joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e3c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040a3ac
push eax
push 0x2e
push 1
push str.Error_reading_global.env_environment_file_set.
call fcn.0040a641
push 0x42ef20
call fcn.00403a60
add esp, 0x18
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push 0x42ee50
push eax
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_append1_8
mov edi, dword [esp + 0x428]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.slink.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_append_8
push 0x42eea0
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41e47c
cwde
push 0x431612
sub eax, ebx
push eax
push 0x42ef24
call fcn.00403a60
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41e48f
cmp ax, bx
jge 0x41e48b
movsx esi, ax
jmp 0x41e491
mov esi, ebx
jmp 0x41e491
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a641
push 0x42ef28
call fcn.00403a60
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41e4e3
movsx eax, cx
push 0x431613
sub eax, 0x400
push eax
push 0x42ef2c
call fcn.00403a60
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41e4f6
cmp ax, bx
jge 0x41e4f2
movsx esi, ax
jmp 0x41e4f8
mov esi, ebx
jmp 0x41e4f8
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a641
push 0x42ef30
call fcn.00403a60
add esp, 0x18
call sym.slink.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 4
Function at 0x41eb40
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x418
push ebx
push esi
push edi
mov eax, 0x10
mov ebx, 0x400
push 1
mov word [esp + 0x10], ax
mov word [esp + 0x24], bx
call fcn.0040a3ac
push eax
push 0xe
push 1
push str.Error_reading
call fcn.0040a641
mov edi, dword [esp + 0x43c]
add esp, 0x14
movzx ecx, word [edi + 2]
mov eax, ecx
cmp cx, 0x20
jle 0x41eba6
movsx eax, cx
push 0x431672
sub eax, 0x20
push eax
push 0x42f168
call fcn.00403a60
movzx eax, word [edi + 2]
add esp, 0xc
test ax, ax
jle 0x41ebbd
cmp ax, 0x20
jge 0x41ebb6
movsx esi, ax
jmp 0x41ebbf
mov esi, 0x20
jmp 0x41ebbf
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
lea eax, [edi + 4]
push 1
push eax
call fcn.0040a641
push 1
call fcn.0040a3ac
push eax
push 0x22
push 1
push str..lan_language_descriptor_file_set.
call fcn.0040a641
push 0x42f190
call fcn.00403a60
add esp, 0x2c
xor eax, eax
mov word [esp + 0x22], ax
lea eax, [esp + 0x20]
push str.Error_on_line
push eax
call sym.slink.exe__string_appends_8
push 0x20
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_append1_8
mov edi, dword [esp + 0x42c]
lea eax, [esp + 0xc]
push dword [edi + 0x914]
push eax
call sym.slink.exe__string_f_int_8
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_append_8
push str._of_file
lea eax, [esp + 0x24]
push eax
call sym.slink.exe__string_appends_8
mov ax, word [esp + 0x22]
cmp ax, bx
jle 0x41ec75
cwde
push 0x431673
sub eax, 0x400
push eax
push 0x42f194
call fcn.00403a60
mov ax, word [esp + 0x2e]
add esp, 0xc
test ax, ax
jle 0x41ec88
cmp ax, bx
jge 0x41ec84
movsx esi, ax
jmp 0x41ec8a
mov esi, ebx
jmp 0x41ec8a
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
lea eax, [esp + 0x30]
push 1
push eax
call fcn.0040a641
push 0x42f198
call fcn.00403a60
movzx ecx, word [edi + 0x50e]
add esp, 0x18
mov eax, ecx
cmp cx, bx
jle 0x41ecdc
movsx eax, cx
push 0x431674
sub eax, 0x400
push eax
push 0x42f19c
call fcn.00403a60
movzx eax, word [edi + 0x50e]
add esp, 0xc
test ax, ax
jle 0x41ecef
cmp ax, bx
jge 0x41eceb
movsx esi, ax
jmp 0x41ecf1
mov esi, ebx
jmp 0x41ecf1
xor esi, esi
push 1
call fcn.0040a3ac
push eax
push esi
lea eax, [edi + 0x510]
push 1
push eax
call fcn.0040a641
push 0x42f1a0
call fcn.00403a60
add esp, 0x18
call sym.slink.exe__sys_bomb_0
pop edi
pop esi
pop ebx
add esp, 0x418
ret 8
Function at 0x1000b71e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
or esi, 0xffffffff
mov ebx, ecx
push edi
mov dword [esp + 0x18], esi
call fcn.1000afa6
cmp dword [ebx + 0x19c], 0
jne 0x1000b91e
cmp byte [ebx + 0x5c], 0
je 0x1000b91e
cmp byte [ebx + 0x54], 0
mov dword [ebx + 0x19c], 1
jne 0x1000b918
mov eax, dword [ebx + 0x78]
lea ecx, [ebx + 0x10]
cmp eax, dword [ebx + 0x70]
mov byte [esp + 0x20], 0
sete byte [esp + 0x17]
call fcn.10005bb7
and dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
test eax, eax
jle 0x1000b8fa
dec eax
mov dword [esp + 0x2c], eax
mov ecx, dword [ebx + 0x80]
mov eax, dword [ecx]
call dword [eax + 0x18]
imul ebp, dword [ebx + 0x70], 0x14
mov dword [esp + 0x28], eax
add ebp, dword [ebx + 0x60]
cmp dword [ebp], 0
jne 0x1000b7b1
push ecx
push ebp
push 0x440
jmp 0x1000b7e4
cmp dword [ebp], 3
jne 0x1000b7dd
movaps xmm0, xmmword [0x10115a40]
lea esi, [esp + 0x30]
mov eax, dword [ebp + 4]
and dword [esp + 0x50], 0
movups xmmword [esp + 0x30], xmm0
mov dword [esp + 0x54], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x40], xmm0
jmp 0x1000b7ef
push ecx
push ebp
push 0x840
lea ecx, [esp + 0x3c]
call fcn.1000913d
mov esi, eax
sub esp, 0x28
push 0xa
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.1000d3e1
imul eax, dword [ebx + 0x70], 0x14
add eax, dword [ebx + 0x60]
cmp dword [eax], 0
jne 0x1000b822
push dword [eax + 0xc]
lea ecx, [ebx + 0x10]
push dword [eax + 8]
push dword [eax + 4]
call fcn.100054d6
xor edi, edi
inc edi
jmp 0x1000b837
xor edi, edi
inc edi
cmp dword [eax], edi
jne 0x1000b837
push dword [eax + 0xc]
lea ecx, [ebx + 0x10]
push dword [eax + 4]
call fcn.10005875
inc dword [ebx + 0x70]
mov eax, dword [ebp]
cmp eax, 3
je 0x1000b858
push dword [ebp + 4]
mov ecx, ebx
call fcn.1000af91
mov ecx, dword [ebp + 4]
mov eax, dword [ebp]
mov dword [esp + 0x18], ecx
jmp 0x1000b85c
mov ecx, dword [esp + 0x18]
push 0x40
pop esi
test eax, eax
jne 0x1000b86f
add ecx, dword [ebp + 0xc]
push 0x41
mov dword [esp + 0x1c], ecx
pop esi
jmp 0x1000b877
push 0x42
cmp eax, edi
pop ecx
cmove esi, ecx
cmp dword [esp + 0x24], edi
jle 0x1000b883
or esi, 0x80
mov ecx, dword [ebx + 0x80]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [esp + 0x20]
sub eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
movzx ecx, cl
cmovne ecx, edi
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x1c], edx
jne 0x1000b8ba
or esi, 0x100
test cl, cl
je 0x1000b8ba
or esi, 0x1000
push 0
push dword [ebp + 8]
lea ecx, [esp + 0x38]
push eax
push dword [ebp + 0xc]
push dword [ebp + 4]
push esi
call fcn.10009103
sub esp, 0x28
mov esi, eax
push 0xa
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.1000d3e1
mov edi, dword [esp + 0x1c]
inc edi
mov dword [esp + 0x1c], edi
cmp edi, dword [esp + 0x24]
jl 0x1000b78c
mov esi, dword [esp + 0x18]
mov eax, dword [ebx + 0x78]
cmp eax, dword [ebx + 0x70]
sete al
mov byte [esp + 0x2c], al
cmp byte [esp + 0x17], al
je 0x1000b918
push dword [esp + 0x2c]
mov ecx, ebx
call fcn.1000d3b2
dec dword [ebx + 0x19c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x100217c5
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
lea esi, [eax - 1]
mov dword [esp + 0xc], edx
mov ebp, esi
mov dword [esp + 0x10], esi
push edi
mov edi, edx
sar ebp, 1
mov ebx, ecx
mov ecx, edi
cmp edi, ebp
jge 0x10021819
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
mov ecx, dword [ebx + esi*4 + 8]
call fcn.1000ee5e
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
cmp ecx, ebp
jl 0x100217e8
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
cmp ecx, ebp
jne 0x1002182a
test al, 1
jne 0x1002182a
mov eax, dword [ebx + eax*4 - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
mov ebp, dword [esp + 0x20]
cmp edx, edi
jge 0x10021854
push dword [ebp]
lea esi, [edi - 1]
sar esi, 1
mov ecx, dword [ebx + esi*4]
call fcn.1000ee5e
test al, al
je 0x10021854
mov eax, dword [ebx + esi*4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [esp + 0x10], esi
jl 0x10021832
mov eax, dword [ebp]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x10021d64
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
lea ebx, [eax - 1]
mov dword [esp + 0xc], edx
push edi
mov edi, edx
mov dword [esp + 0x14], ebx
sar ebx, 1
mov ebp, ecx
mov ecx, edi
cmp edi, ebx
jge 0x10021dc2
lea esi, [ecx + ecx]
lea ecx, [esi + 2]
shl ecx, 4
add ecx, ebp
lea eax, [ecx - 0x10]
push eax
call fcn.1000ee5e
lea ecx, [esi + 1]
movzx eax, al
xor eax, 1
shl edi, 4
add ecx, eax
add edi, ebp
mov esi, ecx
shl esi, 4
add esi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ecx
cmp ecx, ebx
jl 0x10021d85
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
cmp ecx, ebx
jne 0x10021ddf
test al, 1
jne 0x10021ddf
shl edi, 4
lea esi, [ebp - 0x10]
shl eax, 4
add esi, eax
add edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
cmp edx, edi
jge 0x10021e0f
push dword [esp + 0x20]
lea ebx, [edi - 1]
sar ebx, 1
mov esi, ebx
shl esi, 4
add esi, ebp
mov ecx, esi
call fcn.1000ee5e
test al, al
je 0x10021e0f
shl edi, 4
add edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ebx
cmp dword [esp + 0x10], ebx
jl 0x10021de3
mov esi, dword [esp + 0x20]
shl edi, 4
add edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x100240af
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x978
mov byte [ebp - 0x1e4], 0x2e
mov byte [ebp - 0x1e3], 0x41
mov byte [ebp - 0x1e2], 0x69
mov byte [ebp - 0x1e1], 0xfc
mov byte [ebp - 0x1e0], 0xcb
mov byte [ebp - 0x1df], 0xe2
mov dword [ebp - 0x49c], 0x29
mov dword [ebp - 0x498], 0xbe
mov dword [ebp - 0x494], 0x3e
mov dword [ebp - 0x490], 0xb6
mov byte [ebp - 0x8c], 0xa8
mov byte [ebp - 0x8b], 0xac
mov byte [ebp - 0x8a], 0xb8
mov byte [ebp - 0x89], 0x87
mov byte [ebp - 0x88], 0xd1
mov dword [ebp - 0x850], 0xca
mov dword [ebp - 0x84c], 0xfc
mov dword [ebp - 0x848], 0x9c
mov dword [ebp - 0x844], 0x5d
mov dword [ebp - 0x840], 0x5b
mov dword [ebp - 0x65c], 0xac
mov dword [ebp - 0x658], 0x84
mov dword [ebp - 0x654], 0xaa
mov dword [ebp - 0x650], 0x28
mov dword [ebp - 0x64c], 0xa2b483ae
mov dword [ebp - 0x648], 0x69
mov byte [ebp - 0x148], 0x81
mov byte [ebp - 0x147], 0x15
mov dword [ebp - 0x350], 0xe7
mov eax, 0x1d4
mov word [ebp - 0x414], ax
mov ecx, 0x63
mov word [ebp - 0x418], cx
mov dword [ebp - 0x360], 0x28
mov dword [ebp - 0x264], 0x2e
mov dword [ebp - 0x260], 0x4a
mov dword [ebp - 0x25c], 0xb
mov dword [ebp - 0x258], 0xb2
mov dword [ebp - 0x700], 0x1ab
mov byte [ebp - 0xac], 0x7f
mov byte [ebp - 0xab], 0xc9
mov dword [ebp - 0x748], 0x45
mov dword [ebp - 0x744], 0xb0
mov dword [ebp - 0x8ac], 0x86
mov dword [ebp - 0x8a8], 0x26
mov dword [ebp - 0x8a4], 0x74
mov dword [ebp - 0x8a0], 0xc0
mov dword [ebp - 0x89c], 0x86
mov dword [ebp - 0x898], 0x96
mov edx, 0x2f
mov word [ebp - 0x41c], dx
mov eax, 0xaa
mov word [ebp - 0x420], ax
mov dword [ebp - 0x238], 0xcf91f5
mov ecx, 0xe2
mov word [ebp - 0x458], cx
mov edx, 0xbe
invalid
invalid
xchg ebp, eax
stosb byte es:[edi], al
sti
invalid
Function at 0x100270df
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
mov dword [ebp - 4], eax
xor ebx, ebx
push edi
movzx eax, word [eax]
or edi, 0xffffffff
test ax, ax
je 0x100271e1
push esi
lea ecx, [ecx]
movzx ecx, ax
mov edx, ecx
shr edx, 1
lea eax, [ecx + ecx]
xor edx, eax
lea eax, [ecx + ecx]
and edx, 0x55555555
xor edx, eax
mov esi, edx
shr esi, 2
lea eax, [edx*4]
xor esi, eax
lea eax, [edx*4]
and esi, 0x33333333
xor esi, eax
mov eax, esi
mov ecx, esi
shr eax, 4
shl ecx, 4
xor eax, ecx
shl esi, 4
and eax, 0xf0f0f0f
xor eax, esi
lea esi, [edi + edi]
bswap eax
mov ecx, eax
xor ecx, edi
jge 0x1002715a
xor esi, 0x4c11db7
add eax, eax
lea edx, [esi + esi]
mov ecx, eax
xor ecx, esi
jge 0x1002716b
xor edx, 0x4c11db7
add eax, eax
lea esi, [edx + edx]
mov ecx, eax
xor ecx, edx
jge 0x1002717c
xor esi, 0x4c11db7
add eax, eax
lea edx, [esi + esi]
mov ecx, eax
xor ecx, esi
jge 0x1002718d
xor edx, 0x4c11db7
add eax, eax
lea esi, [edx + edx]
mov ecx, eax
xor ecx, edx
jge 0x1002719e
xor esi, 0x4c11db7
add eax, eax
lea edx, [esi + esi]
mov ecx, eax
xor ecx, esi
jge 0x100271af
xor edx, 0x4c11db7
add eax, eax
lea esi, [edx + edx]
mov ecx, eax
xor ecx, edx
jge 0x100271c0
xor esi, 0x4c11db7
add eax, eax
lea edi, [esi + esi]
xor eax, esi
jge 0x100271cf
xor edi, 0x4c11db7
mov eax, dword [ebp - 4]
inc ebx
movzx eax, word [eax + ebx*2]
test ax, ax
jne 0x100270ff
pop esi
not edi
mov ecx, edi
shr ecx, 1
lea eax, [edi + edi]
xor ecx, eax
lea eax, [edi + edi]
and ecx, 0x55555555
xor ecx, eax
mov edx, ecx
shr edx, 2
pop edi
lea eax, [ecx*4]
xor edx, eax
lea eax, [ecx*4]
and edx, 0x33333333
xor edx, eax
mov eax, edx
mov ecx, edx
shr eax, 4
shl ecx, 4
xor eax, ecx
shl edx, 4
and eax, 0xf0f0f0f
xor eax, edx
bswap eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002723f
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
mov ebx, ecx
push edi
or edi, 0xffffffff
mov al, byte [ebx]
test al, al
Function at 0x1002724a
Capabilities:
Hash data using crc32b

Disassembly:
je 0x10027327
push esi
movzx ecx, al
lea esi, [edi + edi]
mov edx, ecx
shr edx, 1
lea eax, [ecx + ecx]
xor edx, eax
lea eax, [ecx + ecx]
and edx, 0x55555555
xor edx, eax
mov ecx, edx
shr ecx, 2
lea eax, [edx*4]
xor ecx, eax
lea eax, [edx*4]
and ecx, 0x33333333
xor ecx, eax
mov eax, ecx
shr ecx, 4
and eax, 0xff0f0f0f
shl eax, 4
or eax, ecx
bswap eax
mov ecx, eax
xor ecx, edi
jge 0x100272a5
xor esi, 0x4c11db7
add eax, eax
lea edx, [esi + esi]
mov ecx, eax
xor ecx, esi
jge 0x100272b6
xor edx, 0x4c11db7
add eax, eax
lea esi, [edx + edx]
mov ecx, eax
xor ecx, edx
jge 0x100272c7
xor esi, 0x4c11db7
add eax, eax
lea edx, [esi + esi]
mov ecx, eax
xor ecx, esi
jge 0x100272d8
xor edx, 0x4c11db7
add eax, eax
lea esi, [edx + edx]
mov ecx, eax
xor ecx, edx
jge 0x100272e9
xor esi, 0x4c11db7
add eax, eax
lea edx, [esi + esi]
mov ecx, eax
xor ecx, esi
jge 0x100272fa
xor edx, 0x4c11db7
add eax, eax
lea esi, [edx + edx]
mov ecx, eax
xor ecx, edx
jge 0x1002730b
xor esi, 0x4c11db7
add eax, eax
lea edi, [esi + esi]
xor eax, esi
jge 0x1002731a
xor edi, 0x4c11db7
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x10027251
pop esi
not edi
mov ecx, edi
shr ecx, 1
lea eax, [edi + edi]
xor ecx, eax
lea eax, [edi + edi]
and ecx, 0x55555555
xor ecx, eax
mov edx, ecx
shr edx, 2
pop edi
lea eax, [ecx*4]
xor edx, eax
lea eax, [ecx*4]
and edx, 0x33333333
xor edx, eax
mov eax, edx
mov ecx, edx
shr eax, 4
shl ecx, 4
xor eax, ecx
shl edx, 4
and eax, 0xf0f0f0f
xor eax, edx
bswap eax
pop ebx
ret

Function at 0x1002737f
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x100273ef
mov eax, dword [edi + 0x3c]
add eax, edi
cmp dword [eax], 0x4550
jne 0x100273ef
mov ecx, 0x14c
cmp word [eax + 4], cx
jne 0x100273ef
mov ecx, dword [eax + 0x78]
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x100273ef
cmp dword [eax + 0x74], 0
jbe 0x100273ef
add ecx, edi
je 0x100273ef
mov eax, dword [ecx + 0x20]
xor esi, esi
mov ebx, dword [ecx + 0x18]
add eax, edi
mov dword [ebp - 8], eax
test ebx, ebx
je 0x100273ef
mov ecx, dword [eax + esi*4]
add ecx, edi
call fcn.1002723f
cmp eax, dword [ebp - 4]
je 0x100273f8
mov eax, dword [ebp - 8]
inc esi
cmp esi, ebx
jb 0x100273d4
lea esp, [esp]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edi]
mov eax, dword [edx + edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002741f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
mov edx, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
pop eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov dword [ebp - 0x14], eax
mov ebx, dword [eax]
mov dword [ebp - 8], ebx
cmp ebx, eax
je 0x100274dc
test edx, edx
jne 0x10027462
test ecx, ecx
je 0x100274e5
mov esi, dword [ebx + 0x30]
test esi, esi
je 0x100274cc
cmp esi, 0xffff
je 0x100274cc
xor eax, eax
lea edi, [ebp - 0x78]
mov ecx, 0x19
rep stosd dword es:[edi], eax
cmp word [esi], ax
je 0x100274b6
inc eax
cmp word [esi + eax*2], 0
jne 0x10027482
test eax, eax
je 0x100274b6
xor edx, edx
test eax, eax
je 0x100274b6
movzx edi, word [esi + edx*2]
mov ebx, edi
lea ecx, [edi - 0x41]
cmp cx, 0x19
ja 0x100274a9
lea ecx, [edi + 0x20]
movzx ebx, cx
mov word [ebp + edx*2 - 0x78], bx
inc edx
cmp edx, eax
jb 0x10027494
mov ebx, dword [ebp - 8]
lea ecx, [ebp - 0x78]
call fcn.100270df
mov edx, dword [ebp - 0x10]
cmp edx, eax
je 0x100274e5
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebx]
mov ebx, eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x14]
jne 0x10027456
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031d92
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push 0x50
mov eax, 0x100f0a75
call fcn.100bb090
mov ebx, ecx
mov dword [ebp - 0x50], ebx
cmp dword [ebx + 0x18], 0
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x4c], edi
je 0x10031f76
movss xmm0, dword [ebp + 0x10]
movss xmm1, dword [ebp + 8]
movd xmm2, esi
subss xmm0, xmm1
cvtdq2ps xmm2, xmm2
comiss xmm0, xmm2
movss dword [ebp - 0x34], xmm2
jbe 0x10031dfb
subss xmm0, xmm2
mulss xmm0, dword [0x10115974]
call fcn.10021eb5
movss xmm2, dword [ebp - 0x34]
movaps xmm1, xmm0
addss xmm1, dword [ebp + 8]
movss dword [ebp + 8], xmm1
movss xmm0, dword [ebp + 0x14]
addss xmm2, xmm1
movss xmm1, dword [ebp + 0xc]
subss xmm0, xmm1
movss dword [ebp + 0x10], xmm2
movd xmm2, edi
cvtdq2ps xmm2, xmm2
comiss xmm0, xmm2
movss dword [ebp - 0x34], xmm2
jbe 0x10031e46
subss xmm0, xmm2
mulss xmm0, dword [0x10115974]
call fcn.10021eb5
movss xmm2, dword [ebp - 0x34]
movaps xmm1, xmm0
addss xmm1, dword [ebp + 0xc]
movss dword [ebp + 0xc], xmm1
mov eax, edi
addss xmm2, xmm1
imul eax, esi
push ecx
lea ecx, [ebp - 0x5c]
movss dword [ebp + 0x14], xmm2
shl eax, 2
push eax
call fcn.1000dbcd
and dword [ebp - 4], 0
test edi, edi
jle 0x10031eff
mov ebx, dword [ebp - 0x5c]
mov eax, esi
shl eax, 2
mov ecx, esi
mov dword [ebp - 0x48], eax
inc ebx
mov eax, edi
mov dword [ebp - 0x40], ebx
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0xff
shl ecx, 2
test esi, esi
jle 0x10031eec
mov dword [ebp - 0x38], ebx
mov ebx, esi
mov esi, dword [ebp - 0x38]
movzx ecx, byte [edi + 3]
xor edx, edx
movzx eax, byte [edi]
imul eax, ecx
div dword [ebp - 0x3c]
xor edx, edx
mov byte [esi + 1], al
movzx eax, byte [edi + 1]
imul eax, ecx
div dword [ebp - 0x3c]
xor edx, edx
mov byte [esi], al
lea esi, [esi + 4]
movzx eax, byte [edi + 2]
imul eax, ecx
mov ecx, 0xff
div ecx
mov byte [esi - 5], al
mov al, byte [edi + 3]
add edi, 4
mov byte [esi - 2], al
sub ebx, 1
jne 0x10031e9c
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x48]
add ebx, ecx
sub eax, 1
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], eax
jne 0x10031e90
mov edi, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
mov edx, dword [ebx + 0x18]
and dword [ebp - 0x38], 0
mov dword [ebp - 0x20], 0x57
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x42900000
mov dword [ebp - 0x14], 0x42900000
mov eax, dword [edx]
mov ecx, dword [eax + 0x10]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, esi
shl eax, 2
push eax
push dword [ebp - 0x5c]
push edi
push esi
push edx
call ecx
test eax, eax
js 0x10031f6e
mov eax, dword [ebx + 0x18]
lea edx, [ebp - 0x30]
movups xmm0, xmmword [ebp + 8]
push 0
push 1
movups xmmword [ebp - 0x30], xmm0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push edx
push dword [ebp - 0x38]
push eax
call dword [ecx + 0x68]
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [ebp - 0x5c]
call fcn.10006653
call fcn.100bb03a
ret 0x1c
Function at 0x10065a5a
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0xc
and dword [esp], 0
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebp, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebp
mov eax, dword [edi + 0x1c]
cmp eax, dword [edi + 8]
jae 0x10065aa4
mov ecx, dword [edi + 0x38]
cmp ecx, 0x20
je 0x10065a91
cmp ecx, 9
je 0x10065a91
cmp ecx, 0xa
je 0x10065a91
cmp ecx, 0xd
jne 0x10065aa0
mov ecx, edi
call fcn.10040b19
mov eax, dword [edi + 0x1c]
cmp eax, dword [edi + 8]
jb 0x10065a7a
mov edx, dword [esp + 0x10]
push dword [edi + 0x30]
dec eax
mov ecx, edx
push eax
call fcn.100408fe
mov esi, dword [edi + 0x38]
cmp esi, 0x80
jge 0x10065c45
push esi
call fcn.100ddd24
pop ecx
test eax, eax
jne 0x10065add
cmp esi, 0x2e
je 0x10065add
cmp esi, 0x5f
je 0x10065add
cmp esi, 0x5c
jne 0x10065c45
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [esp + 0x24]
cmp eax, dword [edi + 8]
jae 0x10065b91
mov ebp, dword [esp + 0x10]
mov esi, dword [edi + 0x38]
cmp esi, 0x20
je 0x10065b89
cmp esi, 9
je 0x10065b89
cmp esi, 0xa
je 0x10065b89
cmp esi, 0xd
je 0x10065b89
cmp ebp, 0x1f3
jge 0x10065b89
push esi
call fcn.100ddd24
pop ecx
test eax, eax
jne 0x10065b6f
cmp esi, 0x2a
je 0x10065b89
cmp esi, 0x2f
je 0x10065b89
cmp esi, 0x2d
je 0x10065b89
cmp esi, 0x2b
je 0x10065b89
cmp esi, 0x28
je 0x10065b89
cmp esi, 0x29
je 0x10065b89
cmp esi, 0x3d
je 0x10065b89
cmp esi, 0x25
je 0x10065b89
cmp esi, 0x5b
je 0x10065b89
cmp esi, 0x5d
je 0x10065b89
cmp esi, 0x3c
je 0x10065b89
cmp esi, 0x3e
je 0x10065b89
cmp esi, 0x2c
je 0x10065b89
cmp esi, 0x3b
je 0x10065b89
cmp esi, 0x3a
je 0x10065b89
mov al, byte [edi + 0x38]
mov ecx, edi
mov byte [ebx + ebp], al
inc ebp
call fcn.10040b19
mov eax, dword [edi + 0x1c]
cmp eax, dword [edi + 8]
jb 0x10065af2
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov esi, ebx
mov byte [eax + ebx], 0
mov al, byte [ebx]
jmp 0x10065bbc
movsx eax, al
push eax
call fcn.100dde22
pop ecx
test eax, eax
je 0x10065bb9
movsx eax, byte [esi]
push eax
call fcn.100de244
pop ecx
mov byte [esi], al
inc esi
mov al, byte [esi]
test al, al
jne 0x10065b9f
mov ecx, dword [ebp]
push ebx
call fcn.100400da
test al, al
je 0x10065bd1
push 3
jmp 0x10065c02
mov ecx, dword [ebp + 8]
push ebx
call fcn.100400da
test al, al
je 0x10065be2
push 5
jmp 0x10065c02
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.100400da
test al, al
je 0x10065bf3
push 6
jmp 0x10065c02
mov ecx, dword [ebp + 0x10]
push ebx
call fcn.100400da
test al, al
je 0x10065c05
push 7
pop ecx
jmp 0x10065c18
mov ecx, dword [ebp + 4]
push ebx
call fcn.100400da
xor ecx, ecx
test al, al
push 4
pop edx
cmovne ecx, edx
mov eax, dword [edi + 0x1c]
dec eax
pop ebx
test ecx, ecx
je 0x10065c35
push ecx
mov dword [edi + 0x30], ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.100408fe
and dword [edi + 0x30], 0
jmp 0x10065c45
mov ecx, dword [esp + 0x10]
and dword [edi + 0x30], 0
push 0
push eax
call fcn.100408fe
pop edi
pop esi
pop ebp
add esp, 0xc
ret