joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d54c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
call fcn.0041e88c
cmp eax, 2
jne 0x42d587
push 0x200
lea eax, [esp + 0x204]
push eax
push 2
push ebx
call sub.kernel32.dll_GetLocaleInfoW
mov edx, esi
lea eax, [esp + 0x200]
call fcn.0040a968
jmp 0x42d5a7
push 0x200
lea eax, [esp + 4]
push eax
push 2
push ebx
call sub.kernel32.dll_GetLocaleInfoW
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00408f9c
add esp, 0x400
pop esi
pop ebx
ret

Function at 0x42d5b0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42d6e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x42d6f8
call fcn.00408610
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x42d69a
mov eax, dword [ebp - 8]
add eax, eax
add eax, eax
call fcn.00404594
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42d693
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov eax, dword [ebp - 4]
call fcn.00408210
mov ebx, dword [ebp - 8]
dec ebx
test ebx, ebx
jb 0x42d674
inc ebx
xor esi, esi
mov eax, dword [ebp - 0xc]
movzx edi, word [eax + esi*4]
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0042d54c
lea eax, [ebp - 0x14]
mov edx, 0x42d71c
call fcn.00409088
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00408fec
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00408cb4
mov eax, dword [ebp - 4]
inc esi
dec ebx
jne 0x42d639
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d69a
mov edx, dword [ebp - 8]
add edx, edx
add edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004045b0
pop eax
jmp eax
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
test ebx, ebx
je 0x42d6ac
sub ebx, 4
mov eax, dword [ebx]
shr eax, 1
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, ebx
sub ecx, 4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 1
call fcn.00408e78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d6eb
lea eax, [ebp - 0x14]
call fcn.004081c8
lea eax, [ebp - 0x10]
call fcn.00408210
pop eax
jmp eax
Function at 0x42d7d0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d84c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408ec4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00408ca0
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x42d828
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408e78
jmp 0x42d834
mov eax, ebx
mov edx, 0x42d85c
call fcn.00408610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d853
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax

Function at 0x42f390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42f431
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x420cf8]
call fcn.0040b244
push esi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x420cf8]
call fcn.0040b120
add esp, 4
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x42f402
push 0
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_WriteFile
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x420cf8]
call fcn.0040b244
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f438
lea eax, [ebp - 4]
mov edx, dword [0x420cf8]
call fcn.0040b244
pop eax
jmp eax
Function at 0x42f988
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea eax, [ebp - 4]
call fcn.004082dc
xor eax, eax
push ebp
push 0x42fa85
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x42f9f4
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004211a4
mov eax, dword [ebp - 0xc]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x42fa52
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x42fa16
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x42fa60
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004211a4
mov eax, dword [ebp - 0x10]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x42f9b9
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fa8c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00408298
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax

Function at 0x42fb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42fbfb
push dword fs:[eax]
mov dword fs:[eax], esp
inc dword [ebx]
lea edx, [ebp - 4]
mov eax, dword [ebx]
call fcn.00421f08
mov eax, 1
mov edx, dword [esi]
movzx edx, byte [edx]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x42fb3a
xor eax, eax
mov edx, dword [esi]
movzx edx, byte [edx + eax]
shl edx, 4
movzx edx, dl
shr edx, 4
movzx ecx, dl
mov ebx, dword [esi]
movzx ecx, byte [ebx + ecx]
movzx edx, dl
mov ebx, dword [esi]
add ebx, edx
mov edx, dword [esi]
movzx edx, byte [edx + eax]
mov byte [ebx], dl
mov edx, dword [esi]
mov byte [edx + eax], cl
inc eax
cmp eax, 0x10
jne 0x42fb4c
xor eax, eax
mov edx, dword [esi]
movzx edx, byte [edx + 0xf]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0xf
jne 0x42fb80
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 3]
shl edx, 6
movzx eax, dl
shr eax, 6
mov edx, eax
xor eax, eax
movzx ecx, dl
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
mov ebx, dword [esi]
xor byte [ebx + eax], cl
inc eax
cmp eax, 0x10
jne 0x42fba5
xor eax, eax
mov edx, eax
and edx, 0x80000003
jns 0x42fbcb
dec edx
or edx, 0xfffffffc
inc edx
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + edx]
mov ecx, dword [esi]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x10
jne 0x42fbbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fc02
lea eax, [ebp - 4]
mov edx, dword [0x420cf8]
call fcn.0040b244
pop eax
jmp eax
Function at 0x4302cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp + 0xc]
call fcn.004082dc
xor eax, eax
push ebp
push 0x4303e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x43033d
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 0xc]
call fcn.004211a4
mov eax, dword [ebp - 0x10]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x4303b5
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x430376
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_WriteFile
test eax, eax
je 0x430376
cmp edi, dword [ebp - 0xc]
je 0x4303c3
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
call fcn.004211a4
mov eax, dword [ebp - 0x14]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x430300
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4303ef
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00408298
lea eax, [ebp + 0xc]
call fcn.00408210
pop eax
jmp eax
Function at 0x430644
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea eax, [ebp + 8]
call fcn.004082dc
xor eax, eax
push ebp
push 0x43075b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov bl, 1
cmp dword [esi], 0xffffffff
jne 0x4306b3
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
call fcn.004211a4
mov eax, dword [ebp - 0x10]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
jmp 0x430728
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [esi]
push eax
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x4306ec
push 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x4306ec
cmp edi, dword [ebp - 0xc]
je 0x430736
mov eax, dword [esi]
push eax
call sub.kernel32.dll_CloseHandle
push 0x64
call sub.kernel32.dll_Sleep
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
call fcn.004211a4
mov eax, dword [ebp - 0x14]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
inc ebx
cmp bl, 0xb
jne 0x430678
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430762
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00408298
lea eax, [ebp + 8]
call fcn.00408210
pop eax
jmp eax
Function at 0x4309a0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4309a9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
call fcn.004082dc
lea eax, [ebp - 8]
call fcn.004082dc
xor eax, eax
push ebp
push 0x430afb
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
cmp edi, 0xffffffff
jne 0x430a1a
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004211a4
mov eax, dword [ebp - 0xc]
call fcn.00408ca0
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
cmp edi, 0xffffffff
jne 0x430a1a
mov edi, 0x80
mov eax, 1
and eax, edi
cmp eax, 1
jne 0x430a9c
and edi, 0xfffffffe
test edi, edi
jne 0x430a32
mov edi, 0x80
push edi
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004211a4
mov eax, dword [ebp - 0x14]
call fcn.00408ca0
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004211a4
mov eax, dword [ebp - 0x1c]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x430ade
jmp 0x430adc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00408d28
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.004211a4
mov eax, dword [ebp - 0x24]
call fcn.00408ca0
push eax
call sub.kernel32.dll_CreateFileW
mov dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x430ade
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430b02
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00408298
pop eax
jmp eax

Function at 0x430c98
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004082dc
xor eax, eax
push ebp
push 0x430d2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov bl, 0xa
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00430b10
mov eax, dword [ebp - 0x2c]
call fcn.00408ca0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x430d04
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x430d0f
push 0x64
call sub.kernel32.dll_Sleep
dec bl
jne 0x430ccd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x430d36
lea eax, [ebp - 0x2c]
call fcn.00408210
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax
Function at 0x436c84
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [0x420d30]
call fcn.0040b244
mov eax, dword [ebp - 8]
mov edx, dword [0x420d30]
call fcn.0040b244
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x436d87
xor edx, edx
push ebp
push 0x436d74
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x65c]
push eax
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 0xc]
push eax
call sub.WS2_32.DLL_WSAIoctl
inc eax
je 0x436d6a
mov eax, dword [ebp - 0x10]
mov ecx, 0x4c
cdq
idiv ecx
mov esi, eax
dec esi
test esi, esi
jl 0x436d6a
inc esi
lea edi, [ebp - 0x658]
push esi
push edi
mov esi, edi
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
cmp dword [ebp - 0x1c], 0x100007f
je 0x436d64
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x19]
push eax
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 0x1b]
movzx ebx, byte [ebp - 0x1c]
mov edx, ebx
call fcn.00420e34
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x19]
push eax
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp - 0x1b]
mov edx, ebx
call fcn.00420e34
add edi, 0x4c
dec esi
jne 0x436d1a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x436d7e
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437ca0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x4448c4]
add eax, 0xcc
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x437cc5
mov eax, dword [0x4448c4]
mov byte [eax + 0x9c], 1
ret

Function at 0x438a04
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004082dc
xor eax, eax
push ebp
push 0x438a9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov bl, 0xa
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0043887c
mov eax, dword [ebp - 0x2c]
call fcn.00408ca0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x438a70
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x438a7b
push 0x64
call sub.kernel32.dll_Sleep
dec bl
jne 0x438a39
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438aa2
lea eax, [ebp - 0x2c]
call fcn.00408210
lea eax, [ebp - 4]
call fcn.00408210
pop eax
jmp eax
Function at 0x439174
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x23c], eax
mov edi, dword [0x4448c4]
xor eax, eax
push ebp
push 0x43936f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.0042758c
mov dword [ebp - 8], eax
mov dword [ebp - 0x234], 0x22c
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 8]
call fcn.004275ac
mov dword [ebp - 4], eax
jmp 0x43932c
mov eax, dword [edi + 0x28]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x43931b
inc esi
xor ebx, ebx
lea eax, [ebp - 0x23c]
mov edx, dword [edi + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + ebx*4]
call fcn.00408fec
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00418798
mov eax, dword [ebp - 0x238]
push eax
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.00408c64
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.00418798
mov edx, dword [ebp - 0x240]
pop eax
call fcn.00408e70
je 0x4392fb
lea eax, [ebp - 0x24c]
mov edx, dword [edi + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + ebx*4]
call fcn.00408fec
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x248]
call fcn.00418798
mov eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x25c]
lea edx, [ebp - 0x210]
mov ecx, 0x104
call fcn.00408f9c
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 0x258]
call fcn.0041908c
mov edx, dword [ebp - 0x258]
lea eax, [ebp - 0x254]
call fcn.00408fec
mov eax, dword [ebp - 0x254]
lea edx, [ebp - 0x250]
call fcn.00418798
mov edx, dword [ebp - 0x250]
pop eax
call fcn.00408e70
jne 0x439313
push 0
mov eax, dword [ebp - 0x22c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
inc ebx
dec esi
jne 0x439213
lea edx, [ebp - 0x234]
mov eax, dword [ebp - 8]
call fcn.004275cc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x439201
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439376
lea eax, [ebp - 0x25c]
mov edx, 2
call fcn.00408228
lea eax, [ebp - 0x254]
mov edx, 8
call fcn.00408298
pop eax
jmp eax
Function at 0x1003292f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10023bc9
call fcn.10022973
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
xor eax, eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x418], eax
push 0x60
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.100339be
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x100329a4
push 2
mov ecx, esi
call fcn.100339be
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x100329a4
call fcn.10031dc9
mov esi, eax
jmp 0x10032a78
push dword [ebp - 0x41c]
push ebx
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100329c2
call fcn.10031dc9
jmp 0x10032a6b
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
je 0x100329b8
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x100329f4
mov esi, 0x8007000e
jmp 0x10032a6d
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1001314e
jmp 0x10032a1e
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x100329ed
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100329b8
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call fcn.1001314e
mov esi, eax
test edi, edi
je 0x10032a78
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10032a91
lea ecx, [ebp - 0x418]
call fcn.10032083
lea ecx, [ebp - 0x428]
call fcn.1003150e
mov eax, esi
call fcn.10022963
ret 0x10
Function at 0x1004807d
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100481de
push 0x29
pop edi
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100481de
cmp eax, edi
jne 0x100480be
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x100481de
cmp eax, edi
jne 0x100480be
test dword [esi + 0x50], edx
je 0x100481e4
cmp eax, 0x2e
jne 0x100480d9
push 5
lea ecx, [esi + 0x24]
call fcn.1001314e
mov ecx, esi
call fcn.10049c8b
jmp 0x100481c9
cmp eax, 0x5c
jne 0x1004812e
mov ecx, esi
call fcn.10049c8b
test byte [esi + 0x50], 0x80
je 0x10048122
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1004810a
push 4
lea ecx, [esi + 0x24]
call fcn.1001314e
mov ecx, esi
call fcn.10049c8b
jmp 0x100481d0
cmp eax, 0x42
jne 0x10048122
push 4
lea ecx, [esi + 0x24]
call fcn.1001314e
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100480fe
mov ecx, esi
call fcn.1001314e
jmp 0x100481c9
cmp eax, 0x5b
jne 0x1004814e
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004877d
push 4
push 0x5d
mov ecx, esi
call fcn.1001314e
jmp 0x100481c9
cmp eax, 0x28
jne 0x1004816f
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004a1aa
push 5
push edi
mov ecx, esi
mov bl, al
call fcn.1001314e
jmp 0x100481c5
cmp eax, 0x5e
jne 0x1004817b
push 2
jmp 0x100480f6
cmp eax, 0x24
jne 0x10048187
push 3
jmp 0x100480f6
cmp eax, 0x2a
je 0x100481f4
cmp eax, 0x2b
je 0x100481f4
cmp eax, 0x3f
je 0x100481f4
cmp eax, 0x7b
je 0x100481f4
cmp eax, 0x7d
jne 0x100481a5
test dword [esi + 0x50], edx
je 0x100481ec
cmp eax, 0x5d
jne 0x100481af
test dword [esi + 0x50], edx
je 0x100481f0
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1001314e
mov ecx, esi
call fcn.10049c8b
mov bl, 1
test bl, bl
je 0x100481d0
mov ecx, esi
call fcn.1001314e
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10048093
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
push 6
jmp 0x100481e6
push 4
jmp 0x100481e6
push 0xa
jmp 0x100481e6