joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5032c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564900
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0xec], 0
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], eax
mov dword [edi + 0x110], 2
mov dword [edi + 0xf4], esi
jne 0x50331b
mov eax, 2
jmp 0x503491
push 0
push esi
call fcn.00501120
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x50343b
test esi, esi
je 0x50333f
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [edi + 4]
mov byte [edi + 0x10c], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x503425
nop dword [eax]
mov eax, dword [ebp - 0x28]
cmp eax, 0x100
jb 0x503381
cmp eax, 0x109
jbe 0x50338b
add eax, 0xfffffe00
cmp eax, 0xe
ja 0x5033ed
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x5033c5
push esi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [edi + 4]
je 0x5033c5
nop dword [eax]
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [edi + 4]
jne 0x5033b0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x37f
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
je 0x503401
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x503401
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [edi + 0x10c], 0
je 0x503422
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x503370
mov esi, dword [ebp - 0x34]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
test esi, esi
je 0x50343b
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
lea eax, [ebp - 0x4c]
mov ecx, edi
push eax
call fcn.005086e0
mov esi, eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], 0
cmp eax, esi
je 0x503483
mov ecx, eax
call fcn.00408df0
movups xmm0, xmmword [esi]
mov eax, dword [ebp - 0x30]
movups xmmword [eax], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [eax + 0x10], xmm0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x4c]
call fcn.00408e50
mov eax, dword [edi + 0x110]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 8
Function at 0x506540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564a3b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x13c], ebx
mov esi, dword [0x5cdd90]
mov edi, 1
mov eax, dword [ebp + 0x14]
push 0xf0
push 0x71
push esi
mov dword [ebp - 0x144], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x506675
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x506675
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x506675
mov edx, 0x1234
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x506675
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x140], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x5066af
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.005290f0
add esp, 0xc
lea ecx, [ebp - 0x114]
push esi
call fcn.004fdd30
push dword [ebp - 0x114]
mov dword [ebp - 4], 0
push 0
push 0x143
push ebx
mov ebx, dword [ebp - 0x13c]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x114]
cmove edi, ecx
lea ecx, [ebp - 0x110]
cmp eax, ecx
je 0x506662
push eax
call fcn.004097f9
add esp, 4
mov edx, 0x1234
add esi, dword [ebp - 0x140]
test edi, edi
jne 0x5065c6
push 1
push ebx
call fcn.004fd550
mov eax, dword [ebp - 0x144]
add esp, 8
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 0x10
cmp dx, ax
jne 0x506720
push esi
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x138], 1
mov dword [ebp - 0x134], 0xffffffff
call fcn.004fdd30
lea ecx, [ebp - 0x244]
mov eax, dword [eax]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x248]
cmp eax, ecx
je 0x5066f5
push eax
call fcn.004097f9
add esp, 4
lea eax, [ebp - 0x138]
push eax
push 0
push 0x40b
push ebx
mov ebx, dword [ebp - 0x13c]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
jmp 0x506662
mov ebx, dword [ebp - 0x13c]
jmp 0x506667
Function at 0x50e890
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5652e8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x3c], 0
mov dword [ebp - 4], 1
je 0x50ea09
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00409a20
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.00409a20
mov esi, dword [esi + 0x3c]
mov eax, dword [ebp + 0x38]
mov byte [ebp - 4], 4
test eax, 0x100000
jne 0x50e9f9
and eax, 0x30000
cmp eax, 0x20000
je 0x50e9f9
cmp dword [ebp - 0x54], 0
je 0x50e9f9
cmp dword [ebp - 0x50], 8
lea eax, [ebp - 0x64]
cmovae eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x50e9f9
push 0x3c
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.005290f0
add esp, 0xc
mov dword [ebp - 0x4c], 0x3c
cmp dword [ebp - 0x50], 8
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x64]
mov dword [ebp - 0x44], 1
cmovae eax, dword [ebp - 0x64]
push ecx
push 0
push dword [ebp - 0x54]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x50e9f9
mov eax, dword [ebp - 0x40]
cmp eax, 3
je 0x50e97f
cmp eax, 4
jne 0x50e9f9
cmp dword [ebp - 0x6c], 0
je 0x50e9f9
cmp dword [ebp - 0x68], 8
lea eax, [ebp - 0x7c]
cmovae eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x50e9f9
push 0x3c
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.005290f0
add esp, 0xc
mov dword [ebp - 0x4c], 0x3c
cmp dword [ebp - 0x68], 8
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x44], 1
cmovae eax, dword [ebp - 0x7c]
push ecx
push 0
push dword [ebp - 0x6c]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x50e9f9
mov eax, dword [ebp - 0x40]
cmp eax, 3
je 0x50e9e5
cmp eax, 4
jne 0x50e9f9
push 1
lea eax, [ebp - 0x64]
push eax
push dword [esi + 0xd0]
call fcn.004bdc90
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.00408e50
lea ecx, [ebp - 0x7c]
call fcn.00408e50
lea ecx, [ebp + 8]
call fcn.00408e50
lea ecx, [ebp + 0x20]
call fcn.00408e50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 0x34
Function at 0x50f200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push 5
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 5
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 7
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [ebp + 8], 0
je 0x50f263
push dword [edi + 0xcc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x5cb420]
test eax, eax
jne 0x50f27f
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
cmp byte [edi + 0xc2], 0
mov dword [ebp - 0x24], eax
je 0x50f359
push esi
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x24]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 1
ja 0x50f358
test eax, eax
je 0x50f34e
cmp eax, 1
jne 0x50f33a
push 3
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x50f33f
mov esi, dword [edi + 4]
test esi, esi
je 0x50f30e
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x24]
cmp ecx, eax
je 0x50f2f5
push eax
push ecx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x50f30e
lea eax, [ebp - 0x20]
push eax
push 0
push 0x37f
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
je 0x50f322
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 3
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x50f2d5
jmp 0x50f33f
cmp eax, 0xffffffff
je 0x50f34e
cmp byte [edi + 0xc2], 0
jne 0x50f290
jmp 0x50f358
mov dword [edi + 0xbc], 2
pop esi
cmp dword [edi + 0xbc], 1
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4

Function at 0x50fe80
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
je 0x50ff07
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x50fea8
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x50ff07
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.005290f0
mov eax, dword [esi + 0x10]
add esp, 0xc
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], 1
jb 0x50fedc
mov esi, dword [esi]
lea ecx, [ebp - 0x40]
push ecx
push 0
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov ecx, eax
test ecx, ecx
je 0x50fef5
mov eax, dword [ebp - 0x34]
mov dword [edi], eax
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040154f
mov esp, ebp
pop ebp
ret
Function at 0x510370
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565479
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor bl, bl
mov dword [ebp - 0x54], 0
cmp dword [esi + 0x10], 0
je 0x5104dd
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x5103bb
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x5104dd
push 0x3c
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.005290f0
mov edi, dword [esi + 0x10]
xor ecx, ecx
mov edx, 2
mov dword [ebp - 0x4c], 0x3c
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042c075
add esp, 0x10
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x51041d
lea ecx, [edi*2 + 2]
push ecx
push 0
push eax
call fcn.005290f0
lea eax, [edi + 1]
add esp, 0xc
mov dword [ebp - 0x38], eax
cmp dword [esi + 0x14], 8
jb 0x510425
mov esi, dword [esi]
lea eax, [ebp - 0x4c]
push eax
push 0
push edi
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x5104cd
mov eax, dword [ebp - 0x40]
cmp eax, 3
je 0x510457
cmp eax, 4
jne 0x5104cd
mov eax, 0x1bb
cmp word [ebp - 0x34], ax
jmp 0x51045c
cmp word [ebp - 0x34], 0x50
jne 0x5104cd
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x5104ac
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x5104ac
push ecx
xor edx, edx
mov dword [ebp - 0x5c], 0
push eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x58], 7
mov word [ebp - 0x6c], dx
call fcn.00408740
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x54], 1
call fcn.0050ff20
add esp, 4
mov byte [ebp - 0x4d], 0
test al, al
jne 0x5104b0
mov byte [ebp - 0x4d], 1
test byte [ebp - 0x54], 1
je 0x5104be
lea ecx, [ebp - 0x6c]
call fcn.00408e50
cmp byte [ebp - 0x4d], 0
mov eax, 1
movzx ebx, bl
cmove ebx, eax
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x5104dd
push eax
call fcn.0041e6ef
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
Function at 0x510570
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5654bb
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x88], esi
cmp byte [esi + 0xc4], 0
mov ebx, dword [ebp + 8]
je 0x510774
cmp dword [ebx + 0x10], 0
je 0x510774
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x5105ca
mov eax, dword [ebx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x510774
push 0x3c
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.005290f0
add esp, 0xc
mov dword [ebp - 0x7c], 0x3c
cmp dword [ebx + 0x14], 8
mov eax, ebx
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x68], 1
jb 0x510608
mov eax, dword [ebx]
lea ecx, [ebp - 0x7c]
push ecx
push 0
push dword [ebx + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x510774
mov eax, dword [ebp - 0x70]
cmp eax, 3
je 0x510631
cmp eax, 4
jne 0x510774
mov eax, dword [ebp - 0x78]
mov byte [ebp - 0x7d], 0
test eax, eax
je 0x51075f
mov ecx, dword [ebp - 0x74]
test ecx, ecx
je 0x51075f
cmp dword [ebp - 0x6c], 0
je 0x51075f
cmp dword [ebp - 0x68], 0
jbe 0x51075f
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.004fdf20
push dword [ebp - 0x68]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
push dword [ebp - 0x6c]
call fcn.004fdf20
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xbc]
call fcn.00409a20
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xa4]
call fcn.00409a20
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 1
push eax
add esi, 0xe4
mov dword [ebp - 0x84], 0
lea eax, [ebp - 0x84]
mov dword [ebp - 0x8c], esi
push eax
mov ecx, esi
call fcn.0040da50
mov edi, dword [esi]
mov esi, dword [ebp - 0x84]
cmp esi, edi
je 0x5106f6
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.004721d0
add esp, 8
test al, al
je 0x5106f8
mov esi, edi
lea ecx, [ebp - 0xa4]
call fcn.00408e50
lea ecx, [ebp - 0xbc]
call fcn.00408e50
mov eax, dword [ebp - 0x8c]
cmp esi, dword [eax]
je 0x51073c
add esi, 0x40
cmp dword [esi + 0x14], 8
jb 0x510723
mov esi, dword [esi]
push esi
mov esi, dword [ebp - 0x88]
push dword [esi + 0xcc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 0x7d], 1
jmp 0x510742
mov esi, dword [ebp - 0x88]
lea ecx, [ebp - 0x28]
call fcn.00408e50
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.00408e50
cmp byte [ebp - 0x7d], 0
jne 0x510774
cmp dword [ebx + 0x14], 8
jb 0x510767
mov ebx, dword [ebx]
push ebx
push dword [esi + 0xcc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret 4
Function at 0x512750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56576b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
xor edi, edi
test ecx, ecx
je 0x5128f1
mov eax, dword [0x5cd624]
cmp ecx, eax
jne 0x5128f1
push ecx
push edi
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x5128f1
lea eax, [ebp - 0x230]
push eax
call fcn.00512ab0
add esp, 4
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], edi
cmp dword [ebp - 0x220], edi
jne 0x5127df
mov dword [ebp - 4], 0xffffffff
call fcn.00408e50
jmp 0x5128f1
push 0x56999c
call fcn.00465450
push str.AcroRdUWP.exe
lea ecx, [ebp - 0x230]
call fcn.00465450
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005290f0
add esp, 0xc
mov dword [ebp - 0x234], 0x104
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x51284b
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0xffffffff
call fcn.00408e50
jmp 0x5128f1
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040b363
add esp, 8
test eax, eax
jne 0x512834
push esi
call fcn.00472770
add esp, 4
test al, al
je 0x512834
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, 1
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 4], edi
cmp edx, 8
jb 0x5128cd
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x5128c3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x51291f
push edx
push ecx
call fcn.004097e6
add esp, 8
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov dword [ebp - 4], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov eax, 0x5cd624
xchg dword [eax], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
call fcn.0052cae1
int3
Function at 0x513cb0
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565956
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x5c7cec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
push 0xc
push 0x599650
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x248], ax
call fcn.00408740
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push 0
push eax
xor bl, bl
call fcn.005290f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x513df2
cmp word [ebp - 0x218], 0
je 0x513df2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x513df2
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x513df2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x513df2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.004653aa
mov bl, 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 0
call fcn.00408e50
test bl, bl
je 0x513e21
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call fcn.00413ea0
mov dword [esi], eax
mov eax, dword [esi]
test eax, eax
je 0x513ebb
push str.RdrNGLInitialize
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esi]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x513e44
xor eax, eax
jmp 0x513e54
push str.RdrNGLRegisterNotifier
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [esi]
mov dword [esi + 8], ecx
test eax, eax
jne 0x513e5f
xor ecx, ecx
jmp 0x513e6f
push str.RdrNGLSetAcroAppMessageParams
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [esi]
mov dword [esi + 0xc], ecx
test eax, eax
jne 0x513e7a
xor ecx, ecx
jmp 0x513e8a
push str.RdrNGLLaunchWorkFlow
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [esi]
mov dword [esi + 0x10], ecx
test eax, eax
jne 0x513e95
xor ecx, ecx
jmp 0x513ea5
push str.RdrNGLGetDataResult
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov eax, dword [esi]
mov dword [esi + 0x14], ecx
test eax, eax
je 0x513eb8
push str.RdrNGLRelease
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x18], eax
lea ecx, [ebp - 0x230]
call fcn.00408e50
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040154f
mov esp, ebp
pop ebp
ret
Function at 0x515c90
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor dl, dl
mov ecx, dword [esi + 0x4c]
cmp ecx, 0xffffffff
je 0x515e5f
push ebx
mov eax, ecx
push edi
cmp eax, 0x7c
je 0x515e5d
cmp eax, 0x29
jne 0x515cd3
cmp dword [esi + 0x10], 0
jne 0x515e5d
cmp eax, eax
jne 0x515cd3
test dword [esi + 0x50], 0x10000000
je 0x515e6c
jmp 0x515e14
cmp eax, 0x2e
jne 0x515ce7
push 5
lea ecx, [esi + 0x24]
call fcn.00518370
jmp 0x515e3f
cmp eax, 0x5c
jne 0x515d43
mov ecx, esi
call fcn.005183f0
test byte [esi + 0x50], 0x80
je 0x515d37
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x515d16
push 4
lea ecx, [esi + 0x24]
call fcn.00518370
mov ecx, esi
call fcn.005183f0
jmp 0x515e4d
cmp al, 0x42
jne 0x515d37
push 4
lea ecx, [esi + 0x24]
call fcn.00518370
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.005183f0
jmp 0x515e4d
mov ecx, esi
call fcn.00515e90
jmp 0x515e46
cmp eax, 0x5b
jne 0x515da4
mov ecx, esi
call fcn.005183f0
lea ecx, [esi + 0x24]
call fcn.00515190
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x515d70
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.005183f0
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x515d8e
cmp eax, 0x5d
jne 0x515d8e
push eax
lea ecx, [esi + 0x24]
call fcn.00515110
mov ecx, esi
call fcn.005183f0
mov ecx, esi
call fcn.00516970
cmp dword [esi + 0x4c], 0x5d
jne 0x515e75
jmp 0x515e3f
cmp eax, 0x28
jne 0x515dd0
mov ecx, esi
call fcn.005183f0
mov ecx, esi
call fcn.00518810
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x515e6c
mov ecx, esi
call fcn.005183f0
test bl, bl
je 0x515e4d
jmp 0x515e46
cmp eax, 0x5e
jne 0x515de8
push 2
lea ecx, [esi + 0x24]
call fcn.00518370
mov ecx, esi
call fcn.005183f0
jmp 0x515e4d
cmp eax, 0x24
jne 0x515e00
push 3
lea ecx, [esi + 0x24]
call fcn.00518370
mov ecx, esi
call fcn.005183f0
jmp 0x515e4d
cmp eax, 0x2a
je 0x515e63
cmp eax, 0x2b
je 0x515e63
cmp eax, 0x3f
je 0x515e63
cmp eax, 0x7b
je 0x515e63
cmp ecx, 0x7d
jne 0x515e24
test dword [esi + 0x50], 0x10000000
je 0x515e7e
jmp 0x515e32
cmp ecx, 0x5d
jne 0x515e32
test dword [esi + 0x50], 0x10000000
je 0x515e75
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00514ff0
mov ecx, esi
call fcn.005183f0
mov ecx, esi
call fcn.00518450
mov ecx, dword [esi + 0x4c]
mov dl, 1
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x515ca5
pop edi
pop ebx
mov al, dl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.00517c10
push 5
mov ecx, esi
call fcn.00517c10
push 4
mov ecx, esi
call fcn.00517c10
push 6
mov ecx, esi
call fcn.00517c10
int3

Function at 0x518970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x811c9dc5
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
sub edi, edx
xor esi, esi
cmp edx, dword [ebp + 0xc]
cmova edi, ebx
test edi, edi
je 0x5189a4
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc esi
imul eax, ecx, 0x1000193
cmp esi, edi
jne 0x518991
pop edi
pop esi
pop ebx
pop ebp
ret 8