joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c6de8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
call fcn.100c7e69
mov esi, eax
test esi, esi
je 0x100c6e66
lea eax, [esp + 0x14]
mov dword [esp + 0x15], 0x74707972
push eax
push esi
mov dword [esp + 0x28], 0x6d617261
mov dword [esp + 0x22], 0x654b7465
mov byte [esp + 0x1c], 0x43
mov byte [esp + 0x2c], bl
mov word [esp + 0x26], 0x5079
mov byte [esp + 0x21], 0x47
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c6e5f
push ebx
push dword [esp + 0x14]
push ebp
push 8
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003d588
add esp, 0x1c
ret

Function at 0x100c6e7b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x10], eax
mov ebp, ecx
xor ebx, ebx
call fcn.100c7e69
mov esi, eax
test esi, esi
je 0x100c6efc
lea eax, [esp + 0x14]
mov dword [esp + 0x1a], 0x654b7465
push eax
push esi
mov word [esp + 0x1c], 0x7243
mov word [esp + 0x1f], 0x7470
mov word [esp + 0x26], 0x5079
mov dword [esp + 0x29], 0x6d6172
mov byte [esp + 0x28], 0x61
mov byte [esp + 0x21], 0x53
mov byte [esp + 0x1e], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c6ef5
push ebx
push dword [esp + 0x14]
push edi
push ebp
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003d588
add esp, 0x1c
ret

Function at 0x100c6f11
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x10], eax
mov edi, ecx
xor ebx, ebx
call fcn.100c7e69
mov esi, eax
test esi, esi
je 0x100c6f95
lea eax, [esp + 0x14]
mov word [esp + 0x15], 0x7972
push eax
push esi
mov word [esp + 0x20], 0x4974
mov dword [esp + 0x25], 0x654b7472
mov word [esp + 0x23], 0x6f70
mov byte [esp + 0x22], 0x6d
mov byte [esp + 0x1f], 0x70
mov byte [esp + 0x1c], 0x43
mov word [esp + 0x29], 0x79
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c6f8e
push dword [esp + 0x10]
push 1
push ebx
push 0x2c
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003d588
add esp, 0x18
ret
Function at 0x100c6faa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.100c7e69
mov esi, eax
test esi, esi
je 0x100c702f
lea eax, [ebp - 0x1c]
mov word [ebp - 0x15], 0x7571
push eax
push esi
mov word [ebp - 0x12], 0x6572
mov word [ebp - 0xf], 0x6e6f
mov dword [ebp - 0x1c], 0x70797243
mov byte [ebp - 0x10], 0x43
mov word [ebp - 9], 0x41
mov word [ebp - 0xc], 0x7865
mov word [ebp - 0x17], 0x6341
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0x18], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7028
push 0xf0000000
push 0x18
push ebx
push ebx
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c7042
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov edi, ecx
xor ebx, ebx
call fcn.100c7e25
mov esi, eax
test esi, esi
je 0x100c70c4
lea eax, [esp + 0x10]
mov dword [esp + 0x1a], 0x6e6f6973
push eax
push esi
mov dword [esp + 0x18], 0x46746547
mov dword [esp + 0x2c], 0x41657a
mov dword [esp + 0x27], 0x536f666e
mov word [esp + 0x1c], 0x6c69
mov word [esp + 0x1f], 0x6556
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x26], 0x49
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x1e], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c70bd
push ebp
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003d588
add esp, 0x1c
ret

Function at 0x100c70d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x10], eax
mov ebp, ecx
xor ebx, ebx
call fcn.100c7e25
mov esi, eax
test esi, esi
je 0x100c7169
lea eax, [esp + 0x14]
mov word [esp + 0x23], 0x666e
push eax
push esi
mov word [esp + 0x1c], 0x6547
mov dword [esp + 0x1f], 0x656c6946
mov word [esp + 0x2e], 0x41
mov word [esp + 0x29], 0x496e
mov dword [esp + 0x24], 0x69737265
mov byte [esp + 0x1e], 0x74
mov byte [esp + 0x28], 0x6f
mov byte [esp + 0x23], 0x56
mov byte [esp + 0x2d], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7162
push dword [esp + 0x10]
push dword [esp + 0x34]
push edi
push ebp
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x28]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003d588
add esp, 0x1c
ret
Function at 0x100c717e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
call fcn.100c7e25
mov esi, eax
test esi, esi
je 0x100c71f4
lea eax, [esp + 0x14]
mov dword [esp + 0x1e], 0x4165756c
push eax
push esi
mov dword [esp + 0x1e], 0x65755172
mov dword [esp + 0x22], 0x61567972
mov byte [esp + 0x2a], bl
mov word [esp + 0x1c], 0x6556
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c71ed
push dword [esp + 0x10]
push ebp
push 0x100ddd58
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x24]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003d588
add esp, 0x18
ret

Function at 0x100c7209
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xe], 0x416c6163
push eax
mov esi, edx
mov word [ebp - 0xa], 0x6c6c
xor ebx, ebx
mov word [ebp - 0x10], 0x6f4c
mov word [ebp - 7], 0x63
mov byte [ebp - 8], 0x6f
call fcn.100c7eb1
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7256
push esi
push ebx
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c7523
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.100c7ef2
mov esi, eax
test esi, esi
je 0x100c75a0
lea eax, [ebp - 0x20]
mov dword [ebp - 0xd], 0x49737365
push eax
push esi
mov word [ebp - 9], 0x64
mov dword [ebp - 0x13], 0x72506461
mov word [ebp - 0x1c], 0x6e69
mov word [ebp - 0x1f], 0x7465
mov byte [ebp - 0x20], 0x47
mov dword [ebp - 0x17], 0x65726854
mov word [ebp - 0x1a], 0x6f64
mov word [ebp - 0xf], 0x636f
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x1d], 0x57
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7599
push ebx
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100c7615
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100c7ef2
mov esi, eax
test esi, esi
je 0x100c767c
lea eax, [ebp - 0x18]
mov word [ebp - 0xb], 0x6957
push eax
push esi
mov dword [ebp - 9], 0x776f646e
mov dword [ebp - 0x10], 0x6e756f72
mov dword [ebp - 0x16], 0x726f4674
mov word [ebp - 0x18], 0x6547
mov byte [ebp - 5], bl
mov word [ebp - 0x12], 0x6765
mov byte [ebp - 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7675
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c7824
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xd], 0x6f6c4364
xor ebx, ebx
mov word [ebp - 9], 0x6573
push eax
mov esi, ecx
mov byte [ebp - 7], bl
mov word [ebp - 0xf], 0x6e69
mov byte [ebp - 0x10], 0x46
call fcn.100c7eb1
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c786d
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c787f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0xd], 0x6c694674
xor ebx, ebx
mov dword [ebp - 0x13], 0x4e646e69
push eax
mov edi, edx
mov byte [ebp - 0x14], 0x46
mov esi, ecx
mov word [ebp - 9], 0x4165
mov word [ebp - 0xf], 0x7865
mov byte [ebp - 7], bl
call fcn.100c7eb1
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c78d3
push edi
push esi
call eax
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c78e6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x73726946
push eax
mov ebx, edx
mov word [ebp - 0x13], 0x6e69
mov edi, ecx
mov word [ebp - 0xb], 0x6946
or esi, 0xffffffff
mov word [ebp - 8], 0x4165
mov byte [ebp - 9], 0x6c
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x14], 0x46
mov byte [ebp - 6], 0
call fcn.100c7eb1
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7947
push ebx
push edi
call eax
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100c795a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
mov edi, 0x80004005
mov word [ebp - 7], 0x6c6c
mov dword [ebp - 0xc], 0x2e32336c
mov dword [ebp - 0x10], 0x6c656853
mov byte [ebp - 5], 0
mov byte [ebp - 8], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x100c79ea
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 0x41687461
push eax
push esi
mov dword [ebp - 0x1f], 0x646c6f46
mov word [ebp - 0x1a], 0x5072
mov dword [ebp - 0x24], 0x65474853
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c79e3
push ebx
xor ecx, ecx
push ecx
push ecx
push 0x1a
push ecx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c79fd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call fcn.100c7ef2
mov esi, eax
test esi, esi
je 0x100c7a62
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0x776f64
push eax
push esi
mov dword [ebp - 0x16], 0x726f4674
mov dword [ebp - 0x12], 0x6f726765
mov dword [ebp - 0xc], 0x6e695764
mov word [ebp - 0xe], 0x6e75
mov word [ebp - 0x18], 0x6553
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7a5b
push edi
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c7a75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100c7ef2
mov esi, eax
test esi, esi
je 0x100c7af5
lea eax, [ebp - 0x20]
mov word [ebp - 0x14], 0x7267
push eax
push esi
mov dword [ebp - 0x11], 0x57646e75
mov word [ebp - 0xd], 0x6e69
mov dword [ebp - 0x18], 0x65726f46
mov word [ebp - 0xa], 0x776f
mov word [ebp - 0x1a], 0x7465
mov word [ebp - 0x1d], 0x776f
mov word [ebp - 0x20], 0x6c41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 8], bl
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x1b], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7aee
push 0xffffffffffffffff
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100c7b07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.100c7ef2
mov esi, eax
test esi, esi
je 0x100c7b7a
lea eax, [ebp - 0x1c]
mov word [ebp - 6], 0x77
push eax
push esi
mov dword [ebp - 0x14], 0x6765726f
mov dword [ebp - 0xf], 0x646e756f
mov dword [ebp - 0xb], 0x646e6957
mov byte [ebp - 7], 0x6f
mov word [ebp - 0x17], 0x7465
mov dword [ebp - 0x1c], 0x6b636f4c
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x18], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c7b73
push 2
call eax
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c7d91
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x7061
push eax
mov word [ebp - 7], 0x6c6c
mov word [ebp - 0xf], 0x6c68
mov word [ebp - 0xa], 0x2e69
mov byte [ebp - 5], 0
mov byte [ebp - 8], 0x64
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xd], 0x77
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c7e25
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69737265
push eax
mov dword [ebp - 0xa], 0x6c642e6e
mov word [ebp - 6], 0x6c
mov byte [ebp - 0x10], 0x56
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c7e69
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x6c6c642e
push eax
mov word [ebp - 0x14], 0x6441
mov dword [ebp - 0x11], 0x33697061
mov byte [ebp - 8], 0
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret

Function at 0x100c7eb1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x6c6c642e
push eax
mov dword [ebp - 0x14], 0x6e72654b
mov dword [ebp - 0x10], 0x32336c65
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d588
mov esp, ebp
pop ebp
ret
Function at 0x100c8007
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x14
mov eax, dword [0x100e7260]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, ecx
push esi
push edi
xor edi, edi
mov esi, edx
mov al, byte [ebx]
test al, al
je 0x100c810f
push ebp
cmp al, 0x24
je 0x100c8062
cmp al, 0x26
je 0x100c8062
cmp al, 0x2b
je 0x100c8062
cmp al, 0x2c
je 0x100c8062
cmp al, 0x2f
je 0x100c8062
cmp al, 0x3a
je 0x100c8062
cmp al, 0x3b
je 0x100c8062
cmp al, 0x3d
je 0x100c8062
cmp al, 0x3f
je 0x100c8062
cmp al, 0x40
je 0x100c8062
cmp al, 0x23
je 0x100c8062
cmp al, 0x20
je 0x100c8062
mov byte [esi], al
inc esi
inc edi
jmp 0x100c80fb
movsx eax, al
push eax
lea eax, [esp + 0x1c]
mov word [esp + 0x1e], 0x3025
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x20]
mov word [esp + 0x29], 0x78
push 4
push eax
mov word [esp + 0x2c], 0x2525
mov byte [esp + 0x30], 0x32
call fcn.1003c238
lea ecx, [esp + 0x28]
add esp, 0x14
xor ebp, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100c809f
sub ecx, edx
je 0x100c80cf
movsx eax, byte [esp + ebp + 0x14]
push eax
call fcn.10042033
pop ecx
lea ecx, [esp + 0x14]
mov byte [esp + ebp + 0x14], al
inc ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100c80c2
sub ecx, edx
cmp ebp, ecx
jb 0x100c80aa
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push eax
mov eax, 0x800
sub eax, edi
push eax
push esi
call fcn.1004205f
lea ecx, [esp + 0x24]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100c80ee
sub ecx, edx
add esi, ecx
add edi, ecx
inc ebx
cmp edi, 0x7ff
jae 0x100c810e
mov al, byte [ebx]
test al, al
jne 0x100c8029
pop ebp
mov ecx, dword [esp + 0x1c]
pop edi
mov byte [esi], 0
pop esi
pop ebx
xor ecx, esp
call fcn.1003d588
add esp, 0x14
ret
Function at 0x100c8a4c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
sub esp, 0x418
lea ebp, [esp - 4]
mov eax, dword [0x100e7260]
xor eax, ebp
mov dword [ebp + 0x418], eax
push 0x48
mov eax, 0x100cea95
call fcn.1004361d
mov ebx, ecx
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
push 0x10
pop edi
mov dword [ebp - 4], eax
mov esi, edi
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
call fcn.100033e4
push 0
pop eax
dec esi
jne 0x100c8a8d
mov esi, dword [ebp + 0x424]
jmp 0x100c8aba
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0x1c]
lea eax, [ebp - 0xd]
push eax
call fcn.1000345d
inc esi
mov al, byte [esi]
test al, al
jne 0x100c8aaa
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push eax
lea ecx, [ebp - 0x1c]
call fcn.100033e4
dec edi
jne 0x100c8ac0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
push dword [ebp - 0x18]
cdq
and edx, 0xf
add eax, edx
and eax, 0xfffffff0
add eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.100034ab
xor ecx, ecx
mov dword [ebp - 0x23], 0x44454445
xor eax, eax
mov dword [ebp - 0x29], 0x46314238
lea edi, [ebp - 0x48]
mov dword [ebp - 0x2e], 0x44424433
stosd dword es:[edi], eax
mov dword [ebp - 0x32], 0x39313537
mov dword [ebp - 0x3b], 0x33463746
mov dword [ebp - 0x37], 0x36434142
stosd dword es:[edi], eax
mov byte [ebp - 0x3c], 0x33
mov word [ebp - 0x25], 0x3134
mov byte [ebp - 0x2a], 0x32
stosd dword es:[edi], eax
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x33], 0x36
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 1
mov esi, ecx
mov al, byte [ebp + esi - 0x3c]
lea ecx, [ebp - 0x48]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push eax
call fcn.1000345d
inc esi
cmp esi, 0x1d
jl 0x100c8b4d
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x4c], 0x400
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x48]
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x1c]
call fcn.100c8148
push dword [ebp - 0x4c]
lea edx, [ebp + 0x18]
lea ecx, [ebp]
call fcn.100c879e
pop ecx
lea eax, [ebp]
mov byte [ebp - 4], 2
cmp ebx, eax
je 0x100c8bc0
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.1000295d
push 0
push 1
lea ecx, [ebp]
call fcn.10002868
lea ecx, [ebp - 0x48]
call fcn.1000369b
lea ecx, [ebp - 0x1c]
call fcn.1000369b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x418]
xor ecx, ebp
call fcn.1003d588
lea esp, [ebp + 0x41c]
pop ebp
ret 4