joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 8], edi
cmp byte [edi + 0x131], 0
jne 0x10037fc3
push ebx
push 0x100a2c08
jmp loc.101dedec
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100381b0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc88
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0xc84], eax
push esi
push edi
push 0x100a2c08
jmp loc.101e66fa

Function at 0x10038950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x13ac
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0x13a8], eax
push esi
push 0x100a2c08
jmp loc.101cf15d

Function at 0x10039920
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [0x100f45a0]
push 0x100a2c08
jmp fcn.101a43c7

Function at 0x100399f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
push ebx
mov ebx, dword [0x100f45a0]
not eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x10039a24
nop
movzx ecx, byte [edi + edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
cmp edx, esi
jb 0x10039a10
pop edi
pop esi
not eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003c380
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x5f8
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100a2c08
mov edi, ecx
jmp loc.101a8527

Function at 0x100401b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov dword [ebp - 0xcc], ecx
push 0x100a2c08
jmp loc.101b1527

Function at 0x100418f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xe8
push esi
push edi
push 0x100a2c08
jmp loc.101c921c

Function at 0x10046ad0
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 4]
call fcn.10049dc0
push 0x1312d00
jmp loc.10151935
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1f78
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100a2c08
jmp 0x100233ce
Function at 0x100483a0
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100a2c08
mov esi, edx
call fcn.101c2f1f
movaps xmm0, xmmword [ebp - 0xdff0]
clc
xorps xmm0, xmmword [ebp - 0xe000]
test ecx, 0x9cae79af
movaps xmmword [ebp - 0xe010], xmm0
test di, 0x6217
cmp ah, 0xa4
movaps xmm0, xmmword [ebp - 0xe010]
stc
cmp esi, 0xd797b69b
cmp bx, dx
movaps xmmword [ebp - 0xa050], xmm0
sub edx, edx
je 0x101cf306
jmp 0x101cede9
movaps xmmword [ebp - 0xe030], xmm0
movaps xmm0, xmmword [ebp - 0xa040]
movaps xmmword [ebp - 0xe020], xmm0
test eax, esi
clc
movaps xmm0, xmmword [ebp - 0xe020]
cmp dh, 1
xorps xmm0, xmmword [ebp - 0xe030]
movaps xmmword [ebp - 0xe040], xmm0
test edx, 0x2c27a819
test dx, bp
movaps xmm0, xmmword [ebp - 0xe040]
movaps xmmword [ebp - 0xa040], xmm0
xor eax, eax
jmp loc.1001cc71
movaps xmm0, xmmword [ebp - 0x86e0]
jmp 0x101ceda2

Function at 0x10048450
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x100a2c08
mov edi, edx
mov esi, ecx
call fcn.101e3610

Function at 0x10048620
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
push esi
push edi
push 0x100a2c08
mov esi, edx
mov edi, ecx
push ebx
pushfd
mov ebx, 0xf4b70b12
shr ebx, 0xab
ja 0x101d2b9a
test cl, al
movaps xmmword [ebp - 0xa460], xmm0
test dl, 0xa1
cmc
xor eax, eax
jmp fcn.1015995b
mov ebx, dword [esp + 4]
mov dword [esp + 4], 0x1018c8cc
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1004cea8

Function at 0x100486a0
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
movzx eax, byte [0x100ee834]
test eax, eax
je 0x10048716
mov ecx, dword [0x100f459c]
mov edx, dword [ecx + 0x4ac]
call edx
cmp eax, dword [0x100f93e4]
jb 0x10048716
push 0x100a2c08
push ebx
pushfd
mov ebx, 0x38881c93
sub ebx, 0x1e8afb19
call fcn.101c96e5
mov eax, dword [ebp - 0xbdac]
bswap ecx
cmovbe ecx, ecx
push eax
lea ecx, [ebp - 0x54f8]
push ecx
jmp loc.101e3168
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10048780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
jmp 0x10069ca4
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x5c8
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0x5c4], eax
push esi
push edi
push 0x100a2c08
jmp 0x100723bd
push eax
jmp loc.1019de10
lea esp, [esp + 4]
movzx eax, cx
xchg ah, ah
push 0x228
not al
lahf
lea eax, [esp + 0x3a0]
jmp 0x1000f006
Function at 0x100495d0
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
movaps xmm0, xmmword [ebp - 0xd3d0]
bt eax, ebp
movaps xmmword [ebp - 0x18f30], xmm0
bswap ax
shrd ax, si, 0xa9
movaps xmm0, xmmword [ebp - 0xe7b0]
shld eax, edi, 0x14
cmp ah, 0x81
movaps xmmword [ebp - 0x18f20], xmm0
mov ah, 0x39
bt eax, 0x3f
rcr ax, cl
movaps xmm0, xmmword [ebp - 0x18f20]
btr ax, di
sub ax, sp
xorps xmm0, xmmword [ebp - 0x18f30]
movaps xmmword [ebp - 0x18f40], xmm0
cmova eax, esi
movsx eax, bx
shl al, 2
movaps xmm0, xmmword [ebp - 0x18f40]
bsr eax, ebx
movsx ax, dh
movaps xmmword [ebp - 0xe7b0], xmm0
cmp edx, edi
stc
mov eax, 1
test eax, eax
jmp 0x101a6d5d
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18c
push esi
push 0x100a2c08
push ebp
pushfd
mov ebp, 0x7ea49081
shl bp, 0xb5
call fcn.1000c807
movaps xmm0, xmmword [ebp - 0xd3f0]
movaps xmmword [ebp - 0x18ed0], xmm0
movaps xmm0, xmmword [ebp - 0xe7d0]
movzx ecx, di
movaps xmmword [ebp - 0x18ec0], xmm0
rol cl, cl
test esp, edx
movaps xmm0, xmmword [ebp - 0x18ec0]
sub ch, bl
xorps xmm0, xmmword [ebp - 0x18ed0]
movaps xmmword [ebp - 0x18ee0], xmm0
sar cx, 0xa3
movaps xmm0, xmmword [ebp - 0x18ee0]
movaps xmmword [ebp - 0xe7d0], xmm0
mov ecx, 1
test si, ax
cmp cx, bx
test ecx, ecx
je 0x10051bda
jmp 0x10051c3b
movaps xmm0, xmmword [ebp - 0xd3e0]
movaps xmmword [ebp - 0x18f00], xmm0
sub dx, cx
shl dh, cl
movaps xmm0, xmmword [ebp - 0xe7c0]
movaps xmmword [ebp - 0x18ef0], xmm0
shr dl, 0xb3
movaps xmm0, xmmword [ebp - 0x18ef0]
bsf edx, ebp
and dl, dl
or dh, 0x1e
xorps xmm0, xmmword [ebp - 0x18f00]
or dx, ax
movaps xmmword [ebp - 0x18f10], xmm0
shrd edx, ecx, 0xbb
or dx, ax
sub dh, 0xad
movaps xmm0, xmmword [ebp - 0x18f10]
shld dx, di, 0xb
movaps xmmword [ebp - 0xe7c0], xmm0
mov edx, 1
test esp, ecx
stc
cmp bx, 0x32bf
test edx, edx
je 0x1002c976
jmp 0x1002c9eb

Function at 0x10049dc0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x650
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100a2c08
push edx
pushfd
mov edx, 0xad9b868f
lea edx, [edx + edx - 0x30516c78]
bswap edx
neg dx
shl edx, 0x95
movzx edx, dx
mov edx, dword [esp + 4]
mov dword [esp + 4], 0x1018644f
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1004cea8

Function at 0x1004b660
Capabilities:
Encode data using base64
Hash data with md5

Disassembly:
lea esp, [esp + 4]
not ecx
mov cx, bx
bswap edi
mov byte [esi], 0
mov edi, ebx
movsx ecx, si
mov dword [ebp - 0xc], 0x78323025
jmp loc.101d3c26
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x100a2c08
mov esi, ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1000d49d
Function at 0x1004b990
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x100a2c08
mov esi, ecx
mov dword [ebp - 0x18], ebx
jmp loc.101d2732

Function at 0x1004bcb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x100a2c08
mov dword [ebp - 0x14], esi
jmp loc.1016546d

Function at 0x1004d190
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 4]
jmp loc.10139ffa
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009ba50
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc
mov eax, 0x5764
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x4620], esi
push 0x100a2c08
jmp 0x1000a4d0

Function at 0x10050dd0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x78], ecx
push 0x100a2c08
jmp loc.101d96d7

Function at 0x100513d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], ecx
push 0x100a2c08
jmp loc.101f733b

Function at 0x10051a30
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x7c], ecx
push 0x100a2c08
jmp loc.101ce747

Function at 0x10052028
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
xor eax, ebx
mov dword [esp], edx
neg dword [esp]
movzx ecx, byte [esp]
dec eax
and dword [esp + ecx*8 - 0x2c8], ecx
sub edx, 0x49d2004
xor eax, 0xd221a218
jmp fcn.1017aae1

Function at 0x10052090
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x78], ecx
push 0x100a2c08
jmp loc.10156304
Function at 0x10052ec0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x78], ecx
push 0x100a2c08
jmp 0x1007bf00
lea esp, [esp + 4]
bt edx, edx
rol ecx, 0x84
and ecx, 0x1818c214
mov eax, dword [ebp - 0x78]
rcl ecx, cl
sar ecx, cl
movzx ecx, cx
mov ecx, dword [eax + 0xc]
shl edx, cl
xadd edx, edx
add ecx, 4
bts dx, si
mov edx, dword [ebp - 0x78]
cmp ecx, dword [edx + 4]
jmp loc.10198bf1

Function at 0x100534c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x7c], ecx
push 0x100a2c08
jmp loc.101cfd00

Function at 0x100542c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
push 0x100a2c08
jmp 0x10059983
mov dword [ebp - 4], 8
jmp fcn.10197855
lea esp, [esp + 4]
and dx, di
mov eax, 1
imul ecx, eax, 0
not dl
rdtsc
bswap eax
mov edx, dword [ebp - 0xc]
cbw
mov eax, dword [edx]
mov ecx, dword [ecx + eax]
mov dword [ebp - 0x10], ecx
jmp 0x1005a1a4
mov dword [ebp - 8], 0xa4fa41d3
jmp 0x10054992

Function at 0x10054410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa28
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0xa24], eax
push esi
push edi
mov esi, ecx
push 0x100a2c08
mov dword [esp + 0xc], esi
jmp loc.1013ffad

Function at 0x10054900
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [edi + edi*2 + 0x7f1e1b0d]
mov dword [esp], esi
pushfd
mov esi, edx
sar di, 0x44
jbe fcn.1018f1ea
bswap edi
mov edi, eax
cld
call fcn.10040a57
shr dword [esp + 4], 0xf
mov dword [esp + 4], 0x1005751d
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1004cea8
movaps xmm0, xmmword [ebp - 0x2af0]
call fcn.101431d4

Function at 0x100571f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1054
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0x1050], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0x100a2c08
jmp loc.1013730d
Function at 0x10057a60
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2b14
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1c48], ecx
push 0x100a2c08
jmp 0x10067af2
lea esp, [esp + 4]
cmovp ax, si
movzx ecx, ax
mov eax, dword [ebp - 0x1c48]
mov cx, 0x4eac
bswap cx
setg ch
mov byte [eax + 0x3e8], 0
setae cl
mov ecx, eax
movsx ecx, bx
mov dword [ebp - 0x1c40], 0
mov dword [ebp - 0x1c3c], 0
movsx cx, dh
xchg cx, cx
mov dword [ebp - 0x1c38], 0
push 0x1001
not ecx
movzx cx, ch
movzx ecx, bx
push 0
setno cl
lea ecx, [ebp - 0x1a40]
jmp fcn.101c03fd

Function at 0x1005a5f0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x858
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0x854], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x24], eax
push 0x100a2c08
mov dword [esp + 0xc], esi
jmp fcn.1016238c

Function at 0x1005b060
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x9008
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x4ee0], ecx
push 0x100a2c08
jmp loc.101ebb07

Function at 0x10065d00
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009bb40
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc
mov eax, 0x107b4
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x9278], ecx
push 0x100a2c08
push 0x7e072aaf
push ecx
pushfd
and byte [esp + 8], 0x3c
add word [esp + 8], 0x6703
call fcn.10129ae7
add edx, esi
Function at 0x100675f4
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
movzx eax, byte [ebp]
xor al, bl
mov dword [esp], 0x25b2b6ab
push 0x519204b3
not al
push 0xce1fb790
mov edx, 0x8a222bf
rol al, 1
lea edx, [edx + edx*8 + 0xa0bfd34]
movsx ecx, word [esp + edx - 0x57bf35e8]
shr dl, 0x22
sbb al, 0xb4
mov dword [esp + edx - 0x57bf352e], 0xdb9a782b
shr edx, cl
rol al, 1
lea ecx, [edx + 0x2f222b87]
inc al
not word [esp + edx*4 - 0x57be7]
not al
not ecx
dec dx
xor bl, al
not word [esp + edx*4 - 0x57bde]
ror cx, 0xe
not dword [esp + edx*4 - 0x57bea]
lea eax, [esp + eax + 0x10]
not dx
sar dx, 0xc1
mov edx, dword [edx + eax - 0x1d082]
or dword [esp + 6], 0x15b00939
and cl, byte [esp + 0xc]
adc word [esp + 0xa], cx
mov dword [esi - 4], edx
mov eax, dword [ebp + 1]
sbb ebp, 0xfffffffb
mov edx, 0xfd03e821
xor eax, ebx
dec eax
bts ecx, ecx
jae 0x10180632
ror eax, 1
shr byte [esp + 0xc], cl
bswap eax
rol dx, cl
shr byte [esp + 0xb], 0x82
shl edx, 0x8b
inc eax
btc ecx, edx
call fcn.101485ad
Function at 0x10079b60
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
bswap ax
bts ax, si
or ax, 0x6f1c
mov eax, dword [ebp - 0x1ab4]
rcr edx, cl
mov ecx, dword [eax]
add ah, ch
mov ah, 0xbd
xor ecx, 0x2ad218ce
and eax, 0x2ab56ba3
mov dword [ebp - 0x2328], ecx
cmovp dx, dx
xchg dx, ax
shr dx, cl
mov edx, dword [ebp - 0x1ab4]
mov eax, dword [edx + 4]
test eax, esp
bsf dx, dx
xor eax, 0x1d20ca4e
cdq
mov dword [ebp - 0x234c], eax
jmp 0x101b1bec
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x32b4
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1ab4], ecx
call fcn.10049dc0
mov eax, dword [ebp - 0x1ab4]
cmp dword [eax + 0x1c], 0
je 0x10079bcc
mov ecx, dword [0x101208d8]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x22fc], ecx
push 1
mov ecx, dword [ebp - 0x22fc]
call fcn.10040a80
movzx edx, byte [0x100ee837]
test edx, edx
jne 0x10079be6
movzx eax, byte [0x100ee836]
test eax, eax
je 0x1007b735
push 0x100a2c08
call fcn.101a5b1e
movzx ecx, sp
mov edx, dword [ebp - 0x1ab4]
cmp dword [edx + 0x1c], 0
jne 0x1007b807
push 0x100a2c08
call fcn.1000e284
mov edx, 0x8f371da7
movzx eax, dl
mov eax, dword [ebp + eax*4 - 0x29c]
call fcn.10052028
movaps xmmword [ebp - 0x560], xmm0
call fcn.1006b03f
xorps xmm0, xmmword [ebp - 0x183c0]
movaps xmmword [ebp - 0x183d0], xmm0
jmp 0x102016af
call fcn.100486a0
movzx ecx, byte [0x100f45b6]
test ecx, ecx
je 0x1007b82d
movzx edx, byte [0x100f45b5]
test edx, edx
je 0x1007b82d
movzx eax, byte [0x100f45b4]
test eax, eax
jne 0x1007b832
jmp 0x1007d52f
mov ecx, dword [ebp - 0x1ab4]
mov edx, dword [ecx + 0x84]
mov dword [ebp - 0x231c], edx
mov eax, dword [0x101208d8]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x231c]
call fcn.10018e50
mov ecx, dword [0x100f93d8]
call fcn.10065c90
movzx ecx, byte [0x101208c5]
test ecx, ecx
jne 0x1007c7b6
mov edx, dword [0x100f459c]
mov eax, dword [edx + 0x4ac]
call eax
sub eax, dword [0x100f9420]
cmp eax, 0x2710
jbe 0x1007c7b6
mov ecx, dword [ebp - 0x1ab4]
call fcn.1007df40
mov dword [ebp - 0x1afc], eax
cmp dword [ebp - 0x1afc], 0x249f0
jbe 0x1007c7b6
push 0x100a2c08
call fcn.101a3fad
mov eax, dword [0x100f459c]
mov ecx, dword [eax + 0x4ac]
call ecx
mov edx, dword [ebp - 0x1ab4]
sub eax, dword [edx + 0x58]
cmp eax, 0x1388
jbe 0x1007d52f
push 0x100a2c08
jmp 0x1000e203
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10083ca1
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x1007d550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4c8
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0x4c4], eax
push esi
push edi
push 0x100a2c08
jmp loc.101e2efe
Function at 0x1007e060
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x100a2c08
call fcn.101c68ca
mov eax, ebp

Function at 0x10081990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x8dd8
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, esp
mov dword [esp + 0x8dd4], eax
push esi
push edi
mov edi, ecx
mov dword [esp + 0x468], edi
mov eax, dword [edi + 0x31cfc]
cmp eax, dword [edi + 0x31d00]
je 0x100819cd
mov dword [edi + 0x31d00], eax
mov eax, dword [0x100f459c]
push edi
push 0x10083460
mov eax, dword [eax + 0x464]
call eax
mov edx, dword [edi + 0x31d00]
xor esi, esi
mov ecx, dword [edi + 0x31cfc]
mov eax, edx
sub eax, ecx
mov dword [esp + 0xc], esi
sar eax, 3
test eax, eax
je 0x100823d6

Function at 0x1008d783
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1008d7c2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1008d7c2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1008d7c2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1008d7c2
cmp dword [ecx + 0x74], 0xe
jbe 0x1008d7c2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1008ebac
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009ebf8
push 0x1009ebf0
push str.FlsAlloc
push 0x1f
call fcn.1008eac8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008ebe0
push dword [ebp + 8]
mov ecx, esi
call dword [0x1009d130]
call esi
jmp 0x1008ebe6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1008ec2a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009ec08
push 0x1009ec00
push str.FlsGetValue
push 0x21
call fcn.1008eac8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008ec61
push dword [ebp + 8]
mov ecx, esi
call dword [0x1009d130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1008ec69
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009ec10
push 0x1009ec08
push str.FlsSetValue
push 0x22
call fcn.1008eac8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008eca3
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1009d130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]