joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100932b8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10093355
push ebx
push esi
call fcn.10093281
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10093215
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10093302
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10093354
push edi
push eax
call fcn.1008e877
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10093322
call fcn.1008e8c5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10093353
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10093215
add esp, 0x20
test eax, eax
jne 0x10093341
push edi
call fcn.1008e8c5
jmp 0x10093349
push ebx
call fcn.1008e8c5
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100996a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100996cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100996cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1012abb4
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
pushfd
call fcn.101c1de5
cmp bh, 0x24
movaps xmm0, xmmword [ebp - 0x125d0]
movaps xmmword [ebp - 0x16580], xmm0
cmc
stc
movaps xmm0, xmmword [ebp - 0x16580]
xorps xmm0, xmmword [ebp - 0x16590]
clc
cmp esi, 0x82be7380
stc
movaps xmmword [ebp - 0x165a0], xmm0
test sp, 0xdca7
stc
movaps xmm0, xmmword [ebp - 0x165a0]
cmp al, 0xab
movaps xmmword [ebp - 0x125d0], xmm0
test eax, edx
sub ecx, ecx
jmp loc.100519a6

Function at 0x1013032e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x1c]
call fcn.1004cea8

Function at 0x1013033c
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0x689743a9
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.1004cea8

Function at 0x101305f1
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
mov dword [esp], edi
mov edi, 0x7183aa38
call fcn.10054900
Function at 0x10131eed
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
bswap edx
lea eax, [ecx + eax - 0x446473ea]
lea edx, [edx + eax*2 + 0x1470e7fd]
mov dword [esp + eax - 0x724dc294], ecx
ror edx, 1
push ecx
cwde
dec ax
add edx, 0x31195207
or word [esp + 3], ax
xor edx, 0x100e0e03
xor ebx, edx
jmp 0x101d11d9
and edx, eax
xor ebx, ecx
xchg dx, ax
jmp 0x101f7096
bswap eax
add edi, edx
movzx edx, byte [esp + 0x10]
xadd edx, eax
mov ecx, dword [eax + ebp - 0xb2]
sal byte [esp + eax - 0xa8], 0xe7
lea ebp, [eax + ebp - 0xae]
xor ecx, ebx
xchg byte [esp + eax*8 - 0x5b0], al
cbw
dec ecx
sar dword [esp + eax*2 + 0xf], 0x36
not ecx
neg ecx
sub eax, eax
inc ecx
mov dword [esp + eax*8 + 8], edx
jmp 0x101bda83
mov dword [eax + esi - 6], ecx
dec byte [esp + eax + 0xa]
movsx ecx, dl
dec eax
lea esi, [esi + edx*2 - 6]
add dx, word [esp + edx + 8]
pop eax
pop ecx
pop edx
pop edx
pop eax
jno fcn.10196a0b

Function at 0x10133593
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
pushfd
add dword [esp + 8], 0xeffb7993
mov dword [esp + 8], 0x1001539c
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.1004cea8

Function at 0x10136ace
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.1004cea8
call fcn.10085770
add esp, 0x24
jmp 0x10127958
jne 0x10187065
jne 0x10079d2c

Function at 0x101396b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], 0x1014951c
lea esp, [esp + 4]
call fcn.1004cea8
mov dword [esp + 0x388], eax
movsx eax, di
mov eax, eax
mov dword [esp + 0x38c], ecx
mov dword [esp + 0x38], 0xbc4ed785
setnp ch
cmovae ecx, edx
mov dword [esp + 0x3c], 0x4057f935
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
jmp loc.10030605

Function at 0x1013d86d
Capabilities:
Parse pe header

Disassembly:
mov dword [esp], 0x100599a8
call fcn.1004cea8
movaps xmm0, xmmword [ebp - 0x8d80]
call fcn.101e37d4
push 0
push 0x105
jmp loc.100738f2

Function at 0x101434f6
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
lea esp, [esp + 8]
call fcn.1004cea8

Function at 0x1014e72e
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
test dx, 0x8b1
call fcn.1014e72e
mov edx, dword [esp + edx - 0x7a163aa4]
je 0x101d5cf1
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.1004cea8
lea edx, [edx + edx*2 - 0x6d0cae54]
jle 0x101434ff

Function at 0x1016023f
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ecx
mov ecx, dword [esp + 8]
mov dword [esp + 8], 0x1001b2c8
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.1004cea8
setnp cl
mov eax, esi
jns 0x100321ce
fistp word gs:[edi]
cmp eax, 0xae7b4ab4
lodsd eax, dword [esi]
invalid
Function at 0x1017009e
Capabilities:
Hash data with crc32

Disassembly:
pushfd
mov dword [esp + 4], 0x1013966e
lea esp, [esp + 4]
call fcn.1004cea8

Function at 0x101896b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub dword [esp + 8], 0x5c8a448c
mov dword [esp + 0x10], 0x101ba64d
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.1004cea8
movaps xmm0, xmmword [ebp - 0x70]
stc
movaps xmmword [ebp - 0x2e0], xmm0
test bp, di
movaps xmm0, xmmword [ebp - 0xc0]
movaps xmmword [ebp - 0x230], xmm0
movaps xmm0, xmmword [ebp - 0x230]
xorps xmm0, xmmword [ebp - 0x2e0]
cmc
cmp dh, dh
clc
movaps xmmword [ebp - 0x2f0], xmm0
test ah, 0x1d
movaps xmm0, xmmword [ebp - 0x2f0]
cmp esp, 0x6ba38324
jmp 0x101cafe1
movaps xmmword [ebp - 0xc0], xmm0
stc
sub eax, eax
jmp loc.10050bec

Function at 0x1018f20d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x18]
call fcn.1004cea8
call fcn.10011ef0
mov edx, dword [ebp - 0x14ec]
setp cl
mov dword [edx + 0x478], eax
movzx eax, bp
setl ah
cbw
lea eax, [ebp - 0x3b0]
movzx ecx, si
cmovns cx, bp
push eax
mov ecx, 0xf70f7582
movsx cx, dl
mov cx, bx
mov ecx, dword [ebp - 0x14f8]
jmp 0x101987f0
push ecx
mov ecx, dword [ebp - 0x14ec]
jmp loc.10031b94

Function at 0x10191a88
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
sal byte [esp + ecx + 1], 0x67
bswap eax
btc ecx, 0x8b
adc cx, dx
ror eax, 3
xor edx, 0xb58ee8a6
pop ecx
ror ecx, 0xf0
xor ebx, eax
shr edx, 0x49
inc dl
adc edi, eax
lea edx, [edx + ecx*4 - 0x597c5700]
movsx eax, dx
or cx, 0x80
mov word [esi + eax*2 - 0xe012], cx
call fcn.10189c47
xor dword [esp + edx - 0x7951fa0d], edx
neg edx
add edi, eax
call fcn.101fa3be
adc eax, dword [ebp + eax*4]
lea ebp, [edx + ebp - 0xd6fc]
add ecx, ecx
xor eax, ebx
btc edx, 0xab
push edx
sar ecx, 0x3c
rol eax, 1
sal dx, 0x63
inc eax
jmp 0x1014ca3b
Function at 0x10197837
Capabilities:
Encode data using xor
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
lea eax, [ecx + ecx*2 + 0x41a364b7]
mov ecx, dword ss:[edx]
lea edx, [eax*4 - 0xcda4c5f]
call fcn.101f6f5a
mov dword [esp + 0x148], ecx
push eax
bswap ax
movaps xmmword [esp + 0x2a0], xmm1
bswap ax
lea eax, [esp + 0x10e8]
jmp 0x101653a4
movaps xmm1, xmmword [esp + 0x140]
xorps xmm1, xmmword [esp + 0x2b0]
jmp 0x101b96d0
mov eax, dword [ebp + edx*2 - 0x2b625600]
lea ecx, [edx*8 - 0x1475b37d]
lea ebp, [ebp + edx*4 - 0x56c4abfc]
xor eax, ebx
add ecx, ecx
jg 0x101fd84b
not eax
sar ecx, cl
xadd ecx, edx
inc dx
neg eax
sub eax, 0xad09af91
not eax
ror edx, cl
adc ecx, 0x81a08f2a
rol eax, 1
xor ebx, eax
ror ecx, 0x1a
sal dl, cl
imul edx, ecx
add edi, eax
jmp edi
push 0
jmp 0x101ee0b9
mov dword [esp + eax - 0x6152caf2], edi
pop eax
sub ebx, ecx
lea edi, [0x10197841]
mov edx, 0x1f15b12b
shl edx, 0x48
jns 0x1017add9
push eax
jmp 0x101cf08c
or ecx, 0xf73c9185
neg edx
shr cl, 0xa3
adc eax, 0x6b1fa6a2
btr ecx, ecx
inc edx
xor ebx, edx
shr eax, 0xf7
add edi, edx
bts ecx, ecx
cwde
neg cl
mov ecx, dword [esi + eax*4 - 0x468]
movsx edx, al
div eax
xor dl, 0x8c
mov eax, dword [ecx + eax*2 - 0x2f34a70a]
lea edx, [edx*2 - 0x53708858]
shl dx, 0x21
movzx ecx, dx
mov dword [esi + ecx - 0xefa0], eax
jmp edi
push 0x3e8
jmp 0x101abc50
call fcn.10018460
push 0xfa0
setns ah
lea eax, [esp + 0x3804]
jmp 0x1018067e
movaps xmmword [esp + 0x2b8], xmm1
jmp 0x101cc5a3
push eax
jmp 0x10079d3a
shld ax, dx, cl
mov ecx, 0x5e370634
lea edx, [ecx + ecx + 0x279e1db7]
dec dword [esp + ecx - 0x5e370634]
mov word [esi + ecx - 0x5e370634], ax
je 0x101b5581
mov ecx, dword [ebp + ecx - 0x5e370634]
sar dx, 0x67
push edx
movsx eax, dl
lea ebp, [ebp + eax - 0x50]
add edx, 0x9f2cfb80
cdq
mul dword [esp + edx + 1]
xor ecx, ebx
add dl, 0x19
mul dx
bswap ecx
and edx, eax
sar edx, 0x81
xor dx, 0x3b04
rol ecx, 1
rol dl, 0x25
not ecx
sar dl, 0xe5
jnp 0x101569a7
or eax, edx
bswap ecx
neg ecx
lea ecx, [ecx + eax - 0x653f8fe9]
sal eax, 0x3b
bswap ecx
xor ebx, ecx
xor byte [esp + edx*2 - 0x77f8], 0x27
cbw
adc edi, ecx
xadd byte [esp + edx*2 - 0x77f4], ah
push edx
mov dword [esp + edx*8 - 0x1dfe0], edi
ret 8
Function at 0x101a2df7
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
mov dword [ebp - 0xe05c], 0
jmp fcn.10200208
jne 0x101a3a66
cmp word [ebp - 0xdfdc], 0
jmp 0x101d35b6
mov word [edx + esi - 0x383fa41f], ax
mov edx, dword [ecx + ebp - 0x58000000]
lea ebp, [ecx + ebp - 0x57fffffc]
movzx eax, cl
rol ecx, 0xfd
bswap ecx
xor edx, ebx
mov dword [esp + ecx - 7], eax
btc eax, 0xb5
push ecx
bswap edx
push ecx
sbb byte [esp + ecx*4 - 0x26], ch
neg cx
ror edx, 2
push eax
xchg cl, al
rol dword [esp + ecx - 0xff00], 0x58
not edx
call fcn.101a532a
movaps xmmword [ebp - 0x193e0], xmm0
movaps xmm0, xmmword [ebp - 0xe250]
mov eax, 0xdd3ba226
clc
movaps xmmword [ebp - 0x193d0], xmm0
bts ecx, edx
xor cx, si
movaps xmm0, xmmword [ebp - 0x193d0]
xorps xmm0, xmmword [ebp - 0x193e0]
sub ax, dx
rol ecx, 0x2d
movaps xmmword [ebp - 0x193f0], xmm0
sub cl, 0x89
not dh
movaps xmm0, xmmword [ebp - 0x193f0]
sbb edx, 0xce2a8b8f
movzx edx, cx
bsf dx, di
movaps xmmword [ebp - 0xe250], xmm0
neg dl
lea ecx, [ebp - 0xe280]
btc edx, 0x23
movsx eax, bp
xor eax, esp
mov dword [ebp - 0xdef0], ecx
sar cx, 0xc
clc
shrd ax, dx, 0xb9
lea edx, [ebp - 0x370]
mov dword [ebp - 0xdee0], edx
clc
mov eax, dword [ebp - 0xdee0]
rcr dx, cl
xchg dh, dl
mov cx, word [eax]
mov word [ebp - 0xdfdc], cx
mov edx, dword [ebp - 0xdef0]
test dh, 5
cmp cx, word [edx]
jmp 0x1019c699
sbb eax, eax
or eax, 1
bts cx, ax
bt cx, sp
rcr cl, cl
mov dword [ebp - 0xe05c], eax
mov ecx, dword [ebp - 0xe05c]
cmp sp, dx
cmp bl, 0x13
test si, bx
mov dword [ebp - 0xed60], ecx
test di, 0x5e34
jmp loc.1001c157
je 0x1003d515
mov eax, dword [ebp - 0xdee0]
btc edx, ebp
rcr edx, 0x31
neg edx
mov cx, word [eax + 2]
adc dh, bl
mov word [ebp - 0xdfde], cx
sub dl, 0x86
test di, bp
cmovg dx, bx
mov edx, dword [ebp - 0xdef0]
stc
cmp cx, word [edx + 2]
jne 0x101a3a66
add dword [ebp - 0xdee0], 4
cmc
add dword [ebp - 0xdef0], 4
cmp ebp, edi
cmc
jmp fcn.1003d507

Function at 0x101ac1b7
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
je 0x101ac206
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.1004cea8
movaps xmmword [ebp - 0x16830], xmm0
clc
movaps xmm0, xmmword [ebp - 0x124f0]
movaps xmmword [ebp - 0x16820], xmm0
clc
movaps xmm0, xmmword [ebp - 0x16820]
xorps xmm0, xmmword [ebp - 0x16830]
movaps xmmword [ebp - 0x16840], xmm0
test cl, ah
cmp ebx, 0xaa9c7987
movaps xmm0, xmmword [ebp - 0x16840]
clc
cmp di, bp
movaps xmmword [ebp - 0x124f0], xmm0
jmp 0x101c0d88
push 0x8e3b0810
push ebp
push 0xe1a483a2
mov dword [esp + 0x10], 0x10166870
lea esp, [esp + 0x10]
call fcn.1004cea8
movaps xmmword [ebp - 0x9e30], xmm0
push ebp
pushfd
mov ebp, 0x15bdd02d
movzx ebp, bp
sub ebp, 0xf21fee06
push edx
mov edx, ebp
not dx
mov ebp, dword [esp + edx - 0xde01dd0]
mov dword [esp + 8], 0x1015e1f6
mov edx, dword [esp + edx - 0xde01dd8]
jge 0x1006ed98
Function at 0x101aefef
Capabilities:
Parse pe header

Disassembly:
push 0x69254d84
pushfd
add dword [esp + 8], 0xefff1d77
call fcn.101896b9
Function at 0x101bc43b
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
movaps xmm0, xmmword [ebp - 0xc6f0]
movaps xmmword [ebp - 0x13aa0], xmm0
movsx cx, dh
neg ch
movaps xmm0, xmmword [ebp - 0x11910]
rcr cx, cl
sub ecx, 0x101b4ab2
movaps xmmword [ebp - 0x13a90], xmm0
movaps xmm0, xmmword [ebp - 0x13a90]
xorps xmm0, xmmword [ebp - 0x13aa0]
movsx ecx, dx
movaps xmmword [ebp - 0x13ab0], xmm0
movaps xmm0, xmmword [ebp - 0x13ab0]
movaps xmmword [ebp - 0x11910], xmm0
sar ch, cl
and cx, di
mov ecx, 1
clc
test eax, esp
test ecx, ecx
je 0x101b4c16
jmp 0x101b4c76
movaps xmm0, xmmword [ebp - 0xc6b0]
inc dl
xor dx, bp
sub dx, bp
movaps xmmword [ebp - 0x13b60], xmm0
movaps xmm0, xmmword [ebp - 0x118d0]
cmp ebx, esi
movaps xmmword [ebp - 0x13b50], xmm0
rcr dx, cl
movaps xmm0, xmmword [ebp - 0x13b50]
rol dx, cl
sar dh, cl
xorps xmm0, xmmword [ebp - 0x13b60]
bt edx, esp
movaps xmmword [ebp - 0x13b70], xmm0
bts dx, bx
movaps xmm0, xmmword [ebp - 0x13b70]
bsf dx, si
movaps xmmword [ebp - 0x118d0], xmm0
sal dx, cl
mov edx, 1
clc
test edx, edx
jmp fcn.1017d971
movaps xmm0, xmmword [ebp - 0xc6c0]
adc cl, 0x8c
xor ch, 0x1a
btr ecx, 0x80
movaps xmmword [ebp - 0x13b30], xmm0
bts ecx, edx
movaps xmm0, xmmword [ebp - 0x118e0]
shl cx, cl
shl ecx, 0x1b
movaps xmmword [ebp - 0x13b20], xmm0
test esp, ecx
movaps xmm0, xmmword [ebp - 0x13b20]
bt ecx, 0x1a
xorps xmm0, xmmword [ebp - 0x13b30]
rol ch, cl
movaps xmmword [ebp - 0x13b40], xmm0
and ch, ch
rcl ch, cl
movaps xmm0, xmmword [ebp - 0x13b40]
movaps xmmword [ebp - 0x118e0], xmm0
sar ch, cl
sbb ecx, edi
mov ecx, 1
test ecx, ecx
je 0x10083081
jmp 0x100830e0
je 0x101c88d1
jmp 0x101c8939
je 0x1012cb65
jmp 0x1012cbc7
movaps xmm0, xmmword [ebp - 0xc6e0]
rcl dl, 0x80
movaps xmmword [ebp - 0x13ad0], xmm0
neg dh
and dl, 0x13
movaps xmm0, xmmword [ebp - 0x11900]
movaps xmmword [ebp - 0x13ac0], xmm0
not edx
mov dx, si
sbb dh, bh
movaps xmm0, xmmword [ebp - 0x13ac0]
xorps xmm0, xmmword [ebp - 0x13ad0]
test ebp, 0xfb3e930b
movaps xmmword [ebp - 0x13ae0], xmm0
xadd edx, edx
shr dh, cl
movaps xmm0, xmmword [ebp - 0x13ae0]
movaps xmmword [ebp - 0x11900], xmm0
neg dh
bt edx, eax
sar dl, cl
mov edx, 1
cmc
test edx, edx
jmp 0x101610ab
mov edi, dword [esp + edi - 0x5ba68486]
mov dword [esp + 0xc], 0x101521fb
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.1004cea8
je 0x1001b404
jmp 0x1001b45a
movaps xmm0, xmmword [ebp - 0xc6d0]
rol eax, cl
movaps xmmword [ebp - 0x13b00], xmm0
shl eax, 0x30
movaps xmm0, xmmword [ebp - 0x118f0]
bts eax, edi
cmovbe ax, cx
movaps xmmword [ebp - 0x13af0], xmm0
bt eax, 0xa2
adc ax, si
add al, 0x9a
movaps xmm0, xmmword [ebp - 0x13af0]
test si, di
bts ax, sp
xorps xmm0, xmmword [ebp - 0x13b00]
rol eax, cl
cmp ch, 0x33
movaps xmmword [ebp - 0x13b10], xmm0
movaps xmm0, xmmword [ebp - 0x13b10]
ror ax, cl
movaps xmmword [ebp - 0x118f0], xmm0
adc eax, 0x4318813f
mov eax, 1
cmp edi, 0xc8bb4493
test ax, 0xdb1f
test eax, eax
jmp 0x101617f2
Function at 0x101bec47
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x10]
call fcn.1004cea8
push edi
not bl
or bx, 0x96b2
mov edi, ebx
sets bl
mov ebx, dword [esp + edi - 0x7033dfef]
mov dword [esp + 0x10], 0x10076e23
mov edi, dword [esp + edi - 0x7033dfff]
jne 0x1005bfd5
clc

Function at 0x101c1de5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], 0x5391665a
mov dword [esp + 0x1c], 0xf1484cd1
movsx eax, dx
not al
mov eax, dword [esp + 0x18]
movsx ecx, ax
mov ecx, dword [esp + 0x1c]
jmp 0x101e1db7
mov dword [esp + 0x160], eax
not ah
setb ah
mov dword [esp + 0x164], ecx
jmp 0x10140fbc
mov dword [esp + 8], 0x10133003
lea esp, [esp + 8]
call fcn.1004cea8
je 0x101c8891
nop dword [eax + eax]
not al
mov dword [esp + 0x10], 0xbc0dd7c4
nop
mov dword [esp + 0x14], 0x4065f915
movsx ax, bl
mov eax, dword [esp + 0x10]
mov ch, 0xb6
cmovge cx, sp
mov ecx, dword [esp + 0x14]
jmp 0x1018f268
mov ecx, dword [0x100f459c]
push edi
jmp loc.1003a617
mov dword [esp + 0x168], eax
cwde
movzx eax, dx
cbw
mov dword [esp + 0x16c], ecx
xchg ecx, eax
mov dword [esp + 0x20], 0xaf90f122
not al
mov dword [esp + 0x24], 0x1544d19a
cbw
movsx ecx, cx
movzx ecx, si
mov eax, dword [esp + 0x20]
xchg cx, cx
jmp loc.1006e99f

Function at 0x101c2f1f
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp + 4], 0x1007e67c
lea esp, [esp + 4]
call fcn.1004cea8

Function at 0x101c68ca
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
pushfd
add dword [esp + 4], 0xeff81f92
push edi
mov dword [esp + 8], 0x10184088
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.1004cea8

Function at 0x101c842c
Capabilities:
Encode data using base64
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], 0x101faa60
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.1004cea8
Function at 0x101d3ef6
Capabilities:
Parse pe header

Disassembly:
push 0xda959911
mov dword [esp + 4], edx
push 0x9fba6224
mov dword [esp + 4], edi
push 0x66114f21
mov dword [esp + 4], ebp
mov dword [esp], ecx
mov ecx, 0x9a00eb0b
pushfd
push ebx
push ebp
mov ecx, 0
mov ebx, 0x2a2f0f8f
mov dword [esp + ebx - 0x2a2f0f8f], ecx
xor ebx, ebx
mov ebp, dword [esp + ebx*4 + 0x20]
not ebp
movzx edi, bx
lea edx, [ebx*8 - 0x1c4a8cc4]
dec ebp
sar edi, 0x7e
not ebp
btr di, dx
sal dl, 1
xchg ebx, edx
inc ebp
and ebx, edi
neg ebx
dec edi
adc ebp, ecx
movsx ecx, dx
add edx, ecx
xor edx, ecx
mov dword [esp + ebx*2 + 0x1c], esi
jo 0x1015d63f
sar dx, 0xcd
mov dword [esp + edx + 0x20], eax
mov esi, esp
not edi
movsx eax, bl
lea ebx, [esi + ebx - 0xec]
lea edx, [eax*4 + 0x6aa24ca5]
cwde
mov esp, ebx
mov edi, 0xd0b3209d
mov ecx, edi
lea eax, [ecx + ecx*2 - 0x10c696e5]
mov ebx, ebp
xchg edi, ecx
mov ecx, 0
call fcn.10197837
jmp 0x10145fb7
Function at 0x101e4f27
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0x101b80ad
lea esp, [esp + 4]
call fcn.1004cea8
mov dword [esi + eax - 0x40000002], edx
xor al, ah
neg word [esp + eax - 0x3ffffffe]
push ecx
mov edx, dword [ebp + eax*2 - 0x7ffffffe]
cwde
add dword [esp + eax*4 + 1], ecx
inc eax
xor edx, ebx
shl byte [esp + eax + 5], 0xa2
sal word [esp + eax + 5], cl
push ecx
xor edx, 0xb29f75a8
xadd byte [esp + eax*8 + 2], cl
sub ax, 0xaf83
call fcn.10131eed

Function at 0x101e4f7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
call fcn.1007626d
movaps xmm0, xmmword [ebp - 0xd650]
cmp ebp, edx
clc
stc
movaps xmmword [ebp - 0x19d70], xmm0
cmp ch, 0x8b
movaps xmm0, xmmword [ebp - 0xe730]
test di, bp
cmp edi, 0x65260ab2
movaps xmmword [ebp - 0x19d60], xmm0
stc
cmp bp, bp
movaps xmm0, xmmword [ebp - 0x19d60]
cmc
xorps xmm0, xmmword [ebp - 0x19d70]
movaps xmmword [ebp - 0x19d80], xmm0
movaps xmm0, xmmword [ebp - 0x19d80]
movaps xmmword [ebp - 0xe730], xmm0
test dh, 0x2a

Function at 0x101e7907
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
jmp loc.1001c1d0
nop
jmp 0x1016db19
mov ebx, dword [esp + ebx + 0x40597e09]
mov dword [esp + 0x10], 0x101d9b48
mov ebp, dword [esp + ebp - 0x16369a9e]
call fcn.10072c6a
call fcn.10048450
add esp, 8
setg dh
mov edx, dword [ebp - 0xde3c]
mov byte [edx + 0x130], 1
jmp 0x101bf23a

Function at 0x101eacb9
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x20]
call fcn.1004cea8
movaps xmm1, xmmword [ebp - 0x40]
call fcn.101dd3ef

Function at 0x101fa7e0
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 8], 0x1002cb54
lea esp, [esp + 8]
call fcn.1004cea8
movaps xmmword [ebp - 0x2bb0], xmm0
push ebx
call fcn.10128f9a