joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401045
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x405108
call fcn.00401dd4
mov edi, 0x94
mov eax, edi
call fcn.00401e20
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4072b8], ecx
mov eax, dword [esi + 4]
mov dword [0x4072c4], eax
mov edx, dword [esi + 8]
mov dword [0x4072c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4072bc], esi
cmp ecx, 2
je 0x4010a5
or esi, 0x8000
mov dword [0x4072bc], esi
shl eax, 8
add eax, edx
mov dword [0x4072c0], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4010e0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4010e0
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010f8
cmp eax, 0x20b
je 0x4010e5
mov dword [ebp - 0x1c], esi
jmp 0x40110c
cmp dword [ecx + 0x84], 0xe
jbe 0x4010e0
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x401106
cmp dword [ecx + 0x74], 0xe
jbe 0x4010e0
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401d83
pop ecx
test eax, eax
jne 0x401138
cmp dword [0x4072a8], 1
jne 0x401125
call fcn.0040152c
push 0x1c
call fcn.004013b5
push 0xff
call fcn.0040121e
pop ecx
pop ecx
call fcn.00401ce1
mov dword [ebp - 4], esi
call fcn.00401b36
test eax, eax
jge 0x401151
push 0x1b
call fcn.00401020
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4077f4], eax
call fcn.00401a14
mov dword [0x4072a0], eax
call fcn.00401972
test eax, eax
jge 0x401177
push 8
call fcn.00401020
pop ecx
call fcn.0040173f
test eax, eax
jge 0x401188
push 9
call fcn.00401020
pop ecx
call fcn.0040124e
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x40119b
push eax
call fcn.00401020
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004016d6
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x4011bc
movzx eax, word [ebp - 0x34]
jmp 0x4011bf
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00401000
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4011dd
push edi
call fcn.00401375
call fcn.00401397
jmp 0x40120f
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401e0f
ret
Function at 0x4012b3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x4072f8], esi
push edi
jne 0x4012d3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x4072f4], esi
mov byte [0x4072f0], al
jne 0x401339
mov ecx, dword [0x4077e8]
test ecx, ecx
je 0x40131a
mov eax, dword [0x4077e4]
sub eax, 4
cmp eax, ecx
jmp 0x401313
mov eax, dword [eax]
test eax, eax
je 0x401305
call eax
mov eax, dword [0x4077e4]
sub eax, 4
cmp eax, dword [0x4077e8]
mov dword [0x4077e4], eax
jae 0x4012fd
mov eax, 0x40701c
mov esi, 0x407020
cmp eax, esi
mov edi, eax
jae 0x401339
mov eax, dword [edi]
test eax, eax
je 0x401332
call eax
add edi, 4
cmp edi, esi
jb 0x40132a
mov eax, 0x407024
mov esi, 0x407028
cmp eax, esi
mov edi, eax
jae 0x401358
mov eax, dword [edi]
test eax, eax
je 0x401351
call eax
add edi, 4
cmp edi, esi
jb 0x401349
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x401373
push dword [ebp + 8]
mov dword [0x4072f8], 1
call fcn.0040121e
pop ecx
pop ebp
ret

Function at 0x4013b5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x407160]
xor eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 4], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x407038]
je 0x4013e2
inc eax
cmp eax, 0x12
jb 0x4013d3
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x407038]
jne 0x401516
mov eax, dword [0x4072a8]
cmp eax, 1
je 0x4014f1
cmp eax, edx
jne 0x401412
cmp dword [0x407034], 1
je 0x4014f1
cmp ecx, 0xfc
je 0x401516
push 0x104
lea eax, [ebp - 0x10c]
push eax
push edx
mov byte [ebp - 8], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40144b
lea eax, [ebp - 0x10c]
push str._program_name_unknown_
push eax
call fcn.00402020
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea edi, [ebp - 0x10c]
call fcn.00402250
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40148d
lea eax, [ebp - 0x10c]
push eax
call fcn.00402250
mov edi, eax
lea eax, [ebp - 0x10c]
sub eax, 0x3b
push 3
add edi, eax
push 0x405478
push edi
call fcn.00402120
add esp, 0x10
push edi
call fcn.00402250
push dword [esi + 0x40703c]
mov ebx, eax
call fcn.00402250
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00401e20
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00402020
push edi
push ebx
call fcn.00402030
push 0x405458
push ebx
call fcn.00402030
push dword [esi + 0x40703c]
push ebx
call fcn.00402030
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00401f19
add esp, 0x2c
jmp 0x401516
push edx
lea eax, [ebp + 8]
push eax
lea esi, [esi + 0x40703c]
push dword [esi]
call fcn.00402250
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.0040230c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f19
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x407414], ebx
push esi
push edi
jne 0x401f99
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x401fd4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40550c
push edi
call esi
test eax, eax
mov dword [0x407414], eax
je 0x401fd4
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x407418], eax
call esi
cmp dword [0x4072b8], 2
mov dword [0x40741c], eax
jne 0x401f99
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x407424], eax
je 0x401f99
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x407420], eax
mov eax, dword [0x407420]
test eax, eax
je 0x401fde
call eax
test eax, eax
je 0x401fc5
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x407424]
test eax, eax
je 0x401fc5
test byte [ebp - 8], 1
jne 0x401fde
cmp dword [0x4072c4], 4
jb 0x401fd8
or byte [ebp + 0x12], 0x20
jmp 0x401ffd
xor eax, eax
jmp 0x40200d
or byte [ebp + 0x12], 4
jmp 0x401ffd
mov eax, dword [0x407418]
test eax, eax
je 0x401ffd
call eax
mov ebx, eax
test ebx, ebx
je 0x401ffd
mov eax, dword [0x40741c]
test eax, eax
je 0x401ffd
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x407414]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4046c8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00401e20
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40475d
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x4072b8]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x40475d
cmp eax, 1
je 0x404775
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40475d
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x404732
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x404759
xor eax, eax
inc eax
jmp 0x404791
cmp esi, ebx
jae 0x404761
xor eax, eax
jmp 0x404791
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4072b8]
jmp 0x404777
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10028f64
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10028f64
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10
Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.10028f64
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10028f64
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10028f64
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.10028f64
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10028f64
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x100133d0
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002d3b0
call fcn.10017005
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x100133fb
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x10013586
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1002f4d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001341f
mov eax, 0x80004005
jmp 0x10013586
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.10028f64
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10028f64
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.10028f64
test al, al
je 0x1001355e
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100194b0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.10028f64
add esp, 0x14
test eax, eax
jne 0x100134d8
push 0x2f
push edi
call fcn.10028f64
pop ecx
pop ecx
test eax, eax
je 0x100134f8
add eax, 2
push 0x2e
push eax
call fcn.10028f64
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10028f64
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x10013557
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10028f64
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10013549
lea eax, [ebp - 0x218]
push eax
call fcn.10028f64
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001354f
push edi
call fcn.10028f64
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x1001356f
mov esi, 0x80004005
jmp 0x10013578
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.10028f64
push eax
lea ecx, [ebx + 0x10]
call fcn.10028f64
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016faf
ret 0xc
Function at 0x10013c40
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002d483
call fcn.10017005
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013d7c
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.100194b0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.10028f64
add esp, 0x18
test eax, eax
jne 0x10013ce1
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.10028f64
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013d20
cmp dword [ebp - 0x818], 0
jne 0x10013d20
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.10028f64
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009bb3
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013d7c
cmp dword [ebp - 0x818], 0
jne 0x10013d7c
test esi, esi
jns 0x10013d7c
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016faf
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10028f64
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x29a01815
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x29a169b8]
jne 0x29a0181f
repz ret
jmp fcn.29a0e56f

Function at 0x29a0b79d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x29a0b7ac
pop dword [ebp - 0x40]
mov eax, 0x67bda632
add eax, 0xc1e3117a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x34c34636
add dword [ebp - 0x50], 0x198eff15
mov dword [ebp - 0x4c], 0x5292d145
add dword [ebp - 0x4c], 0xdfa07b00
mov dword [ebp - 0x48], 0x48de43fd
sub dword [ebp - 0x48], 0xfc91ffcf
mov dword [ebp - 0x44], 0x2a975ca7
sub dword [ebp - 0x44], 0x2a975ca7
lea eax, [ebp - 0x50]
push eax
mov eax, 0x95dd867e
add eax, 0x93c37a26
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x3d8a1bd4
add dword [ebp - 0x50], 0x36e84d82
mov dword [ebp - 0x4c], 0xa0bfe4b1
sub dword [ebp - 0x4c], 0x5f53833c
mov dword [ebp - 0x48], 0x92c6bc70
add dword [ebp - 0x48], 0xd0a8affc
mov dword [ebp - 0x44], 0x95e26e32
sub dword [ebp - 0x44], 0x95e26e32
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xf7788bd3
add eax, 0x322874c9
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3c321
push 0
call eax
mov ecx, 0x5328
mov edx, eax
mov ebx, 0x389dc1fc
sub ebx, 0xefbd3fc
add ebx, dword [ebp - 0x40]
mov esi, 0x426b7fc1
add esi, 0x1323eb93
sub dword [ebp - 0xc], esi
mov edi, dword [ebx]
mov dword [ebp - 0x38], 0x60b8a887
xor edi, esi
mov dword [edx], edi
sub dword [ebp - 0x38], 0xeb26035d
add edx, 4
add ebx, 0x57380f8d
add ebx, 0xa8c7f077
loop 0x29a0b8c8
add eax, 0x572328ad
add eax, 0xa8de16c6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5e6274b7
add ecx, 0xcb3d8b49
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4032c9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403323
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403323
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x403313
cmp esi, ecx
jae 0x403323
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x403301
cmp esi, ecx
jae 0x403323
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
jmp 0x403325
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4096fc
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor al, al
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x409858
mov edx, 0x10000000
cmp ecx, 0x7c
je 0x409858
cmp ecx, 0x29
jne 0x40973c
cmp dword [esi + 0x10], 0
jne 0x409858
lea edi, [esi + 0x50]
test dword [edi], edx
je 0x40985c
jmp 0x409816
lea edi, [esi + 0x50]
cmp ecx, 0x2e
jne 0x40975a
push 5
lea ecx, [esi + 0x24]
call fcn.00409971
mov ecx, esi
call fcn.004096d3
jmp 0x409846
cmp ecx, 0x5c
jne 0x4097b0
mov ecx, esi
call fcn.004096d3
test byte [edi], 0x80
je 0x4097a4
movzx eax, word [esi + 0x48]
mov ecx, eax
cmp eax, 0x62
jne 0x40978c
push 4
lea ecx, [esi + 0x24]
call fcn.00409971
mov ecx, esi
call fcn.004096d3
jmp 0x40984d
cmp ecx, 0x42
jne 0x4097a4
push 4
lea ecx, [esi + 0x24]
call fcn.00409971
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x409780
mov ecx, esi
call fcn.0040a509
jmp 0x409846
cmp ecx, 0x5b
jne 0x4097d0
mov ecx, esi
call fcn.004096d3
mov ecx, esi
call fcn.0040a4bd
cmp dword [esi + 0x4c], 0x5d
je 0x40974e
push 4
jmp 0x40985e
cmp ecx, 0x28
jne 0x4097ed
mov ecx, esi
call fcn.004096d3
mov ecx, esi
call fcn.0040a5ae
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x40985c
jmp 0x40983b
cmp ecx, 0x5e
jne 0x4097f6
push 2
jmp 0x409778
cmp ecx, 0x24
jne 0x409802
push 3
jmp 0x409778
cmp ecx, 0x2a
je 0x409854
cmp ecx, 0x2b
je 0x409854
cmp ecx, 0x3f
je 0x409854
cmp ecx, 0x7b
je 0x409854
cmp ecx, 0x7d
jne 0x409823
test dword [edi], edx
jne 0x40982c
push 6
jmp 0x40985e
cmp ecx, 0x5d
jne 0x40982c
test dword [edi], edx
je 0x4097c9
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0040a719
mov bl, 1
mov ecx, esi
call fcn.004096d3
test bl, bl
je 0x40984d
mov ecx, esi
call fcn.0040a633
mov al, 1
jmp 0x409703
push 0xa
jmp 0x40985e
pop edi
pop esi
pop ebx
ret
push 5
call fcn.00408830
int3