joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a970
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1008
call fcn.1000f0c0
push esi
push 0
push 0
mov esi, dword [esp + 0x1018]
push 0
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1000a9ba
xor eax, eax
pop esi
add esp, 0x1008
ret 4
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x1000aa01
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push 0
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push esi
mov dword [esp + 0x28], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1000a9ae
mov al, byte [esp + 0xc]
test al, al
je 0x1000a9ae
mov eax, 1
pop esi
add esp, 0x1008
ret 4
xor ecx, ecx
pop esi
cmp ecx, eax
sbb eax, eax
neg eax
add esp, 0x1008
ret 4

Function at 0x1000cba0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push edi
xor edi, edi
cmp ebp, edi
je 0x1000cc71
cmp dword [esp + 0x1c], edi
je 0x1000cc71
push ebx
lea eax, [esp + 0x1c]
push esi
push eax
push ebp
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, edi
je 0x1000cc65
mov ecx, dword [sym.imp.MSVCP60.dll_struct_std::nothrow_t_const_std::nothrow]
push ecx
push esi
call fcn.1000f7f0
mov ebx, eax
add esp, 8
cmp ebx, edi
je 0x1000cc65
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebx
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1000cc5c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
xor eax, eax
push 0x10015fb8
push ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1000cc5c
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x24]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x18], 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 0x18]
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret

Function at 0x1000d0c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [esp + 8]
pop edi
cmp edx, 6
sbb eax, eax
inc eax
add esp, 0x94
ret
Function at 0x1000e390
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebp
push esi
mov esi, dword [esp + 0x118]
test esi, esi
je 0x1000e557
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x1000e557
mov ebp, dword [esp + 0x120]
cmp ebp, 0x40
jb 0x1000e557
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x26
jne 0x1000e557
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x103
lea eax, [esp + 0x14]
cmp byte [eax], 0
je 0x1000e400
inc eax
dec ecx
jne 0x1000e3f5
jmp 0x1000e444
test ecx, ecx
je 0x1000e444
lea eax, [esp + 0xc]
test eax, eax
je 0x1000e415
mov eax, 0x103
sub eax, ecx
jmp 0x1000e419
mov eax, dword [esp + 0xc]
mov edx, 0x103
sub edx, eax
lea eax, [esp + eax + 0x14]
je 0x1000e444
mov edi, str.CLSID_
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x1000e43c
mov byte [eax], cl
inc eax
dec edx
jne 0x1000e42d
jmp 0x1000e440
test edx, edx
jne 0x1000e441
dec eax
mov byte [eax], 0
mov ecx, 0x103
lea eax, [esp + 0x14]
pop edi
cmp byte [eax], 0
je 0x1000e459
inc eax
dec ecx
jne 0x1000e44e
jmp 0x1000e498
test ecx, ecx
je 0x1000e498
lea edx, [esp + 8]
test edx, edx
je 0x1000e46e
mov eax, 0x103
sub eax, ecx
jmp 0x1000e472
mov eax, dword [esp + 8]
mov edx, 0x103
sub edx, eax
lea eax, [esp + eax + 0x10]
je 0x1000e498
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x1000e490
mov byte [eax], cl
inc eax
dec edx
jne 0x1000e481
jmp 0x1000e494
test edx, edx
jne 0x1000e495
dec eax
mov byte [eax], 0
mov ecx, 0x103
lea eax, [esp + 0x10]
cmp byte [eax], 0
je 0x1000e4ac
inc eax
dec ecx
jne 0x1000e4a1
jmp 0x1000e4f0
test ecx, ecx
je 0x1000e4f0
lea eax, [esp + 8]
test eax, eax
je 0x1000e4c1
mov eax, 0x103
sub eax, ecx
jmp 0x1000e4c5
mov eax, dword [esp + 8]
mov edx, 0x103
sub edx, eax
lea eax, [esp + eax + 0x10]
je 0x1000e4f0
mov esi, str.InprocServer32
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x1000e4e8
mov byte [eax], cl
inc eax
dec edx
jne 0x1000e4d9
jmp 0x1000e4ec
test edx, edx
jne 0x1000e4ed
dec eax
mov byte [eax], 0
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push 0x20019
push 0
push edx
push SysReAllocString
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e557
mov ecx, dword [esp + 0x11c]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], ebp
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
pop ebp
sete al
add esp, 0x10c
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x100014f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1000150e
push 0
push 0
push 0
push 0x100011d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x70c41970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x2c
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [ebp - 0x1c], eax
cmp edi, ebx
jl 0x70c419c6
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea ebx, [eax + 0x20]
mov dword [esp], 0x70c5105c
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
jb 0x70c419d7
lea edx, [ebx - 1]
mov dword [esp], edi
mov dword [esp + 4], edx
call fcn.70c44b4a
mov edx, dword [esi + edi*4]
mov ecx, dword [ebp - 0x1c]
mov dword [esp], 0
call fcn.70c41897
push eax
mov eax, edi
add eax, 1
mov edi, eax
jno 0x70c4198a
call fcn.70c433d9
jmp 0x70c4198a

Function at 0x70c41d3c
Capabilities:
Write file on windows

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push ebx
mov ebx, eax
sub esp, 0x10
test edx, edx
je 0x70c41d58
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp], edx
mov dword [esp + 4], 1
call sub.msvcrt.dll_fwrite
mov dword [esp], ebx
call sub.msvcrt.dll_fflush
add esp, 0x10
pop ebx
pop edi
pop ebp
ret

Function at 0x70c433ca
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov edx, ecx
add eax, 0x40
jmp fcn.70c41d3c

Function at 0x70c46fdb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
sub esp, 0x2c
call fcn.70c46f41
test eax, eax
jns 0x70c4702a
mov eax, 0x70c51a80
test esi, esi
je 0x70c47002
cmp dword [esi], 0
je 0x70c47002
lea eax, [esi + 8]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
mov ecx, eax
test eax, eax
jne 0x70c4701e
lea esp, [ebp - 0xc]
mov ecx, edi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.70c44877
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.70c4412a
mov ebx, eax
mov eax, dword [0x718cbcc0]
test eax, eax
je 0x70c4703e
mov eax, dword [eax]
cmp ebx, eax
jb 0x70c4704d
dec eax
jmp 0x70c47041
or eax, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.70c44b4a
mov eax, dword [0x718cbcc0]
test eax, eax
je 0x70c4705f
mov eax, dword [eax]
cmp ebx, eax
jb 0x70c4706e
dec eax
jmp 0x70c47062
or eax, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.70c44b4a
mov eax, dword [0x718cbcc0]
mov edx, 0x3d
mov ecx, dword [eax + ebx*4 + 8]
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.70c46289
add eax, 1
push edx
push edx
mov edx, eax
jno 0x70c470a4
mov dword [ebp - 0x1c], eax
call fcn.70c433d9
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x718cbcc0]
mov ecx, dword [eax + ebx*4 + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp 0x70c4502d
Function at 0x70c49460
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x718c27fc
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x718c27f4]
sub esp, 4
test ebx, ebx
je 0x70c494ab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x70c494a4
test esi, esi
je 0x70c494a4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x70c49480
mov dword [esp], 0x718c27fc
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x70c49690
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x718bea04
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x70c496e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x70c497b4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x70c4971e
cmp eax, 4
jne 0x70c49740
test esi, esi
je 0x70c49732
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x70c49724
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x70c4977f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x70c49771
cmp ecx, 0x40
je 0x70c49732
cmp ecx, 4
je 0x70c49732
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], 0x718bea1c
call fcn.70c49690
lea esi, [esi]
Function at 0x408941
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ebx
dec esi
add esi, edx
call fcn.00408970
add edx, 1
add edx, 0x5afa71a7
xor dword [edi], ebx
inc edi
or esi, esi
dec edx
cmp edi, eax
jne fcn.00408941
and edx, edx
mov edx, 0xa2ce5008
ret
Function at 0x406864
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406888
xor eax, eax
test eax, eax
je 0x40689b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40689b
xor ecx, ecx
jmp 0x40689e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069c1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dac], 0
push esi
jne 0x4069f8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4069d2
mov dword [ecx*4 + 0x427da8], eax
inc ecx
cmp ecx, 0x100
jl 0x4069cd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a29
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427da8]
xor eax, esi
inc ecx
dec edx
jne 0x406a0b
pop edi
not eax
pop esi
ret 0xc

Function at 0x8504a4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x8504ae
pushal
call 0x8504b4
pop ebp
sub ebp, 0x10
sub ebp, 0x4504a4
jmp 0x8504ca
mov eax, 0x4504a4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c2
mov edx, 0xd5603bb8
xor byte [eax], dl
inc eax
dec ecx
jne 0x8504e1
jmp 0x8504f4
xor esi, dword [ebp + 0x33]
xor dword [eax + edi*4 + 0x7939b8b8], eax
inc eax
mov eax, 0x75bbb8b8
add byte [ebx + 0x2b8b8b8], dh
nop
mov eax, 0x5a4fb8b8
mov ebx, 0xb4393370
mov eax, 0x7dbbb8b8
call 0xe059d607
mov dh, 0xb8
rol byte [eax - 0x464771db], 1
xchg esp, eax
pushfd
rcl byte [eax]
ret 0x3e33
Function at 0x403a07
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44e44d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x469070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebx], edi
je 0x403a66
lea esi, [ebx + 4]
cmp dword [esi + 0x10], edi
jne 0x403a66
push edi
push 0x104
mov ecx, esi
call fcn.0040222b
cmp dword [esi + 0x14], 8
jb 0x403a5a
mov esi, dword [esi]
push dword [ebx + 0x14]
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or dword [ebp - 4], 0xffffffff
cmp dword [ebx + 0x14], edi
jne 0x403a77
lea eax, [ebx + 0x1c]
jmp 0x403b8b
cmp dword [ebx + 0x18], 8
lea ecx, [ebx + 4]
mov dword [ebp - 0x20], edi
jb 0x403a86
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ecx, eax
test ecx, ecx
je 0x403a6f
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
push ecx
push ecx
lea ecx, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00403ba5
mov ecx, dword [ebp - 0x18]
lea eax, [ebx + 4]
mov esi, dword [ebp - 0x1c]
sub ecx, esi
cmp dword [eax + 0x14], 8
jb 0x403abc
mov eax, dword [eax]
push esi
push ecx
xor edi, edi
push edi
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x403ae0
test esi, esi
je 0x403a6f
mov ecx, dword [ebp - 0x14]
sub ecx, esi
push ecx
push esi
call fcn.00403413
pop ecx
pop ecx
jmp 0x403a6f
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], edi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], edi
push eax
push 0x460838
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x403acc
mov ecx, dword [ebp - 0x28]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x46083c
call fcn.00403c2a
add esp, 0x14
test eax, eax
je 0x403acc
inc eax
lea edi, [ebx + 0x1c]
push 0
push eax
mov ecx, edi
mov dword [ebp - 0x2c], eax
call fcn.0040222b
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x403b41
mov edx, dword [edi]
mov ecx, dword [ebp - 0x28]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x46083c
push dword [ebx + 0x2c]
push edx
call fcn.00403bfb
mov eax, dword [ebp - 0x2c]
add esp, 0x1c
dec eax
mov ecx, edi
push 0
push eax
call fcn.0040222b
test esi, esi
je 0x403b89
mov ecx, dword [ebp - 0x14]
sub ecx, esi
push ecx
push esi
call fcn.00403413
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ab25
leave
ret
Function at 0x40552f
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4056cc
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4056cc
cmp eax, 0x29
jne 0x40556c
cmp dword [esi + 0x10], 0
jne 0x4056cc
cmp eax, eax
jne 0x40556c
test dword [esi + 0x50], edx
je 0x4056d2
cmp eax, 0x2e
jne 0x405587
push 5
lea ecx, [esi + 0x24]
call fcn.004057c2
mov ecx, esi
call fcn.00405506
jmp 0x4056b6
cmp eax, 0x5c
jne 0x4055dc
mov ecx, esi
call fcn.00405506
test byte [esi + 0x50], 0x80
je 0x4055d0
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x4055b8
push 4
lea ecx, [esi + 0x24]
call fcn.004057c2
mov ecx, esi
call fcn.00405506
jmp 0x4056bd
cmp eax, 0x42
jne 0x4055d0
push 4
lea ecx, [esi + 0x24]
call fcn.004057c2
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x4055ac
mov ecx, esi
call fcn.00405805
jmp 0x4056b6
cmp eax, 0x5b
jne 0x40563f
mov ecx, esi
call fcn.00405506
lea ecx, [esi + 0x24]
call fcn.00405ec9
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x405609
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00405506
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x405627
cmp eax, 0x5d
jne 0x405627
push eax
lea ecx, [esi + 0x24]
call fcn.00405f24
mov ecx, esi
call fcn.00405506
mov ecx, esi
call fcn.00405cd1
cmp dword [esi + 0x4c], 0x5d
je 0x40557b
push 4
jmp 0x4056d4
cmp eax, 0x28
jne 0x40565c
mov ecx, esi
call fcn.00405506
mov ecx, esi
call fcn.004058fb
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4056d2
jmp 0x4056ab
cmp eax, 0x5e
jne 0x405668
push 2
jmp 0x4055a4
cmp eax, 0x24
jne 0x405674
push 3
jmp 0x4055a4
cmp eax, 0x2a
je 0x4056c8
cmp eax, 0x2b
je 0x4056c8
cmp eax, 0x3f
je 0x4056c8
cmp eax, 0x7b
je 0x4056c8
cmp eax, 0x7d
jne 0x405692
test dword [esi + 0x50], edx
je 0x4056c4
cmp eax, 0x5d
jne 0x40569c
test dword [esi + 0x50], edx
je 0x405638
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00405ada
mov bl, 1
mov ecx, esi
call fcn.00405506
test bl, bl
je 0x4056bd
mov ecx, esi
call fcn.00405a00
mov cl, 1
jmp 0x405536
push 6
jmp 0x4056d4
push 0xa
jmp 0x4056d4
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.004051e3
int3

Function at 0x445a28
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004456a5
Function at 0x438c9b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
or ebx, edx
add edx, 0x48bce4e1
mov ebx, 0x293c21db
call fcn.00438cd5
sub ebx, 0x48e7bb0b
xor dword [eax], ecx
and ebx, edx
and ebx, edx
inc eax
mov edx, 0x463c8465
and ebx, ebx
add edx, edx
cmp eax, edi
jne fcn.00438c9b
or ebx, ebx
ret
Function at 0x4011db
Capabilities:
Query environment variable
Set console window title
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2eddc04]
mov ecx, dword [0x2eda9fc]
sub esp, 0xd4c
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x40128c
mov edi, ecx
mov ebx, eax
cmp dword [0x2eddc04], 0xae9
jne 0x40127c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxA]
push esi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x548]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
push esi
lea eax, [ebp - 0xd48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.colenivadehuhejewohij
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push str.rirojoxelayufeyorobigefirijecipayotajek
push str.lilitezutavehitusikutiyazowogetolamayesabagotiludumivabomunaboyidiyufalikapesomugazoviwesi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea eax, [ebp - 0x148]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfoExA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push edi
call fcn.00401017
add edi, 8
dec ebx
jne 0x401203
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4012f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [0x2eddc04]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x2eda9fc], eax
ret

Function at 0x405622
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41c410]
jne 0x40562c
repz ret
jmp fcn.0040a7f6