joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027ea0
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
mov dword [ecx + 0x400], 0
xor edx, edx
lea eax, [ecx + 0x10]
nop
mov dword [eax - 0x10], 0x6a09e667
mov dword [eax - 0xc], 0xbb67ae85
mov dword [eax - 8], 0x3c6ef372
mov dword [eax - 4], 0xa54ff53a
mov dword [eax], 0x510e527f
mov dword [eax + 4], 0x9b05688c
mov dword [eax + 8], 0x1f83d9ab
mov dword [eax + 0xc], 0x5be0cd19
xor dword [eax - 8], edx
xor dword [eax - 0x10], 0x2080020
xor dword [eax - 4], 0x20000000
inc edx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
lea eax, [eax + 0x80]
cmp edx, 8
jb 0x10027eb0
mov dword [ecx + 0x3f4], 0xffffffff
ret

Function at 0x10028340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov esi, dword [esi]
mov ebx, ecx
xor edi, edi
and esi, 7
mov dword [ebp - 8], ebx
cmp edx, 5
jae 0x10028368
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add dword [ebp + 8], 5
sub edx, 4
add edx, ebx
mov dword [ebp - 0xc], edx
lea eax, [edi + ebx]
cmp eax, edx
jae 0x1002838f
jmp 0x10028380
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x1002838f
inc eax
cmp eax, edx
jb 0x10028380
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x1002847b
cmp ecx, 2
jbe 0x100283e8
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x1002846d
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, edi
add edi, 5
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
je 0x10028412
add ebx, ecx
jmp 0x10028414
shr esi, cl
test esi, esi
je 0x100283a8
cmp esi, 4
ja 0x10028407
cmp esi, 3
je 0x10028407
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x100283a8
or esi, 8
shr esi, 1
inc edi
jmp 0x10028374
sub ebx, ecx
test esi, esi
je 0x10028447
and esi, 6
shl esi, 2
mov edx, ebx
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x10028442
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x10], 0
je 0x1002843f
add ebx, dword [ebp - 4]
jmp 0x10028442
sub ebx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
xor esi, esi
mov ecx, ebx
shr ecx, 8
mov byte [eax + 1], bl
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 4], bl
mov ebx, dword [ebp - 8]
mov byte [eax + 3], cl
jmp 0x10028374
mov ebx, dword [ebp - 8]
or esi, 8
shr esi, 1
inc edi
jmp 0x10028374
cmp ecx, 2
jbe 0x10028492
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002a2e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx + 0x34], 0
mov word [ecx + 0x1e], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x30], 0x20
mov byte [ecx + 0x1d], 1
mov dword [ecx + 0x48], 4
xor edx, edx
lea esi, [ecx + 0x60]
lea esp, [esp]
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
mov eax, edx
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
shr eax, 1
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
shr eax, 1
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
shr eax, 1
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
inc edx
mov dword [esi], eax
lea esi, [esi + 4]
cmp edx, 0x100
jb 0x1002a310
pop esi
ret

Function at 0x1002f410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
lea edx, [ecx + 0x325c8]
push esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
push edi
lea ebx, [ebx]
xor ebx, ebx
mov edi, eax
lea eax, [ebx + 1]
mov dword [ebp - 4], 4
mov edi, edi
movzx edx, word [ecx + eax*2 + 0x32c4c]
mov esi, edi
and esi, 1
mov ecx, esi
neg ecx
sar ecx, 4
and ecx, 0x7f
shr edx, 4
xor edx, ecx
mov ecx, dword [ebp - 0x10]
add eax, eax
add ebx, dword [ecx + edx*4 + 0x30f34]
shr edi, 1
or eax, esi
dec dword [ebp - 4]
jne 0x1002f440
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [edx], ebx
add edx, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
cmp eax, 0x10
jb 0x1002f430
pop edi
pop esi
mov dword [ecx + 0x84], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100f0e3c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, 4
push edi
mov edi, ecx
mov dword [ebp - 0x208], ebx
movzx ecx, byte [edi + ebx + 0x30734]
mov eax, ecx
mov edx, ecx
shr eax, 1
dec eax
and edx, 1
mov dword [ebp - 0x218], ecx
or edx, 2
mov ecx, eax
shl edx, cl
mov ecx, ebx
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], 0
sub ecx, edx
mov dword [ebp - 0x214], edx
mov esi, 1
test eax, eax
je 0x1002f56a
mov ebx, eax
jmp 0x1002f510
mov eax, esi
sub eax, dword [ebp - 0x218]
mov edx, ecx
add eax, dword [ebp - 0x214]
shr ecx, 1
mov dword [ebp - 0x210], ecx
movzx ecx, word [edi + eax*2 + 0x32b66]
and edx, 1
mov eax, edx
neg eax
sar eax, 4
and eax, 0x7f
shr ecx, 4
xor ecx, eax
mov eax, dword [ebp - 0x20c]
add eax, dword [edi + ecx*4 + 0x30f34]
mov ecx, dword [ebp - 0x210]
add esi, esi
or esi, edx
mov dword [ebp - 0x20c], eax
dec ebx
jne 0x1002f510
mov ebx, dword [ebp - 0x208]
jmp 0x1002f56c
xor eax, eax
mov dword [ebp + ebx*4 - 0x204], eax
inc ebx
mov dword [ebp - 0x208], ebx
cmp ebx, 0x80
jb 0x1002f4c3
lea eax, [edi + 0x32968]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x204]
sub eax, edi
lea esi, [edi + 0x319c8]
lea edx, [edi + 0x31dd0]
sub eax, 0x31dc8
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x210], 4
jmp 0x1002f5d0
xor ebx, ebx
mov dword [ebp - 0x214], ebx
cmp dword [edi + 0x88], ebx
jbe 0x1002f63f
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x1002f61e
mov ebx, dword [ebp - 0x21c]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
movzx ecx, word [ebx + edx*2]
sar eax, 4
and eax, 0x7f
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [edi + ecx*4 + 0x30f34]
cmp eax, 1
jne 0x1002f5f2
mov ebx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x208]
inc ebx
mov dword [eax + ebx*4 - 4], esi
mov dword [ebp - 0x214], ebx
cmp ebx, dword [edi + 0x88]
jb 0x1002f5e0
mov edx, dword [ebp - 0x20c]
mov esi, eax
mov ecx, 0xe
cmp dword [edi + 0x88], ecx
jbe 0x1002f666
lea esp, [esp]
mov eax, ecx
shr eax, 1
sub eax, 5
shl eax, 4
add dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x88]
jb 0x1002f650
mov eax, dword [esi]
mov ebx, dword [ebp - 0x218]
mov dword [edx - 8], eax
mov eax, dword [esi + 4]
mov dword [edx - 4], eax
mov eax, dword [esi + 8]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 4], eax
mov ecx, 4
add edx, 8
lea ebx, [ebx]
movzx eax, byte [edi + ecx + 0x30734]
inc ecx
mov eax, dword [esi + eax*4]
add eax, dword [ebx + edx]
lea edx, [edx + 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x1002f690
mov edx, dword [ebp - 0x20c]
sub dword [ebp - 0x21c], 0xffffff80
add esi, 0x100
add edx, 0x200
sub ebx, 0x200
dec dword [ebp - 0x210]
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x218], ebx
jne 0x1002f5d0
mov ecx, dword [ebp - 4]
mov dword [edi + 0x80], 0
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b7060
mov esp, ebp
pop ebp
ret
Function at 0x10030f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov edi, ecx
mov dword [ebp - 0x14], edi
mov ebx, dword [ebp + 0x10]
movzx esi, word [edi]
movzx ecx, word [edi + 2]
mov eax, esi
shr eax, 4
xor esi, 0x7f0
mov eax, dword [ebx + eax*4]
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 4
shr esi, 4
mov eax, dword [ebx + eax*4]
add eax, dword [ebx + esi*4]
xor ecx, 0x7f0
shr ecx, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + ecx*4]
add eax, dword [ebx + esi*4]
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x10], esi
cmp esi, dword [ebp + 8]
jae 0x10031096
mov edx, esi
or edx, 8
xor eax, eax
cmp edx, 1
je 0x10030fb5
mov esi, eax
mov edi, edi
mov eax, dword [ebp - 8]
mov ecx, edx
shr ecx, 1
and edx, 1
lea eax, [ecx + eax*8]
neg edx
movzx eax, word [edi + eax*2 + 4]
sar edx, 4
and edx, 0x7f
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x10030f80
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
inc esi
mov dword [ecx + esi*4 - 4], eax
mov dword [ebp + 0x10], esi
cmp esi, 8
jb 0x10030f67
cmp esi, 0x10
jae 0x10031038
lea ecx, [esi - 8]
mov dword [ebp - 0xc], ecx
cmp esi, dword [ebp + 8]
jae 0x10031096
mov edx, ecx
or edx, 8
xor eax, eax
cmp edx, 1
je 0x1003101f
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, edx
shr ecx, 1
and edx, 1
lea eax, [ecx + eax*8]
neg edx
movzx eax, word [edi + eax*2 + 0x104]
sar edx, 4
and edx, 0x7f
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x10030fe7
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
inc esi
mov dword [edx + esi*4 - 4], eax
inc ecx
mov dword [ebp + 0x10], esi
mov dword [ebp - 0xc], ecx
cmp esi, 0x10
jb 0x10030fd0
mov ecx, edx
cmp esi, dword [ebp + 8]
jae 0x10031096
lea eax, [esi - 0x10]
mov dword [ebp - 0xc], eax
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x1003107e
mov esi, dword [ebp - 0x14]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
movzx ecx, word [esi + edx*2 + 0x204]
sar eax, 4
and eax, 0x7f
shr ecx, 4
xor ecx, eax
mov eax, edx
add edi, dword [ebx + ecx*4]
cmp eax, 1
jne 0x10031052
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
add eax, edi
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0xc]
inc esi
inc eax
mov dword [ebp + 0x10], esi
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp + 8]
jb 0x10031043
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10031220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
or edx, 0x100
mov ecx, edx
shr ecx, 7
mov eax, edx
shr eax, 8
and ecx, 1
movzx esi, word [ebx + eax*2]
mov eax, dword [ebp + 8]
neg ecx
sar ecx, 4
shr esi, 4
and ecx, 0x7f
xor esi, ecx
add edx, edx
add edi, dword [eax + esi*4]
cmp edx, 0x10000
jb 0x10031230
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10031270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ecx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
add ecx, esi
mov eax, edx
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
and eax, 1
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add edx, edx
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x10031286
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10033116
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
inc ecx
adc al, 0xf
mov bh, 0x71
push es

Function at 0x100334bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub eax, 0x119f45c6
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.100330e6
push eax
push esi
push dword [ebp + 8]
call fcn.1003309b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100330e6
push eax
push esi
push dword [ebp + 8]
call fcn.1003309b
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100330d6
pushfd
invalid
Function at 0x10033dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ecx], al
add byte [eax], al
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
test dword [ebp - 7], edx
invalid
inc dword [ecx]
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.100330e6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1003309b
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
stc
invalid
invalid
call fcn.100330d6
add ecx, dword [edi]
xchg edi, eax
push dword [ebp - 0x698]
lea eax, [ebp - 0x6c0]
push eax
push dword [ebp + 8]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
jne 0x10033f36
call fcn.100332b2
add esp, 0x14
call fcn.100330d6
or eax, 0xfff780fb
mov ch, 0x68
stc
invalid

Function at 0x10037830
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x18]
and esi, 0xf
inc esi
mov dword [edi + esi*4 + 0x1c], SysStringLen
cmp esi, 0xe
je 0x1003786e
jmp 0x10037850
and esi, 0xf
jne 0x10037860
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.10037a20
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x10037850
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
shld eax, ecx, 5
shl ecx, 5
mov dword [edi + 0x5c], ecx
push ebx
lea edx, [edi + 0x20]
mov ecx, edi
mov dword [edi + 0x58], eax
call fcn.10037a20
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10037960
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x18]
and esi, 0x3f
mov ecx, esi
shr esi, 2
xor edx, edx
and ecx, 3
je 0x1003797d
mov edx, dword [edi + esi*4 + 0x20]
shl ecx, 3
mov eax, SysReAllocString
shr eax, cl
inc esi
or eax, edx
mov dword [edi + esi*4 + 0x1c], eax
cmp esi, 0xe
je 0x100379b1
and esi, 0xf
jne 0x100379a3
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.10037a20
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x10037993
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x1c]
shld eax, ecx, 3
shl ecx, 3
mov dword [edi + 0x5c], ecx
push edi
lea edx, [edi + 0x20]
mov ecx, edi
mov dword [edi + 0x58], eax
call fcn.10037a20
xor ecx, ecx
mov eax, dword [edi + ecx*4]
bswap eax
inc ecx
mov dword [ebx], eax
lea ebx, [ebx + 4]
cmp ecx, 5
jb 0x100379d1
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10038380
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
ret
Function at 0x10038f40
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x20]
and esi, 0x3f
inc esi
mov byte [esi + edi + 0x27], 0x80
cmp esi, 0x38
je 0x10038f6f
and esi, 0x3f
jne 0x10038f64
mov ecx, edi
call fcn.10039120
mov byte [edi + esi + 0x28], 0
inc esi
cmp esi, 0x38
jne 0x10038f58
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
shld eax, ecx, 3
shl ecx, 3
bswap ecx
mov dword [edi + 0x64], ecx
mov ecx, edi
bswap eax
mov dword [edi + 0x60], eax
call fcn.10039120
xor edx, edx
nop
mov ecx, dword [edi + edx*4 + 4]
bswap ecx
mov eax, dword [edi + edx*4]
add edx, 2
bswap eax
mov dword [ebx], eax
mov dword [ebx + 4], ecx
lea ebx, [ebx + 8]
cmp edx, 8
jb 0x10038f90
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
pop edi
pop esi
pop ebx
ret

Function at 0x10039000
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
ret

Function at 0x10039fc1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push edi
push edi
call fcn.100b8ef8
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10039feb
call fcn.10039f0a
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x10045c39
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
cmp esi, 0x200
jb 0x10045c99
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10045c99
mov edx, dword [ecx + 0x3c]
cmp edx, 0x1000
jae 0x10045c99
lea eax, [edx + 0x200]
cmp eax, esi
ja 0x10045c99
test dl, 7
jne 0x10045c99
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x10045c99
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x10045cb5
sub eax, 0x74
je 0x10045cae
dec eax
dec eax
je 0x10045cae
dec eax
dec eax
je 0x10045ca7
sub eax, 0x3c
je 0x10045ca0
sub eax, 0x8464
je 0x10045cb5
xor eax, eax
pop esi
pop ebp
ret 4
mov edx, 0x3030401
jmp 0x10045cba
mov edx, 0x3030701
jmp 0x10045cba
mov edx, 0x3030501
jmp 0x10045cba
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x10045c99
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10045cd7
cmp eax, 0x20b
jne 0x10045c99
mov eax, dword [ebp + 8]
mov dword [eax], edx
xor eax, eax
inc eax
jmp 0x10045c9b
Function at 0x10050158
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp edx, 8
jb 0x10050177
push edi
mov edi, edx
shr edi, 3
mov eax, dword [ecx + 4]
xor eax, dword [ecx]
add ecx, 8
xor esi, eax
sub edx, 8
dec edi
jne 0x10050166
pop edi
cmp edx, 4
jb 0x10050181
xor esi, dword [ecx]
add ecx, 4
and edx, 3
cmp edx, 2
jbe 0x10050192
movzx eax, byte [ecx]
shl eax, 0x10
xor esi, eax
inc ecx
cmp edx, 1
jbe 0x100501a0
movzx eax, byte [ecx]
shl eax, 8
xor esi, eax
inc ecx
test edx, edx
je 0x100501a9
movzx ecx, byte [ecx]
xor esi, ecx
mov eax, esi
pop esi
ret
Function at 0x1005e843
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x3c], 2
mov eax, dword [ebp + 8]
jge 0x1005e863
cmp byte [ecx + 0x42], 0
je 0x1005e8c0
cmp eax, 0x3f
jb 0x1005e8c0
jne 0x1005e860
push 0x46
jmp 0x1005e8bf
dec eax
jmp 0x1005e8c0
cmp eax, 0x2c
jb 0x1005e8c0
cmp dword [ecx + 0x3c], 3
jl 0x1005e878
cmp eax, 0x2c
jne 0x1005e877
push 0x48
jmp 0x1005e8bf
dec eax
cmp dword [ecx + 0x3c], 4
jl 0x1005e888
cmp eax, 0x2c
jne 0x1005e887
push 0x49
jmp 0x1005e8bf
dec eax
cmp eax, 0x3a
jb 0x1005e8c0
cmp byte [ecx + 0x14], 0
je 0x1005e8a8
cmp eax, 0x3a
jne 0x1005e89c
push 0x44
jmp 0x1005e8bf
cmp eax, 0x3b
jne 0x1005e8a5
push 0x45
jmp 0x1005e8bf
sub eax, 2
cmp eax, 0x3f
jb 0x1005e8b8
cmp byte [ecx + 0x42], 0
je 0x1005e8b8
cmp eax, 0x3f
jmp 0x1005e85a
cmp eax, 0x44
jne 0x1005e8c0
push 0x47
pop eax
pop ebp
ret 4

Function at 0x1006ccf3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], edx
mov eax, dword [edi + 0x18]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0xc], eax
xor eax, eax
mov word [esi], ax
mov dword [ebp - 4], ecx
cmp byte [edi + 1], al
je 0x1006cd73
mov bl, byte [edi + 2]
lea eax, [edi + 0x20]
push eax
lea ecx, [esi + 0x24]
call fcn.100025fc
movzx eax, byte [edi + 4]
push eax
mov ecx, esi
call fcn.1006d073
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x6c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x70], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x78], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x7c], eax
mov al, byte [edi + 3]
mov byte [esi + 0x80], al
jmp 0x1006cd7c
mov ecx, esi
call fcn.1006b62c
mov bl, al
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x38]
mov dword [esi + 0x48], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esi + 0x4c], ecx
xor ecx, ecx
mov dword [esi + 0x40], 0x3f
mov byte [esi + 5], cl
test bl, bl
jne 0x1006cda9
mov eax, dword [ebp - 8]
cmp byte [eax + 0x24], cl
je 0x1006cda9
or word [esi], 1
jmp 0x1006cdce
mov eax, 0xfffe
and word [esi], ax
test bl, bl
je 0x1006cdce
xor eax, eax
mov byte [esi + 4], 0x14
mov word [esi + 2], ax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x1c], ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1007b4ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
test esi, esi
je 0x1007b51d
movzx eax, byte [edi]
mov edx, ecx
shr edx, 8
xor edx, eax
and edx, 0xff
shl ecx, 8
xor cx, word [edx*2 + 0x100f59e0]
inc edi
movzx ecx, cx
dec esi
jne 0x1007b4fb
pop edi
mov ax, cx
pop esi
pop ebp
ret 4
Function at 0x10089534
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jbe 0x1008955d
movzx eax, byte [esi + edx]
xor eax, ecx
and eax, 0xff
shr ecx, 8
movzx eax, word [eax*2 + 0x100f5bf8]
xor ecx, eax
inc esi
cmp esi, dword [ebp + 8]
jb 0x1008953f
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x10096155
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx edx, word [edi]
test esi, esi
je 0x10096185
movzx ecx, byte [ebx]
movzx eax, dl
xor ecx, eax
shr dx, 8
xor dx, word [ecx*2 + 0x100f5e00]
inc ebx
movzx edx, dx
dec esi
jne 0x1009616a
mov word [edi], dx
pop edi
pop esi
pop ebx
pop ebp
ret 8