joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ba778
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100ba815
push ebx
push esi
call fcn.100ba741
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100ba6d5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100ba7c2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100ba814
push edi
push eax
call fcn.100b5d37
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100ba7e2
call fcn.100b5d85
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100ba813
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100ba6d5
add esp, 0x20
test eax, eax
jne 0x100ba801
push edi
call fcn.100b5d85
jmp 0x100ba809
push ebx
call fcn.100b5d85
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100c0b60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100c0b8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100c0b8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1014b059
Capabilities:
Execute anti-debugging instructions

Disassembly:
sal ax, 0x2c
mov dword [esi + eax - 0xffc], edx
jb 0x1015eb73
lea esi, [esi + eax - 0xffc]
rol ecx, cl
mov eax, dword [ebp + eax - 0x1006]
shl cx, cl
lea ebp, [ebp + ecx - 0xe]
xor eax, ebx
mov dword [esp + ecx - 8], ecx
shl word [esp + ecx*2 - 0x10], 0xc2
inc eax
bt ecx, ecx
dec dword [esp + ecx*2 - 0x10]
movsx edx, cx
bswap eax
sal ecx, cl
rol ecx, 0x61
rol eax, 3
neg word [esp + ecx - 0xfff]
adc eax, 0xf13e8a95
xadd ecx, edx
adc edx, 0x9da18985
and ecx, ecx
xor ebx, eax
sar dword [esp + ecx*2 - 0x2010], cl
adc edi, eax
mov eax, 0xa42f42b8
add dword [esp + ecx*4 - 0x4020], edi
ret

Function at 0x101504df
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
shl si, 0xc5
shr esi, 0xb4
push edx
mov esi, dword [esp + esi*8 + 8]
mov dword [esp + 8], 0xa569b391
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10063354
sub ebp, 4
push 0x422df389
mov eax, 0x44beb121
mov ecx, dword [ebp + eax - 0x44beb121]
push eax
dec al
xor ecx, ebx
rol ecx, 2
xor eax, 0x2b0070a1
mov edx, 0xfc3a0e9e
not ecx
cwde
xor eax, edx
xchg byte [esp + eax*8 - 0x1e2e78f1], dh
sbb ecx, 0xf6b0061f
cwd
xor ecx, 0x7215c92b
shr dl, 0xc7
jbe 0x10198637
pushfd
push edi
call fcn.101974f9
movaps xmmword [ebp - 0x3150], xmm0
push esi
pushfd
mov esi, 0x34aba300
shr esi, 0x91
jns 0x1004cc16
neg ecx
cdq
add dl, dl
mov dword [esp + eax*2 - 0x78b9e3a], 0xce0c129a
xor ebx, ecx
xadd dword [esp + eax*2 - 0x78b9e3c], edx
or eax, 0x29b6a4b1
rol dword [esp + eax - 0x2bf7efbd], 0xa1
adc edi, ecx
ror edx, 0xe5
call fcn.1017abad
Function at 0x10157e69
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov dword [esp + 0xc], 0xbb33b2b1
lea esp, [esp + 0xc]
call fcn.10063354

Function at 0x1015f578
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.10063354
call fcn.101dd1f7
push ecx
pushfd
mov ecx, 0x5e9d9201
push 0x7c15d2bb
not byte [esp + ecx - 0x5e9d9201]
and ecx, 0x680ad8ab
mov dword [esp + 0xc], 0x9a83b111
mov ecx, dword [esp + ecx - 0x48088ff9]
or dword [esp], 0x880369bf
setl byte [esp]
xor dword [esp], 0x3ba11985
or byte [esp], 0x3b
xor dword [esp], 0x8a07a019
jno 0x1015f56a

Function at 0x101629aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
add esi, 0xef0c073a
mov esi, dword [esp + esi*4 - 0x5ab1e9d4]
mov dword [esp + 8], 0x25e8b131
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.10063354

Function at 0x10165644
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0xe0923d16
not edx
add ecx, eax
jmp 0x1016836b
call fcn.101680f2
mov ecx, dword [esi]
mov eax, dword [esi + 4]
jmp 0x10164f7a
movsx eax, dl
mov dword [edx + esi - 0x1f6dc2e5], ecx
mov edx, dword [ebp + edx*4 - 0x7db70ba8]
shr al, 0x24
sbb ebp, 3
call fcn.101ad57a

Function at 0x10168627
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0x6721da26
pushfd
pop dword [esp]
push eax
call fcn.1004b855
movaps xmm1, xmmword [esp + 0x30]
jmp 0x101f3318
mov dword [esp + 0x858], eax
cmovp eax, ebp
lahf
mov ax, 0x6e2c
mov dword [esp + 0x85c], ecx
not eax
nop
cwde
xorps xmm1, xmmword [esp + 0x850]
setp al
movsx eax, dx
not eax
movaps xmmword [esp + 0x30], xmm1
movsx eax, cx
mov eax, 0x2b11312
lahf
lea eax, [esp + 0x10]
jmp loc.10027a7e

Function at 0x10169209
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
shl ecx, cl
mov dword [esp + 0x10], 0x6e39b1b1
mov ecx, dword [esp + 8]
jne 0x1017c88c
call fcn.101c426e
Function at 0x1016b808
Capabilities:
Execute anti-debugging instructions

Disassembly:
movaps xmm0, xmmword [ebp - 0x8850]
shr cl, 0xe
movaps xmmword [ebp - 0xfd00], xmm0
setnp dh
mov eax, dword [ebp - 0x92a0]
rcl ecx, cl
stc
movups xmm0, xmmword [eax + 0xa0]
shr ecx, 0x2a
rcl dx, cl
inc cx
movaps xmmword [ebp - 0xfcf0], xmm0
movaps xmm0, xmmword [ebp - 0xfcf0]
cmovl dx, bx
xorps xmm0, xmmword [ebp - 0xfd00]
mov dx, 0xc8b4
sar edx, 0x19
movaps xmmword [ebp - 0xfd10], xmm0
cmove cx, cx
cmp esi, ecx
movaps xmm0, xmmword [ebp - 0xfd10]
mov ch, ah
mov ecx, dword [ebp - 0x92a0]
add dh, dh
mov dl, 0x3e
add ecx, 0xa0
movups xmmword [ecx], xmm0
mov edx, 1
test dh, bl
test ecx, 0x423bb922
test edx, edx
jmp 0x10044f7e
push edx
call fcn.1017cfad
push ebx
pushfd
mov ebx, 0x1014ddbb
push edx
bswap ebx
neg ebx
and bl, bl
mov edx, 0xf732d531
mov ebx, dword [esp + edx*2 + 0x119a55a6]
mov dword [esp + 8], 0xb865b0d1
mov edx, dword [esp + edx + 0x8cd2acf]
js 0x10247a22
push edx
pushfd
mov edx, 0xc308938a
not dl
push ebp
mov ebp, 0x2b1ed9bb
shr bp, 0xe7
neg bp
mov edx, dword [esp + edx*2 + 0x79eed91e]
mov dword [esp + 8], 0xe8b6b031
mov ebp, dword [esp + ebp*2 - 0x563dfc9a]
call fcn.101b813f
movaps xmm0, xmmword [ebp - 0x8860]
cmp si, bx
movaps xmmword [ebp - 0xfcd0], xmm0
shr ah, cl
mov eax, dword [ebp - 0x92a0]
sbb cx, 0xf417
shr dh, cl
movups xmm0, xmmword [eax + 0x90]
movaps xmmword [ebp - 0xfcc0], xmm0
ror dx, cl
shld cx, dx, 0x9b
mov dx, 0x816
movaps xmm0, xmmword [ebp - 0xfcc0]
or dx, sp
xorps xmm0, xmmword [ebp - 0xfcd0]
bts cx, sp
test ebp, esp
movaps xmmword [ebp - 0xfce0], xmm0
dec ch
btc dx, dx
movaps xmm0, xmmword [ebp - 0xfce0]
ror edx, 4
sar dx, 0xb1
mov ecx, dword [ebp - 0x92a0]
add ecx, 0x90
cdq
movups xmmword [ecx], xmm0
shr edx, cl
mov edx, 1
test cl, 0xb9
test edx, edx
jmp 0x10181fa5
je 0x1015405b
jmp 0x101540d1
call fcn.1019a444
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10063354
mov ecx, 0xb237cb83
xor cl, cl
mov eax, dword [esi]
not cx
adc ecx, ecx
not cl
movzx ecx, byte [ebp + ecx - 0x646e6902]
xor cl, bl
mov edx, 0x63b0ea1a
add dx, 0xc606
not cl
add dl, dh
ror cl, 1
lea edx, [edx + 0x493f848c]
btc dx, dx
inc cl
not cl
ror edx, 0xf8
btc edx, edx
inc dl
neg cl
ror dl, 0xc3
xor bl, cl
inc dx
add ecx, esp
mov dword [ecx], eax
jmp 0x101d097d

Function at 0x1017abad
Capabilities:
Execute anti-debugging instructions

Disassembly:
sar dword [esp + eax - 0x2bf7efb9], 0x67
lea ebp, [ebp + eax*2 - 0x57efdf7f]
shr dx, 0x44
mov dword [esp + eax*2 - 0x57efdf7e], edx
cwde
movzx ecx, byte [ebp]
xor cl, bl
lea eax, [edx*8 - 0x1fd29c5c]
xadd dword [esp + eax - 0x64cdccad], edx
adc eax, 0x3dabaaa7
dec cl
jmp fcn.1004dad1

Function at 0x1017cfad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, 0xa8bab193
bswap edx
pushfd
sub edx, 0xb12f5e10
mov dword [esp + 0xc], 0x92e9b1b1
mov edx, dword [esp + edx*2 + 0x3afb46d8]
add dword [esp + 4], 0xefe947f2
call fcn.102038ab
Function at 0x101842ce
Capabilities:
Check http status code
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
movaps xmm0, xmmword [ebp - 0xbd50]
xorps xmm0, xmmword [ebp - 0xbd60]
not eax
jmp 0x10164f88
movaps xmm0, xmmword [ebp - 0x67a0]
movaps xmmword [ebp - 0xbd60], xmm0
shr ecx, cl
mov ecx, dword [ebp - 0x6dac]
movups xmm0, xmmword [ecx + 0x50]
movaps xmmword [ebp - 0xbd50], xmm0
shr ah, cl
sbb ah, 0x84
jmp 0x1002ba30
mov eax, 1
cmp di, 0xebad
clc
jmp 0x10197293
push ebp
pushfd
mov ebp, 0x8a81d12f
movsx ebp, bp
call fcn.1006f88b
je 0x101bfa23
jmp 0x101bfa90
test eax, eax
jmp 0x10162b4c
movaps xmm0, xmmword [ebp - 0x67b0]
movaps xmmword [ebp - 0xbd30], xmm0
mov ecx, dword [ebp - 0x6dac]
cdq
shl dh, cl
movups xmm0, xmmword [ecx + 0x40]
clc
setne dl
movaps xmmword [ebp - 0xbd20], xmm0
movaps xmm0, xmmword [ebp - 0xbd20]
cmc
xor dh, 0x1f
xorps xmm0, xmmword [ebp - 0xbd30]
cbw
bts eax, ebx
movzx eax, sp
movaps xmmword [ebp - 0xbd40], xmm0
movaps xmm0, xmmword [ebp - 0xbd40]
rol eax, 0x3b
cmp cl, ch
mov edx, dword [ebp - 0x6dac]
or ax, di
rol ax, cl
add edx, 0x40
mov ax, bx
mov eax, 0x57ae283d
movups xmmword [edx], xmm0
mov eax, 1
test eax, eax
jmp 0x1023dd9c
je 0x1009fdc3
jmp 0x10164fbd

Function at 0x1018b406
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
retf
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.10063354
movsb byte es:[edi], byte [esi]
pop edx
loopne 0x1002ce0d
scasb al, byte es:[edi]
mov ebx, 0x667f292b
outsb dx, byte [esi]
adc esi, dword [edx - 0x42fd80ab]
and esi, 0x2f
mov dword [eax - 0x20], eax
adc eax, 0xaf093c7e
retf
jg 0x1002ce6f
xchg ebp, eax
xchg ebx, eax
xlatb
sal bh, 1
pop edx
inc ebp
lahf
invalid

Function at 0x101909a0
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
not dword [esp + 8]
mov dword [esp + 8], 0x68abb491
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10063354
movaps xmm1, xmmword [esp + 0x140]
jmp 0x101c595d
movaps xmmword [esp + 0x140], xmm1
jmp 0x1018697a
xorps xmm1, xmmword [esp + 0x200]
jmp 0x1019b2ba

Function at 0x10196110
Capabilities:
Execute anti-debugging instructions

Disassembly:
and cl, ch
mov ecx, dword [esp + 8]
mov dword [esp + 8], 0xb043b0f1
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10063354
xchg ecx, ecx

Function at 0x10199dbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
add dword [esp + 4], 0xeff634dd
push ecx
call fcn.10041734
Function at 0x1019e78b
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
movaps xmm0, xmmword [ebp - 0xca10]
sar al, 0x3a
movaps xmmword [ebp - 0x170f0], xmm0
sub ecx, edx
bt ax, 0x16
mov eax, dword [ebp - 0xde38]
btr ecx, edi
movups xmm0, xmmword [eax + 0x2a0]
bt ecx, 0x39
movaps xmmword [ebp - 0x170e0], xmm0
movaps xmm0, xmmword [ebp - 0x170e0]
movsx cx, bl
cmp di, 0x9999
xorps xmm0, xmmword [ebp - 0x170f0]
bsf cx, cx
sar ecx, cl
sbb cl, 0x3f
movaps xmmword [ebp - 0x17100], xmm0
movaps xmm0, xmmword [ebp - 0x17100]
sub cx, ax
mov ecx, dword [ebp - 0xde38]
cmp esp, ecx
lea ecx, [ecx + 0x2a0]
cmp bh, 0x90
cmc
movups xmmword [ecx], xmm0
sub edx, edx
jmp loc.101808ae
xor ebx, edx
bts ecx, eax
neg eax
dec cx
adc edi, edx
sub al, ch
sbb al, al
pop ecx
jns fcn.10017b2c
mov eax, dword [ebp]
mov edx, ecx
xor eax, ebx
xadd edx, ecx
neg eax
xor eax, 0x6bb1123b
xor ecx, 0x8bbb9b
lea eax, [edx + eax - 0x5f0cbe79]
sub ecx, ecx
call fcn.101f3359
movaps xmm0, xmmword [ebp - 0xca20]
ror cx, cl
shr ch, cl
movaps xmmword [ebp - 0x170c0], xmm0
bts eax, ecx
or ax, si
mov eax, dword [ebp - 0xde38]
xor cx, bp
movups xmm0, xmmword [eax + 0x290]
movaps xmmword [ebp - 0x170b0], xmm0
movaps xmm0, xmmword [ebp - 0x170b0]
xor cx, 0x52ba
xorps xmm0, xmmword [ebp - 0x170c0]
add cx, bp
and cx, bp
movaps xmmword [ebp - 0x170d0], xmm0
movaps xmm0, xmmword [ebp - 0x170d0]
bt cx, 0x3b
rcl ecx, cl
mov ecx, dword [ebp - 0xde38]
add ecx, 0x290
movups xmmword [ecx], xmm0
cmp esp, ebx
stc
test bh, 0xe
sub edx, edx
jmp 0x101cd805
je 0x1001f001
jmp 0x1001f07a
Function at 0x1019ea04
Capabilities:
Encode data using base64

Disassembly:
ja 0x101d4ee6
mov ebx, dword [ebp - 0x18]
nop word [eax + eax]
xchg cl, ah
bswap eax
lea eax, [edi + 0x10113c88]
movzx ecx, sp
xchg ecx, ecx
mov ecx, esi
jmp 0x101c2b5f
jmp 0x102457be
rol edi, 0xa1
mov dword [esp + edi*2 - 0x28], edx
mov ebp, dword [esp + edi + 0xc]
rol di, 0xf
neg ebp
push ebx
sub dword [esp + edi*2 - 0x14], ebx
sbb ebp, 0xb5024b2d
bswap ebp
bswap edi
sal di, 0x8e
sub byte [esp + edi - 0xa000000], bh
rol ebp, 3
jmp 0x101cdd36
mov dword [esp + edi*8 - 0x2d4], esi
mov dword [esp + edi*8 - 0x2d0], eax
movzx ecx, bl
call fcn.1020ff56
movaps xmm0, xmmword [ebp - 0x2a20]
push ebp
pushfd
mov ebp, 0x6599e105
test ebp, ebp
push ecx
mov ecx, 0x72990c8d
call fcn.10159838
push eax
jmp 0x10204d13
lea edx, [edi + edi*4 - 0x5a7a5862]
pop edi
add ebp, ecx
xor dl, bh
jg 0x101b4e29
ror byte [esp + edx - 0x494dc23e], 0x63
mov eax, dword [edx + ebp - 0x494dc240]
movsx ecx, dl
xor eax, ebx
not eax
lea eax, [eax + edx*4 - 0x787c22d7]
shr ecx, 0xb2
xor byte [esp + ecx*8 + 3], dh
inc dword [esp + edx - 0x494dc240]
neg eax
not ecx
sub edx, ecx
bswap edx
lea eax, [eax + edx*4 - 0x7dfa9a8c]
xchg edx, ecx
neg edx
xor ebx, eax
add edi, eax
not dword [esp + edx - 1]
shl dx, cl
pop edx
jns fcn.10017b2c
movaps xmmword [ebp - 0x3140], xmm0
call fcn.101f33ba
test sp, 0x6784
cmp edi, ecx
jmp 0x1015de39
jbe 0x1015de4c
mov dword [ebp - 0x18], ebx
shr ah, 0xb8
btr bx, di
mov ebx, 0x40
neg eax
mov eax, dword [ebp - 0x18]
sub edx, edx
jmp 0x10176475
push eax
jmp 0x100294b5
call fcn.100594c0
mov ecx, dword [ebp - 0x1c]
cmp sp, si
lea edi, [edi + 0x40]
stc
lea ebx, [ebx + 0x40]
cmp edi, ecx
jmp 0x101d4ecf
sub ecx, eax
cmp ax, 0xa595
lea eax, [eax + 0x10113cc8]
push ecx
push eax
lea eax, [esi + 1]
add eax, edx
jmp 0x101e0233

Function at 0x101aab69
Capabilities:
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
sub eax, ecx
mov esp, eax
push edi
push esi
mov edi, 0xe722f2a9
bswap edi
movzx esi, di
pushfd
sub esi, 0x129d1580
jnp 0x101d415a
and esi, edi
mov esi, edx
mov edi, eax
cld
push 0xe0815d8c
rep movsb byte es:[edi], byte [esi]
push 0x113adda3
call fcn.101fae05
bts edx, esi
ror ecx, 0xa9
Function at 0x101ad57a
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
add al, ah
xor edx, ebx
inc al
push eax
not edx
movsx ecx, ax
inc cx
rol edx, 1
mov dword [esp + 4], 0x966e85
not edx
inc edx
neg edx
sub ecx, dword [esp + 4]
jl 0x101b7177
pushfd
push ebx
invalid
mov eax, dword [ebp - 0xac68]
add ecx, esi
mov ecx, dword [ebp - 0xac64]
rcr edx, cl
mov dword [ebp - 0x8af8], eax
bts eax, edi
or eax, 0xf1b8a625
mov dword [ebp - 0x8af4], ecx
cmp cx, bp
mov edx, 0xba9bd0d8
mov dword [ebp - 0xac70], 0x8950cd9f
neg ah
add eax, 0x20a672b5
jmp 0x1020bc02
and al, 0xc
jp 0x101b7118
or eax, 0xc2444c7
jno 0x101b711c
or dword [ebx - 0x73], 0x64
and al, 0xc
call fcn.10063354
setbe al
lea edx, [edx + ecx - 0x553a6350]
jnp 0x101e7db4
mov dword [esi - 0x35c8a7c2], edi
in eax, 0xb0
rcl dword [edx - 0x75], cl
or bh, byte [ebp + 0x2f52d3b0]
shr ch, cl
mov al, 0xd3
push edx
ja 0x101b720d
cmp dword [ebx - 0x78], 0xffffffb2
in eax, 0x37
cmc
or al, 0x60
mov edi, dword [edi + 0x1a5a65d2]
xchg ebx, eax
push ecx
daa
or eax, 0x6e313a5f
daa
jne 0x101b7160
add dh, byte [ecx]
outsb dx, byte [esi]
daa
pop es
mov ds, word [edx + 0x31]
outsb dx, byte [esi]
daa
inc ebp
cmp esp, 0xffffff9e
pop edi
dec ebx
mov byte [ebp - 0x1e3], 0x6e
jmp loc.10007413
xor edx, ebx
xor dword [esp + ecx*8], ecx
btc ax, ax
rol edx, 3
shl ecx, 0x14
not edx
dec ecx
cwde
adc edx, ecx
dec cl
ror edx, 2
xor ebx, edx
add edi, edx
sar eax, cl
mov edx, dword [esp + eax*8]
or edx, 0x3d1cf488
mov edx, dword [eax + ebp - 8]
inc byte [esp + eax*2 + 1]
add cl, byte [esp + eax + 3]
inc eax
xor edx, ebx
shr cx, 0x65
sub edx, eax
btc ax, 0x37
lea ecx, [eax + ecx*8 - 0x66548b63]
cwde
not edx
dec ecx
ror edx, 1
lea edx, [edx + ecx - 0xe7ec4d9]
not ecx
sal ecx, 0x24
bswap edx
sbb eax, dword [esp + eax*2 - 0x102]
xor ebx, edx
btc ecx, ecx
sal eax, cl
mov dword [ecx + esi - 0x65c4ae9d], edx
adc byte [esp + ecx - 0x65c4ae9e], 0x2d
movzx edx, byte [ecx + ebp - 0x65c4aeaa]
neg word [esp + ecx - 0x65c4aea1]
xadd ecx, eax
lea ebp, [ebp + eax - 0x65c4aeaa]
sar eax, cl
xor dl, bl
cbw
sub dword [esp + eax - 0xcb8ffd4], ecx
adc dl, 0xff
not dl
pop eax
xadd eax, ecx
ror dl, 1
rol cl, 0xa5
sar eax, cl
adc dl, 0xb6
btc ax, 0x3f
sar al, 0xc7
xor bl, dl
shr al, 2
sar cx, 0x61
shl ax, 0xad
adc edx, esp
xor al, al
mov ecx, dword [edx + eax*2 - 0xa0000]
mov dword [esi + eax - 0x50000], ecx
jmp edi
and cx, 0x62f
push eax
xor ebx, edx
add edi, edx
sub dword [esp + 8], ecx
mov eax, dword [esi + 4]
movzx dx, byte [eax]
rol cx, 0x44
and ecx, ecx
shr dword [esp + 6], 0x81
mov word [esi + 6], dx
sar ecx, 0x16
lea eax, [ecx + ecx*8 + 0x7189db90]
lea esi, [esi + eax - 0x7189db6f]
mov dword [esp + eax - 0x7189db75], edi
ret 8
mov dword [ebp - 0xac6c], edx
mov eax, dword [ebp - 0xac70]
mov ecx, dword [ebp - 0xac6c]
mov dx, dx
cdq
mov dword [ebp - 0xac78], eax
adc ah, 0xa8
jmp loc.100316f6

Function at 0x101b813f
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.10063354
Function at 0x101c426e
Capabilities:
Check for software breakpoints
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0x14]
call fcn.10063354
movaps xmm0, xmmword [ebp - 0xd3b0]
movsx dx, bh
movaps xmmword [ebp - 0x1bf70], xmm0
mov edx, dword [ebp - 0xde68]
sub al, al
bts ax, sp
shrd ax, ax, 0x1d
movups xmm0, xmmword [edx + 0x10]
movaps xmmword [ebp - 0x1bf60], xmm0
not ax
movaps xmm0, xmmword [ebp - 0x1bf60]
cmc
ror al, 0x93
xorps xmm0, xmmword [ebp - 0x1bf70]
movaps xmmword [ebp - 0x1bf80], xmm0
movaps xmm0, xmmword [ebp - 0x1bf80]
sub al, 0x3d
mov eax, dword [ebp - 0xde68]
add eax, 0x10
movups xmmword [eax], xmm0
test si, cx
stc
test bl, 0x34

Function at 0x101c47ce
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, 0x923b2c12
call fcn.1022eae5

Function at 0x101dd1f7
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
movaps xmm0, xmmword [ebp - 0xcbb0]
sal edx, 0xbe
movaps xmmword [ebp - 0x16490], xmm0
shrd cx, di, 0x95
mov edx, dword [ebp - 0xde40]
sub eax, eax
btc ax, 0xe
movups xmm0, xmmword [edx + 0x3a0]
bswap ax
cmc
movaps xmmword [ebp - 0x16480], xmm0
cmp esp, esi
shr al, 0xbc
sal ah, 0xa4
movaps xmm0, xmmword [ebp - 0x16480]
cmp ebp, 0x54a71691
xorps xmm0, xmmword [ebp - 0x16490]
sar ah, 0xbf
sar ax, cl
movaps xmmword [ebp - 0x164a0], xmm0
movaps xmm0, xmmword [ebp - 0x164a0]
mov eax, dword [ebp - 0xde40]
bsf ecx, esp
lea eax, [eax + 0x3a0]
bts cx, cx
movups xmmword [eax], xmm0
sbb cx, si
mov ecx, 1
jmp 0x10056696
push 0xccb641aa
pushfd
add dword [esp + 8], 0xefea0a83
call fcn.1000fb8d
je 0x10161e3f
jmp 0x10161ebd

Function at 0x101e0671
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.10063354

Function at 0x101f8de3
Capabilities:
Check for software breakpoints
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
mov dx, word [esi + eax - 0x2557e4d4]
mov dword [esp + eax - 0x2557e4d6], eax
xchg dword [esp + eax - 0x2557e4d6], eax
dec dword [esp + eax - 0x2557e4d6]
or cx, dx
and dword [esp + eax*2 - 0x4aafc9ac], eax
not cx
mov edx, dword [esp + eax - 0x2557e4d6]
mov word [esi + edx*2 - 0x4aafc9a6], cx
mov edx, dword [eax + ebp - 0x2557e4da]
movsx ecx, al
jno 0x10210f4b
xor edx, ebx
sal eax, 0x1f

Function at 0x10203e8b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
adc byte [esp + eax - 0x3532], ah
pop edx
pop edx
pop ecx
pop ecx
pop ecx
jp fcn.10017b2c
Function at 0x10219f3f
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using chaskey
Encrypt data using des
Encrypt data using speck
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
movzx edx, byte [ecx + ebp - 0xaa8ff1e]
xor dl, bl
cwde
push eax
and al, al
xor dl, 0x18
not dl
sub word [esp + ecx - 0xaa8ff13], 0x6920
dec dl
sal eax, 0x6e
sal eax, cl
inc byte [esp + ecx - 0xaa8ff1a]
not dl
jae 0x1018aad9
push edi
push 0x1001a9f0
jmp 0x100a4253
call eax
mov edx, dword [esp + 0x8c]
mov eax, dword [eax + 0x464]
jmp 0x10042f92
adc cl, 0x85
adc edx, 0xf13e8a94
or ecx, ecx
ror dword [esp + eax + 8], 0x49
sub ecx, dword [esp + eax + 7]
xor ebx, edx
sar byte [esp + eax*2 + 0xa], 1
add dword [esp + eax + 8], ecx
shr ecx, cl
add edi, edx
shl ax, 0xce
mov ecx, dword [esi + eax*4 - 6]
adc ax, word [ecx + eax]
jmp 0x100312e1
bts eax, 0xbb
add dword [esp + ecx*4 - 0x2aa3fc68], eax
dec dl
btc ax, ax
setae byte [esp + eax - 0x8000001]
xor bl, dl
lea eax, [ecx*8 + 0x2403dfb3]
xadd ax, cx
lea edx, [esp + edx + 0xc]
mov ecx, dword [edx + ecx*2 - 0x1551b126]
not word [esp + eax - 0x794bd7ad]
sbb al, al
xor dword [esp + eax - 0x794bd7f7], eax
mov dword [esi + eax - 0x794bd805], ecx
movzx edx, ax
mov edx, dword [eax + ebp - 0x794bd805]
adc byte [esp + eax - 0x794bd7ff], 0x3a
movzx ecx, ax
lea ebp, [ebp + eax - 0x794bd805]
xor edx, ebx
inc edx
sal cl, 0x61
shl eax, cl
bswap edx
or dword [esp + ecx - 0xd7fa], ecx
cwde
cwde
rol edx, 3
bts cx, 0x83
jb 0x1018a24b
jb 0x101eb5c9
mov bx, 0x9e2d
mov ebx, dword [esp + 4]
mov dword [esp + 4], 0xd066b4b1
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.10063354
not ch
jmp 0x101caa15
push ecx
not cl
push 0
mov cx, 0x770d
movsx cx, bh
mov ecx, dword [ebp - 0xca04]
jmp 0x102127b2
push ebx
mov ebx, 0xeb0ab1a7
pushfd
or ebx, 0xf012b602
sub ebx, ebx
je 0x1018ab5f
call fcn.1004d210
mov dword [ebp - 0x93a4], eax
jmp 0x1018e845
btr ecx, ecx
xor dl, 0x9a
add ecx, ecx
ror dl, 1
movsx eax, cx
sub cx, ax
sbb dl, 0x3b
or cx, 0xff1c
mov dword [esp + ecx - 0xaa8ff18], eax
shr word [esp + eax - 0x7129], 0xeb
xor bl, dl
mov dword [esp + ecx*2 - 0x1551fe38], ecx
add dword [esp + ecx - 0xaa8ff18], ecx
sub dword [esp + ecx*2 - 0x1551fe37], eax
mov word [esi + ecx - 0xaa8ff1e], dx
jae 0x10039736
call fcn.1004d270
mov edx, dword [ebp - 0x9380]
shl ah, cl
xor cl, 3
shl edx, 1
mov dword [ebp - 0x9380], edx
not cx
seto ah
mov eax, dword [0x101468c8]
mov cx, bx
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 4]
movsx ecx, dx
cmovs cx, di
movzx ecx, sp
mov dword [ebp - 0xca04], eax
push 4
movzx ecx, dx
mov cx, di
push 0x3000
movzx ecx, ax
xchg ecx, ecx
mov ecx, dword [ebp - 0x9380]
jmp 0x101c973d

Function at 0x1021c4a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esi + 0x118], 0
jmp loc.1004aafa
or bl, 0x13
and ebx, 0xbe9a018e
mov ebx, dword [esp + ebx*2 - 0x7803fff8]
mov dword [esp + 0xc], 0xec29b4d1
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.10063354
mov dword [esi + 0x110], 0
mov dword [esi + 0x114], 0
jmp 0x101ea2b1