joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004aa20
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x650
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100a0c08
push ebx
push edx
push ebp
pushfd
mov edx, 0x4a3f6526
mov ebx, edx
mov ebx, dword [esp + ebx - 0x4a3f651a]
mov dword [esp + 0xc], 0x1189a22
mov edx, dword [esp + edx - 0x4a3f651e]
mov ebp, 0xb4267b1b
popfd
call fcn.10193147
movaps xmm0, xmmword [ebp - 0xd870]
movzx edx, ax
cdq
ror dl, cl
movaps xmmword [ebp - 0x19b60], xmm0
rol dh, 0x19
clc
test ax, dx
movaps xmm0, xmmword [ebp - 0xe530]
movaps xmmword [ebp - 0x19b50], xmm0
movaps xmm0, xmmword [ebp - 0x19b50]
rcl edx, cl
bsr edx, ebp
bt dx, sp
xorps xmm0, xmmword [ebp - 0x19b60]
bts dx, cx
cmovg dx, dx
movaps xmmword [ebp - 0x19b70], xmm0
rcl edx, 0x88
movaps xmm0, xmmword [ebp - 0x19b70]
movaps xmmword [ebp - 0xe530], xmm0
or dh, 0x99
mov edx, 1
stc
cmc
test edx, edx
jmp loc.1019ec99

Function at 0x1004c2d0
Capabilities:
Execute anti-debugging instructions
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x100a0c08
mov esi, ecx
mov dword [ebp - 0x1c], ebx
jmp loc.1012d0cd

Function at 0x1004c600
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
mov edi, dword [ebp + 0xc]
mov byte [esi], 0
sal ax, 0x9c
mov dword [ebp - 0xc], 0x78323025
mov byte [ebp - 8], 0
rcl al, 4
lea eax, [edi*8]
test ebp, 0xbda7e687
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x44], eax
bt eax, 0xb4
or eax, edx
not eax
mov eax, edi
shr eax, 0x1d
stc
mov dword [esi + 0x48], eax
adc eax, ebp
lea eax, [esi + 1]
mov dword [esi + 0x50], 0xefcdab89
test si, 0x931e
mov dword [esi + 0x54], 0x98badcfe
jmp loc.1013698e
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x100a0c08
mov esi, ecx
mov dword [ebp - 0x18], ebx
jmp 0x1000cb6f

Function at 0x1004dba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
jmp loc.10147050
lea esp, [esp + 4]
cbw
mov eax, dword [0x100f259c]
jmp 0x1001eb78
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100a0c08
mov edi, ecx
jmp 0x100473d2
Function at 0x1004dc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 4]
btr ax, 0x31
mov ebx, dword [0x100f7438]
mov ecx, dword [ebp + 8]
rol esi, 0x8d
imul eax, ebx, 0x192
sub dx, bp
lea esi, [eax + 0x100f7560]
adc dx, 0x13b6
mov edx, esi
rcr eax, 0xb3
sub edx, ecx
clc
movzx eax, ax
cmp esi, 0xa43349bc
nop word [eax + eax]
movzx eax, word [ecx]
cmp di, 0x231
lea ecx, [ecx + 2]
test sp, ax
mov word [edx + ecx - 2], ax
test sp, si
test ax, ax
jmp 0x10058355
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100a0c08
jmp 0x10003e21
jne 0x10003e61
lea ecx, [esi + 2]
adc ax, 0x7c1f
rcl al, cl
xadd ax, ax
mov ax, word [esi]
add esi, 2
test ax, ax
jmp loc.101779a9

Function at 0x1004dd30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x100a0c08
mov esi, ecx
jmp loc.101d0299

Function at 0x1004de00
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009a400
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc
mov eax, 0x5764
call fcn.100983e0
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x4d6c], esi
push 0x100a0c08
jmp loc.101d8704

Function at 0x10050840
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x78], ecx
push 0x100a0c08
jmp loc.101b9df5
Function at 0x10052040
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], ecx
push 0x100a0c08
jmp loc.10155655

Function at 0x100526a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x7c], ecx
push 0x100a0c08
jmp loc.1012dfce

Function at 0x10052d00
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x78], ecx
push 0x100a0c08
jmp loc.101bbdec

Function at 0x10054130
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
bsr ecx, esi
mov eax, dword [ebp - 0x7c]
sal dx, cl
mov ecx, dword [eax]
mov edx, dword [ebp - 0x7c]
add ecx, dword [edx + 0xc]
bswap dx
mov dword [ebp - 0x98], ecx
add cl, 0
cbw
mov eax, dword [ebp - 0x98]
xadd ch, dl
not cx
add edx, eax
mov dword [ebp - 0x80], eax
or edx, 0x393ae220
bts dx, dx
shld ecx, ecx, 0x90
mov ecx, dword [ebp - 0x80]
add ecx, 1
sal al, 0x23
mov dword [ebp - 0x194], ecx
rcr dh, 3
mov edx, dword [ebp - 0x80]
test dl, 0xaf
mov al, byte [edx]
mov byte [ebp - 0x71], al
cmp ah, 0xa4
jmp fcn.101a6804
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x7c], ecx
push 0x100a0c08
jmp 0x1001c409

Function at 0x10054780
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x78], ecx
push 0x100a0c08
jmp loc.1012059b

Function at 0x10054f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
push 0x100a0c08
jmp loc.101a9e91

Function at 0x1005647d
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse credit card information

Disassembly:
pushfd
add dword [esp + 0xc], 0xefe8dcca
mov ebp, 0x7cb97132
call fcn.10158fa9

Function at 0x10056fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x30], ecx
push 0x100a0c08
jmp loc.101ddf87
Function at 0x100577f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1054
call fcn.100983e0
mov eax, dword [0x100a4040]
xor eax, esp
mov dword [esp + 0x1050], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0x100a0c08
jmp loc.101baf1e

Function at 0x10058c03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebp, dword [esp + ebp + 0x4bd984ed]
call fcn.10191b1d

Function at 0x1005abf0
Capabilities:
Authenticate hmac
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x858
mov eax, dword [0x100a4040]
xor eax, esp
mov dword [esp + 0x854], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x24], eax
push 0x100a0c08
mov dword [esp + 0xc], esi
jmp loc.101b303e

Function at 0x1005b660
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
mov eax, 0x34bef402
bswap ecx
mov eax, dword [0x100f259c]
bswap dx
cdq
mov ecx, dword [eax + 0x584]
mov dword [ebp - 0x651c], ecx
mov edx, dword [ebp - 0x4e90]
jmp loc.101981d8
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x8d68
call fcn.100983e0
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x4e90], ecx
push 0x100a0c08
jmp 0x1003d8f9

Function at 0x100673dc
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
push ebp
pushfd
mov esi, 0xc482b60d
xor esi, esi
shl si, 0x3d
mov esi, dword [esp + 0xc]
mov dword [esp + 0xc], 0x1054de1
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.1012000b

Function at 0x1006d08b
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr ecx, 0xdc
mov dword [esp + 0x14], 0x1169631
mov ecx, dword [esp + 4]
add dword [esp + 8], 0xefe49ff3
call fcn.101b1d4b

Function at 0x10072847
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub dword [esp + 0xc], 0xe18f6f2a
push dword [esp + 4]
popfd
lea esp, [esp + 0x14]
call fcn.1012000b

Function at 0x10075a37
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x1c]
call fcn.1012000b
mov edx, 0x5d14f700
movzx ax, byte [ebp + edx - 0x5d14f700]
jmp fcn.10186702
Function at 0x10077480
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2d8], ecx
push 0x100a0c08
push 0x5a1a3fb8
push ecx
call fcn.1004320b
mov byte [ebp - 0x72f], 0x75
mov byte [ebp - 0x72e], 0x74
mov byte [ebp - 0x72d], 0x65
lahf
movzx ax, bl
mov byte [ebp - 0x72c], 0x41
mov byte [ebp - 0x72b], 0
mov byte [ebp - 0x748], 0x53
mov byte [ebp - 0x747], 0x68
lahf
movzx ax, dh
not ax
mov byte [ebp - 0x746], 0x65
mov byte [ebp - 0x745], 0x6c
movsx eax, sp
mov byte [ebp - 0x744], 0x6c
nop
cwde
lahf
mov byte [ebp - 0x743], 0x45
lahf
mov byte [ebp - 0x742], 0x78
cmove eax, ecx
bswap eax
mov byte [ebp - 0x741], 0x65
cmovge ax, sp
cbw
mov byte [ebp - 0x740], 0x63
not ch
mov byte [ebp - 0x73f], 0x75
mov byte [ebp - 0x73e], 0x74
bswap cx
mov byte [ebp - 0x73d], 0x65
movsx ecx, sp
mov byte [ebp - 0x73c], 0x57
xchg al, ah
mov byte [ebp - 0x73b], 0
setl al
cwde
mov byte [ebp - 0x1444], 0x44
setnp ah
xchg cl, ah
cwde
mov byte [ebp - 0x1443], 0x33
setl al
movsx eax, bp
mov ah, 0x8e
mov byte [ebp - 0x1442], 0x44
bswap ax
mov byte [ebp - 0x1441], 0x58
mov byte [ebp - 0x1440], 0x53
mov byte [ebp - 0x143f], 0x61
movzx eax, si
movsx cx, bl
movsx ecx, cx
mov byte [ebp - 0x143e], 0x76
mov byte [ebp - 0x143d], 0x65
movzx eax, sp
xchg al, al
cwde
mov byte [ebp - 0x143c], 0x53
movzx eax, di
mov ax, 0x7410
mov byte [ebp - 0x143b], 0x75
lahf
jmp 0x100808f6
mov byte [ebp - 0x143a], 0x72
mov byte [ebp - 0x1439], 0x66
movzx ecx, sp
lahf
setl cl
mov byte [ebp - 0x1438], 0x61
cwde
mov eax, esp
mov byte [ebp - 0x1437], 0x63
setle ah
mov eax, 0x123e993a
mov byte [ebp - 0x1436], 0x65
cbw
mov al, 0xba
mov byte [ebp - 0x1435], 0x54
movzx ecx, dx
mov byte [ebp - 0x1434], 0x6f
mov byte [ebp - 0x1433], 0x46
sets al
mov ecx, 0xb5be059b
movzx ecx, bp
mov byte [ebp - 0x1432], 0x69
setge al
bswap ax
xchg ah, ch
mov byte [ebp - 0x1431], 0x6c
movsx ecx, si
mov ax, bx
mov byte [ebp - 0x1430], 0x65
movzx ecx, dx
movsx eax, dx
mov byte [ebp - 0x142f], 0x49
cmovl ecx, edx
movzx ecx, ax
movsx eax, si
mov byte [ebp - 0x142e], 0x6e
cwde
nop
mov byte [ebp - 0x142d], 0x4d
cmovno ax, sp
mov byte [ebp - 0x142c], 0x65
movsx eax, bp
not cl
mov byte [ebp - 0x142b], 0x6d
mov byte [ebp - 0x142a], 0x6f
mov byte [ebp - 0x1429], 0x72
not eax
mov byte [ebp - 0x1428], 0x79
mov byte [ebp - 0x1427], 0
cwde
mov byte [ebp - 0x3f8], 0x43
movsx eax, cx
lahf
bswap ecx
mov byte [ebp - 0x3f7], 0x72
mov ax, si
mov byte [ebp - 0x3f6], 0x65
mov ecx, 0xf8a73a33
mov byte [ebp - 0x3f5], 0x61
mov eax, edx
mov byte [ebp - 0x3f4], 0x74
cbw
mov byte [ebp - 0x3f3], 0x65
movsx cx, ah
movsx ecx, si
movzx ecx, bp
mov byte [ebp - 0x3f2], 0x46
cwde
not cl
jmp loc.1018a23d
Function at 0x10078500
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x32b4
call fcn.100983e0
mov eax, dword [0x100a4040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1ab4], ecx
call fcn.1004aa20
mov eax, dword [ebp - 0x1ab4]
cmp dword [eax + 0x1c], 0
je 0x1007856c
mov ecx, dword [0x1011e8d8]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x22fc], ecx
push 1
mov ecx, dword [ebp - 0x22fc]
call fcn.10041e90
movzx edx, byte [0x100ec837]
test edx, edx
jne 0x10078586
movzx eax, byte [0x100ec836]
test eax, eax
je 0x1007a0d5
push 0x100a0c08
push ebp
push ebx
pushfd
mov ebx, 0x710f6db6
xor ebx, ebx
mov ebp, ebx
bswap ebx
cmovno ebp, ebx
neg ebp
jne 0x100785ba
mov ebp, dword [esp + ebx + 8]
mov dword [esp + 8], 0x1073c7a
mov ebx, dword [esp + ebx*4 + 4]
call fcn.100273cf
cmovge eax, ebp
mov edx, dword [ebp - 0x1ab4]
cmp dword [edx + 0x1c], 0
jne 0x1007a1a7
push 0x100a0c08
call fcn.101d7c23
call fcn.10049300
movzx ecx, byte [0x100f25b6]
test ecx, ecx
je 0x1007a1cd
movzx edx, byte [0x100f25b5]
test edx, edx
je 0x1007a1cd
movzx eax, byte [0x100f25b4]
test eax, eax
jne 0x1007a1d2
jmp 0x1007becf
mov ecx, dword [ebp - 0x1ab4]
mov edx, dword [ecx + 0x84]
mov dword [ebp - 0x231c], edx
mov eax, dword [0x1011e8d8]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x231c]
call fcn.10018df0
mov ecx, dword [0x100f73d8]
call fcn.10065d50
movzx ecx, byte [0x1011e8c5]
test ecx, ecx
jne 0x1007b156
mov edx, dword [0x100f259c]
mov eax, dword [edx + 0x4ac]
call eax
sub eax, dword [0x100f7420]
cmp eax, 0x2710
jbe 0x1007b156
mov ecx, dword [ebp - 0x1ab4]
call fcn.1007c8e0
mov dword [ebp - 0x1afc], eax
cmp dword [ebp - 0x1afc], 0x249f0
jbe 0x1007b156
push 0x100a0c08
push 0xedacd93b
call fcn.101d36ff
fisttp word [ebx]
xor dword [0x57dfccab], esi
jmp 0xeaded99e
mov eax, dword [0x100f259c]

Function at 0x1007bef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4c8
mov eax, dword [0x100a4040]
xor eax, esp
mov dword [esp + 0x4c4], eax
push esi
push edi
push 0x100a0c08
jmp fcn.1019101b
Function at 0x1007bf2e
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
not dword [esp + edx - 8]
sub dword [esp + edx - 0xa], 0x629e9333
lea edx, [edx + edx*2 + 0x110b4618]
neg cl
not word [esp + edx*2 - 0x22168c71]
rol dl, 0x61
ror cl, 1
call fcn.101869bd
cli
loopne 0x10024982
xor eax, 0xbccabbd6
in al, dx
and ebp, dword [esi]
inc ecx
sti
invalid
xchg ebp, eax
in eax, dx
and al, byte [0x54942a2c]
cmp esp, eax
xor al, 0x35
fsubr dword [eax]
xor edi, dword [esp + ebp*8 + 0xc6f6723]
or edi, dword [esp + ebp*8 + 0x890c723]
pop ss
out 0xc4, al
xchg edi, eax
inc ecx
add edx, dword [ebp - 0x37]
inc edx
or al, 0x35
hlt
bswap edx
jb 0x10024924
shl byte [esp + 5], 0xa4
add al, al
xor ebx, edx
sub cl, byte [esp + 6]
add edi, edx
mov dword [esp], eax
dec byte [esp + 4]
sar ecx, 0xba
pop eax
pop eax
js fcn.101dd833
jmp 0x3a3cf073

Function at 0x1007c8a0
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push 0x100a0c08
call int.1019600d
Function at 0x10080340
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x8dd8
call fcn.100983e0
mov eax, dword [0x100a4040]
xor eax, esp
mov dword [esp + 0x8dd4], eax
push esi
push edi
mov edi, ecx
mov dword [esp + 0x388], edi
mov eax, dword [edi + 0x31cfc]
cmp eax, dword [edi + 0x31d00]
je 0x1008037d
mov dword [edi + 0x31d00], eax
mov eax, dword [0x100f259c]
push edi
push 0x10081e10
mov eax, dword [eax + 0x464]
call eax
mov edx, dword [edi + 0x31d00]
xor esi, esi
mov ecx, dword [edi + 0x31cfc]
mov eax, edx
sub eax, ecx
mov dword [esp + 0xc], esi
sar eax, 3
test eax, eax
je 0x10080d86

Function at 0x1008c133
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1008c172
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1008c172
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1008c172
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1008c172
cmp dword [ecx + 0x74], 0xe
jbe 0x1008c172
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1008d55c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009cbf8
push 0x1009cbf0
push str.FlsAlloc
push 0x1f
call fcn.1008d478
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008d590
push dword [ebp + 8]
mov ecx, esi
call dword [0x1009b130]
call esi
jmp 0x1008d596
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1008d5da
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009cc08
push 0x1009cc00
push str.FlsGetValue
push 0x21
call fcn.1008d478
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008d611
push dword [ebp + 8]
mov ecx, esi
call dword [0x1009b130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1008d619
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1009cc10
push 0x1009cc08
push str.FlsSetValue
push 0x22
call fcn.1008d478
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1008d653
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1009b130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10091c68
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10091d05
push ebx
push esi
call fcn.10091c31
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10091bc5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10091cb2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10091d04
push edi
push eax
call fcn.1008d227
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10091cd2
call fcn.1008d275
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10091d03
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10091bc5
add esp, 0x20
test eax, eax
jne 0x10091cf1
push edi
call fcn.1008d275
jmp 0x10091cf9
push ebx
call fcn.1008d275
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10098050
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1009807d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009807d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x101390e4
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse credit card information

Disassembly:
lea esp, [esp + 0xc]
ja 0x1015d6c2
mov edx, 0x45b07b0d
mov edx, esp
mov ecx, 0x64
lea eax, [ebp - 0x80]
push 0xeb1ec59d
inc dword [esp]
and eax, 0xfffffffc
call fcn.1015d687
jmp edi

Function at 0x101394fe
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
push esi
pushfd
mov esi, 0x4f1e5abb
add dword [esp + esi - 0x4f1e5ab3], 0xefff1521
or esi, 0xd10825a6
mov dword [esp + 8], 0x117cba0
mov esi, dword [esp + 4]
jb 0x10139500
ja 0x101bf867
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.1012000b

Function at 0x1014ed1b
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
xor cl, bl
mov dword [esp + edx - 0x74af00ac], 0xebc2911
mul al
sub dword [esp + edx - 0x74af00ac], eax
sbb cl, 0xb2
push eax
neg cl
dec dl
mul edx
xor cl, 0x86
pop eax
sub cl, 0x87
lea edx, [eax*8 - 0x587ef268]
xor bl, cl
lea ecx, [esp + ecx + 4]
shr al, 0xa4
shl edx, 0xea
movzx ax, byte [edx + ecx - 0x8ff8000]
jae 0x101c3d23
mov word [ebp + edx*2 - 0x11ff0002], ax
shr dword [esp + edx*2 - 0x11ff0000], 0x83
movsx eax, dx
mov ecx, dword [esp + edx - 0x8ff8000]
lea ebp, [ebp + edx*2 - 0x11ff0002]
pop ecx
jne fcn.101dd833

Function at 0x1016208a
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
bt edx, 0x14
neg al
sar edx, cl
ror al, 1
push edx
sal cl, 0x41
dec al
mov dword [esp + 4], 0x389ad536
call fcn.1014d89c
movzx eax, dx
btr eax, 0xa0
pop edx
pop edx
pop edx
jae fcn.101dd833
push es
mov dword [eax], esp
xor eax, 0xd57267d5
clc
and eax, dword [edx + 0x22]
inc ecx
inc edx
aad 0xf8
and edi, edx
lodsd eax, dword [esi]
push edi
invalid

Function at 0x10174dfb
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 4], 0x1052dca
lea esp, [esp + 4]
call fcn.1012000b