joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002074b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100e3100
call fcn.100e0410
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100ecf78
mov dword [esi + 4], 0x100ecf5c
mov dword [esi + 8], 0x100ecf4c
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push fcn.1006f196
push 0x1002094d
push 6
lea eax, [esi + 0x160]
push 8
push eax
mov byte [ebp - 4], 7
call fcn.100e06fa
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100ef734
mov dword [esi + 4], 0x100ef718
mov dword [esi + 8], 0x100ef708
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1002c885
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x1002c8b4
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
shr eax, 8
movzx ecx, word [ecx*2 + 0x1010c5f0]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x1002c894
pop edi
pop esi
ret 4

Function at 0x1003115c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e4201
call fcn.100e0410
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100ecf78
mov dword [esi + 4], 0x100ed600
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000263b
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100f1154
mov dword [esi + 4], 0x100f1144
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10035768
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x100e45b5
call fcn.100e0410
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x18]
mov dword [ebx], eax
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.10035807
and dword [ebp - 4], 0
lea eax, [esi + 0x24]
push eax
lea ecx, [ebx + 0x24]
call fcn.10035876
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.10067248
mov eax, dword [ebp + 8]
push 0xa
add esi, 0x40
lea edi, [ebx + 0x40]
pop ecx
add eax, 0x68
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x68]
mov byte [ebp - 4], 2
call fcn.1000f13c
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1003f050
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x14
pop eax
cmp edx, eax
jb case.0x1003f15b.8
mov esi, dword [ebp + 8]
mov di, word [esi]
mov word [ecx], di
mov di, word [esi + 2]
mov bx, word [ecx]
mov word [ecx + 2], di
mov di, word [esi + 4]
mov word [ecx + 4], di
mov di, word [esi + 6]
mov word [ecx + 6], di
xor edi, edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x18], edi
cmp bx, 2
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x1c], edi
je 0x1003f1b4
cmp bx, 9
je 0x1003f1ae
cmp bx, 1
jne 0x1003f0dc
cmp edx, 0x20
jb case.0x1003f15b.8
mov eax, dword [esi + 0x10]
push 0x20
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
movzx eax, word [esi + 0x18]
cdq
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
movzx eax, word [esi + 0x1a]
mov dword [ecx + 0xc], eax
pop eax
jmp 0x1003f22c
cmp bx, 8
jne 0x1003f145
push 0x28
pop eax
cmp edx, eax
jb case.0x1003f15b.8
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edi
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], edi
movzx edx, word [esi + 0x20]
movzx ebx, word [esi + 0x22]
cmp edx, edi
mov dword [ecx + 0xc], ebx
jbe 0x1003f22c
lea ecx, [eax + 0xc]
cmp ecx, dword [ebp + 0xc]
ja case.0x1003f15b.8
mov ecx, dword [eax + esi + 8]
lea eax, [eax + ecx + 0xd]
cmp eax, dword [ebp + 0xc]
ja case.0x1003f15b.8
cmp ecx, 0x400
ja case.0x1003f15b.8
inc edi
cmp edi, edx
jb 0x1003f112
jmp 0x1003f22c
movzx edx, bx
add edx, 0xfffffffd
cmp edx, 0xb
ja case.0x1003f15b.8
movzx edx, byte [edx + 0x1003f243]
jmp dword [edx*4 + 0x1003f233]
cmp dword [ebp + 0xc], 0x18
jb case.0x1003f15b.8
mov esi, dword [esi + 0x14]
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], edi
lea eax, [esi + 0x18]
cmp dword [ebp + 0xc], eax
jb case.0x1003f15b.8
cmp esi, 0x40000000
jbe case.0x1003f15b.6
jmp case.0x1003f15b.8
push 0x18
pop eax
cmp dword [ebp + 0xc], eax
jb case.0x1003f15b.8
cmp bx, 8
jb 0x1003f22c
add eax, 4
cmp dword [ebp + 0xc], eax
jb case.0x1003f15b.8
jmp 0x1003f22c
cmp bx, 2
jne 0x1003f1db
cmp edx, 0x20
jb case.0x1003f15b.8
mov eax, dword [esi + 0x10]
push 0x20
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
mov eax, dword [esi + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edi
jmp 0x1003f206
cmp edx, 0x38
jb case.0x1003f15b.8
mov eax, dword [esi + 0x10]
push 0x38
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 0xc], eax
pop esi
push dword [ebp + 0x10]
call fcn.1003f008
push edi
push 4
push edx
push eax
call fcn.100e05a0
xor ecx, ecx
add eax, esi
adc edx, ecx
cmp edx, ecx
ja case.0x1003f15b.8
jb 0x1003f22c
cmp eax, dword [ebp + 0xc]
jbe 0x1003f22c
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1003f48a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e5029
call fcn.100e0410
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100f2ac4
mov dword [esi + 4], 0x100f2ab4
lea ecx, [esi + 0x168]
mov dword [ebp - 4], 0x11
call fcn.100d9a50
mov eax, dword [esi + 0x89c]
test eax, eax
je 0x1003f4bf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x890]
call fcn.100035fc
mov eax, dword [esi + 0x164]
pop ecx
test eax, eax
mov byte [ebp - 4], 0xf
je 0x1003f4df
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x15c]
mov byte [ebp - 4], 0xe
test eax, eax
je 0x1003f4f3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x154]
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1003f507
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x138]
call fcn.100035fc
push dword [esi + 0x12c]
call fcn.100035fc
push dword [esi + 0x120]
call fcn.100035fc
mov eax, dword [esi + 0x108]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 9
je 0x1003f53f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x90]
call fcn.100035fc
push dword [esi + 0x88]
call fcn.100035fc
push dword [esi + 0x7c]
call fcn.100035fc
add esp, 0xc
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 5
call fcn.1003f5a8
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.1003f5a8
push dword [esi + 0x30]
call fcn.100035fc
push dword [esi + 0x24]
call fcn.100035fc
push dword [esi + 0x18]
call fcn.100035fc
push dword [esi + 0xc]
call fcn.100035fc
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x10044694
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e5368
call fcn.100e0410
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10001e84
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10001e84
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x28]
mov byte [esi + 0x28], al
mov al, byte [edi + 0x29]
mov byte [esi + 0x29], al
mov al, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
mov al, byte [edi + 0x2b]
mov byte [esi + 0x2b], al
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10045a1e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100e54dc
call fcn.100e0410
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100ecf78
mov dword [esi + 4], 0x100ecf4c
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.1000263b
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov dword [esi], 0x100f3848
mov dword [esi + 4], 0x100f3838
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10045b28
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100e5512
call fcn.100e0410
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [esi + 0x30]
mov dword [ebp - 4], 2
call fcn.100035fc
pop ecx
lea ecx, [esi + 0x24]
call fcn.10066ffd
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.10045c05
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.10045bbf
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1004ca3d
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100e5b9d
call fcn.100e0410
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov byte [esi + 1], al
mov byte [esi + 2], al
mov byte [esi + 3], al
mov byte [esi + 4], al
mov byte [esi + 5], al
mov byte [esi + 6], al
mov byte [esi + 7], al
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.1004c80f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1004d4d4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e5cb6
call fcn.100e0410
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10001e28
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10001e28
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10001e28
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10001e28
or dword [esi + 0x7c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x64], bl
mov byte [esi + 0x65], bl
mov byte [esi + 0x66], bl
mov byte [esi + 0x67], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1004ea4d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e5e8a
call fcn.100e0410
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10001e84
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10001e84
mov eax, dword [esi + 0x18]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10001e84
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.10001e84
mov al, byte [esi + 0x64]
push 5
mov byte [ebx + 0x64], al
mov al, byte [esi + 0x65]
mov byte [ebx + 0x65], al
mov al, byte [esi + 0x66]
mov byte [ebx + 0x66], al
mov al, byte [esi + 0x67]
mov byte [ebx + 0x67], al
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100572d2
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e69ab
call fcn.100e0410
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.1000263b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10057b44
Capabilities:
Enumerate pe sections

Disassembly:
or byte [esi + 0x57], dl
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10057b7c
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10057b63
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10057b74
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10057b7e
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10057b59
xor eax, eax
pop edi
pop esi
ret

Function at 0x1005b7af
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e6f10
call fcn.100e0410
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.1005b9ab
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.1009f326
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.1009f326
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.1009f326
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.1009f326
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.1009f326
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.1009f326
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.1009f326
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.1009f326
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10060753
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x100607af
cmp word [ecx], 0x5a4d
jne 0x100607af
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x100607af
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x100607af
test al, 7
jne 0x100607af
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100607af
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x100607c9
sub ecx, 0x74
je 0x100607c2
dec ecx
dec ecx
je 0x100607c2
dec ecx
dec ecx
je 0x100607bb
sub ecx, 0x3c
je 0x100607b4
sub ecx, 0x8464
je 0x100607c9
xor eax, eax
ret 4
mov ecx, 0x3030401
jmp 0x100607ce
mov ecx, 0x3030701
jmp 0x100607ce
mov ecx, 0x3030501
jmp 0x100607ce
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x100607af
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x100607e8
cmp eax, 0x20b
jne 0x100607af
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x100607b1

Function at 0x10064544
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e7593
call fcn.100e0410
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.100646e8
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.1006479d
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.100026ee
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10064e55
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x10064e74
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x10064e63
pop edi
cmp esi, 4
jb 0x10064e7e
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x10064e8f
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x10064e9b
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x10064ea5
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x10071512
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0x3c]
cmp edx, 2
jge 0x1007152b
cmp byte [ecx + 0x42], 0
mov eax, dword [esp + 4]
je 0x10071590
cmp eax, 0x3f
jb 0x10071590
jmp 0x1007157f
mov eax, dword [esp + 4]
cmp eax, 0x2c
jb 0x10071590
cmp edx, 3
jl 0x10071543
cmp eax, 0x2c
jne 0x10071542
push 0x48
jmp 0x1007158f
dec eax
cmp edx, 4
jl 0x10071552
cmp eax, 0x2c
jne 0x10071551
push 0x49
jmp 0x1007158f
dec eax
cmp eax, 0x3a
jb 0x10071590
cmp byte [ecx + 0x14], 0
je 0x10071571
cmp eax, 0x3a
jne 0x10071566
push 0x44
jmp 0x1007158f
cmp eax, 0x3b
jne 0x1007156f
push 0x45
jmp 0x1007158f
dec eax
dec eax
cmp eax, 0x3f
jb 0x10071588
cmp byte [ecx + 0x42], 0
je 0x10071588
cmp eax, 0x3f
jne 0x10071585
push 0x46
jmp 0x1007158f
dec eax
jmp 0x10071590
cmp eax, 0x44
jne 0x10071590
push 0x47
pop eax
ret 4

Function at 0x10072c01
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100e814b
call fcn.100e0410
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov byte [esi], 1
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.10001e28
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.1000263b
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10072d62
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e81e7
call fcn.100e0410
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10001e28
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000263b
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.10072e03
lea eax, [esi + 0xb8]
mov dword [eax], edi
mov dword [eax + 4], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.10001e28
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.10001e28
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea eax, [esi + 0xfc]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret