joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007ec0
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push esi
push esi
push esi
call fcn.10008629
add esp, 0x14
cmp edi, esi
je 0x10007e9b
xor eax, eax
mov word [edi], ax
mov word [edi + 2], ax
mov word [edi + 4], ax

Function at 0x10007f1f
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
pop ebp
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp esi, eax
jne 0x10007f95
push eax
push eax
push eax
push eax
push eax
call fcn.1000b352
add esp, 0x14
push 0x16
pop eax
call fcn.10009191

Function at 0x10007f53
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
dec esi
cmp esi, 0x3f
jbe 0x10007f5b
push 0x3f
pop esi
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx + esi*8]
mov edi, dword [ecx + 4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edi
mov dword [ecx + 4], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx + 8], ebx
mov ecx, dword [ebx + 4]
cmp ecx, dword [ebx + 8]
jne 0x10007f0b
mov cl, byte [esi + eax + 4]
mov byte [ebp + 0xf], cl

Function at 0x100081ab
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push dword [ebp + 8]
call fcn.10006b6c
add esp, 0xc
pop ebp
mov edi, edi
push ebp
mov ebp, esp
push 0x10

Function at 0x100081f3
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
xor dword [ebx], 0xff685d2
lahf
ret 0x548d
Function at 0x10008629
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
je 0x1000896c
cmp ebx, 0xf
je 0x100066fa
cmp ebx, 8
je 0x1000869f
cmp ebx, 4
je 0x100085fb
cmp ebx, 0xb
jne 0x100073dd
call fcn.10009a50
mov esi, eax
test esi, esi
je 0x10009adb
mov edi, 0x1000fd8f
and eax, 0xfffff002
add eax, 0x1001
push eax
push edi
Function at 0x10008853
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 8], eax
mov eax, ebx
cdq
idiv edi
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 0x10]
sub edx, eax
mov ebx, edx
lea eax, [edi - 1]
cdq
and edx, 3
add eax, edx
sar eax, 2
Function at 0x10008cde
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sar edi, 4
dec edi
lea ecx, [ecx + esi - 4]
cmp edi, 0x3f
jbe 0x10008cf1
push 0x3f
pop edi
mov ebx, dword [ebp - 0xc]
lea ebx, [ebx + edi*8]
mov dword [ebp + 0x10], ebx
mov ebx, dword [ebx + 4]
mov dword [ecx + 4], ebx
mov ebx, dword [ebp + 0x10]
mov dword [ecx + 8], ebx
mov dword [ebx + 4], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx + 8], ecx
mov ebx, dword [ecx + 4]
cmp ebx, dword [ecx + 8]
lea ecx, [ebp - 0x7c]
cmp dword [ebp - 0x54], 0x10000002
jne 0x10008d46
push 0x1000fad1
push esi
push ebx
lea edi, [ebx + 0xb8]
call fcn.10007966
and dword [ebp - 4], 0
lea eax, [esi + 0x1c]
mov dword [ebp - 0x10], ebx
add esp, 0xc
sub dword [ebp - 0x10], esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push ecx
xor edi, dword [ebp - 0x64]
or ecx, dword [ebp - 0x64]
push dword [ebp - 0x4c]
and esi, eax
call fcn.100064a7
mov byte [ebp - 0x50], 0xd3
xor eax, esi
add dword [ebp - 0x4c], 0xfffffffc
or dword [ebp - 0x64], 0xdc2
or ecx, dword [ebp - 0x50]
push dword [ebp - 0x74]
call fcn.100063af
cmp dword [ebp - 0x54], 0x57
jne 0x10008d91
mov dword fs:[0], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
int3
push dword [ebp - 0x58]
call fcn.100063af
add ebx, edx
push dword [ebp - 0x60]
call fcn.100063af

Function at 0x10008ebc
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
or esi, dword [ebp - 0x48]
push dword [ebp - 0x84]
call fcn.100063af
or dword [ebp - 0x48], ebx
push dword [ebp - 0x80]
call fcn.100063af
add dword [ebp - 0x88], esi
cmp dword [ebp - 0x5c], 0x10000002
jne 0x10008de6
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
jle 0x10008dbc
push esi
lea esi, [ebp + 0x10]
add esi, 4
push dword [esi]
add dword [ebp - 0x50], eax
mov esi, dword [ebp - 0x80]
test dword [ebp - 0x54], 0
je 0x10008e18
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.1000a88b
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x10008e67
mov dword [eax], edi
cmp edi, ebx
jne 0x10008da3
call fcn.1000b92f
push ebx
mov edx, dword [ebp - 0x7c]
add dword [ebp - 0x64], 0xa6e
cmp dword [ebp - 0x5c], 1
je 0x10008e4d
test esi, esi
jne 0x10008e8f
movzx esi, byte [eax + 0x1f]
movzx ebx, byte [ecx + 0x1f]
sub esi, ebx
je 0x10008e5f
xor ebx, ebx
test esi, esi
setg bl
lea ebx, [ebx + ebx - 1]
mov esi, ebx
xor esi, esi
test esi, esi
jne 0x10008dcd
add eax, edx
mov esi, dword [edx + 8]
mov dword [ebp - 0x80], esi
sub eax, dword [ebp - 0x44]
cmp dword [ebp - 0x5c], 0xffffffc4
jne 0x10008e7d
call fcn.10009d92
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x10008e4b
mov dword [eax], edi
cmp edi, ebx
jne 0x10008e47
call fcn.10007f1f
jl 0x10008e6a
pop edi
pop esi
mov edi, edi
push ebp
Function at 0x10009b46
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0x7f
jb 0x10009b8d
push 0x1000f766
push dword [0x1000fcbb]
lea eax, [ebp - 0x188]
push eax
call fcn.1000b1b8
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [edi + 4], eax
and dword [edi + 4], 0
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, dword [edi + 4]
Function at 0x1000a4df
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
test eax, eax
jne 0x1000a4ad
mov eax, dword [ecx - 4]
cmp eax, dword [edx - 4]
je 0x1000a526
movzx esi, al
movzx eax, byte [edx - 4]
sub esi, eax
je 0x1000a4ff
xor eax, eax
lea ecx, [ebp - 0x7c]
add eax, ecx
or ebx, edx
push ecx
cmp dword [ebp - 0x5c], 1
je 0x1000a546
Function at 0x1000a508
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x1000f974]
mov edx, dword [ebp + 8]
and edx, dword [ebp + 0xc]
not ecx
and ecx, eax
push ebp
mov ebp, esp
sub esp, 8
and eax, esi
push 0x6d
call fcn.10006723
push 0
push dword [ebp + 8]
call fcn.1000b9b2
pop ecx
pop ecx
pop ebp
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
add esp, 0x14
xor eax, eax
imul ecx, dword [ebp + 0x10]
push esi
push edi
mov esi, ecx
cmp dword [ebp + 8], ebx
je 0x100066ff
push dword [ebp + 8]
call fcn.10009d92
pop ecx
mov ebx, eax
push esi
mov dword [0x1000f935], ebx
mov al, byte [ebp + 0x10]
mov byte [0x10015cb0], al
cmp dword [ebp + 0xc], 0
jne 0x100066cf
push dword [0x1000f4e7]
call fcn.1000a4df
pop ecx
mov edi, eax
mov dword [ebp - 0x28], edi
test edi, edi
je 0x1000a592
push dword [0x1000f37e]
call fcn.10009154
pop ecx
mov esi, eax
mov dword [ebp - 0x24], esi
push dword [ebp - 0x4c]
mov word [ebp - 0x44], 0xbc2
sub edx, dword [ebp - 0x8c]
call fcn.100064a7
sub ebx, esi
sub edi, dword [ebp - 0x44]
sub dword [ebp - 0x4c], 0x40
lea eax, [esi]
cmp dword [ebp - 0x54], 0x10000002
jne 0x1000a58c
and edi, dword [ebp - 0x88]
or edi, ebx
mov eax, dword [ebp - 0x68]
or edi, dword [ebp - 0x44]
add dword [ebp - 0x54], 0
je 0x1000a5d7
test esi, esi
mov edi, dword [ebp - 0x80]
xor word [ebp - 0x88], 0xef3
sub edx, dword [ebp - 0x44]
add eax, dword [edi + 0x1c]
mov dword [ebp - 0x68], eax
add word [ebp - 0x8c], 0xbe1
lea edi, [ebp - 0x68]
lea ecx, [ebx + ecx*4 + 0xea9]
push edi
add edx, dword [ebp - 0x44]
push dword [ebp - 0x84]
and dword [ebp - 0x88], eax
xor edi, dword [ebp - 0x44]
call fcn.10006556
lea ebx, [ebx + eax*8 + 0xa9e]
mov ebx, dword [ebp - 0x68]
add dword [ebp - 0x54], 0
je 0x1000a655
mov ecx, dword [ebx + 0x10]
mov dword [ecx], eax
mov eax, dword [ebx + 0x10]
cmp dword [eax], 0xffffffff
je 0x1000a609
mov dword [0x1000f126], ebx
mov eax, dword [ebx + 0x10]
mov edx, dword [eax]
mov dword [ebp - 4], edx
cmp edx, 0xffffffff
je 0x1000a5d5
mov ecx, dword [eax + edx*4 + 0xc4]
mov edi, dword [eax + edx*4 + 0x44]
and ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x60]
add ecx, 0x8a45
mov edi, dword [ebx]
mov dword [ebp - 0x60], edi
xor eax, dword [ebp - 0x44]
mov edi, edx
or eax, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
cmp dword [ebp - 0x5c], 1
je 0x1000a697
cmp byte [eax], bl
jne 0x1000a5f8
mov dword [ebp - 4], esi
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
lea edi, [ebp - 0xc]
call fcn.1000714e
mov eax, dword [ebp - 8]
add esp, 0xc
cmp eax, 0x3fffffff
or dword [ebp - 0x60], edx
jne 0x1000a6e1
add dword [ebp - 0x88], ecx
and ecx, esi
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x50], ecx
test dword [ebp - 0x54], 0
je 0x1000a6d0
mov edx, dword [ebp - 0x68]
or ebx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ebx
mov edi, dword [edx + 4]
mov dword [ebp - 0x60], edi
add ecx, edi
mov dword [ebp - 0x78], esp
mov dword [ebp - 0x64], esi
or dword [ebp - 0x44], eax
mov esp, dword [ebp - 0x4c]
cmp dword [ebp - 0x5c], 0xffffffc8
jne 0x1000a724
Function at 0x1000a7c0
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
jne 0x10007c31
movzx esi, byte [eax - 0x19]
movzx edx, byte [ecx - 0x19]
sub esi, edx
je 0x1000a7dd

Function at 0x1000a83e
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
xor edx, edx
test esi, esi
setg dl
lea edx, [edx + edx - 1]
cmp dword [0x1000f328], 0
je 0x1000a7d2
push edi
push esi
and edi, 0xf
and esi, 0xf
cmp edi, esi
pop esi
pop edi
jne 0x1000a8cc
pop esi
pop edi
pop ebp
test edi, 3
jne 0x1000a8ca
shr ecx, 2

Function at 0x1000aa49
Capabilities:
Encode data using base64
Parse credit card information

Disassembly:
mov eax, esi
xor eax, eax
test eax, eax
jne 0x100087ba
mov eax, dword [ecx - 0x16]
cmp eax, dword [edx - 0x16]
je 0x1000aab9
movzx esi, al
movzx eax, byte [edx - 0x16]
sub esi, eax

Function at 0x1000ae78
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [edi], cl
test dword [eax], ecx
add byte [eax], al
Function at 0x1000b1b8
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
call fcn.10006906
add esp, 0x10
pop ebp
mov edi, edi
push ebp
mov ebp, esp
push 1
push 0
push dword [ebp + 8]
push 0
call fcn.100076e8
add esp, 0x10
pop ebp

Function at 0x1000b268
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
setg al
lea eax, [eax + eax - 1]
mov esi, eax
mov eax, esi
xor eax, eax
test eax, eax
jne 0x1000a0d1
movzx eax, byte [ecx - 1]
movzx ecx, byte [edx - 1]
sub eax, ecx
je 0x100096eb
xor ecx, ecx
test eax, eax
setg cl
lea ecx, [ecx + ecx - 1]
mov eax, ecx
mov eax, dword [ecx - 0x1e]
cmp eax, dword [edx - 0x1e]
push dword [ebp - 0x68]
cmp dword [ebp - 0x5c], 0x3a
cmp dh, byte [ebp + 0x3d]
mov edi, 0x1000f1c7
shr edi, cl
or dword [ebx + 4], edi
mov ecx, dword [ebp - 4]
lea edi, [eax + ecx*4 + 0xc4]
lea ecx, [esi - 0x20]
mov esi, 0x1000f4c6
shr esi, cl
or dword [edi], esi
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1000b26f
mov dword [edx], ecx
mov dword [ecx + edx - 4], ecx
call fcn.100064a7
or dword [ebp - 0x44], 0xffffffa3
mov dword [ebp - 0x74], 5
cmp dword [ebp - 0x5c], 0xffffff8e
jne 0x1000b32f
call dword [0x1000f078]
test eax, eax
je 0x1000b2b9
mov dword [0x1000fdfc], esi
call dword [0x1000f038]
cmp eax, 0x78
jne 0x1000b298
push 2
pop eax
mov dword [str.T__bQ], eax
mov eax, dword [0x1000f639]
cmp eax, 2
je 0x1000bafe
cmp eax, ebx
jmp 0x1000a11c

Function at 0x1000b352
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x1000f710]
test eax, eax
je 0x1000b107
mov ecx, dword [0x1000f280]
mov esi, dword [0x1000f988]
push 0x1000f71e
shl ecx, 0xf
add ecx, dword [eax + 0xc]
mov ebx, 0x1000f84f
push ebx
push ecx
call esi
mov ecx, dword [0x1000f940]
mov eax, dword [0x1000fcaf]
mov edx, 0x1000f391
shr edx, cl
lea ecx, [ebp - 0x84]

Function at 0x1000b39d
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
or esi, dword [ebp - 0x8c]
mov dword [ebp - 0x8c], ebx
lea ebx, [ebp - 0x60]
push ebx
call fcn.10006410
add dword [ebp - 0x48], 0xffffffbb
test dword [ebp - 0x54], 0
je 0x1000b3da
lea esi, [ebp - 0x58]
push esi
call fcn.10006410
add edi, ecx
Function at 0x1000b488
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
and al, 0x83
cli
imul ebp, dword [edx + 3], 0x58
push 2
lea ecx, [ebp - 0x7c]
push ecx
call fcn.10006410
add dword [ebp - 0x50], 0x36
and ebx, ecx
and dword [ebp - 0x50], eax
cmp dword [ebp - 0x5c], 1
je 0x1000b4cb
cmp byte [ebp - 4], 0
je 0x1000b502
mov eax, dword [ebp - 8]
and dword [eax + 0x70], 0xfffffffd
xor eax, eax
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.10007677
pop ecx
pop ecx
pop ebp
int3
mov ebx, dword [ebp - 0x4c]
and esi, dword [ebp - 0x44]
push dword [ebx]
sub eax, edi
mov eax, 0xf0e61a74
mov eax, edx
add edi, ebx
mov edi, 0xeb93920a
mov edi, esi
add edx, dword [ebp - 0x8c]
mov ecx, 0xc
add dword [ebp - 0x88], ecx
test dword [ebp - 0x54], 0
je 0x1000b539
call fcn.1000a6f3
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000b557
cmp dword [0x1000f676], eax
jbe 0x1000b4e5
push esi
call dword [0x1000f064]
lea eax, [esi + 0x3e8]
cmp eax, dword [0x1000faac]
jbe 0x1000b502
or eax, 0xffffffff
mov esi, eax
cmp eax, 0xffffffff
jne 0x1000b56e
mov eax, edi
add dword [ebp - 0x4c], ecx
add dword [ebp - 0x54], 0
je 0x1000b55c
cmp dword [ebp - 4], ebx
jb 0x1000b52b
xor edi, dword [ebp - 0x8c]
ret
and dword [ebp - 0x48], 0xd81
test dword [ebp - 0x54], 0
je 0x1000b5ac
and eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008b0d
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1000fa84]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.1000a035
mov esi, eax
lea edx, [ebp - 0x7c]
or dword [ebp - 0x48], edx
test dword [ebp - 0x54], 0
je 0x1000b5de
movdqa xmmword [edi + 0x70], xmm7
lea esi, [esi + 0x80]
lea edi, [edi + 0x80]
dec ecx
jne 0x1000b642
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
push ebp
mov ebp, esp
sub esp, 0x1c
push edx
mov dword [ebp - 0x48], ecx
push dword [ebp - 0x4c]
or eax, esi
call fcn.100064a7
or dword [ebp - 0x64], 0xdc2
and edx, esi
push dword [ebp - 0x74]
call fcn.100063af
or word [ebp - 0x50], 0xef1
and dword [ebp - 0x8c], edx
push dword [ebp - 0x80]
call fcn.100063af
test dword [ebp - 0x54], 0
je 0x1000b639
pop ecx
push edi
call fcn.1000807d
pop ecx
mov esi, eax
call fcn.1000a9a6
push esi
push 0x1000f150
mov ebx, eax
call dword [0x1000f0a0]
cmp eax, ebx
cmp dword [ebp - 0x5c], 0x10000002
jne 0x1000b66a
xor eax, eax
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
push dword [ebp + 0x1c]
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
call fcn.1000ad22
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x1000b622
mov edx, dword [ebp - 0x68]
and ebx, dword [ebp - 0x50]
and dword [ebp - 0x88], ebx
mov edi, dword [ebp - 0x7c]
xor ecx, edi
mov edx, dword [edi + 8]
mov dword [ebp - 0x68], edx
or edx, dword [ebp - 0x8c]
and dword [ebp - 0x48], 0xa66
lea edx, [ebp - 0x80]
cmp dword [ebp - 0x5c], 0x10000002
jne 0x1000b6bf
Function at 0x1000b642
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
and al, 0x83
cli
imul ebp, dword [edx + 3], 0x58
push 2
lea ecx, [ebp - 0x7c]
push ecx
call fcn.10006410
add dword [ebp - 0x50], 0x36
and ebx, ecx
and dword [ebp - 0x50], eax
cmp dword [ebp - 0x5c], 1
je 0x1000b4cb
cmp byte [ebp - 4], 0
je 0x1000b502
mov eax, dword [ebp - 8]
and dword [eax + 0x70], 0xfffffffd
xor eax, eax
mov edi, edi
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call fcn.10007677
pop ecx
pop ecx
pop ebp
int3
mov ebx, dword [ebp - 0x4c]
and esi, dword [ebp - 0x44]
push dword [ebx]
sub eax, edi
mov eax, 0xf0e61a74
mov eax, edx
add edi, ebx
mov edi, 0xeb93920a
mov edi, esi
add edx, dword [ebp - 0x8c]
mov ecx, 0xc
add dword [ebp - 0x88], ecx
test dword [ebp - 0x54], 0
je 0x1000b539
call fcn.1000a6f3
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000b557
cmp dword [0x1000f676], eax
jbe 0x1000b4e5
push esi
call dword [0x1000f064]
lea eax, [esi + 0x3e8]
cmp eax, dword [0x1000faac]
jbe 0x1000b502
or eax, 0xffffffff
mov esi, eax
cmp eax, 0xffffffff
jne 0x1000b56e
mov eax, edi
add dword [ebp - 0x4c], ecx
add dword [ebp - 0x54], 0
je 0x1000b55c
cmp dword [ebp - 4], ebx
jb 0x1000b52b
xor edi, dword [ebp - 0x8c]
ret
and dword [ebp - 0x48], 0xd81
test dword [ebp - 0x54], 0
je 0x1000b5ac
and eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008b0d
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1000fa84]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.1000a035
mov esi, eax
lea edx, [ebp - 0x7c]
or dword [ebp - 0x48], edx
test dword [ebp - 0x54], 0
je 0x1000b5de
movdqa xmmword [edi + 0x70], xmm7
lea esi, [esi + 0x80]
lea edi, [edi + 0x80]
dec ecx
jne 0x1000b642
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
push ebp
mov ebp, esp
sub esp, 0x1c
push edx
mov dword [ebp - 0x48], ecx
push dword [ebp - 0x4c]
or eax, esi
call fcn.100064a7
or dword [ebp - 0x64], 0xdc2
and edx, esi
push dword [ebp - 0x74]
call fcn.100063af
or word [ebp - 0x50], 0xef1
and dword [ebp - 0x8c], edx
push dword [ebp - 0x80]
call fcn.100063af
test dword [ebp - 0x54], 0
je 0x1000b639
pop ecx
push edi
call fcn.1000807d
pop ecx
mov esi, eax
call fcn.1000a9a6
push esi
push 0x1000f150
mov ebx, eax
call dword [0x1000f0a0]
cmp eax, ebx
cmp dword [ebp - 0x5c], 0x10000002
jne 0x1000b66a
xor eax, eax
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
push dword [ebp + 0x1c]
xor ebx, ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
call fcn.1000ad22
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x1000b622
mov edx, dword [ebp - 0x68]
and ebx, dword [ebp - 0x50]
and dword [ebp - 0x88], ebx
mov edi, dword [ebp - 0x7c]
xor ecx, edi
mov edx, dword [edi + 8]
mov dword [ebp - 0x68], edx
or edx, dword [ebp - 0x8c]
and dword [ebp - 0x48], 0xa66
lea edx, [ebp - 0x80]
cmp dword [ebp - 0x5c], 0x10000002
jne 0x1000b6bf
Function at 0x1000b69a
Capabilities:
Encrypt data using speck

Disassembly:
mov edi, 0x1000f2d8
shr edi, cl
or dword [ebx + 4], edi
mov ecx, dword [ebp - 4]
lea edi, [eax + ecx*4 + 0xc4]
lea ecx, [esi - 0x20]
mov esi, 0x1000fc07
shr esi, cl
or dword [edi], esi
mov ecx, dword [ebp - 8]
test ecx, ecx
push edx
add ecx, dword [ebp - 0x88]
sub ecx, edi
push dword [ebp - 0x80]
xor edx, dword [ebp - 0x48]
add ecx, dword [ebp - 0x88]
call fcn.10006659
add word [ebp - 0x8c], 0x43f
mov dword [ebp - 0x74], 4

Function at 0x1000b8d9
Capabilities:
Encode data using base64
Encrypt data using speck
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
sub dword [ebp - 0x4c], 4
mov ecx, dword [ebp - 0x4c]
pop dword [ecx]
push dword [ebp - 0x7c]
call fcn.100063af
cmp dword [ebp - 0x5c], 1
je 0x1000b920
lea eax, [ecx - 4]
mov ecx, dword [esp + 4]
sub eax, ecx
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.10006906
movzx eax, byte [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dl, byte [ebp + 0x14]
test byte [ecx + eax + 0x1d], dl
jne fcn.1000b92f
cmp dword [ebp + 0x10], 0
lea esi, [ebp - 0x7c]
xor edi, edx
push esi
cmp dword [ebp - 0x54], 0x10000002
jne 0x1000b964
Function at 0x425730
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4aac3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0049cf42
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4257b2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0049a46d
mov eax, dword [eax]
push 0xa4c260
push eax
call fcn.0048c524
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0049d1cd
test bl, bl
je 0x4257b2
push 0xa4c260
lea ecx, [esp + 0xc]
call fcn.0049d5a9
push 0xa4fdf4
lea ecx, [esp + 0xc]
call fcn.0049d5a9
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4257ee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0049d1cd
jmp 0x4258b9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x425872
lea edx, [esp + 0x7c]
push 0xa4fdf0
push edx
call fcn.0048c524
add esp, 8
test eax, eax
je 0x425872
lea eax, [esp + 0x7c]
push 0xa4fdec
push eax
call fcn.0048c524
add esp, 8
test eax, eax
je 0x425872
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425802
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0049d1cd
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4260d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x426132
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc