joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435360
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 8], 0x8b108514
mov dword [esp + 0xc], 0x8fe489ee
mov dword [esp + 0x10], 0xb3de8de2
mov dword [esp + 0x14], 0xb7dcb1d6
mov dword [esp + 0x18], 0xbbb4b5da
mov dword [esp + 0x1c], 0
mov word [esp + 0x20], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x19
ja 0x43540b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
and edx, 0xf5ec4715
xor eax, 0x75ec4715
lea eax, [eax + edx*2]
lea edx, [eax + ecx]
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 0x6c
and eax, 0x6c
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x1a
jb 0x4353c0
lea esi, [esp + 8]
push esi
call fcn.00437420
add esp, 4
mov ecx, eax
mov dword [0x44f49c], eax
xor eax, eax
test ecx, ecx
sete al
mov eax, dword [eax*4 + 0x443f6c]
mov edx, 0xa413e600
xor edx, dword [0x443f74]
add edx, eax
inc edx
xor eax, eax
jmp edx

Function at 0x437aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 0x10], 0xd3d0d186
mov dword [esp + 0x14], 0
mov word [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x437b2b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov eax, dword [esp]
movzx esi, byte [esp + eax + 0x10]
lea ecx, [edx - 0x44fbdd9d]
mov eax, ecx
and eax, esi
xor ecx, esi
lea ecx, [ecx + eax*2]
add edx, 0x63
and edx, esi
or eax, edx
add eax, edx
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x4b
mov ecx, dword [esp]
mov byte [esp + ecx + 0x10], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x437ae0
mov eax, dword [esp + 0x10]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
mov ecx, dword [ecx*4 + 0x445660]
mov edx, 0xd5ce9b4c
xor edx, dword [0x445668]
add ecx, edx
inc ecx
jmp ecx
Function at 0x44cd3c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop eax
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetMessageW]
or eax, eax
je 0x44cd2d
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_TranslateMessage]
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x44cd06
mov eax, dword [ebp - 0x14]
call fcn.0040c64d
pop ebx
pop edi
pop esi
leave
ret 0x10
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [0x494c04], 8
mov dword [0x494c08], 0x4000
push 0x494c04
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ebx, str.durt
mov eax, dword [ebp + 8]
mov dword [0x48f35d], eax
push str.fillt
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x494c44], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov esi, edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], edi
mov eax, 0x420602
nop
mov dword [ebp - 0x30], esi
nop
mov dword [ebp - 0x28], edi
nop
mov dword [ebp - 0x20], esi
mov esi, 0x20
mov dword [ebp - 0x44], eax
mov eax, dword [0x48f35d]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x48], esi
push esi
push edi
call dword [sym.imp.USER32.dll_LoadIconW]
xor eax, eax
push esi
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov eax, 0x10
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ebx
xor eax, eax
mov al, 0x30
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
jmp 0x45676d
xor eax, eax
mov dword [0x48f361], ebp
mov edi, eax
inc eax
push edi
push dword [0x48f35d]
dec eax
push edi
push edi
push eax
push ebx
push edi
push edi
push 0x80ca0000
push str.fillt
push str.durt
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x44ccee
leave
ret 0x10

Function at 0x472105
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4956c8]
jne 0x47210f
repz ret
jmp fcn.004730d5

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x828a92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x828b67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x828b31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x828b5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00828b71
test eax, eax
je 0x828b67
add ebx, 0x14
jmp 0x828b3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x828b71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x828ddd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x828ddd
mov eax, 1
test eax, eax
je 0x828ddd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x828ddd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x828dd3
mov ebx, eax
and eax, 0x80000000
jne 0x828d4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x828ddd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x828ddd
mov eax, 1
test eax, eax
je 0x828ddd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x828ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x828ca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x828ddd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x828b67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x828ddd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x828ca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x828e9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x828fee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x828fee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.00828ff8
test eax, eax
je 0x828fee
add ebx, 0x28
dec ecx
jne 0x828fc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x82909e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x8290c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x82912e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x8290e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x82912e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x829105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x82912e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x829123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x82912e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x82916b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x829172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x8291a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x8291a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x829dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00829f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00829f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00829eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00829f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00829ecb
push ecx
push dword [ebp + 8]
call fcn.00829f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00829f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00829ecb
push ecx
push dword [ebp + 8]
call fcn.00829f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00829f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00829ecb
push ecx
push dword [ebp + 8]
call fcn.00829f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00829f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00829ecb
cmp ecx, 0x2b
jne 0x829e0f
leave
ret 0xc

Function at 0x82b4b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x82b544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x211640
push 0
call dword [eax + 0x20]
test eax, eax
je 0x82b5d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x211640
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x211640
call fcn.0082b3fa
push 0x211640
push dword [ebp + 0xc]
call fcn.008291a8
test eax, eax
jne 0x82b5b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x211640
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.0082b5dd
test eax, eax
je 0x82b5d6
jmp 0x82b574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x82b5d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x82b60b
Capabilities:
Terminate process

Disassembly:
call fcn.0082b618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x412b60
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7dcee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.004cbd20
mov eax, dword [ebp + 8]

Function at 0x412b7b
Capabilities:
Get number of processors
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20bc
push ebx
push esi
push edi
push edi
and edi, 0x7c54
or edi, 0x6c2c
xor edi, 0x5de3
pop edi
push esi
push eax
add esp, 4
add esi, 0x151cc
and esi, 0x67de
pop esi
push edx
push eax
add esp, 4
add edx, 0x7d37
pop edx
mov eax, 0x4d
mov word [ebp - 0x1ff8], ax
mov ecx, 0x42
mov word [ebp - 0x1ff6], cx
mov edx, 0x53
mov word [ebp - 0x1ff4], dx
mov eax, 0x65
mov word [ebp - 0x1ff2], ax
mov ecx, 0x72
mov word [ebp - 0x1ff0], cx
mov edx, 0x76
mov word [ebp - 0x1fee], dx
mov eax, 0x69
mov word [ebp - 0x1fec], ax
mov ecx, 0x63
add byte [eax], al
mov word [ebp - 0x1fea], cx
mov edx, 0x65
mov word [ebp - 0x1fe8], dx
mov eax, 0x2e
mov word [ebp - 0x1fe6], ax
mov ecx, 0x65
mov word [ebp - 0x1fe4], cx
mov edx, 0x78
mov word [ebp - 0x1fe2], dx
mov eax, 0x65
mov word [ebp - 0x1fe0], ax
xor ecx, ecx
mov word [ebp - 0x1fde], cx
mov dword [ebp - 0x1060], 1
push esi
and esi, 0x113b8
pop esi
push edi
push esi
add esp, 4
xor edi, 0xf98b
or edi, 0xd5af
and edi, 0x127ad
pop edi
push edx
push edi
add esp, 4
xor edx, 0x176d1
jbe 0x412c93
invalid
add edx, 0x67ef
pop edx
imul edx, dword [ebp - 0x1060], 0x70
add edx, 0x44f3663b
imul eax, dword [ebp - 0x1060], 0x70
sub edx, eax
xor edx, str.s3H_rRMTFE
imul edx, dword [ebp - 0x1060]
imul ecx, dword [ebp - 0x1060], 0x70
sub edx, ecx
mov dword [ebp - 0x1064], edx
push esi
push edi
add esp, 4
xor esi, 0x79f8
add esi, 0x1473c
invalid
into
invalid
Function at 0x412c90
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
jbe 0x412c93
add byte [ecx + 0x67efc2], al
add byte [edx + 0x6b], bl
xchg ebp, eax
mov al, byte [0x70ffffef]

Function at 0x412ce0
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
ret
Function at 0x4162c3
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov ds, word [eax]
add dword [eax], eax
add byte [edi + 0x50], dl
add esp, 4
add edi, 0x13283
jmp 0x4162a9
pop edi
push ecx
push edx
add esp, 4
xor ecx, 0xb651
int1
push ecx
mov dh, 0
add al, ch
or dword [eax], eax
add byte [eax], al
add byte [ecx + 0x45], cl
inc edx
inc edx
dec esp
dec ebx
push eax
cmp eax, dword [ebx - 0x74a6fb3c]
xchg ebp, eax
cmp al, 0xf5
invalid

Function at 0x416305
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub ebx, 0x5887
pop ebx
mov eax, dword [ebp - 0xac4]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xa60]
movzx eax, byte [edx]
cmp ecx, eax
jle 0x416331
mov dword [ebp - 0x15c8], 1
jmp 0x41633b
mov dword [ebp - 0x15c8], 0xffffffff
mov ecx, dword [ebp - 0x15c8]
mov dword [ebp - 0xc84], ecx
jmp 0x4163ad
Function at 0x416bc3
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
or edi, 0x8968
pop edi
push ecx
push ecx
add esp, 4
add ecx, 0x1fb4
sub ecx, 0x126a
pop ecx
push ebx
or ebx, 0x1733b
pop ebx
push ecx
push ebx
add esp, 4
add ecx, 0x1798
pop ecx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push edx
push ecx
add esp, 4
add edx, 0x3114
sub edx, 0x8a5
call fcn.00416bc3
add byte [ecx + 0x3a], cl
dec esi
dec ebp
xor al, 0x38
add esp, 4
call 0x416bd3
add byte [esi], dh
inc ebp
push eax
cmp al, byte [eax + 0x3d]
push eax
add esp, 4
pop edx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x416bfa
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x416c5d
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x416b19
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x416b19
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x416c47
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x416c51
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x416ca6
push esi
or esi, 0x5432
call 0x416c79
add byte [ebx + 0x4c], al
dec ebx
xor dh, byte [esi]
add esp, 4
jmp 0x416c83
pop esi
push esi
and esi, 0x8d5f
xor esi, 0x137d2
xor esi, 0x7f55
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x416d0e
push esi
sub esi, 0x10232
add esi, 0x63ae
and esi, 0x27f1
pop esi
push esi
push edx
add esp, 4
add esi, 0xac80
or esi, 0x13cd2
pop esi
push edi
push ebx
add esp, 4
or edi, 0x3f98
pop edi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x416d04
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x416aba
mov dword [ebp - 0x31c], 0
Function at 0x416bd3
Capabilities:
Get number of processors
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push edi
push ebx
add esp, 4
or edi, 0x8968
pop edi
push ecx
push ecx
add esp, 4
add ecx, 0x1fb4
sub ecx, 0x126a
pop ecx
push ebx
or ebx, 0x1733b
pop ebx
push ecx
push ebx
add esp, 4
add ecx, 0x1798
pop ecx
mov eax, dword [ebp - 0xc90]
mov cx, word [eax]
mov word [ebp - 0x1032], cx
mov edx, dword [ebp - 0xc90]
add edx, 2
mov dword [ebp - 0xc90], edx
mov ax, word [ebp - 0x1032]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc94]
mov dx, word [ecx]
mov word [ebp - 0x1034], dx
mov eax, dword [ebp - 0xc94]
add eax, 2
mov dword [ebp - 0xc94], eax
mov cx, word [ebp - 0x1034]
mov word [ebp - 0x10c], cx
push edx
push ecx
add esp, 4
add edx, 0x3114
sub edx, 0x8a5
call fcn.00416bc3
add byte [ecx + 0x3a], cl
dec esi
dec ebp
xor al, 0x38
add esp, 4
call 0x416bd3
add byte [esi], dh
inc ebp
push eax
cmp al, byte [eax + 0x3d]
push eax
add esp, 4
pop edx
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x416bfa
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e0], eax
jmp 0x416c5d
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x416b19
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x416b19
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x416c47
mov dword [ebp - 0x15dc], 0xffffffff
jmp 0x416c51
mov dword [ebp - 0x15dc], 1
mov edx, dword [ebp - 0x15dc]
mov dword [ebp - 0x15e0], edx
cmp dword [ebp - 0x15e0], 0
jne 0x416ca6
push esi
or esi, 0x5432
call 0x416c79
add byte [ebx + 0x4c], al
dec ebx
xor dh, byte [esi]
add esp, 4
jmp 0x416c83
pop esi
push esi
and esi, 0x8d5f
xor esi, 0x137d2
xor esi, 0x7f55
pop esi
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x31c], eax
jmp 0x416d0e
push esi
sub esi, 0x10232
add esi, 0x63ae
and esi, 0x27f1
pop esi
push esi
push edx
add esp, 4
add esi, 0xac80
or esi, 0x13cd2
pop esi
push edi
push ebx
add esp, 4
or edi, 0x3f98
pop edi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x416d04
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x416aba
mov dword [ebp - 0x31c], 0