xd], bl
je 0x441d14
push 1
push ebx
mov ecx, esi
call fcn.00438596
test byte [ebp + 0x10], 1
jne 0x441d24
push 1
push esi
call fcn.00441a70
pop ecx
pop ecx
cmp dword [esi + 4], ebx
setne byte [ebp - 0xe]
mov byte [ebp - 4], bl
push dword [ebp - 0x14]
call fcn.0043d2ed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004014ed
mov al, byte [ebp - 0xe]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x444948
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x45e6e7
call fcn.0044e550
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp esi, ebx
je 0x44497b
push ebx
push esi
call fcn.0042efc0
pop ecx
pop ecx
test eax, eax
je 0x44497b
or dword [ebp + 0x10], 0x10000
mov byte [ebp - 0xd], 1
push esi
push dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00443ea1
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], ebx
je 0x4449d4
mov eax, dword [ebp - 0x24]
and eax, 0xfffffffe
or eax, 0x20
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x18]
call fcn.004448be
mov esi, eax
neg esi
sbb esi, esi
not esi
and esi, dword [ebp + 0x18]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0040873d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
cmp esi, ebx
je 0x444a38
cmp byte [ebp - 0xd], bl
jne 0x444a38
push esi
lea ecx, [ebp + 0x18]
call fcn.0040478c
mov byte [ebp - 4], 1
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov byte [ebp - 4], bl
push dword [ebp + 0x18]
call fcn.0043d2ed
mov dword [ebp + 0x18], ebx
cmp esi, ebx
jne 0x444a0c
xor esi, esi
jmp 0x4449b8
or dword [ebp - 0x24], 0x40000000
lea eax, [ebp - 0x38]
push eax
push esi
call fcn.004448be
test eax, eax
je 0x4449b8
and dword [ebp - 0x24], 0xbfffffff
push 0xffffffffffffffe0
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_GetClassLongW]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x38]
push eax
push fcn.004448be
call dword [sym.imp.USER32.dll_EnumWindows]
xor esi, esi
cmp dword [ebp - 0x34], ebx
jle 0x444a62
mov eax, dword [ebp - 0x38]
push dword [eax + esi*4]
lea ecx, [ebp - 0x38]
call fcn.00443d93
inc esi
cmp esi, dword [ebp - 0x34]
jl 0x444a4e
mov esi, dword [ebp - 0x1c]
jmp 0x4449b8
Function at 0x448040
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x44804b
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
push esi
not eax
cmp edx, 8
jb 0x448129
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4667e0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4667e0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x4667e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4667e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4667e0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4667e0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4667e0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4667e0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x448065
pop edi
test edx, edx
je 0x44814b
lea ecx, [ecx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4667e0]
inc ecx
sub edx, 1
jne 0x448130
not eax
pop esi
ret
Function at 0x448e97
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
inc ecx
movzx eax, byte [ecx]
push edi
test eax, eax
jne 0x448eb6
mov dword [esi], str._at_end_of_pattern
jmp 0x449018
lea edx, [eax - 0x30]
cmp edx, 0x4a
ja 0x449018
movsx edi, word [edx*2 + 0x467108]
test edi, edi
je 0x448ed5
mov eax, edi
jmp 0x449018
cmp eax, 0x58
jg 0x448f8b
je 0x448f08
cmp eax, 0x30
je 0x448f60
jle 0x448fb0
cmp eax, 0x39
jle 0x448f13
cmp eax, 0x4c
je 0x448f08
cmp eax, 0x4e
je 0x448f08
cmp eax, 0x50
je 0x448f08
cmp eax, 0x55
jne 0x448fb0
mov dword [esi], str.PCRE_does_not_support_L__l__N__P__p__U__u__or_X
jmp 0x449018
cmp dword [ebp + 0x14], 0
jne 0x448f46
push ebx
mov esi, ecx
jmp 0x448f2a
imul edx, edx, 0xa
mov ecx, eax
movzx eax, byte [ecx]
lea edx, [edx + eax - 0x30]
lea eax, [ecx + 1]
movzx ebx, byte [eax]
test byte [ebx + 0x467290], 4
jne 0x448f1e
cmp edx, 0xa
pop ebx
jl 0x448f56
cmp edx, dword [ebp + 0xc]
jle 0x448f56
mov ecx, esi
movzx eax, byte [ecx]
cmp eax, 0x38
jl 0x448f60
dec ecx
xor eax, eax
jmp 0x449018
push 0xffffffffffffffef
pop eax
sub eax, edx
jmp 0x449018
sub eax, 0x30
lea esi, [ecx + 1]
mov dl, byte [esi]
inc edi
cmp dl, 0x30
jb 0x448f81
cmp dl, 0x37
ja 0x448f81
cmp edi, 2
mov ecx, esi
movzx edx, byte [ecx]
lea eax, [edx + eax*8 - 0x30]
jl 0x448f63
and eax, 0xff
jmp 0x449018
cmp eax, 0x63
je 0x448ffa
cmp eax, 0x6c
je 0x448f08
cmp eax, 0x70
je 0x448f08
cmp eax, 0x75
je 0x448f08
cmp eax, 0x78
je 0x448fbe
test byte [ebp + 0x10], 0x40
je 0x449018
mov dword [esi], str.unrecognized_character_follows__
jmp 0x449018
xor eax, eax
lea edx, [ecx + 1]
movzx esi, byte [edx]
inc edi
test byte [esi + 0x467290], 8
je 0x449018
mov ecx, edx
movzx esi, byte [ecx]
cmp esi, 0x61
jl 0x448fdd
sub esi, 0x20
xor edx, edx
cmp esi, 0x41
setge dl
shl eax, 4
dec edx
and edx, 0xfffffff9
add edx, 0x37
sub eax, edx
add eax, esi
cmp edi, 2
jl 0x448fc0
jmp 0x449018
inc ecx
movzx eax, byte [ecx]
test eax, eax
jne 0x44900a
mov dword [esi], str.c_at_end_of_pattern
jmp 0x44901d
lea edx, [eax - 0x61]
cmp edx, 0x19
ja 0x449015
sub eax, 0x20
xor eax, 0x40
mov edx, dword [ebp + 8]
mov dword [edx], ecx
pop edi
pop esi
pop ebp
ret

Function at 0x4490f4
Capabilities:
Parse credit card information

Disassembly:
push esi
push edi
movzx ecx, byte [eax]
cmp ecx, 0x44
jg 0x44914e
cmp ecx, 0x42
jge 0x449138
cmp ecx, 3
jl 0x449166
cmp ecx, 4
jle 0x449158
cmp ecx, 0xf
je 0x449117
cmp ecx, 0x3c
jmp 0x449156
cmp dword [esp + 0xc], 0
jle 0x449134
movzx ecx, byte [eax + 1]
mov esi, dword [edx]
and esi, dword [esp + 0xc]
mov edi, ecx
and edi, dword [esp + 0xc]
cmp edi, esi
je 0x449134
mov dword [edx], ecx
inc eax
inc eax
jmp 0x4490f6
movzx ecx, byte [eax + 1]
movzx esi, byte [eax + 2]
shl ecx, 8
or ecx, esi
add eax, ecx
cmp byte [eax], 0x3d
je 0x449138
jmp 0x449158
cmp ecx, 0x48
je 0x449158
cmp ecx, 0x4b
jne 0x449166
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0x4670a8]
add eax, ecx
jmp 0x4490f6
pop edi
pop esi
ret
Function at 0x4533e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x472948]
jne 0x4533f2
repz ret
jmp fcn.00458aa5

Function at 0x458cc2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00453469
and dword [ebp - 4], 0
cmp dword [0x476b44], 0
mov ebx, eax
jne 0x458d73
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x458e24
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x458e24
push eax
call fcn.004533f7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x476b44], eax
call esi
push eax
call fcn.004533f7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x476b48], eax
call esi
push eax
call fcn.004533f7
mov dword [esp], 0x4682e8
push edi
mov dword [0x476b4c], eax
call esi
push eax
call fcn.004533f7
pop ecx
mov dword [0x476b54], eax
test eax, eax
je 0x458d73
push 0x4682d0
push edi
call esi
push eax
call fcn.004533f7
pop ecx
mov dword [0x476b50], eax
mov eax, dword [0x476b50]
cmp eax, ebx
je 0x458dcb
cmp dword [0x476b54], ebx
je 0x458dcb
push eax
call fcn.00453472
push dword [0x476b54]
mov esi, eax
call fcn.00453472
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x458dcb
test edi, edi
je 0x458dcb
call esi
test eax, eax
je 0x458dc2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x458dc2
test byte [ebp - 0xc], 1
jne 0x458dcb
or dword [ebp + 0x10], 0x200000
jmp 0x458e04
mov eax, dword [0x476b48]
cmp eax, ebx
je 0x458e04
push eax
call fcn.00453472
pop ecx
test eax, eax
je 0x458e04
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x458e04
mov eax, dword [0x476b4c]
cmp eax, ebx
je 0x458e04
push eax
call fcn.00453472
pop ecx
test eax, eax
je 0x458e04
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x476b44]
call fcn.00453472
pop ecx
test eax, eax
je 0x458e24
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x458e26
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408922
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
and edx, ebx
add ebx, ebx
call fcn.0040894c
mov edx, ebx
add edx, edx
xor dword [esi], ecx
mov ebx, 0x632001d
add esi, 1
add edx, edx
cmp esi, edi
jne fcn.00408922
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2f460f07
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x783634e2
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x447836
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x447845
pop dword [ebp - 0x10]
mov eax, 0x447845
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x5185c
push 0
mov eax, 0x77299e6d
sub eax, 0x76e4ebbd
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x595e080e
add ecx, 0xa6a24512
mov ebx, eax
mov esi, 0x1f0b7fd6
add esi, 0xe13d0e2a
add esi, dword [ebp - 0x10]
mov edx, 0xca4fb439
add edx, 0x835278e0
sub dword [ebp - 4], ecx
mov edi, dword [esi]
mov dword [ebp - 4], 0xe342f229
xor edi, edx
xor dword [ebp - 4], esi
mov dword [ebx], edi
add dword [ebp - 0xc], ebx
add ebx, 4
add esi, 0xc535e66f
sub esi, 0xc535e66b
loop 0x44789f
add eax, 0x6b66d38f
sub eax, 0x6b65ac3c
xor ebx, ebx
add ebx, eax
add eax, 0x7bcf7499
add eax, 0x84308b6c
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x406f01
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406f59
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x40920c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406f4c
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x406f5b
xor eax, eax
pop esi
leave
ret 4