joyce8/EMBER2024-capa huggingface dataset:
Function at 0x887722
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
not bl
xchg dl, ch
mov bp, 0xa573
dec esi
add esp, 2
jmp 0x887590
lea edx, [ebp*4]
mov ebx, 0xba36f639
mov ebp, eax
mov esi, dword [esp + 4]
add esp, 1
mov dx, cx
jmp 0x887547
mov esi, 0xfd2a7b2c
add esp, 0xb
not dh
not di
neg dl
not ecx
jmp 0x8875ba
sub esp, 0x12
xchg byte [esp + 0xd], cl
mov ch, byte [esp + 4]
rdtsc
xchg si, dx
pop ax
jmp 0x887577
lea ebp, [edx - 0xe]
inc ebx
rdtsc
not eax
setp dh
mov dx, word [esp + 3]
jmp 0x887628
stc
lea esp, [esp]
mov ah, byte [esp + 1]
mov bl, ch
xchg dword [esp], esi
bts bp, sp
jmp 0x8875a4
mov cx, word [esp + 6]
bsr esi, ebp
mov dword [esp + 8], edx
pop dword [esp]
pop word [esp + 4]
rcr ecx, 3
jmp 0x88755d
mov si, word [esp]
lea esi, reloc.KERNEL32.dll_FreeLibrary
xchg byte [esp + 1], al
sub esp, 0x13
call 0x887606
pop word [esp + 0x13]
mov dl, byte [esp + 0x2b]
dec dl
rdtsc
sub esp, 0x16
lea esp, [esp + 0x48]
jmp 0x887690
lea ebp, [eax + esi]
cpuid
mov dh, 0xef
xchg ebx, ecx
bswap ecx
rcl ebx, cl
jmp 0x8876c0
mov al, 0xbc
bswap eax
bswap esi
mov ax, word [esp]
rdtsc
and dh, ah
jmp 0x88767a
dec si
btc cx, bp
adc ecx, eax
mov edx, 0xd6918809
sub esp, 0x12
pop word [esp + 8]
jmp 0x8876f2
mov ebx, dword [esp]
mov bp, 0xbe8
setp bl
lea ebp, [ecx + ebx]
mov ebx, dword [esp]
mov bh, 0xea
jmp 0x8876a0
btc edi, ebp
pop eax
std
dec cx
pop dword [esp + 1]
mov word [esp + 3], bp
jmp 0x887709
xchg dword [esp + 8], esi
push word [esp + 4]
dec ax
xchg byte [esp + 8], cl
rdtsc
mov byte [esp + 3], ch
jmp 0x8876d4
mov ch, byte [esp + 6]
std
xchg ebp, edi
mov bl, dl
lea esp, [esp + 9]
bsf esi, edi
jmp 0x887810
lea ecx, [ebp*4]
dec bx
jmp 0x8875d4
lea ebp, reloc.KERNEL32.dll_FreeLibrary
pop word [esp + 0x16]
xchg byte [esp], bh
pop dword [esp + 0xb]
call fcn.00887759
scasb al, byte es:[edi]
xchg byte [esp], ch
mov ch, dh
bswap esi
neg ch
sub esp, 0x1e
lea ebx, [eax + edi]
jmp 0x887730
setnp bh
cld
lea esi, [eax + ecx]
xchg bx, bp
xchg ebx, edx
add esp, 0
jmp 0x887748
mov bp, 0xbee2
lea ebp, [edi - 0x31]
neg esi
add si, ax
lea esp, [esp]
dec ebp
jmp 0x887774
shl edx, cl
rol edx, 0xb
ror al, cl
mov edx, ebx
xchg bx, cx
cpuid
jmp 0x8877de
Function at 0x8877ba
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop si
mov ax, 0xe87c
jmp 0x8877c7
pop ecx
mov di, word [esp + 0xb]
mov bh, 0x3b
mov si, ax
xchg byte [esp], dl
bswap edx
jmp 0x8877f0
btc di, bx
cpuid
mov cl, 0x37
xchg di, bp
lea ebp, reloc.KERNEL32.dll_FreeLibrary
rdtsc
jmp 0x8878ab
lea ecx, [esp + 0x46]
pop dword [esp + 0xa]
setle ch
pop dx
jmp 0x887879
neg bp
mov al, 0xde
mov edx, esp
mov dword [esp + 9], ebx
lea ebp, [edi*4]
mov byte [esp], ah
jmp 0x887820
push word [esp + 0x11]
neg eax
pop bx
not bp
mov cl, dl
sub dh, dh
jmp 0x887836
push dword [esp + 0x12]
mov dl, al
neg al
mov dword [esp + 0x16], ebx
xchg byte [esp + 5], dh
jmp 0x88788c
mov byte [esp + 4], ch
xchg edx, esi
sub esp, 9
mov dl, cl
pop si
mov al, byte [esp + 3]
jmp 0x887863
bswap eax
mov ah, byte [esp + 3]
add esp, 0x15
mov bl, dl
xchg dx, si
xchg word [esp + 2], ax
jmp 0x8878d8
bswap eax
clc
mov ax, word [esp + 0x16]
cpuid
inc ebp
neg bp
jmp 0x887851
pop word [esp]
xchg dx, di
mov bh, byte [esp + 4]
rol dh, 5
mov esi, 0xd9d9628e
rdtsc
jmp 0x8878ea
cpuid
sub esp, 0xb
push eax
mov di, word [esp + 4]
dec esi
mov bp, 0x7259
jmp 0x8878bb
push word [esp + 0xa]
xchg dword [esp + 5], ecx
pop dx
bsf esi, edx
xchg cl, bh
pop di
jmp 0x887963
mov cl, byte [esp + 4]
mov ebx, dword [esp + 3]
cpuid
setae ah
jmp 0x887a74
inc edx
mov ax, 0xc85
std
xchg byte [esp + 0xa], bl
sub dl, 0x90
push dword [esp + 0x10]
jmp 0x887928
lea ecx, reloc.KERNEL32.dll_FreeLibrary
push sp
pop dx
xchg dword [esp + 9], ebp
lea ebp, [edi + 0x5d]
mov ecx, edi
jmp 0x88793e
push dword [esp + 0x10]
xchg bp, cx
mov byte [esp + 0x11], cl
mov edi, 0x7c4d7e64
lea eax, [edx + esi]
rol dl, cl
call fcn.008879d4
mov word [esp + 2], sp
lea edx, [eax + esi]
xchg dx, ax
call fcn.00887b59
mov edi, 0x33303186
sub cl, byte [edi - 0x72f4dbbc]
or al, 0x28
mov word [esp + 0xf], bx
mov ebp, dword [esp + 0x11]
jmp 0x887a47
bsr si, sp
mov bp, word [esp + 0xf]
xchg dword [esp + 0xc], ecx
mov cx, word [esp + 0x13]
pop eax
not cl
jmp 0x887a2d

Function at 0x887b03
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 2]
dec dx
rdtsc
mov dl, 0x40
jmp 0x887b3d
mov dl, 0x1d
mov dh, ah
pop edx
mov ebp, dword [esp]
pushal
xchg bl, ch
jmp 0x887b7e
rdtsc
mov bp, word [esp + 4]
mov dh, cl
rdtsc
mov ah, 0x7b
xchg word [esp], cx
jmp 0x887b10
mov bp, 0x2584
and edi, eax
mov al, byte [esp]
mov dx, 0x5a17
rdtsc
jmp 0x887b93
lea esp, [esp + 0x20]
lea edi, [edx*4]
std
inc bp
lea ebp, [esp + eax]
dec al
jmp 0x887b68
btc edi, ebx
rcl dh, 4
lea ebx, reloc.KERNEL32.dll_FreeLibrary
mov dl, 0x6f
xchg ebx, eax
bswap esi
jmp 0x887c3f
setno bl
lea esp, [esp]
mov edx, dword [esp]
rcl cl, 2
mov edx, edi
call fcn.00887bb4
push edi
rol byte [esi + 0x21], 1
sal byte [eax], 1
retf
add esp, 0
lea edx, [esi + ebp]
mov dh, al
add esp, 0
not eax
bswap esi
jmp 0x887bca
bswap ebx
rdtsc
mov bp, 0xdf8
mov dx, 0x313
mov eax, 0xa2411fe2
rdtsc
jmp 0x887bec
Function at 0x887b59
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
lea esp, [esp]
xchg byte [esp], al
xchg byte [esp], ah
cpuid
lea ebx, [ebx*4]
jmp 0x887ac3
pop word [esp + 2]
xchg di, si
pop edi
lea ecx, [ebp + 0x1d]
mov dx, word [esp]
not ax
jmp 0x887a8b
mov cx, 0xc1d3
push bx
mov word [esp], di
rdtsc
rdtsc
shl eax, cl
jmp 0x887b2a
cld
xchg ch, ah
call fcn.00887b03
sbb al, byte [ecx + 0x6837011]
fadd qword [edx - 0x30]
mov bh, 0x42
lds eax, [ebx - 0x7c7beac6]
les ecx, [esi]
add esp, 0xe
mov di, cx
pop dword [esp]
mov si, word [esp + 6]
mov bx, bp
mov bp, dx
jmp 0x887aae
lea esp, [esp]
xchg dh, al
bswap ebp
sete al
mov di, word [esp + 1]
bswap ebx
jmp 0x887ad5
xchg word [esp + 0xd], bx
mov dword [esp + 4], edx
lea esp, [esp + 1]
jmp 0x887aed

Function at 0x887bb4
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb edx, 0xa866b549
jmp 0x887c13
xchg byte [esp], ch
bswap ebp
not ecx
lea esp, [esp]
cpuid
xchg byte [esp], bh
jmp 0x887c26
bsr edx, edi
bt eax, edi
inc eax
lea esp, [esp + 3]
xchg byte [esp], cl
not bx
jmp 0x887bfd
shl di, cl
xchg word [esp], cx
mov ecx, 0x3243cefe
push word [esp]
sub esp, 6
jmp 0x887e0b
lea eax, reloc.KERNEL32.dll_FreeLibrary
mov di, word [esp + 0xc]
jmp 0x887d78
mov ax, word [esp + 3]
pop ecx
push dword [esp + 3]
mov word [esp + 5], dx
push esp
mov bl, ah
jmp 0x887c54
mov bh, byte [esp + 0x15]
xchg word [esp + 0x13], si
push si
push word [esp + 5]
mov ebp, ebx
push bp
jmp 0x887cc6
bsf ebp, esi
mov ebx, dword [esp + 4]
xchg byte [esp + 0x10], al
mov ch, ah
mov byte [esp + 0x13], dl
xchg byte [esp + 4], ch
jmp 0x887c7e
push word [esp + 0xc]
mov ebp, 0xe397f420
cld
xchg dx, si
xchg al, dh
jmp 0x887d10
add si, si
mov byte [esp + 4], al
pop dword [esp + 0xb]
mov ebp, ebx
lea esp, [esp + 7]
add esp, 6
jmp 0x887caf
bsr dx, bp
sub esp, 0x15
mov ebp, 0x15ec83d5
bswap esi
mov ah, dl
call int.00887cdc
jnp 0x887cf4
add ax, si
push edi
in eax, dx
jge 0x887d10
mul dword [ecx]
jl 0x887d5f
pop word [esp]
rdtsc
mov edx, dword [esp]
xchg ecx, esi
mov dword [esp + 5], esi
xchg ecx, ebx
jmp 0x887cf2
and al, 0x86
ret
lea ecx, [edi*4]
dec ecx
rdtsc
mov ebx, dword [esp + 5]
sub esp, 0xa
xchg esi, eax
jmp 0x887c98
pop edx
mov byte [esp + 1], bl
mov word [esp], di
push dword [esp + 2]
mov bl, 0xd0
mov eax, 0xbe4cf2e8
jmp 0x887c6a
Function at 0x404190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40427e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40427e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40427e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404207
cmp esi, ecx
jae 0x40427e
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x4041f1
cmp esi, ecx
jae 0x40427e
movzx eax, word [esi]
test ax, ax
je 0x40427e
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40423a
push edi
mov ecx, ebx
call fcn.00404770
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x40423d
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00587685
add esp, 0x10
cmp eax, 0x50
ja case.0x40425b.1
movzx eax, byte [eax + 0x4042ac]
jmp dword [eax*4 + 0x40429c]
mov ecx, dword [ebx]
cmp edi, dword [ecx - 8]
jg 0x40428c
mov dword [ecx - 0xc], edi
xor edx, edx
mov ecx, dword [ebx]
lea eax, [edx + 1]
mov word [ecx + edi*2], dx
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
call fcn.00416831
push 0x80070057
call fcn.004048a0
call fcn.00416817
nop
bound eax, qword [edx + 0x40]
add byte [edi - 1778368446], al
inc edx
inc eax
add byte [esi + 0x4042], dl
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x404300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.00416a4d
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x404401
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x404401
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404401
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404401
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404388
cmp esi, ecx
jae 0x404401
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404372
cmp esi, ecx
jae 0x404401
movzx eax, word [esi]
test ax, ax
je 0x404401
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x4043bb
push edi
mov ecx, ebx
call fcn.00404770
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x4043be
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00587685
add esp, 0x10
cmp eax, 0x50
ja case.0x4043dc.1
movzx eax, byte [eax + 0x404430]
jmp dword [eax*4 + 0x404420]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x404411
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00416831
push 0x80070057
call fcn.004048a0
call fcn.00416817
jecxz 0x404465
inc eax
add byte [esp + eax*2], cl
inc eax
add byte [ebx], bl
inc esp
inc eax
add byte [ebx], bl
inc esp
inc eax
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x404490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor cl, cl
test eax, eax
je 0x40459a
test eax, 0xffff0000
jne 0x40459a
push esi
push edi
movzx edi, ax
push edi
call fcn.00416a4d
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x404596
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x404596
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404596
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404596
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x404529
cmp esi, ecx
jae 0x404596
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x404517
cmp esi, ecx
jae 0x404596
movzx eax, word [esi]
test ax, ax
je 0x404596
mov edx, dword [ebx]
mov edi, eax
mov dword [ebp + 8], eax
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x40455c
push edi
mov ecx, ebx
call fcn.00404770
mov edx, dword [ebx]
movzx eax, word [esi]
jmp 0x40455f
mov eax, dword [ebp + 8]
movzx ecx, ax
lea eax, [esi + 2]
push ecx
push eax
push edi
push edx
call fcn.00587685
add esp, 0x10
cmp eax, 0x50
ja case.0x40457d.1
movzx eax, byte [eax + 0x4045c8]
jmp dword [eax*4 + 0x4045b8]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x4045ad
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
pop edi
mov cl, 1
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00416817
call fcn.00416831
push 0x80070057
call fcn.004048a0
nop
test byte [ebp + 0x40], al
add byte [eax - 1560264635], ch
inc ebp
inc eax
add byte [ebx + 0x4045], ah
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x409770
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x623fcc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0xc]
mov edi, edx
push eax
push 0
push 0x2001f
push 0
push 0x6029b8
push 0
push dword [ecx]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4097fc
mov eax, dword [esi]
xor ecx, ecx
mov edx, 2
mov eax, dword [eax - 0xc]
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041505a
mov ecx, dword [esi]
add esp, 4
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push 1
push 0
push dword [edi]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f54f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0054f54f
mov esp, ebp
pop ebp
ret
Function at 0x40d7d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af903
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x623fcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
push 0
push 0
mov dword [ebp - 0x14], 0
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00407550
push 8
call fcn.0041501d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40d8af
xorps xmm0, xmm0
movq qword [ebx], xmm0
push 1
mov dword [ebp - 4], 2
call fcn.00551096
add esp, 4
mov dword [ebx + 4], eax
jmp 0x40d8b1
xor ebx, ebx
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], 3
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 4
push eax
call fcn.0040dc30
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40d912
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x40d912
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov byte [ebp - 4], 1
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x40d92f
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.00407550
lea edx, [edi + 0x10]
mov dword [ebp + 8], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_iostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40d9c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x40d9f1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40d9e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4101f0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x410400
cmp eax, 0x7c
je 0x410400
cmp eax, 0x29
jne 0x410231
cmp dword [esi + 0x10], 0
jne 0x410400
cmp eax, eax
jne 0x410231
test dword [esi + 0x50], 0x10000000
je 0x41040d
jmp 0x4103b9
cmp eax, 0x2e
jne 0x410242
push 5
lea ecx, [esi + 0x24]
call fcn.00410470
jmp 0x4102bb
cmp eax, 0x5c
jne 0x41029e
mov ecx, esi
call fcn.00410190
test byte [esi + 0x50], 0x80
je 0x410292
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x410271
push 4
lea ecx, [esi + 0x24]
call fcn.00410470
mov ecx, esi
call fcn.00410190
jmp 0x4103f2
cmp al, 0x42
jne 0x410292
push 4
lea ecx, [esi + 0x24]
call fcn.00410470
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00410190
jmp 0x4103f2
mov ecx, esi
call fcn.00410ee0
jmp 0x4103eb
cmp eax, 0x5b
jne 0x410306
mov ecx, esi
call fcn.00410190
mov ecx, esi
call fcn.00410df0
cmp dword [esi + 0x4c], 0x5d
jne 0x41041b
mov edx, dword [esi + 8]
mov eax, dword [esi]
cmp eax, edx
je 0x4102fa
cmp byte [eax], 0x5c
jne 0x4102f7
lea ecx, [eax + 1]
cmp ecx, edx
je 0x4102f7
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x4102e4
mov bl, byte [ecx]
cmp bl, 0x28
je 0x4102f5
cmp bl, 0x29
je 0x4102f5
test dl, 0x10
jne 0x4102f7
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x4102f5
cmp dl, 0x7d
jne 0x4102f7
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.0040f4f0
jmp 0x4103eb
cmp eax, 0x28
jne 0x410375
mov ecx, esi
call fcn.00410190
mov ecx, esi
call fcn.00411080
cmp dword [esi + 0x4c], 0x29
mov bh, al
jne 0x41040d
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x410364
cmp byte [eax], 0x5c
jne 0x410361
lea ecx, [eax + 1]
cmp ecx, edx
je 0x410361
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x41034e
mov bl, byte [ecx]
cmp bl, 0x28
je 0x41035f
cmp bl, 0x29
je 0x41035f
test dl, 0x10
jne 0x410361
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x41035f
cmp dl, 0x7d
jne 0x410361
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.0040f4f0
test bh, bh
je 0x4103f2
jmp 0x4103eb
cmp eax, 0x5e
jne 0x41038d
push 2
lea ecx, [esi + 0x24]
call fcn.00410470
mov ecx, esi
call fcn.00410190
jmp 0x4103f2
cmp eax, 0x24
jne 0x4103a5
push 3
lea ecx, [esi + 0x24]
call fcn.00410470
mov ecx, esi
call fcn.00410190
jmp 0x4103f2
cmp eax, 0x2a
je 0x410406
cmp eax, 0x2b
je 0x410406
cmp eax, 0x3f
je 0x410406
cmp eax, 0x7b
je 0x410406
cmp eax, 0x7d
jne 0x4103c9
test dword [esi + 0x50], 0x10000000
je 0x410414
jmp 0x4103d7
cmp eax, 0x5d
jne 0x4103d7
test dword [esi + 0x50], 0x10000000
je 0x41041b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00411330
mov ecx, esi
call fcn.00410190
mov ecx, esi
call fcn.00411190
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x410203
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 0xa
call fcn.0040f4e0
push 5
call fcn.0040f4e0
push 6
call fcn.0040f4e0
push 4
call fcn.0040f4e0
int3

Function at 0x414fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004174cc