joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55bcf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x55bd09
mov esi, edi
mov edi, eax
jmp 0x55bd0b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x55bd1b
mov eax, ebx
jmp 0x55bd25
push eax
push ebx
call fcn.004deb70
add esp, 8
test eax, eax
jne 0x55bd2d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x55bd4b
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x55bd34
cmp eax, dword [esi + 4]
jge 0x55bd62
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x55bd50
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x55bd85
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x55bd82
sub eax, 1
test eax, eax
jg 0x55bd72
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x57dbe0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1c
call 0xe0493f70
mov eax, dword [0x6091e0]
xor eax, esp
mov dword [esp + 0x18], eax
pop dword [esp + 0x20]
push ebx
push ecx
push edi
mov dword [esp + 0xc], eax
xor ebp, ebp
push esi
push 0xfffe6248
add esp, 4
test eax, 0x2003000
je 0x57dc2e
cmp dword [esi + 0x14], ebp
jne 0x57dc2e
invalid
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x580ba0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.004b3f70
push ebp
push esi
mov esi, dword [esp + 0x54]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push ebp
xor edi, edi
call fcn.0056e170
add esp, 0xc
test eax, eax
je 0x580c00
lea esp, [esp]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
shl edx, 0xa
test eax, edx
je 0x580be2
add edi, 1
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
add ebp, 1
push ebp
call fcn.0056e170
add esp, 0xc
test eax, eax
jne 0x580bd0
test edi, edi
jne 0x580c24
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.004d9bd0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x4c]
cdq
idiv edi
cmp edi, 1
push ebx
mov ebx, eax
jne 0x580c3b
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x4c]
push esi
push 0
push eax
call fcn.0049a380
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x30], 0
call fcn.0056e170
add esp, 0x18
test eax, eax
je 0x580d23
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
shl eax, 0xa
test ecx, eax
je 0x580cfd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x580d30
mov ebp, dword [esp + 0x58]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push esi
push ebp
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x5c]
and edx, 1
add edx, ebx
push edx
mov edx, dword [esp + 0x68]
push edi
push eax
call fcn.005807a0
add esp, 0x34
test eax, eax
je 0x580d4e
add edi, ebx
test esi, esi
jle 0x580cfd
mov eax, dword [esp + 0x54]
mov ecx, ebp
sub ecx, eax
mov ebp, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub ebp, 1
jne 0x580cf0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
add eax, 1
push edx
push eax
mov dword [esp + 0x24], eax
call fcn.0056e170
add esp, 0xc
test eax, eax
jne 0x580c70
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.004d9bd0
add esp, 0x14
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x40604c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lodsd eax, dword [esi]
clc
sub al, 0x28
out dx, eax
outsd dx, dword [esi]
jge 0x40606c
pop ds
sbb ebp, eax
clc
fiadd dword [edx - 0x5d]
adc esp, dword [esi - 0x5cdb74b2]
dec eax
dec esp
push 0x33ad3200
push ebp
pushal
mov ch, 0xcf
cmp eax, 0xa64edf82
cmp eax, 0xb76e2ef8
pushfd
outsb dx, byte [esi]
mov bh, 0x9c
sar dword [eax], 1
push 0xffffffffffffffef
adc cl, ch
fsubr st(1)
add eax, 0xce0528c6
jnp 0x4060ef
dec eax
jb 0x406045
push es
sub byte [ebp + 0x131d6d2c], al
mov edi, 0x8b31b680
int1
invalid

Function at 0x406064
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lodsd eax, dword [esi]
clc
sub al, 0x28
out dx, eax
outsd dx, dword [esi]
jge 0x40606c
pop ds
sbb ebp, eax
clc
fiadd dword [edx - 0x5d]
adc esp, dword [esi - 0x5cdb74b2]
dec eax
dec esp
push 0x33ad3200
push ebp
pushal
mov ch, 0xcf
cmp eax, 0xa64edf82
cmp eax, 0xb76e2ef8
pushfd
outsb dx, byte [esi]
mov bh, 0x9c
sar dword [eax], 1
push 0xffffffffffffffef
adc cl, ch
fsubr st(1)
add eax, 0xce0528c6
jnp 0x4060ef
dec eax
jb 0x406045
push es
sub byte [ebp + 0x131d6d2c], al
mov edi, 0x8b31b680
int1
invalid

Function at 0x406090
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lodsb al, byte [esi]
lcall 0xb8ea, 0x55e4d693
loope 0x406080
invalid

Function at 0x4060bc
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov eax, 0x34fee6e1
push es
je 0x406101
push edi
fst dword [eax + 0x6b8c1b5c]
mov dh, 0xef
sal dword [ebx + 0x78366c9e], cl
dec edi
inc ebp
mov bh, 0xcb
dec edi
shr byte [eax], 1
lodsd eax, dword [esi]
jae 0x406097
xor eax, 0x65553d96
push 0x61
aas
and al, 0x92
popal
jecxz 0x4060f0
dec edi
inc edi
out 0xef, eax
mov dh, 0x5d
sbb byte [edi], 0x67
xor byte [ebx + 0x51332ae2], 0x64
Function at 0x40611c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
js 0x4060fe
call 0xb597d87a
insb byte es:[edi], dx
inc esp
invalid
or cl, byte [esi - 0x4a]
xchg esi, edx
mov byte [edx], dh
jo 0x40610b
test dword [ecx + 0xe], edi
inc ebp
push es
shl byte [eax], cl
jge 0x4060db
sub al, 0xf
test dword [esi + ecx*2 + 0x73], edi
inc ebp
jl 0x40613e
jae 0x406137
dec ecx
add byte [esi - 0x76], 0x81
sub bh, byte [ebx]
sar dword [esi + edx*2 - 0x5d], cl
rcl dword [ebx + 0x1f829a44], cl
xor byte [bp + di + 0x2ae2], 0x33
xchg ebx, eax
inc esp
lcall 0xe2b3, 0x82671f82
sub dh, byte [ebx]
push ecx
xchg ebx, eax
xchg ebx, eax
mov ch, 0xba
jl 0x4060d8
fcmove st(0), st(0)
add eax, 0x1e49148b
cmp al, 0x73
jecxz 0x4060ac
scasd eax, dword es:[edi]
sub eax, 0x1f7133ec
jg 0x4060ee
outsd dx, dword [esi]
mov ecx, 0x2f96b253
enter 0xffffffffffffa127, 0x4a
mov bl, 0xf4
invalid
push ebp
fistp qword [ecx + 0xa6ec927]
test dword [ebp - 0x1e615745], ebp
inc edi
xor byte [ebp + 0x58], 8
mov word [eax - 0xbdeea37], gs
jne 0x4060eb
jp 0x4061a9
mov gs, edi
in al, 0x14
jl 0x40618d
xor dword [0x2d1cdb94], 0xb02fbac
stosb byte es:[edi], al
lds ebp, [ebp - 0x7f108ab3]
in al, 0x53
mov edi, ecx
pop ss
sbb dword [eax], edx
in eax, 0x60
add al, 0x92
xchg ebp, eax
test dword [ebx + edx*8 + 0x54da3f8], ebx
shl dword [edi], 1
invalid
inc eax
out 0x9a, al
mov word [eax], ss
imul edi, ebx, 0x51
sub dword [ecx + 0x66], 0x7c6e4e46
insd dword es:[edi], dx
test eax, 0x7429529
inc esi
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
cmp al, 0x66
jns 0x406226
mov esi, 0x286e22b2
lodsb al, byte [esi]
cmp byte [edx], ch
fucom st(7)
jp 0x40621c
sub byte [eax + 0x63d6f460], cl
cdq
fcom st(0)
bound edi, qword [edx - 0x29]
mov al, byte [0x1d49efac]
invalid
cmpsb byte [esi], byte es:[edi]
leave
adc eax, 0x69134e56
cmc
mov esp, 0x5e33cceb
jns 0x406271
int3
cld
pushal
or al, 0xbb
fnstsw word [esi + 0x57]
dec ebp
wait
inc edi
invalid
lodsd eax, dword [esi]
into
shr byte [ebp + 0x1e], 4
sbb byte [eax - 0x3c], al
outsb dx, byte [esi]
rcl cl, 0x7d
or byte [ecx - 0x236b3abd], ah
mov eax, dword [0xdc94c543]
fld dword [ebx]
push 0xbcc8541a
mov word [ecx + ebp*8], ds
sti
loope 0x4062d7
pop ebp
mov edx, ebx
out 0xa9, eax
mov dh, 0xc7
imul ebx, dword [ebp + 0x46], 0x762d81e3
fild word [edx + 0x5aed8b86]
int3
jmp dword [ebx + ebx*2 - 0x31]
stosd dword es:[edi], eax
rcl dword [edx + 7], 0xc6
les ebx, [eax]
mov edi, 0x2e3f7df1
aam 0x7c
mov al, 0xc2
jno 0x40627f
sal ebp, 1
cdq
clc
je 0x406364
sbb eax, 0xb4088c15
je 0x4062b7
cmc
mov ss, word [esi]
inc ebx
retf 0x2b8c
das
xor ebx, dword [0x598efe4e]
or eax, 0x724e4ac
push eax
in al, dx
iretd
Function at 0x406cf4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd7b25bdb
pushfd
bound ebx, qword [ebx - 0x38]
adc dword [0x96fde610], edi
invalid
adc byte [ecx - 0x5c], dl
sub dword [esi + 0x3c], ecx
mov al, byte [0x54cb040e]
dec edx
sbb eax, 0x9cf1add3
test byte [edi + 0x4d], dh
xor byte [ecx + 0x2c], ah
cld
jns 0x406cf2
out dx, al
dec ebp
cli
call 0x7a99c52b
push edx
cmp dword [ebp + edx*4 + 0x39ae1bae], ebx
insd dword es:[edi], dx
mov dh, 0xd1
int1
pop es
pop ecx
invalid
salc
xchg dword cs:[0x8e586e96], edx
into
jbe 0x406d03
push gs
mov byte [esi - 0x46], ah
push 0xda26c1e5
mov byte [ecx], ch
dec esi
push edi
dec ecx
pushfd
push edi
sahf
dec ebp
pop ds
push ecx
add eax, 0x9d45df83
or dword [edi + 0x7b5cc048], ecx
sahf
scasd eax, dword es:[edi]
adc al, 0xfb
adc byte [edx - 0x73d9803f], cl
imul eax, dword [ebx], 0xffffffcc
xchg ecx, eax
push ds
invalid

Function at 0x453ee0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x44a6e141
add dword [ecx + 0x5b], edx
mov al, byte [0x78237344]
sbb byte [ecx - 0x14], al
jae 0x453e86
js 0x453e7d
inc ecx
in al, dx
jmp 0x453e5c
pop esp
jns 0x453ef2
and byte [edx + 0x7d6f8edd], ah
loopne 0x453e1a
dec byte [edi - 0x5711cee9]
sbb al, byte [ebx + 0x5e18e5d7]
sbb al, al
invalid
adc dl, 0x8e
mov dl, 0xd
sahf
jns 0x453ed5
ret
retf
cmp byte [ecx], ah
sbb eax, 0xa2a8ef90
jae 0x453e61
add esp, dword [esi]
or al, 0xe6
pop edx
xchg edx, eax
cwde
cmp eax, 0x8e4708f0
daa
and dword [ebx], edx
xchg ebx, eax
daa
add ebx, dword [ebp + 0x18]
rol byte [ebp - 0x5e], cl
je 0x453f13
insd dword es:[edi], dx
mov al, byte [0x54158631]
push ebx
test eax, 0x3768b19e
jns 0x453eb3
arpl word [eax + 0x17357608], bx
adc al, bl
ret 0xf122
insd dword es:[edi], dx
dec ebp
mov al, 0x2a
inc edx
wait
imul ebx, dword [edx + 0x466e9fe2], 0xb301db7
loop 0x453ebc
outsb dx, byte [esi]
inc esi
mov bh, 0x1d
xor byte [ebx], cl
xchg esp, eax
or dword [edi + 0x19], esi
inc ecx
jecxz 0x453f1b
insd dword es:[edi], dx
cmp al, 0x63
mov byte [0xe03ee704], al
pushfd
mov esi, 0xa135ff5
loopne 0x453f82
aad 0xe7
mov ch, 0x12
in al, 0xbd
imul edi, dword [edi + 0x5c], 0xffffff82
adc ebx, dword [esi]
xor esp, dword [edx + 0x279aaeeb]
mov dl, 0x77
dec ebp
adc dword [ebp + ecx - 0x65b8fe3e], esp
adc al, 0xf0
push esi
insd dword es:[edi], dx
aas
push ebp
sti
pop eax
xor byte [ebp + 0x67], 0x9b
fdiv dword [eax + 0x16]
mov bl, 0x53
mov ebp, 0xe6f03bce
mov ecx, 0xec87bcf3
stc
jmp 0x638790a5
mov esp, ecx
stosb byte es:[edi], al
shl byte [ebx], 1
lahf
loop 0x453f6d
rcr ah, 1
sub ecx, dword [esp + esi*4 + 0x74]
test byte [edx - 0x7304a378], 0x5a
fldcw word [ebx - 0x5834d400]
jbe 0x453ff4
hlt
sbb cl, byte [ecx]
mov dh, 0x38
inc ebx
xor eax, 0xc7cf66b3
movntq qword [edi - 0x17269cd2], mm2
sub bl, 0x68
mul dword [esi + 0x7cf34c43]
sbb al, 0x53
invalid
Function at 0x10007540
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10163d31
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x10200854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
lea eax, [esi + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xb4], eax
je 0x10007661
push 7
mov edx, esi
lea ecx, [ebp - 0xb0]
call fcn.100f1b40
add esp, 4
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x100075a8
mov eax, dword [eax]
mov edx, str.device
mov ecx, eax
call fcn.100f17c0
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100047b0
test bl, bl
je 0x100075f1
cmp edi, esi
je 0x1000772d
cmp dword [esi + 0x14], 8
jb 0x100075dc
mov esi, dword [esi]
mov ebx, dword [ebp - 0xb4]
mov ecx, edi
push dword [ebx]
push esi
call fcn.10004820
jmp 0x1000772d
cmp dword [edi + 0x14], 8
mov eax, edi
mov dword [edi + 0x10], 0
jb 0x10007602
mov eax, dword [edi]
mov ebx, dword [ebp - 0xb4]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebx], 2
jb 0x10007661
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb4], esp
push esi
call fcn.10004e10
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.10106940
add esp, 0x18
mov dword [ebp - 4], 2
cmp dword [ebp - 0xa0], 0
jne 0x10007668
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100047b0
xor al, al
jmp 0x1000772f
push 0x80
lea eax, [ebp - 0x98]
mov dword [ebp - 0x16], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1000768f
mov eax, dword [esi]
mov ax, word [eax]
mov word [ebp - 0x18], ax
mov eax, esi
jb 0x1000769c
mov eax, dword [esi]
mov ax, word [eax + 2]
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x98]
push 0x40
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1000764f
lea ecx, [ebp - 0x98]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100076d0
sub ecx, edx
lea eax, [ebp - 0x98]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.1000e430
cmp dword [ebx], 2
jbe 0x1000771b
cmp dword [esi + 0x14], 8
jb 0x100076fb
mov esi, dword [esi]
add esi, 4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007703
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, edi
call fcn.1000e430
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100047b0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101611d3
mov esp, ebp
pop ebp
ret 8
Function at 0x10009460
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101643f7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x10200854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx], vtable.RC::ISimpleDownloadEvent.0
mov dword [ebp - 4], 0
lea eax, [ebx + 8]
mov dword [ebx + 4], vtable.RC::ISolitaryFunctionCtrlListener.0
xor ecx, ecx
mov dword [ebx], vtable.RC::RCBHORcmdBrowser.1.0
mov dword [ebx + 4], vtable.RC::RCBHORcmdBrowser.0
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 7
mov word [eax + 8], cx
mov byte [ebp - 4], 2
lea eax, [ebx + 0x28]
mov dword [ebp - 0x14], eax
mov dword [eax], ecx
mov byte [eax + 4], cl
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], 7
mov word [eax + 8], cx
mov byte [ebp - 4], 4
mov dword [ebx + 0x48], ecx
mov byte [ebp - 4], 5
mov dword [ebx + 0x4c], ecx
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x54], ecx
mov byte [ebp - 4], 6
mov dword [ebx + 0x58], ecx
mov dword [ebx + 0x5c], ecx
mov dword [ebx + 0x60], ecx
mov byte [ebp - 4], 7
lea eax, [ebx + 0x64]
mov dword [ebp - 0x14], eax
mov dword [eax], 1
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], 7
mov word [eax + 4], cx
mov byte [ebp - 4], 8
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], 7
mov word [eax + 0x1c], cx
mov byte [ebp - 4], 0xa
xor eax, eax
mov byte [ebx + 0x98], cl
mov dword [ebx + 0x9c], ecx
mov dword [ebx + 0xa0], ecx
mov dword [ebx + 0xa4], ecx
mov dword [ebx + 0xa8], ecx
mov dword [ebx + 0xac], ecx
mov dword [ebx + 0xb0], ecx
mov dword [ebx + 0xb4], ecx
mov dword [ebx + 0xc8], ecx
mov dword [ebx + 0xcc], 7
mov word [ebx + 0xb8], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebx + 0xd8]
mov dword [ebp - 0x14], ecx
mov dword [ebx + 0xd0], eax
mov dword [ecx], eax
add ecx, 8
call fcn.100092a0
mov byte [ebp - 4], 0xd
xor eax, eax
mov byte [ebx + 0x178], 0
mov dword [ebx + 0x18c], 0
mov dword [ebx + 0x190], 7
mov word [ebx + 0x17c], ax
mov byte [ebp - 4], 0xe
push 8
call fcn.101611e4
mov esi, eax
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0xf
mov dword [esi], 0
mov byte [ebp - 4], 0x10
push 0x18
call fcn.101611e4
add esp, 8
mov dword [esi + 4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0xe
mov dword [ebx + 0x194], esi
mov byte [ebp - 4], 0x12
lea ecx, [ebx + 0x198]
push 0x33
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push str.FF4855A3_CB3B_4E03_835E_A71240711E0E_FM_RBBHO_MUTEX
mov word [ecx], ax
call fcn.10004820
mov byte [ebp - 4], 0x13
push 0x18
mov byte [ebx + 0x1b0], 0
call fcn.101611e4
add esp, 4
mov dword [ebx + 0x1b4], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b6c0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10166b61
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10200854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.1001b8c0
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov word [ebx + 0xc], 0
mov dword [ebp - 4], 0
lea edi, [ebx + 0x10]
mov dword [ebp - 0x18], edi
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.10004e10
mov byte [ebp - 4], 1
add esi, 0x18
add edi, 0x18
mov dword [ebp + 8], edi
push esi
mov ecx, edi
call fcn.10004e10
mov byte [ebp - 4], 2
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10004e10
mov byte [ebp - 4], 3
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10004e10
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b940
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10166c21
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10200854]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
lea ecx, [esi + 0x30]
call fcn.100047b0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x18]
call fcn.100047b0
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.100047b0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.100047b0
push 0x70
push ebx
call fcn.10161214
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001c340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, edx
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp ecx, eax
je 0x1001c407
push esi
push edi
lea edi, [ebx + 4]
lea esi, [ecx + 0x14]
nop dword [eax]
mov eax, dword [esi - 0x14]
mov dword [ebx], eax
lea eax, [esi - 0x10]
cmp edi, eax
je 0x1001c381
cmp dword [esi + 4], 8
lea eax, [esi - 0x10]
jb 0x1001c377
mov eax, dword [eax]
push dword [esi]
mov ecx, edi
push eax
call fcn.10004820
mov eax, dword [esi + 8]
lea ecx, [edi + 0x20]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
lea eax, [esi + 0x10]
cmp ecx, eax
je 0x1001c3a8
cmp dword [esi + 0x24], 8
jb 0x1001c39f
mov eax, dword [eax]
push dword [esi + 0x20]
push eax
call fcn.10004820
mov eax, dword [esi + 0x28]
lea ecx, [edi + 0x3c]
mov dword [edi + 0x38], eax
lea eax, [esi + 0x2c]
cmp ecx, eax
je 0x1001c3c9
cmp dword [esi + 0x40], 8
jb 0x1001c3c0
mov eax, dword [eax]
push dword [esi + 0x3c]
push eax
call fcn.10004820
mov eax, dword [esi + 0x44]
lea ecx, [edi + 0x5c]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x58], eax
lea eax, [esi + 0x4c]
cmp ecx, eax
je 0x1001c3f0
cmp dword [esi + 0x60], 8
jb 0x1001c3e7
mov eax, dword [eax]
push dword [esi + 0x5c]
push eax
call fcn.10004820
add esi, 0x78
add ebx, 0x78
add edi, 0x78
lea ecx, [esi - 0x14]
cmp ecx, dword [ebp - 4]
jne 0x1001c360
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10028390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x100283c1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x100283b0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1002b9f0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1002bc0b
cmp eax, 0x7c
je 0x1002bc0b
cmp eax, 0x29
jne 0x1002ba31
cmp dword [esi + 0x10], 0
jne 0x1002bc0b
cmp eax, eax
jne 0x1002ba31
test dword [esi + 0x50], 0x10000000
je 0x1002bc18
jmp 0x1002bbc4
cmp eax, 0x2e
jne 0x1002ba90
push 5
lea ecx, [esi + 0x24]
call fcn.1002bc70
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x1002ba84
cmp word [eax], 0x5c
jne 0x1002ba7f
lea ecx, [eax + 2]
cmp ecx, edx
je 0x1002ba7f
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x1002ba6b
movzx edi, word [ecx]
cmp edi, 0x28
je 0x1002ba7d
cmp edi, 0x29
je 0x1002ba7d
test dl, 0x10
jne 0x1002ba7f
movzx edx, word [ecx]
cmp edx, 0x7b
je 0x1002ba7d
cmp edx, 0x7d
jne 0x1002ba7f
mov eax, ecx
add eax, 2
mov dword [esi], eax
mov ecx, esi
call fcn.1002a4a0
jmp 0x1002bbf6
cmp eax, 0x5c
jne 0x1002baef
mov ecx, esi
call fcn.1002b9a0
test byte [esi + 0x50], 0x80
je 0x1002bae3
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1002bac1
push 4
lea ecx, [esi + 0x24]
call fcn.1002bc70
mov ecx, esi
call fcn.1002b9a0
jmp 0x1002bbfd
cmp eax, 0x42
jne 0x1002bae3
push 4
lea ecx, [esi + 0x24]
call fcn.1002bc70
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.1002b9a0
jmp 0x1002bbfd
mov ecx, esi
call fcn.1002cb90
jmp 0x1002bbf6
cmp eax, 0x5b
jne 0x1002bb50
mov ecx, esi
call fcn.1002b9a0
lea ecx, [esi + 0x24]
call fcn.1002dd00
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x1002bb1c
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.1002b9a0
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x1002bb3a
cmp eax, 0x5d
jne 0x1002bb3a
push eax
lea ecx, [esi + 0x24]
call fcn.1002dde0
mov ecx, esi
call fcn.1002b9a0
mov ecx, esi
call fcn.1002d890
cmp dword [esi + 0x4c], 0x5d
jne 0x1002bc1f
jmp 0x1002bbef
cmp eax, 0x28
jne 0x1002bb80
mov ecx, esi
call fcn.1002b9a0
mov ecx, esi
call fcn.1002cda0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x1002bc18
mov ecx, esi
call fcn.1002b9a0
test bl, bl
je 0x1002bbfd
jmp 0x1002bbf6
cmp eax, 0x5e
jne 0x1002bb98
push 2
lea ecx, [esi + 0x24]
call fcn.1002bc70
mov ecx, esi
call fcn.1002b9a0
jmp 0x1002bbfd
cmp eax, 0x24
jne 0x1002bbb0
push 3
lea ecx, [esi + 0x24]
call fcn.1002bc70
mov ecx, esi
call fcn.1002b9a0
jmp 0x1002bbfd
cmp eax, 0x2a
je 0x1002bc11
cmp eax, 0x2b
je 0x1002bc11
cmp eax, 0x3f
je 0x1002bc11
cmp eax, 0x7b
je 0x1002bc11
cmp eax, 0x7d
jne 0x1002bbd4
test dword [esi + 0x50], 0x10000000
je 0x1002bc26
jmp 0x1002bbe2
cmp eax, 0x5d
jne 0x1002bbe2
test dword [esi + 0x50], 0x10000000
je 0x1002bc1f
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1002d010
mov ecx, esi
call fcn.1002b9a0
mov ecx, esi
call fcn.1002ceb0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x1002ba03
pop edi
pop esi
mov al, cl
pop ebx
ret
push 0xa
call fcn.1002a490
push 5
call fcn.1002a490
push 4
call fcn.1002a490
push 6
call fcn.1002a490
int3