joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1781424
Capabilities:
Encode data using xor

Disassembly:
imul ecx
mov ecx, 0xb7a2f48c
mov dword [ebp], edx
not cl
mov dword [ebp + 4], eax
sub esi, 4
movzx edx, cl
not ecx
and ecx, edx
mov eax, dword [esi + ecx*2]
jbe 0xf5b335
jmp 0x176abba
xor eax, ebx
bswap eax
push edx
lea eax, [eax + ecx*8 - 0x6f361232]
ror eax, 3
add dword [esp + ecx], edx
neg eax
call fcn.00fd8c16
invalid
jae 0xef1d8a
adc al, 0xe4
adc eax, 0x2cbaa6b3
or bh, 0x3b
mov al, 0xdc
cmp al, 0x5e
inc ebp
mov byte [0x5e24dce0], al
inc ebp
mov byte [0x5e30c4e8], al
inc ebp
mov byte [0x5e34f4f4], al
inc ebp
mov byte [0xe85574b0], al
add eax, 0xf5c39acf
das
sti
xchg esp, eax
jl 0xf83e07
jb 0xf83d54
xor bh, bh
in al, 0x5f
lodsd eax, dword [esi]
hlt
sub byte [esp + 1], 0xbe
add edi, edx
dec word [esp + 1]
mov ecx, dword [ebp]
jp 0x1774449
mov word [ebp], ax
shl byte [esp + 2], 5
mov ecx, dword [esp]
pop edx
mov ecx, dword [esi + ecx - 0x27604795]
jbe 0xfde0a9
mov ah, 0x8d
popal
hlt
dec dx
xor dx, 0x6814
movzx ecx, al
rol dx, 1
or cl, al
sub eax, 0x81aefaa8
xor bx, dx
mov word [ecx + ebp - 0x12], dx
sal cx, 0x6f
mov ax, word [eax + ebp - 0x7e50056a]
add cl, byte [ebp + ecx*4]
push 0x278b478f
shr ax, cl
jmp 0xfad9c4
sar eax, 0x7a
not dx
ror dx, 1
not ax
jmp 0xfc66ed
movzx edx, word [esi - 2]
xor dx, bx
mov eax, 0xbc2211aa
inc dx
jmp 0x176218c
call fcn.00f72c30
shl edx, cl
rol edx, cl
xor eax, 0x95ba43bb
sub dl, 0x22
neg eax
call fcn.00f07c64
mov eax, 0x6fa9058b
add eax, eax
mov ecx, dword [ebp]
bswap eax
inc al
mov eax, dword [ebp + eax - 0x160b52dc]
add eax, 0xe9f4ad24
jle 0xf83d5c
mov ecx, 0x47f09f63
mov dword [0xf0e345b3], eax
mov ds, word [edx]
push esp
sbb dword ds:[ecx], eax
dec esi
sbb dword ds:[ecx], eax
sbb dh, byte [edx]
and al, 0x3e
sbb dword [ecx], eax
xor byte [edx + 0x1193e94], 0xba
outsb dx, byte [esi]
cmp al, 0x3e
sbb dword [ecx], eax
push es
or dl, byte [esi + edi]
sbb dword [ecx], eax
inc edx
shl byte [esi + edi + 0x7eae0119], cl
and al, 0x3e
sbb dword [ecx], eax
push ds
loop 0x1781448
dec ebx
dec ebx
add dword [esi], edx
mov ch, byte [0xd00dee53]
add eax, 0xffff340e
invalid

Function at 0x1782252
Capabilities:
Encrypt data using speck

Disassembly:
sar cx, 0x8a
sal cl, 0x45
dec esp
add ecx, edi
dec esp
mov dword [esp + ebp - 0x3e0b], ecx
ret 0x10
dec esp
mov dword [esp + ebp - 0x3e0b], esi
bswap edi
inc ecx
mov ebx, 0x320cb71a
dec eax
sub ecx, 0x631a3380
adc ax, cx
lea edi, [ebp + edi + 0x4339e281]
dec eax
mov dword [esp + ebp - 0x3e03], 0x16be6713
inc ecx
sub bl, 0x85
dec eax
mov dword [esp + eax*4 - 0x9d4c], ebx
dec ecx
lea ebx, [esi + edx*4 + 0x240fabbf]
push ecx
inc sp
sub ebp, dword [esp + ebp*2 - 0x7c09]
xor dword [esp + ebp*2 - 0x7c06], edi
dec eax
mov ebx, dword [esp + ebp - 0x3dfb]
neg si
dec dword [esp + ebp*2 - 0x7c0d]
inc ecx
dec bl
dec eax
arpl di, di
jbe 0x1600ba7
Function at 0x178382f
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], eax
dec ebx
call fcn.015e5f30
mov ecx, 0x2525f4ae
fadd qword [ebp + ecx*2 - 0x4a4be95c]
rol cl, 3
lea eax, [ecx*4 - 0x2a41ac74]
lea esi, [esi + eax - 0x6a562564]
inc eax
mov eax, dword [esi + ecx - 0x2525f475]
movsx edx, cx
xor edx, edx
jp 0x1834fd0

Function at 0x1805bbf
Capabilities:
Encrypt data using speck

Disassembly:
ror dl, 1
call fcn.01833ddd
lea esi, [ecx + esi - 0x4ab48ca3]
mov dword [esp + ecx - 0x4ab48c9e], 0x500e5b3d
mov dword [esp + ecx - 0x4ab48c9a], ecx
ja 0x18180cd
xor dl, bl
sub ecx, ecx
sbb dword [esp + ecx*2 + 4], 0xa2bef809
inc dl
push ecx
sal cx, 0x21
sal dword [esp + ecx + 1], 0x79
neg dl
xor ecx, ecx
jbe 0x1724e40

Function at 0x180bc69
Capabilities:
Encode data using xor

Disassembly:
adc esi, esp
dec esp
mov edx, 0xf413953a
dec esp
rol cl, cl
in eax, 0x13
hlt
dec edi
lea esp, [ebp + edi*8 - 0x216cf5d0]
call fcn.015d0a01
mov bh, 6
jne 0x180bcaa
popal
dec ebx
push edx
in al, dx
or byte [ebx], ch
dec ebx
jp 0x180bc71
or byte [ebx], ch
pop edi
dec esi
in al, dx
or byte [ebx], ch
dec edi
test al, 0x6d
sbb dword [eax], esp
jne 0x180bc4d
insb byte es:[edi], dx
mov dword [0x5df04b20], eax
loope 0x180bcde
xchg esp, eax
hlt
out 0x2c, eax
loop 0x180bd2c
jae 0x180bcc3
push ss
mov cl, 0x59
out 0x79, eax
push eax
sar byte [ebp + 0x6f0406fd], 1
fxch st(1)
xor byte [ecx], bh
fild qword [ecx + 0x2429c99c]
push ds
pushfd
leave
sub dword [esi + ebx], esp
rcl byte [ecx]
fisttp dword [ecx + edi*4]
adc dh, byte ds:[edx - 0x56]
stosb byte es:[edi], al
adc dword [ecx + 0x4246c254], eax
xchg esi, eax
pop ebp
xchg ebx, eax
jle 0x180bcb6
mov dl, ch
sbb dh, byte [edx - 0x49d82469]
jle 0x180bcd0
aaa
invalid
ret

Function at 0x180d6a2
Capabilities:
Encrypt data using speck

Disassembly:
sar eax, 9
pop ecx
pop edx
jne fcn.00f2d244
mov word [ebp + eax*2 - 0x400c2524], cx
rol word [esp + eax*2 - 0x400c251e], 0xc9
jae 0x15f721d
ror dword [esp + edx - 0x603e5b5d], 0x29
xor bl, cl
pop edx
lea eax, [eax + eax*4 + 0x5b8856af]
sub ebp, 2
movsx edx, al
and eax, 0x2e1e1296
jno 0x172d96a

Function at 0x180e655
Capabilities:
Encrypt data using speck

Disassembly:
rol eax, 1
dec ebp
xchg esi, esp
not eax
dec esi
mov dword [esp - 0x4119e291], edi
dec edx
lea ecx, [esi + esi*2 - 0x305860e1]
rol eax, 1
neg eax
dec ebp
lea esi, [esi + edi*4 - 0x45c3ad42]
inc ecx
push esi
bswap eax
inc esi
add dword [esp - 0x4119e287], esi
dec edx
mov dword [esp - 0x4119e289], ebx
sar byte [esp + esi - 0x2672], 0x63
call fcn.01731a39

Function at 0x180f41c
Capabilities:
Encrypt data using speck

Disassembly:
bswap eax
call fcn.00f468a4
movsx ecx, ax
movzx ax, byte [ebp + ecx*2 - 0xef62]
and cx, cx
shr ecx, 0x2e
lea edx, [ecx*2 - 0x286338fc]
mov dl, byte [ecx + ebp + 1]
sal cx, 0x47
xor ecx, ecx
adc cx, 0x733e
not al
not dl
and al, dl
call fcn.00f641dd
mov eax, edx
mov eax, dword [edi]
mov dword [esp], 0xbf2f7b3b
push edx
xor eax, ebx
sal edx, 0xc1
inc eax
ror edx, 0xaf
sal dword [esp + edx - 0x7cfd3481], 0xe3
dec word [esp + edx - 0x7cfd3482]
bswap eax
rol eax, 3
dec edx
jg 0x180e4bb
Function at 0x180f483
Capabilities:
Encrypt data using speck

Disassembly:
push ecx
mov cl, byte [ebp + ecx*4 - 0xe41b838]
shrd edx, eax, cl
mov ecx, 0x84ae1908
mov dword [ebp + 6], edx
call fcn.0183334e
add esi, eax
shr cl, 0xa2
sal edx, 3
mov edx, dword [edx + ebp - 0x1c873720]
sub dword [esp + ecx*8 - 0x1c837078], 0x3b5a807
mov eax, dword [ecx + ebp - 0x3906e0c]
jle 0xf89395

Function at 0x180f528
Capabilities:
Link function at runtime on windows

Disassembly:
sal cx, 0xe2
not edx
ror edx, 1
sar ecx, cl
sub ecx, ecx
sbb edx, 0xba33451a
rol eax, 0x61
setae al
sbb ecx, eax
xor ebx, edx
xor eax, 0x832c6d2a
sal ecx, cl
add edi, edx
add cl, ch
dec dword [esp + 4]
mov dword [ebp], edx
lea eax, [ecx*4 + 0x4195f086]
add dword [esp + 4], 0x9afc93b
call fcn.00f0da3d
xadd dword [esp], ecx
add cx, 0xe793
xor ebx, eax
lea edx, [ecx + ecx*2 + 0x2ba5b704]
neg dx
add edi, eax
or word [esp + edx - 0x2b27cde0], 0x4525
rdtsc
sal ecx, cl
sar cl, 0xa4
lea ebp, [ebp + ecx - 0x4ec80008]
mov dword [ebp + ecx - 0x4ec7fffc], eax
adc ecx, ecx
jo 0xfded31
mov ecx, 0xe3116da2
mov edx, ecx
lea eax, [edx + ecx*4 + 0x5a224e02]
sub esi, 4
xadd eax, ecx
inc ecx
mov edx, dword [esi]
xor edx, ebx
rol edx, 3
sal ecx, 0x27
shr al, 0xc5
not edx
and ecx, ecx
sal eax, 0x75
sbb eax, eax
sub edx, 0x272aa427
sub eax, ecx
dec cl
rol ecx, cl
not edx
jne 0x17695ff
or al, 0xa3
ror edx, 1
sar cx, 0xc1
jle 0xee7b72
rol cx, 0x2e
mov dx, word [ebp + 4]
lea ecx, [ecx + ecx - 0x3cd3dca]
jae 0x1751a02
add ax, dx
pop ecx
add ecx, 0xffffffa0
jmp ecx

Function at 0x1813665
Capabilities:
Encrypt data using speck

Disassembly:
add dword [esp + edx*2 - 0xea22000], edi
ret
ror dword [esp + edx - 0x7511000], 0xa
neg ecx
xor ebx, ecx
sar al, 0xe5
adc edi, ecx
shl dword [esp + edx*2 - 0xea22000], 0x5e
je 0xee8558
not dl
and al, byte [esp + 5]
sbb dl, 0xa6
shl dword [esp + 1], cl
setnp byte [esp + 4]
jbe 0xfa9d80
mov byte [0x8c0d0f6d], al
rcr byte [esi + ecx*2], 1
push 0xd
in eax, 0x11
imul edx, dword [ecx + 0x3531ffb0], 0x33
xchg ecx, eax
mov al, 0xff
leave
in eax, 0xdb
xchg ecx, eax
mov al, 0xff
adc dword [ecx - 0x4f6e35], ebx
rcr dword [ecx - 0x4f6e45], 0x2d
std
mov edx, dword [ecx + 0x5e1ffb0]
push ebx
xchg ecx, eax
mov al, 0xff
rol ecx, 1
xchg ecx, eax
mov al, 0xff
xor eax, 0xe2e4ffb9
call dword [edx + 0x47fcb249]
dec edi
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
retf 0xffff
xor bl, dl
not eax
call fcn.0172f6f2
dec ecx
mov dword [esp + edx*2 - 0xea22000], edx
jmp 0xf13b1c

Function at 0x1813775
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
dec esp
mov ecx, 0x19af4d93
inc eax
shl dh, 0x64
dec eax
mov dword [esp + edi*2 - 0x72], 0x5c07fe25
inc ecx
neg esp
pop ecx
rol dl, cl
push ebx
call fcn.0174a98e
Function at 0x1814643
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x762e70b9
mov dl, byte [ebp + edx - 0x762e70b9]
mov eax, 0x673a3a35
movsx ecx, al
movzx ax, byte [eax + ebp - 0x673a3a33]
sal ecx, 0xcf
lea ebp, [ebp + ecx - 0x1a7ffe]
imul dl
sar cl, 0xa5
mov word [ebp + ecx*2 - 0x350000], ax
sub cx, cx
lea edx, [ecx*4 - 0x2bf180ca]
lea esi, [esi + ecx - 0x1a0004]
jns 0x1813e14
xor ebx, ecx
push eax
and dl, dh
adc esi, ecx
shr edx, 0x6c
bswap eax
lea ecx, [eax + edx*8 - 0x44ce26dc]
mov edx, dword [eax + ebp - 0x1592230c]
bswap ecx
mov cl, byte [ebp + eax - 0x15922308]
lea eax, [eax + eax - 0x5ee2f0d8]
mov dword [esp + 4], eax
add ebp, 2
push eax
shr edx, cl
mov dword [ebp], edx
pop eax
call fcn.00ee68a0
jmp 0x17670ae

Function at 0x181476c
Capabilities:
Encode data using xor

Disassembly:
neg edx
push edx
mov eax, dword [ebp]
call fcn.01775e22

Function at 0x1816d17
Capabilities:
Encrypt data using speck

Disassembly:
inc ecx
dec esp
inc ecx
mov edi, 0xdfa4a02e
dec eax
mov dword [esp + edi*4 - 0x148], eax
call fcn.00f2144f

Function at 0x1817b34
Capabilities:
Encrypt data using speck

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.01763754

Function at 0x18180bd
Capabilities:
Encrypt data using speck

Disassembly:
mov dword [esp], edx
neg ecx
pop edx
add ax, ax
xor ebx, ecx
call fcn.0177b130
Function at 0x182df9d
Capabilities:
Encode data using xor

Disassembly:
call fcn.017293c4
mov ecx, dword [ecx + ebp - 0x17fffffc]
adc ebp, 4
xor edx, edx
test ecx, ecx
lea esp, [esp + 4]
je 0x1733866
jmp 0xfddb9c
neg edx
rol eax, 0xb9
dec edx
and cx, cx
ror edx, 1
or ecx, ecx
inc eax
not edx
mov dword [esp + eax - 0x6c8c625a], ecx
sbb edx, 0xd1a8058c
dec ecx
xor ebx, edx
and cx, ax
adc esi, edx
dec eax
shl ecx, cl
mov eax, dword [eax + ebp - 0x6c8c6259]
ja 0x15e28af
aas
fucompi st(6)
rol byte [ecx], 1
lodsd eax, dword [esi]
and eax, 0x1d4e76f
jno 0x182e010
pop ds
out 0xd4, eax
add ebp, edx
in eax, 0xdf
out 0xd4, eax
add dword [ecx], esi
cmp dword [edi], ebx
out 0xd4, eax
add dword [ecx - 0x2b18303f], edx
add ebp, ebx
push ebp
aas
out 0xd4, eax
add ecx, ecx
add eax, 0x1d4e767
inc ebp
xor eax, 0x1869213
or eax, 0x8204b84
or bl, byte [eax - 0x35]
xor al, 0
add byte [eax], al
sub byte [ebx + 0x5f], 0x4e
xchg esp, eax
test byte [ebx + 0x20], cl
or byte [edx], cl
pop eax
retf
add byte [eax], al
add byte [eax - 0x6bb1a095], al
cmpsb byte [esi], byte es:[edi]
mov dword [0x8894fe3c], esi
fld dword [eax - 3]
dec edx
cmp al, 0x4e
xchg esp, eax
adc eax, 0x4fd3d510
enter 0xffffffffffffcb3f, 0
add byte [eax], al
cmp byte [eax], 0x4c
xor eax, 0x342d4d3c
sub al, 0x5f
movsb byte es:[edi], byte [esi]
jp 0x182e047
sar dword [esi], 1
aaa
sal dword [eax], cl
cmpsb byte [esi], byte es:[edi]
int1
inc ebp
int1
add esi, ebx
lea ecx, [eax]
inc eax
jno 0x182e008
pop ss
or byte [esi + 0xdeb8e79], al
sbb byte [edi + 0x5f702c6], ah
js 0x182e04f
add eax, 0x65b32ec6
cmp al, 8
mov dl, 0x42
inc ebx
sub al, 0xb0
jbe 0x182e0e5
mov ch, 0xe
aaa
inc ecx
xor al, 0x3a
invalid
adc ebx, dword [ebx + 0x6a]
mov esi, 0x9466f002
xchg esp, eax
add dword [edi], ecx
nop
inc eax
sub al, 0x1c
cdq
xor al, 0xcb
add byte [eax], al
add byte [eax + 0x3c3e1d6b], al
jb 0x182e0ec
mov ebx, 0xfb5e69a8
push ebp
mov esp, 0xffffff34
invalid
Function at 0xa10114
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa1011e
pushal
call 0xa10124
pop ebp
sub ebp, 0x10
sub ebp, 0x610114
jmp 0xa1013a
mov eax, 0x610114
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e3
mov edx, 0xe4e2059d
xor byte [eax], dl
inc eax
dec ecx
jne 0xa10151
jmp 0xa10164
push ss
push eax
push ss
adc al, 0xa1
popfd
popfd
popfd
sbb al, 0x5c
popfd
popfd
popfd
sahf
push eax
and eax, 0x9d9d9d99
daa
mov ch, 0x9d
popfd
popfd
push 0x7f
sahf
push ebp
push ss
sbb al, 0x91
popfd
popfd
popfd
sahf
pop eax
int 0xcd
cmc
xor dword [ebx], esi
xchg ebx, eax
popfd
cmc
sti
iretd
Function at 0x18005ec8
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x18005f49
mov byte [esi + 8], 1
call fcn.180ad9c7
cmp dword [esi + 0x10], 0
je 0x18005f49
test al, al
je 0x18005ee8
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.18006587
test al, al
jne 0x18005f0f
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800b1a8
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call fcn.180ad9c7
cmp dword [esi + 0x18], 0
jne 0x18005f36
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.1800b1a8
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x18005f49
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x18006587
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x18006594
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x180065cd
cmp eax, 0x80
je 0x180065cd
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.1800b1a8
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x18006590
mov al, 1
pop esi
ret

Function at 0x18006f28
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x18006f5e
lea esi, [edi + 4]
test esi, esi
je 0x18006f5e
call fcn.180044de
test al, al
je 0x18006f5e
mov ecx, edi
call fcn.180044de
test al, al
je 0x18006f5e
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x18006f60
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x18009251
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push edi
push str.Global_MSIExecute
xor edi, edi
push edi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
mov esi, eax
test esi, esi
jne 0x18009286
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x180092c7
test eax, eax
jle 0x180092b5
movzx edi, ax
or edi, 0x80070000
jmp 0x180092c7
push 0x493e0
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x180092c0
cmp eax, 0x80
je 0x180092c0
cmp eax, 0x102
je 0x180092b9
cmp eax, 0xffffffff
je 0x180092b0
mov edi, 0x80004005
jmp 0x180092c7
call fcn.18012ae1
mov edi, eax
jmp 0x180092c7
mov edi, 0x800705b4
jmp 0x180092c7
push esi
call dword [sym.imp.kernel32.dll_ReleaseMutex]
test esi, esi
je 0x180092d2
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x18012b1f
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18012b8e
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x18012b6a
push ebx
push edi
push eax
call fcn.18140600
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x18012b85
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x1801cdca
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
and dword [esi + 0x1c], 0
test ecx, ecx
je 0x1801cdde
mov eax, dword [ecx]
push 1
call dword [eax]
push 0
lea ecx, [esi + 0x18]
call fcn.180ad9c7
mov ecx, dword [0x181c07a8]
pop esi
mov ecx, dword [ecx]
jmp fcn.180160a0
Function at 0x1803186f
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x180319c2
mov edx, 0x10000000
cmp eax, 0x7c
je 0x180319c2
cmp eax, 0x29
jne 0x180318a8
cmp dword [esi + 0x10], 0
jne 0x180319c2
test dword [esi + 0x50], edx
je 0x180319c8
cmp eax, 0x2e
jne 0x180318c3
push 5
lea ecx, [esi + 0x24]
call fcn.180ad9c7
mov ecx, esi
call fcn.18031846
jmp 0x180319ac
cmp eax, 0x5c
jne 0x18031918
mov ecx, esi
call fcn.18031846
test byte [esi + 0x50], 0x80
je 0x1803190c
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x180318f4
push 4
lea ecx, [esi + 0x24]
call fcn.180ad9c7
mov ecx, esi
call fcn.18031846
jmp 0x180319b3
cmp eax, 0x42
jne 0x1803190c
push 4
lea ecx, [esi + 0x24]
call fcn.180ad9c7
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x180318e8
mov ecx, esi
call fcn.180325c9
jmp 0x180319ac
cmp eax, 0x5b
jne 0x18031938
mov ecx, esi
call fcn.18031846
mov ecx, esi
call fcn.1803257d
cmp dword [esi + 0x4c], 0x5d
je 0x180318b7
push 4
jmp 0x180319ca
cmp eax, 0x28
jne 0x18031955
mov ecx, esi
call fcn.18031846
mov ecx, esi
call fcn.180326a2
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x180319c8
jmp 0x180319a1
cmp eax, 0x5e
jne 0x1803195e
push 2
jmp 0x180318e0
cmp eax, 0x24
jne 0x1803196a
push 3
jmp 0x180318e0
cmp eax, 0x2a
je 0x180319be
cmp eax, 0x2b
je 0x180319be
cmp eax, 0x3f
je 0x180319be
cmp eax, 0x7b
je 0x180319be
cmp eax, 0x7d
jne 0x18031988
test dword [esi + 0x50], edx
je 0x180319ba
cmp eax, 0x5d
jne 0x18031992
test dword [esi + 0x50], edx
je 0x18031931
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.180ad9c7
mov bl, 1
mov ecx, esi
call fcn.18031846
test bl, bl
je 0x180319b3
mov ecx, esi
call fcn.180ad9c7
mov cl, 1
jmp 0x18031876
push 6
jmp 0x180319ca
push 0xa
jmp 0x180319ca
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.180ad9c7
int3

Function at 0x1803da90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 2
xor edi, edi
push edi
push dword [ecx]
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x1803dad3
push str.GOOGLEUPDATEAPPLICATIONCOMMANDS
push 1
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1803dad3
push ebx
push esi
call dword [sym.imp.kernel32.dll_SizeofResource]
cmp eax, 4
jne 0x1803db01
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
jne 0x1803daea
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1803db06
movzx edi, di
or edi, 0x80070000
jmp 0x1803db06
push eax
call dword [sym.imp.kernel32.dll_LockResource]
test eax, eax
jne 0x1803dafc
mov edi, 0x80070006
jmp 0x1803db06
cmp dword [eax], 1
je 0x1803db06
mov edi, 0x8000ffff
test esi, esi
je 0x1803db11
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x18081df3
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
mov ebx, dword [edi]
test bl, bl
je 0x18081e68
test bl, 1
je 0x18081e0e
lea ecx, [esi + 0x14]
call fcn.1804fc74
test bl, 2
je 0x18081e1b
mov ecx, dword [esi + 0x18]
call fcn.18056c8b
test bl, 4
je 0x18081e28
mov ecx, dword [esi + 0x1c]
call fcn.180d29b0
test bl, 8
je 0x18081e35
mov ecx, dword [esi + 0x20]
call fcn.180ad9c7
test bl, 0x10
je 0x18081e42
mov ecx, dword [esi + 0x24]
call fcn.1805d433
test bl, 0x20
je 0x18081e4f
mov ecx, dword [esi + 0x28]
call fcn.1805d433
test bl, 0x40
je 0x18081e5c
mov ecx, dword [esi + 0x2c]
call fcn.180730e9
test bl, bl
jns 0x18081e68
mov ecx, dword [esi + 0x30]
call fcn.180d29b0
test ebx, 0xff00
je 0x18081ef4
test ebx, 0x100
je 0x18081e84
mov ecx, dword [esi + 0x34]
call fcn.1805581d
test ebx, 0x200
je 0x18081e94
mov ecx, dword [esi + 0x38]
call fcn.1807376b
test ebx, 0x400
je 0x18081ea4
mov ecx, dword [esi + 0x3c]
call fcn.18074298
test ebx, 0x800
je 0x18081eb4
mov ecx, dword [esi + 0x40]
call fcn.18074298
test ebx, 0x1000
je 0x18081ec4
mov ecx, dword [esi + 0x44]
call fcn.180ad9c7
test ebx, 0x2000
je 0x18081ed4
mov ecx, dword [esi + 0x48]
call fcn.180551ff
test ebx, 0x4000
je 0x18081ee4
mov ecx, dword [esi + 0x4c]
call fcn.180551ff
test ebx, 0x8000
je 0x18081ef4
mov ecx, dword [esi + 0x50]
call fcn.180d29b0
test ebx, 0xff0000
je 0x18081f80
test ebx, 0x10000
je 0x18081f10
mov ecx, dword [esi + 0x54]
call fcn.180d29b0
test ebx, 0x20000
je 0x18081f20
mov ecx, dword [esi + 0x58]
call fcn.18076c08
test ebx, 0x40000
je 0x18081f30
mov ecx, dword [esi + 0x5c]
call fcn.180d29b0
test ebx, 0x80000
je 0x18081f40
mov ecx, dword [esi + 0x60]
call fcn.180ad9c7
test ebx, 0x100000
je 0x18081f50
mov ecx, dword [esi + 0x64]
call fcn.1805581d
test ebx, 0x200000
je 0x18081f60
mov ecx, dword [esi + 0x68]
call fcn.180d29b0
test ebx, 0x400000
je 0x18081f70
mov ecx, dword [esi + 0x6c]
call fcn.180d29b0
test ebx, 0x800000
je 0x18081f80
mov ecx, dword [esi + 0x70]
call fcn.180d29b0
test ebx, 0xff000000
je 0x18082017
test ebx, 0x1000000
je 0x18081f9c
mov ecx, dword [esi + 0x74]
call fcn.18073ce6
test ebx, 0x2000000
je 0x18081fac
mov ecx, dword [esi + 0x78]
call fcn.180d29b0
test ebx, 0x4000000
je 0x18081fbc
mov ecx, dword [esi + 0x7c]
call fcn.1805d433
test ebx, 0x8000000
je 0x18081fcf
mov ecx, dword [esi + 0x80]
call fcn.1805ad79
test ebx, 0x10000000
je 0x18081fe2
mov ecx, dword [esi + 0x84]
call fcn.180770e7
test ebx, 0x20000000
je 0x18081ff5
mov ecx, dword [esi + 0x88]
call fcn.180d29b0
test ebx, 0x40000000
je 0x18082008
mov ecx, dword [esi + 0x8c]
call fcn.1807f075
test ebx, ebx
jns 0x18082017
mov ecx, dword [esi + 0x90]
call fcn.18056923
test byte [esi + 0xc], 1
je 0x18082028
mov ecx, dword [esi + 0x94]
call fcn.1807224e
push 8
push 0
push edi
call fcn.1813fd80
add esp, 0xc
lea ecx, [esi + 4]
test byte [ecx], 1
pop edi
pop esi
pop ebx
jne fcn.18087617
ret