joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ece0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x30], 0x54
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x38], 0x54
mov dword [ebp - 0x28], 0x1d
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x40], 0x59
mov dword [ebp - 0x44], 0x31
mov dword [ebp - 0x48], 0x2d
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 0x3f
mov dword [ebp - 0x24], 0x54
mov dword [ebp - 0x2c], 0x53
mov dword [ebp - 0x18], 0x55
mov dword [ebp - 0x50], 5
mov dword [ebp - 4], 1
mov dword [ebp - 0x54], 0x2a
mov dword [ebp - 0x58], 2
mov dword [ebp - 0x5c], 0x53
mov dword [ebp - 0x14], 0x30
mov dword [ebp - 0x60], 0x3d
mov dword [ebp - 0x10], 0x46
mov dword [ebp - 0x64], 0x33
mov dword [ebp - 0x68], 0x48
mov dword [ebp - 0x6c], 0x23
mov dword [ebp - 8], 0
jmp 0x41eda7
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jge 0x41edba
mov edx, dword [ebp + 0x28]
xor edx, 0x30
mov dword [ebp + 0x28], edx
jmp 0x41ed9e
mov eax, dword [ebp - 0x14]
or eax, 0x14
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x14]
add ecx, 1
mov dword [ebp + 0x14], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x20], 0x18
je 0x41ede4
mov eax, dword [ebp - 0x18]
xor eax, 0x3e
mov dword [ebp - 0x18], eax
cmp dword [ebp - 4], 2
jl 0x41edc3
mov dword [ebp - 0xc], 0
jmp 0x41edfc
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 0x28]
sub edx, 0x68
cmp dword [ebp - 0xc], edx
jge 0x41ee24
cmp dword [ebp - 0x10], 0x44
jge 0x41ee22
cmp dword [ebp - 0x24], 0x41
jle 0x41ee22
mov eax, dword [ebp - 0x1c]
sub eax, 7
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41edf3
cmp dword [ebp + 0x18], 0x5e
jge 0x41ee42
cmp dword [ebp - 0x28], 0x3f
jge 0x41ee42
cmp dword [ebp - 0x2c], 0xd
jge 0x41ee42
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov esp, ebp
pop ebp
ret
Function at 0x41efc0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x48], 0x39
mov dword [ebp - 0x30], 0x15
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x14], 0x37
mov dword [ebp - 0x18], 0x4e
mov dword [ebp - 0x3c], 0x2d
mov dword [ebp - 0x4c], 0x60
mov dword [ebp - 0x20], 0x33
mov dword [ebp - 0x50], 0x5c
mov dword [ebp - 0x1c], 0x48
mov dword [ebp - 0xc], 0x1b
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x2c
mov dword [ebp - 0x54], 0x1a
mov dword [ebp - 0x58], 0x33
mov dword [ebp - 0x28], 0x5a
mov dword [ebp - 0x5c], 0x17
mov dword [ebp - 0x2c], 0x48
mov dword [ebp - 0x44], 0x5d
mov dword [ebp - 0x60], 0x1f
mov dword [ebp - 0x64], 0x2b
mov dword [ebp - 0x34], 0x2e
mov dword [ebp - 0x24], 0x3a
mov dword [ebp - 0x40], 0x5a
mov dword [ebp - 0x68], 0x18
mov dword [ebp - 0x10], 0
jmp 0x41f087
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x47
cmp dword [ebp - 0x10], ecx
jge 0x41f09d
mov edx, dword [ebp - 0x14]
or edx, 0x57
mov dword [ebp - 0x14], edx
jmp 0x41f07e
mov eax, dword [ebp - 0x20]
add eax, 0x13
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x3b
push ecx
mov edx, dword [ebp + 0x1c]
sub edx, 3
push edx
mov eax, dword [ebp - 0x28]
sub eax, 0x2c
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x1e
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x10
push edx
mov eax, dword [ebp - 0x20]
sub eax, 0x26
push eax
call fcn.00427000
add esp, 0x1c
mov ecx, dword [ebp - 4]
xor ecx, 0x34
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0x31
jle 0x41f103
cmp dword [ebp + 0x14], 0x54
je 0x41f103
cmp dword [ebp - 0x2c], 0x2d
je 0x41f103
mov eax, dword [ebp + 0x14]
and eax, 0x21
mov dword [ebp + 0x14], eax
cmp dword [ebp - 8], 0x2d
jl 0x41f0d6
mov ecx, dword [ebp - 0x30]
add ecx, 0x33
push ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x2b
push edx
mov eax, dword [ebp - 8]
add eax, 3
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0x10
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x40
push edx
mov eax, dword [ebp + 8]
sub eax, 0x25
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, 8
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x37
push edx
mov eax, dword [ebp - 0x40]
sub eax, 0x34
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x35
push ecx
call fcn.00423d80
add esp, 0x28
cmp dword [ebp + 8], 0x28
jle 0x41f166
mov edx, dword [ebp - 0x24]
xor edx, 7
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0x53
je 0x41f18a
cmp dword [ebp - 0x44], 0x5a
jne 0x41f18a
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0xc]
sub ecx, 9
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 4], 0x36
jl 0x41f157
mov esp, ebp
pop ebp
ret
Function at 0x41fdc0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0xc], 0x25
mov dword [ebp - 0x18], 0x46
mov dword [ebp - 4], 0x2d
mov dword [ebp - 0x3c], 0x20
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x54], 0x36
mov dword [ebp - 0x4c], 0x5f
mov dword [ebp - 0x10], 0x1e
mov dword [ebp - 0x20], 0x57
mov dword [ebp - 0x14], 0x30
mov dword [ebp - 0x30], 0x5d
mov dword [ebp - 0x24], 0x1b
mov dword [ebp - 0x58], 0x5e
mov dword [ebp - 0x5c], 0x15
mov dword [ebp - 0x34], 0x1b
mov dword [ebp - 0x48], 0x14
mov dword [ebp - 0x44], 0x13
mov dword [ebp - 0x50], 0x3e
mov dword [ebp - 8], 0x41
mov dword [ebp - 0x1c], 0x2d
mov dword [ebp - 0x60], 0x2c
mov dword [ebp - 0x2c], 0x4c
mov dword [ebp - 0x38], 0x17
mov dword [ebp - 0x40], 0x41
mov dword [ebp - 0x64], 0xc
cmp dword [ebp - 4], 0x37
jne 0x41fe84
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 8], 0x42
jl 0x41fe75
cmp dword [ebp - 0x14], 0x31
jge 0x41ff07
cmp dword [ebp - 0x40], 0x21
jle 0x41feb7
cmp dword [ebp - 0x44], 0x5e
jge 0x41feb7
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x1c], 0x49
jge 0x41ff05
cmp dword [ebp - 0x20], 0x35
jge 0x41ff05
cmp dword [ebp - 0x30], 0xd
jle 0x41ff05
cmp dword [ebp - 0x48], 0x3c
je 0x41ff05
cmp dword [ebp - 0x18], 0x64
jle 0x41ff05
cmp dword [ebp - 0x4c], 7
jne 0x41ff05
cmp dword [ebp - 4], 8
jne 0x41ff05
cmp dword [ebp - 0x50], 0x21
jle 0x41ff05
cmp dword [ebp - 0x54], 0x3c
jle 0x41ff05
cmp dword [ebp - 0x10], 0x49
jle 0x41ff05
mov edx, dword [ebp - 0x1c]
or edx, 0x27
mov dword [ebp - 0x1c], edx
jmp 0x41fe9c
cmp dword [ebp - 0x24], 0x62
jne 0x41ff16
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x38], 0x13
jne 0x41ff61
cmp dword [ebp - 4], 2
jle 0x41ff61
cmp dword [ebp - 4], 0x35
jle 0x41ff61
cmp dword [ebp - 0x34], 0x63
jne 0x41ff61
cmp dword [ebp - 8], 6
je 0x41ff61
cmp dword [ebp - 0x30], 0x48
jge 0x41ff61
cmp dword [ebp - 0x58], 3
jne 0x41ff61
cmp dword [ebp - 0x34], 0x1a
je 0x41ff61
cmp dword [ebp - 0x10], 0x39
jle 0x41ff61
cmp dword [ebp - 4], 2
jge 0x41ff61
cmp dword [ebp - 0x10], 0x5a
jne 0x41ff61
mov ecx, dword [ebp - 0xc]
xor ecx, 0x1d
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x10], 0x3d
jne 0x41ff7c
cmp dword [ebp - 0x38], 0x5f
jne 0x41ff7c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x28], 4
jl 0x41ff16
mov ecx, dword [ebp - 0x3c]
xor ecx, 0x35
mov dword [ebp - 0x3c], ecx
mov esp, ebp
pop ebp
ret
Function at 0x420b10
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x44], 0x11
mov dword [ebp - 0x30], 0x51
mov dword [ebp - 0x34], 0x24
mov dword [ebp - 0x14], 0x36
mov dword [ebp - 0x24], 0x3d
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x38], 0x2a
mov dword [ebp - 0x20], 0x19
mov dword [ebp - 0x4c], 0x1a
mov dword [ebp - 0x18], 0x5c
mov dword [ebp - 0x2c], 0x22
mov dword [ebp - 0x3c], 0x15
mov dword [ebp - 0x1c], 0x3f
mov dword [ebp - 0x50], 0x4d
mov dword [ebp - 0x28], 0x46
mov dword [ebp - 0x54], 0x38
mov dword [ebp - 0x58], 0x13
mov dword [ebp - 0x40], 0x5c
mov dword [ebp - 0xc], 0x24
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x5c], 0x3f
mov dword [ebp - 8], 0x2a
mov dword [ebp - 0x10], 0x50
mov dword [ebp - 0x60], 0x3e
mov dword [ebp - 0x64], 5
cmp dword [ebp - 4], 0x60
jne 0x420bd4
mov eax, dword [ebp - 4]
xor eax, 0x44
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0x25
jge 0x420c15
cmp dword [ebp - 4], 0x60
jle 0x420c01
cmp dword [ebp - 0x20], 0x3d
jle 0x420c01
cmp dword [ebp - 4], 0x20
jge 0x420c01
cmp dword [ebp - 8], 0x3f
jne 0x420c01
cmp dword [ebp - 0x24], 0x1d
jge 0x420c01
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x1c]
or eax, 0x35
mov dword [ebp - 0x1c], eax
jmp 0x420bd4
cmp dword [ebp - 0x28], 1
jne 0x420c30
cmp dword [ebp - 0x14], 0x3c
je 0x420c30
cmp dword [ebp - 0x2c], 0x62
jge 0x420c30
mov ecx, dword [ebp - 0x10]
and ecx, 0x33
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0x1c
push edx
mov eax, dword [ebp - 0x34]
sub eax, 0x24
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0x2a
push ecx
mov edx, dword [ebp - 8]
add edx, 2
push edx
mov eax, dword [ebp - 0x38]
sub eax, 5
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
push ecx
mov edx, dword [ebp + 8]
sub edx, 0x20
push edx
mov eax, dword [ebp - 0x3c]
sub eax, 0xf
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x1f
push ecx
call fcn.0041e030
add esp, 0x24
cmp dword [ebp - 0x40], 0x15
je 0x420c86
mov edx, dword [ebp - 0x14]
or edx, 0x2a
mov dword [ebp - 0x14], edx
mov esp, ebp
pop ebp
ret
Function at 0x4210f0
Capabilities:
Accept command line arguments
Create process on windows
Create thread
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x38], 0x1c
mov dword [ebp - 0x3c], 0x47
mov dword [ebp - 0x30], 0x2d
mov dword [ebp - 0x2c], 0x5c
mov dword [ebp - 0x40], 0x30
mov dword [ebp - 0x10], 0x54
mov dword [ebp - 8], 0x5c
mov dword [ebp - 0x14], 0x2a
mov dword [ebp - 0x44], 0x43
mov dword [ebp - 0x20], 0xc
mov dword [ebp - 0x48], 0x35
mov dword [ebp - 0x1c], 0x52
mov dword [ebp - 0x18], 0x1e
mov dword [ebp - 0x28], 0x1d
mov dword [ebp - 0x24], 0x61
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x4c], 0x2c
mov dword [ebp - 0x50], 0x64
mov dword [ebp - 0xc], 0x3b
mov dword [ebp - 0x54], 0x24
mov dword [ebp - 0x58], 0x54
mov dword [ebp - 0x34], 0x42
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x60], 0x59
mov dword [ebp - 0x64], 0x1d
cmp dword [ebp - 0x24], 0x5f
jge 0x4211d8
cmp dword [ebp + 0x10], 0x2c
jge 0x4211d8
cmp dword [ebp - 4], 0xc
jne 0x4211d8
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
cmp dword [ebp - 0xc], 5
jle 0x4211d2
cmp dword [ebp - 0xc], 0x45
je 0x4211d2
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp dword [ebp - 0x18], 9
jge 0x4211ff
cmp dword [ebp + 0x1c], 0x5a
je 0x4211ff
cmp dword [ebp - 0x20], 5
jne 0x4211ff
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
mov ecx, dword [ebp - 8]
or ecx, 4
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, dword [ebp + 0x1c]
add edx, 6
mov dword [ebp + 0x1c], edx
cmp dword [ebp - 4], 0x1a
jge 0x421243
mov eax, dword [ebp + 0xc]
and eax, 0x3d
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x1c], 0x5c
jne 0x421241
cmp dword [ebp - 0x28], 5
jge 0x421241
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov edx, dword [ebp - 0x14]
add edx, 0x25
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x421208
cmp dword [ebp - 8], 0xf
je 0x4212be
cmp dword [ebp - 0x10], 0x32
jle 0x4212be
cmp dword [ebp + 0x14], 0x13
jge 0x4212be
cmp dword [ebp - 0xc], 0x59
jne 0x4212be
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [ebp - 0x18], 0x13
jle 0x4212b8
cmp dword [ebp - 8], 0x59
je 0x4212b8
cmp dword [ebp - 4], 0x12
jle 0x4212b8
cmp dword [ebp - 0x1c], 0x20
jge 0x4212b8
cmp dword [ebp - 0x20], 0x56
jne 0x4212b8
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x2c], 0x39
jne 0x4212b2
cmp dword [ebp - 0x30], 0x43
jle 0x4212ac
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [ebp - 0x34], 0x3f
jne 0x4212ac
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
mov eax, dword [ebp - 0x10]
sub eax, 0x3c
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call dword [sym.imp.USER32.dll_SetWindowLongA]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret
Function at 0x422e10
Capabilities:
Clear file content
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x2c], 0x4d
mov dword [ebp - 0x24], 0x2b
mov dword [ebp - 0x20], 0xd
mov dword [ebp - 0x14], 0x16
mov dword [ebp - 0x30], 0x49
mov dword [ebp - 0x34], 0x25
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x10], 0x22
mov dword [ebp - 0x3c], 0x63
mov dword [ebp - 0x40], 0x57
mov dword [ebp - 0x44], 0x3f
mov dword [ebp - 0x48], 0x3f
mov dword [ebp - 8], 0x18
mov dword [ebp - 0x4c], 0x5d
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 0x28], 0x2a
mov dword [ebp - 0x50], 0x25
mov dword [ebp - 0x1c], 0x52
mov dword [ebp - 0xc], 0x3c
mov dword [ebp - 0x54], 5
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x5c], 0x18
mov dword [ebp - 0x60], 0x14
cmp dword [ebp - 8], 0x3f
jge 0x422ee4
cmp dword [ebp - 8], 8
jge 0x422ee4
cmp dword [ebp + 0x24], 0x44
jle 0x422ee4
call dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp dword [ebp - 0x18], 0x30
je 0x422ede
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [ebp - 0x10]
add ecx, 0x49
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x422eff
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x51
cmp dword [ebp - 4], eax
jge 0x422f39
cmp dword [ebp - 0x20], 0x38
jle 0x422f37
cmp dword [ebp - 0x24], 0x22
jge 0x422f37
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
cmp dword [ebp - 0x28], 0x4b
jne 0x422f31
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
and ecx, 0x2b
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x422ef6
mov esp, ebp
pop ebp
ret
Function at 0x423d80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x28], 0xd
mov dword [ebp - 0xc], 0x2f
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x50
mov dword [ebp - 0x2c], 0x21
mov dword [ebp - 0x10], 0x53
mov dword [ebp - 0x30], 0xd
mov dword [ebp - 0x14], 0x41
mov dword [ebp - 0x34], 0xa
mov dword [ebp - 0x38], 0x16
mov dword [ebp - 0x3c], 0x2c
mov dword [ebp - 0x40], 0x2e
mov dword [ebp - 0x44], 0x2a
mov dword [ebp - 0x18], 0x5b
mov dword [ebp - 0x48], 0x31
mov dword [ebp - 0x4c], 0x16
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x50], 0x42
mov dword [ebp - 0x54], 0x47
mov dword [ebp - 8], 0x11
mov dword [ebp - 0x58], 9
mov eax, dword [ebp - 0xc]
sub eax, 7
push eax
call fcn.0041e640
add esp, 4
cmp dword [ebp + 8], 1
jge 0x423e8e
cmp dword [ebp - 0x10], 6
jge 0x423e7a
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x14], 7
jle 0x423e7a
cmp dword [ebp - 0x18], 0x61
je 0x423e7a
cmp dword [ebp - 0x1c], 0x3e
jne 0x423e7a
cmp dword [ebp + 0x2c], 0x10
jle 0x423e74
cmp dword [ebp - 0x20], 8
jge 0x423e74
cmp dword [ebp + 0xc], 0x5c
jne 0x423e74
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 4]
or ecx, 0x5f
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x423e2f
mov esp, ebp
pop ebp
ret
Function at 0x4257e0
Capabilities:
Allocate thread local storage
Shutdown system
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x24], 0x26
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x40], 0x26
mov dword [ebp - 0x44], 0x15
mov dword [ebp - 0x3c], 0x1c
mov dword [ebp - 0x20], 0x46
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x48], 0x5b
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x2c], 0x52
mov dword [ebp - 0x18], 0x5f
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x54], 0x10
mov dword [ebp - 0x30], 0x13
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x58], 0x5b
mov dword [ebp - 0x34], 0x37
mov dword [ebp - 0x5c], 0x4e
mov dword [ebp - 0x60], 0x10
mov dword [ebp - 0xc], 0x60
mov dword [ebp - 0x64], 0x25
mov dword [ebp - 0x68], 0x58
mov dword [ebp - 0x38], 0x12
mov dword [ebp - 0x6c], 0x4b
mov eax, dword [ebp - 4]
add eax, 0x51
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x59
push ecx
mov edx, dword [ebp - 0x24]
add edx, 0xd
push edx
mov eax, dword [ebp - 0x28]
add eax, 0x4e
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x12
push ecx
call fcn.00425c50
add esp, 0x14
mov dword [ebp - 8], 0
jmp 0x4258cb
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x1c]
sub eax, 4
cmp dword [ebp - 8], eax
jge 0x425911
cmp dword [ebp - 0x2c], 0x1c
jge 0x42590f
cmp dword [ebp - 0x30], 0x33
jge 0x42590f
cmp dword [ebp - 0xc], 0x34
jle 0x42590f
cmp dword [ebp - 4], 0x20
jle 0x42590f
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x34], 0x59
jle 0x425909
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
jmp 0x4258c2
mov dword [ebp - 0x10], 0
jmp 0x425923
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x45
cmp dword [ebp - 0x10], eax
jge 0x42594b
cmp dword [ebp - 0x38], 0x38
jne 0x425949
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp dword [ebp - 0x18], 0x11
jne 0x425949
mov ecx, dword [ebp - 4]
sub ecx, 0x11
mov dword [ebp - 4], ecx
jmp 0x42591a
mov dword [ebp - 0x14], 0
jmp 0x42595d
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x3c]
sub eax, 0x1b
cmp dword [ebp - 0x14], eax
jge 0x425973
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
jmp 0x425954
mov esp, ebp
pop ebp
ret
Function at 0x425c50
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x4c], 0xc
mov dword [ebp - 0x30], 0x55
mov dword [ebp - 0x50], 0x2c
mov dword [ebp - 0x28], 0x36
mov dword [ebp - 0x54], 0x56
mov dword [ebp - 0x48], 0x57
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0x15
mov dword [ebp - 0x44], 0x27
mov dword [ebp - 0x58], 8
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x40], 0xa
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x60], 0x64
mov dword [ebp - 0x10], 0x3d
mov dword [ebp - 4], 0x47
mov dword [ebp - 0x64], 0x38
mov dword [ebp - 0x24], 0x14
mov dword [ebp - 0x2c], 0x53
mov dword [ebp - 0x14], 0xb
mov dword [ebp - 0x68], 0x1c
mov dword [ebp - 0x1c], 0x62
mov dword [ebp - 8], 0x13
mov dword [ebp - 0x3c], 0x23
cmp dword [ebp - 8], 0x14
jge 0x425d63
cmp dword [ebp - 0x10], 0x1f
je 0x425d37
cmp dword [ebp - 4], 0x25
jge 0x425d37
cmp dword [ebp - 0x30], 0x37
jge 0x425d37
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp dword [ebp - 0x34], 0x53
jne 0x425d37
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp dword [ebp - 0x10], 0x1e
jle 0x425d37
mov eax, dword [ebp - 0x14]
add eax, 0x51
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x2c], 0x52
jle 0x425d61
cmp dword [ebp - 0x24], 0x28
jge 0x425d61
cmp dword [ebp - 4], 0x64
jle 0x425d61
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0x20]
and edx, 0x39
mov dword [ebp - 0x20], edx
jmp 0x425cfe
mov dword [ebp - 0xc], 0
jmp 0x425d75
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x13
cmp dword [ebp - 0xc], ecx
jge 0x425d91
cmp dword [ebp - 0x24], 0x2b
je 0x425d8f
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
jmp 0x425d6c
mov eax, dword [ebp - 0x2c]
sub eax, 0x2e
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x20
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x23
push edx
mov eax, dword [ebp - 4]
sub eax, 0x35
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x44
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x18
push edx
mov eax, dword [ebp - 0x40]
add eax, 0x24
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x29
push ecx
call fcn.00422e10
add esp, 0x20
mov dword [ebp - 0x18], 0
jmp 0x425de3
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x44]
sub eax, 0x26
cmp dword [ebp - 0x18], eax
jge 0x425e35
cmp dword [ebp - 0x48], 0x42
jle 0x425e33
cmp dword [ebp + 0xc], 0x5a
je 0x425e33
cmp dword [ebp + 8], 0x44
jle 0x425e33
cmp dword [ebp - 4], 0x22
je 0x425e33
cmp dword [ebp - 4], 0x54
je 0x425e33
cmp dword [ebp + 8], 0x17
jge 0x425e33
call dword [sym.imp.USER32.dll_GetParent]
cmp dword [ebp + 0x14], 0x53
jle 0x425e2d
cmp dword [ebp - 0x1c], 0x51
jge 0x425e2d
mov ecx, dword [ebp - 0x1c]
and ecx, 0x46
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
jmp 0x425dda
mov esp, ebp
pop ebp
ret
Function at 0x426920
Capabilities:
Create pipe
Get file attributes
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 0x38], 0x49
mov dword [ebp - 0x3c], 0x2d
mov dword [ebp - 0x40], 0x5a
mov dword [ebp - 0x1c], 0x37
mov dword [ebp - 0x10], 0x2f
mov dword [ebp - 0x44], 0x33
mov dword [ebp - 0x48], 0x54
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0x37
mov dword [ebp - 0x2c], 0xd
mov dword [ebp - 0x28], 0x62
mov dword [ebp - 0x54], 0x23
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x34], 0x36
mov dword [ebp - 0x14], 0x29
mov dword [ebp - 0x20], 0x45
mov dword [ebp - 0x58], 0xd
mov dword [ebp - 4], 9
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x5c], 0x4d
mov dword [ebp - 0x18], 0x40
mov dword [ebp - 0x60], 0x62
cmp dword [ebp + 0xc], 0x22
jne 0x4269e8
cmp dword [ebp - 0x14], 0x1b
jne 0x4269e8
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_BeginPaint]
cmp dword [ebp - 4], 0xa
jge 0x426a84
cmp dword [ebp - 0x20], 0x5a
jne 0x426a37
cmp dword [ebp - 0x24], 0x58
je 0x426a31
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp dword [ebp - 0xc], 0x32
jge 0x426a31
cmp dword [ebp + 0x1c], 0x4c
jle 0x426a31
cmp dword [ebp - 0x28], 0x3f
jne 0x426a31
cmp dword [ebp - 0x14], 0x44
jle 0x426a2b
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 0x2c], 0x14
je 0x426a7f
cmp dword [ebp - 0x1c], 0x1f
jge 0x426a7f
cmp dword [ebp - 0x30], 0x3c
je 0x426a7f
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x1c], 0x39
jle 0x426a7f
cmp dword [ebp + 0x10], 0x45
jne 0x426a79
cmp dword [ebp - 0x34], 0x18
jle 0x426a79
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov eax, dword [ebp + 0x20]
and eax, 0x32
mov dword [ebp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
jmp 0x4269e8
mov dword [ebp - 8], 0
jmp 0x426a96
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x24]
sub edx, 9
cmp dword [ebp - 8], edx
jge 0x426aac
mov eax, dword [ebp - 0xc]
and eax, 0x50
mov dword [ebp - 0xc], eax
jmp 0x426a8d
mov esp, ebp
pop ebp
ret