joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e173
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x40e347
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x415a40]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x40e347
test cl, 0x48
je 0x40e1de
cmp byte [eax + 5], 0xa
je 0x40e1de
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e230
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x40e218
call fcn.004085e4
mov dword [eax], 9
call fcn.004085ed
mov dword [eax], esi
jmp 0x40e228
cmp eax, 0x6d
je 0x40e347
push eax
call fcn.004085f6
pop ecx
or eax, 0xffffffff
jmp 0x40e349
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x40e342
test eax, eax
je 0x40e257
cmp byte [ebx], 0xa
jne 0x40e257
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40e260
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x40e33c
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x40e32c
cmp al, 0xd
je 0x40e292
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x40e31e
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x40e2ac
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x40e2a7
add dword [ebp + 0x10], 2
jmp 0x40e300
mov dword [ebp + 0x10], eax
jmp 0x40e31a
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e2d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40e31a
cmp dword [ebp - 0xc], 0
je 0x40e31a
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40e2f5
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40e300
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40e31d
cmp ebx, dword [ebp + 0xc]
jne 0x40e305
cmp byte [ebp - 1], 0xa
jne 0x40e305
mov byte [ebx], 0xa
jmp 0x40e31d
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040d081
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x40e31e
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x40e276
jmp 0x40e33c
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x40e33c
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x40e349
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e8af
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x40e8c8
or eax, 0xffffffff
jmp 0x40e929
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x40e925
push 0x3d
push esi
call fcn.0040eb1b
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x40e925
cmp esi, eax
je 0x40e925
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x413a2c]
sete cl
cmp eax, dword [0x413a30]
mov dword [ebp - 8], ecx
jne 0x40e90b
mov edi, eax
call fcn.0040e84e
mov dword [0x413a2c], eax
cmp eax, ebx
jne 0x40e964
cmp dword [ebp + 0xc], ebx
je 0x40e92d
cmp dword [0x413a34], ebx
je 0x40e92d
call fcn.0040dfa2
test eax, eax
je 0x40e964
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x40e936
xor eax, eax
jmp 0x40e928
push 4
call fcn.00405b95
cmp eax, ebx
pop ecx
mov dword [0x413a2c], eax
je 0x40e925
mov dword [eax], ebx
cmp dword [0x413a34], ebx
jne 0x40e964
push 4
call fcn.00405b95
cmp eax, ebx
pop ecx
mov dword [0x413a34], eax
je 0x40e925
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x413a2c]
call fcn.0040e801
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x40e9c5
cmp dword [esi], ebx
je 0x40e9c5
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00405ba7
cmp dword [ebp - 8], ebx
pop ecx
jne 0x40e9a8
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x40ea06
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x40e99f
mov eax, edi
shl eax, 2
push eax
push dword [0x413a2c]
call fcn.004068cb
cmp eax, ebx
pop ecx
pop ecx
je 0x40ea06
jmp 0x40ea01
cmp dword [ebp - 8], ebx
jne 0x40ea71
cmp edi, ebx
jge 0x40e9d4
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x413a2c]
call fcn.004068cb
cmp eax, ebx
pop ecx
pop ecx
je 0x40e925
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x413a2c], eax
cmp dword [ebp + 0xc], ebx
je 0x40ea5b
push dword [ebp - 4]
call fcn.0040a850
inc eax
inc eax
push eax
call fcn.00405b95
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x40ea5b
push dword [ebp - 4]
push esi
call fcn.00408780
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x40ea54
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00405ba7
pop ecx
cmp dword [ebp - 8], ebx
je 0x40ea69
push dword [ebp - 4]
call fcn.00405ba7
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x40e928
push dword [ebp - 4]
call fcn.00405ba7
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x40e932
Function at 0x4324f6
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax + 0x30], al
js 0x43252c
popal
xor byte [eax + esi + 0x64], ah
xor byte [eax + 0x30], ah
push 0x30
bound esi, qword [eax]
jne 0x432539
jno 0x43253b
xor byte fs:[ecx + 0x30], dh
je 0x432541
bound esi, qword [eax]
pushal
xor byte [ecx + 0x30], ch
jb 0x432549
popal
xor byte [ecx + 0x30], ah
arpl word [eax], si
bound esi, qword [eax]
jb 0x432553
xor byte fs:[edx + 0x30], ch
push 0x30
bound esi, qword [eax]
jbe 0x43255d
xor byte [eax + 0x30], ah
push 0x76306730
xor byte [eax + esi + 0x68], ah
xor byte [ebp + 0x30], ah
pushal
xor byte [eax + 0x30], ch
xor byte [bp + 0x30], dh
xor byte fs:[eax + 0x30], ch
xor byte gs:[ebx + 0x30], dh
jae 0x43256d
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
cmp dh, byte [eax]
xor byte [eax], dh
retf 0xddb0
ffree st(7)
and dword [0x9ce1735c], edi
les edi, [ebx + 0x62e640f6]
test byte [eax - 0x1a], 0x62
cli
xor byte [eax], dh
xor byte [eax + 0x31f04332], bh
xor byte [eax], dh
xor byte [eax], dl
inc ebp
xor byte [eax], dh
sbb byte [ebp + 0x30], al
xor byte [edi - 5], bl
inc ebx
lock xor dword [eax], esi
xor byte [eax], dh
adc byte [ebp + 0x30], al
xor byte [eax], bl
inc ebp
xor byte [eax], dh
pop edi
sti
outsb dx, byte [esi]
cmp dword [edx - 0x35], 0x39d23106
mov al, byte [0x4ef65edc]
ja 0x43255a
inc eax
or al, byte [ecx - 0x1c5c57e8]
stosd dword es:[edi], eax
push edx
xor byte [ebx], bh
xor eax, 0x30303030
xor byte [eax], dh
xor byte [eax], dh
mov al, 0x30
xor byte [edx + 0x7d4b8989], ch
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax + 0x30], bh
Function at 0x432845
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
ror ebx, 1
xchg ecx, eax
xchg ebp, eax
mov ebp, dword [ebp - 8]
xor byte [eax], dh
xor byte [eax + esi], cl
inc ebx
lock xor dword [eax], esi
xor byte [eax], dh
adc byte [ebp + 0x30], al
xor byte [eax], bl
inc ebp
xor byte [eax], dh
pop edi
sti
outsb dx, byte [esi]
cmp dword [edx - 0x35], 0x39d23106
mov al, byte [0x4ef65edc]
ja 0x4327e2
inc eax
or al, byte [ecx - 0x1c5c57e8]
jle 0x43285e
xor byte [ebx], bh
xor al, 0x30
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
add byte [eax], bl
invalid
jge 0x4327d8
xchg ebx, eax
mov byte [0x969fa39f], al
movsb byte es:[edi], byte [esi]
pop esi
xchg dword [ecx - 0x58606b62], ebx
mov dword [0x94a0855e], eax
xchg ecx, eax
movsb byte es:[edi], byte [esi]
xchg ebp, eax
pop esi
test dword [eax - 0x5b6081a2], ebp
cdq
xchg esi, eax
test eax, 0x9e9f9379
xor byte [ebx + 0x30], al
xor dword [edx - 0x5d], ecx
cmp byte [edi - 1], 0xb9
mov dl, 0x77
jecxz 0x432881
or al, 0x18
stc
xor al, 0xa6
ljmp 0x3070
arpl word [eax], si
arpl word [eax], si
xor byte [edi - 0x606b6167], al
cmpsd dword [esi], dword es:[edi]
mov dword [0x94a08550], eax
xchg ecx, eax
movsb byte es:[edi], byte [esi]
xchg ebp, eax
push eax
movsb byte es:[edi], byte [esi]
mov byte [0x9950a991], al
cdq
xchg ebx, eax
lahf
sahf
push eax
mov dword [0xa5a491a4], eax
mov dword [0x84a08530], eax
lahf
je 0x43283d
movsb byte es:[edi], byte [esi]
xchg ebp, eax
and dword [ecx + edx*4 + 0x30a3a5a4], 0x38
xor byte [eax], dh
xor byte [eax], dh
xor byte [edx], bh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [ecx], ah
xor byte [ebx - 0x10], al
xor dword [eax], esi
xor byte [eax], dh
adc byte [ebp + 0x30], al
xor byte [eax], bl
inc ebp
xor byte [eax], dh
out 0x3b, eax
fsub qword [ecx + 0x3106cb7a]
sar byte [ecx], cl
mov al, byte [0x4ef65edc]
ja 0x4328c2
inc eax
or al, byte [ecx - 0x1c5c57e8]
mov al, 0x37
xor byte [ebx], bh
xor al, 0x30
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
pop eax
jno 0x43295b
pop ebp
jnp 0x43289a
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax], dh
xor byte [eax + 0x30], bh
cmp al, 0x30
xor dword [eax], esi
insb byte es:[edi], dx
xor byte [eax + esi + 0x7d], ch
cdq
xchg ebx, eax
mov byte [0x969fa39f], al
movsb byte es:[edi], byte [esi]
pop esi
xchg dword [ecx - 0x58606b62], ebx
mov dword [0x94a0855e], eax
xchg ecx, eax
movsb byte es:[edi], byte [esi]
xchg ebp, eax
pop esi
test dword [eax - 0x5b6081a2], ebp
cdq
xchg esi, eax
test eax, 0x9e9f9379
xor byte [ebx + 0x30], al
xor dword [edx - 0x5d], ecx
cmp byte [edi - 1], 0xb9
invalid
Function at 0x100183b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100183c4
pop dword [ebp - 0x40]
mov eax, 0x19b3865
sub eax, 0xf199b4a1
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x6fac04be
add dword [ebp - 0x50], 0xdea6408d
mov dword [ebp - 0x4c], 0x1389ed15
sub dword [ebp - 0x4c], 0xe156a0d0
mov dword [ebp - 0x48], 0x2a66dbfd
add dword [ebp - 0x48], 0x21e56831
mov dword [ebp - 0x44], 0x98c2ac7c
add dword [ebp - 0x44], 0x673d5384
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x2cabe6ff
add dword [ebp - 0x50], 0x47c68257
mov dword [ebp - 0x4c], 0x508ad6b2
sub dword [ebp - 0x4c], 0xf1e753d
mov dword [ebp - 0x48], 0x1e3b9564
sub dword [ebp - 0x48], 0xbacc28f8
mov dword [ebp - 0x44], 0xd93d3522
sub dword [ebp - 0x44], 0xd93d3522
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x390fb
push 0
call eax
mov ecx, 0xa7dbad6d
add ecx, 0x58249e71
mov edx, eax
mov edi, 0x735c1e9e
sub edi, 0x6359029e
add edi, dword [ebp - 0x40]
mov esi, 0xa2503a0f
add esi, 0xd895eb10
xor dword [ebp - 0x3c], 0x86c486db
mov ebx, dword [edi]
sub ebx, esi
add dword [ebp - 0x34], 0x4e94468a
mov dword [edx], ebx
mov dword [ebp - 0x18], 0x128f9937
add edx, 4
add edi, 0x97bbf38f
add edi, 0x68440c75
loop 0x100184dc
add eax, 0x527cff12
add eax, 0xad842339
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3a0fbc46
add ecx, 0xd5f043ba
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x30012b55
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x30015078]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.30012b55
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [0x30015078]
jne 0x30012b5e
ret
jmp 0x30012a40

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x10001876
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x1002007c]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [edi + 4]
or eax, 0x2001f
mov dword [esp + 0x10], ebx
push eax
push ecx
push dword [edi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
call fcn.10002a9c
mov esi, eax
test esi, esi
je 0x100018dc
cmp dword [esp + 0xc], ebx
je 0x100018d5
push dword [esp + 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, esi
jmp 0x1000196b
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
mov ebx, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
jmp 0x10001920
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.10002a9c
mov esi, eax
test esi, esi
jne 0x10001982
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x28]
mov dword [esp + 0x38], 0x100
call ebx
test eax, eax
je 0x100018f7
cmp dword [esp + 0xc], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x1000194a
push dword [esp + 0xc]
call esi
and dword [esp + 0xc], 0
push dword [esp + 0x1c]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.10002a9c
cmp dword [esp + 0xc], 0
mov edi, eax
je 0x10001969
push dword [esp + 0xc]
call esi
mov eax, edi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10014acc
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0xc], 0
jmp 0x100018c9
Function at 0x10001ca2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x100163d3
call fcn.100154a6
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x434], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10001d1f
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x10001d1f
call fcn.1000141f
mov esi, eax
jmp 0x10001e2f
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10001d42
call fcn.1000141f
jmp 0x10001e22
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10001d38
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x10001d75
mov esi, 0x8007000e
jmp 0x10001e24
push 2
push eax
lea eax, [ebp - 0x41c]
mov byte [ebp - 4], 2
push eax
call fcn.10002a9c
test eax, eax
js 0x10001e52
cmp dword [ebp - 0x41c], 0x400
jbe 0x10001dc5
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x418]
call fcn.10002a9c
jmp 0x10001dd1
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x10001d6b
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10001d38
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.10002a9c
mov esi, eax
test edi, edi
je 0x10001e2f
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10001e48
lea ecx, [ebp - 0x418]
call fcn.10004c1d
mov eax, esi
call fcn.100153fb
ret 0x10
push eax
call fcn.10002a9c
int3
Function at 0x10002a9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10002aab
pop dword [ebp - 0x3c]
mov eax, 0x10002aab
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x33d32a40
add dword [ebp - 0x4c], 0x1a7f1b0b
mov dword [ebp - 0x48], 0xd5ac404e
sub dword [ebp - 0x48], 0xa378f409
mov dword [ebp - 0x44], 0x91b28579
add dword [ebp - 0x44], 0xba99beb5
mov dword [ebp - 0x40], 0x207506c
sub dword [ebp - 0x40], 0x207506c
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x7ef73cf5
add dword [ebp - 0x4c], 0xf57b2c61
mov dword [ebp - 0x48], 0xbd92b98b
add dword [ebp - 0x48], 0x83d9a7ea
mov dword [ebp - 0x44], 0xe39c33b
sub dword [ebp - 0x44], 0xaaca56cf
mov dword [ebp - 0x40], 0xe635fb8
sub dword [ebp - 0x40], 0xe635fb8
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x36b2d
push 0
call eax
mov ecx, 0x34ac
mov esi, eax
mov edi, 0xf437a6a6
sub edi, 0xe43536a6
add edi, dword [ebp - 0x3c]
mov ebx, 0x40796874
add ebx, 0xd663f2c
sub dword [ebp - 0x20], 0xa109dd9c
mov edx, dword [edi]
sub dword [ebp - 4], 0x898ce5c6
sub edx, ebx
mov dword [ebp - 0x24], 0xb3b19781
mov dword [esi], edx
xor dword [ebp - 0x14], eax
add esi, 4
add edi, 4
loop 0x10002bb8
add eax, 0x33350388
add eax, 0xcccbc1fb
mov ebx, eax
add eax, 0x18f09c74
add eax, 0xe70f6391
mov ecx, 0x28983ae1
add ecx, 0xe767c51f
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10009f61
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1000a0b6
mov edx, 0x10000000
cmp eax, 0x7c
je 0x1000a0b6
cmp eax, 0x29
jne 0x10009f9a
cmp dword [esi + 0x10], 0
jne 0x1000a0b6
test dword [esi + 0x50], edx
je 0x1000a0bc
cmp eax, 0x2e
jne 0x10009fb5
push 5
lea ecx, [esi + 0x24]
call fcn.10002a9c
mov ecx, esi
call fcn.10009f38
jmp 0x1000a0a0
cmp eax, 0x5c
jne 0x1000a00c
mov ecx, esi
call fcn.10009f38
test byte [esi + 0x50], 0x80
je 0x1000a000
movzx eax, word [esi + 0x48]
mov ecx, eax
cmp eax, 0x62
jne 0x10009fe8
push 4
lea ecx, [esi + 0x24]
call fcn.10002a9c
mov ecx, esi
call fcn.10009f38
jmp 0x1000a0a7
cmp ecx, 0x42
jne 0x1000a000
push 4
lea ecx, [esi + 0x24]
call fcn.10002a9c
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x10009fdc
mov ecx, esi
call fcn.10002a9c
jmp 0x1000a0a0
cmp eax, 0x5b
jne 0x1000a02c
mov ecx, esi
call fcn.10009f38
mov ecx, esi
call fcn.1000aad3
cmp dword [esi + 0x4c], 0x5d
je 0x10009fa9
push 4
jmp 0x1000a0be
cmp eax, 0x28
jne 0x1000a049
mov ecx, esi
call fcn.10009f38
mov ecx, esi
call fcn.1000ac04
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x1000a0bc
jmp 0x1000a095
cmp eax, 0x5e
jne 0x1000a052
push 2
jmp 0x10009fd4
cmp eax, 0x24
jne 0x1000a05e
push 3
jmp 0x10009fd4
cmp eax, 0x2a
je 0x1000a0b2
cmp eax, 0x2b
je 0x1000a0b2
cmp eax, 0x3f
je 0x1000a0b2
cmp eax, 0x7b
je 0x1000a0b2
cmp eax, 0x7d
jne 0x1000a07c
test dword [esi + 0x50], edx
je 0x1000a0ae
cmp eax, 0x5d
jne 0x1000a086
test dword [esi + 0x50], edx
je 0x1000a025
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10002a9c
mov bl, 1
mov ecx, esi
call fcn.10009f38
test bl, bl
je 0x1000a0a7
mov ecx, esi
call fcn.10002a9c
mov cl, 1
jmp 0x10009f68
push 6
jmp 0x1000a0be
push 0xa
jmp 0x1000a0be
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.10002a9c
int3

Function at 0x1000d3d6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push esi
push edi
mov edi, dword [ebp + 8]
sub ecx, edi
sar ecx, 1
push 0
pop esi
add ecx, ecx
je 0x1000d402
movzx eax, byte [esi + edi]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, ecx
jb 0x1000d3f1
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10013e49
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push 0x28
mov eax, 0x10017412
call fcn.10015470
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
lea eax, [esi + 4]
mov dword [ebp - 4], ebx
mov edi, ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edi
test eax, eax
je 0x10013e7f
mov ecx, eax
call fcn.10014632
xor eax, eax
inc eax
mov edi, eax
mov dword [ebp - 0x30], edi
jmp 0x10013e82
xor eax, eax
inc eax
cmp dword [esi + 0x1a8], 0x11
mov byte [ebp - 4], al
jne 0x10013f2c
mov ecx, dword [esi + 0x20]
mov edx, ebx
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x24], ecx
lea ecx, [esi + 0x38]
mov dword [ebp - 0x18], edx
cmp dword [ecx - 8], ebx
je 0x10013ed2
mov edx, dword [ebp - 0x24]
cmp dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
jg 0x10013ed2
jl 0x10013ec2
mov esi, dword [ebp - 0x20]
cmp dword [ecx], esi
mov esi, dword [ebp - 0x14]
jae 0x10013ed2
mov edx, dword [ecx]
mov dword [ebp - 0x20], edx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x24], edx
mov edx, eax
mov dword [ebp - 0x18], edx
inc eax
add ecx, 0x18
cmp eax, 0x11
jb 0x10013ea6
push edx
mov ecx, esi
call fcn.10002a9c
imul eax, dword [ebp - 0x18], 0x18
push dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea ecx, [eax + 0x14]
add ecx, esi
call fcn.10002a9c
mov ecx, dword [ebp - 0x18]
push dword [ebp + 8]
add ecx, 0x10
add ecx, esi
call fcn.10002a9c
mov ecx, dword [ebp - 0x18]
push dword [ebp + 0x10]
add ecx, 0x18
add ecx, esi
call fcn.10002a9c
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
jmp 0x10013f84
mov eax, ebx
cmp eax, 0x11
jae 0x10013f92
imul ecx, eax, 0x18
lea edx, [esi + 0x18]
add edx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
cmp dword [edx], ebx
jne 0x10014021
push dword [ebp + 0xc]
add ecx, 0x14
add ecx, esi
call fcn.10002a9c
mov ecx, dword [ebp - 0x24]
push dword [ebp + 8]
add ecx, 0x10
add ecx, esi
call fcn.10002a9c
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x20]
call fcn.10002a9c
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov dword [edx + esi + 0x20], eax
mov dword [edx + esi + 0x24], ecx
inc dword [esi + 0x1a8]
mov byte [ebp - 4], 2
test edi, edi
jle 0x10013fb5
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x10013fad
test edi, edi
jle 0x10013fad
mov ecx, esi
call fcn.10014655
dec edi
dec edi
test edi, edi
jg 0x10013f9d
mov esi, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.100143d3
mov eax, ebx
call fcn.100153db
ret 0xc
inc eax
jmp 0x10013f2e