joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fc80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push 0x3ff
push 0x1031f2f8
push str.CHROME_ALLOCATOR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1002fd09
push str.winheap
push 0x1031f2f8
call fcn.1006a163
add esp, 8
test eax, eax
jne 0x1002fcc4
mov eax, 1
mov dword [0x10310174], eax
jmp 0x1002fd0e
push str.winlfh
push 0x1031f2f8
call fcn.1006a163
add esp, 8
test eax, eax
jne 0x1002fce6
mov eax, 2
mov dword [0x10310174], eax
jmp 0x1002fd0e
push str.tcmalloc
push 0x1031f2f8
call fcn.1006a163
add esp, 8
neg eax
sbb eax, eax
and eax, dword [0x10310174]
mov dword [0x10310174], eax
jmp 0x1002fd0e
mov eax, dword [0x10310174]
dec eax
je 0x1002fdd2
dec eax
je 0x1002fd8d
mov ecx, 1
call fcn.1002fe00
test eax, eax
je 0x1002fd2d
mov ecx, eax
call fcn.1002edb0
push 0x3ff
push 0x1031f2f8
push str.CHROME_PROFILER_TIME
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1002fd63
cmp byte [0x1031f2f8], 0x31
jne 0x1002fd63
mov dword [0x1030fd4c], 0x100326b0
mov dword [0x1030fd50], 1
push 0x1002fba0
call fcn.1005da9f
push 0x1002fc30
call fcn.1005daac
push 0x1002fc60
call fcn.1005dab9
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10310170], eax
test eax, eax
jne 0x1002fdad
xor cl, cl
test cl, cl
setne al
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [esp + 8]
mov dword [esp + 8], 2
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov cl, 1
xor eax, eax
test cl, cl
setne al
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test eax, eax
mov dword [0x10310170], eax
setne cl
xor eax, eax
test cl, cl
setne al
mov esp, ebp
pop ebp
ret
Function at 0x10030cf0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
cmp esi, 0xfffff
ja 0x10030e82
mov eax, 0x100
mov ecx, 0x1000
cmp esi, eax
cmova eax, esi
mov edi, eax
mov dword [esp + 0x18], eax
mov eax, dword [0x1031f140]
shl edi, 0xc
test eax, eax
jne 0x10030d58
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x38]
cmp eax, dword [esp + 0x38]
lea edx, [esp + 0x20]
cmovae ecx, edx
mov eax, dword [ecx]
mov ecx, 0x1000
mov dword [0x1031f140], eax
cmp eax, 0x1000
push 4
cmova ecx, eax
lea eax, [edi - 1]
add eax, ecx
xor edx, edx
div ecx
push 0x3000
mov edi, eax
imul edi, ecx
push edi
push 0
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je 0x10030d8e
mov esi, eax
jmp 0x10030dbc
cmp esi, dword [esp + 0x18]
jae 0x10030e82
push 0x1000
lea eax, [esp + 0x14]
shl esi, 0xc
push eax
push esi
call fcn.10031750
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10030e82
mov edi, dword [esp + 0x10]
mov ecx, 0x103102c0
shr edi, 0xc
call fcn.1002ffd0
mov ecx, dword [0x10316474]
mov edx, eax
mov dword [esp + 0x18], edx
test ecx, ecx
jne 0x10030ddd
xor eax, eax
jmp 0x10030df0
push 0
lea eax, [edx + 8]
push eax
push 0x1e
push 5
call ecx
mov edx, dword [esp + 0x18]
movzx eax, ax
mov dword [edx + 4], eax
mov ecx, edi
mov eax, dword [0x103102d0]
shl ecx, 0xc
mov dword [edx], ecx
mov dword [edx + 0x80], eax
lea eax, [edi + 2]
add dword [ebx + 0x50b8], ecx
push eax
adc dword [ebx + 0x50bc], 0
add dword [ebx + 0x50d0], ecx
mov ecx, ebx
mov dword [0x103102d0], edx
adc dword [ebx + 0x50d4], 0
shr esi, 0xc
lea eax, [esi - 1]
push eax
call fcn.10030e90
test al, al
je 0x10030e82
mov ecx, 0x103102b0
call fcn.10031b80
mov edx, eax
xorps xmm0, xmm0
movdqu xmmword [edx], xmm0
movq qword [edx + 0x10], xmm0
mov dword [edx + 4], edi
mov dword [edx], esi
mov ecx, dword [ebx]
mov dword [ecx + esi*4], edx
mov eax, dword [edx + 4]
cmp eax, 1
jbe 0x10030e6f
mov ecx, dword [edx]
add ecx, eax
mov eax, dword [ebx]
mov dword [eax + ecx*4 - 4], edx
push edx
mov ecx, ebx
call fcn.100306b0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100316b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 3
jne 0x100316ee
cmp dword [0x1031f104], 0
je 0x100316ee
push esi
push dword [0x1031f108]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push dword [0x1031f108]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x100316ed
push esi
call dword [0x1031f104]
add esp, 4
pop esi
pop ebp
ret 0xc
Function at 0x10031750
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1031f140]
sub esp, 0x24
test eax, eax
jne 0x1003177f
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 8]
cmp eax, dword [ebp - 8]
lea edx, [ebp - 0x20]
cmovae ecx, edx
mov eax, dword [ecx]
mov dword [0x1031f140], eax
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
cmovb ecx, eax
mov eax, dword [ebp + 8]
dec eax
xor edx, edx
add eax, ecx
div ecx
imul eax, ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1003179d
mov dword [ecx], eax
push 4
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esp, ebp
pop ebp
ret

Function at 0x100317c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1031f13c]
sub esp, 0x28
push esi
mov esi, ecx
test eax, eax
jne 0x100317e4
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
mov dword [0x1031f13c], eax
mov dword [ebp - 4], 0
cmp eax, 0x20000
jae 0x10031811
lea ecx, [ebp - 4]
push ecx
push 0x102
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10031811
mov eax, dword [0x1031f13c]
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10033e20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1031f140]
sub esp, 0x24
push esi
mov esi, dword [0x1031f2f0]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test esi, esi
jne 0x10033e65
test eax, eax
jne 0x10033e5d
lea eax, [ebp - 0x24]
push eax
call edi
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 8]
cmp eax, dword [ebp - 8]
lea edx, [ebp - 0x20]
cmovae ecx, edx
mov eax, dword [ecx]
mov dword [0x1031f140], eax
mov esi, eax
mov dword [0x1031f2f0], esi
test eax, eax
jne 0x10033e85
lea eax, [ebp - 0x24]
push eax
call edi
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 8]
cmp eax, dword [ebp - 8]
lea edx, [ebp - 0x20]
cmovae ecx, edx
mov eax, dword [ecx]
mov dword [0x1031f140], eax
mov edi, dword [ebp + 8]
cmp esi, eax
push 4
cmovb esi, eax
xor edx, edx
push 0x3000
lea eax, [edi - 1]
add eax, esi
div esi
imul eax, esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x10033eb3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add dword [0x10312308], edi
pop edi
adc dword [0x1031230c], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100342f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
cmp byte [esi], 0
jne 0x10034464
mov ecx, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ecx + 4]
test ebx, ebx
je 0x10034335
add ecx, 8
mov esi, ebx
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add eax, edx
imul edx, eax, 0x401
mov eax, edx
shr eax, 6
xor edx, eax
dec esi
jne 0x10034318
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 4]
lea edx, [edx + edx*8]
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
mov dword [ebp - 8], edx
and eax, 0x3fff
lea edi, [eax*4]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xc], edi
mov edi, dword [edi + eax]
test edi, edi
je 0x100343b0
lea ecx, [ecx]
cmp dword [edi], edx
jne 0x10034387
cmp dword [edi + 8], ebx
jne 0x10034387
xor eax, eax
lea edx, [ecx + 8]
lea esi, [edi + 0xc]
cmp eax, ebx
jae 0x10034396
mov ecx, dword [esi]
cmp ecx, dword [edx]
jne 0x10034384
inc eax
add esi, 4
add edx, 4
jmp 0x10034371
mov edx, dword [ebp - 8]
mov edi, dword [edi + 0x8c]
test edi, edi
je 0x100343ad
mov ecx, dword [ebp + 8]
jmp 0x10034360
mov esi, dword [ebp + 8]
inc dword [edi + 0x88]
mov eax, dword [esi]
add dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 4]
add dword [esi + 4], ebx
mov ecx, 0x10310284
inc dword [esi + 8]
call fcn.10031d20
mov edx, eax
test edx, edx
jne 0x10034430
sub esp, 0x10
mov dword [ebp - 0x20], 4
movdqu xmm0, xmmword [ebp - 0x20]
mov eax, esp
mov dword [ebp - 0x30], 4
sub esp, 0x10
xor ecx, ecx
movdqu xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movdqu xmm0, xmmword [ebp - 0x30]
movdqu xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
mov dword [eax + 0xc], edx
mov dword [eax], 2
mov dword [eax + 8], 0x90
mov eax, esp
push 0x60
mov dword [eax], edx
mov edx, str.e:_trunk_v39_97_src_third_party_tcmallocchromium_src_stack_trace_table.cc
mov dword [eax + 8], str.tcmalloc:_could_not_allocate_bucket
call fcn.10033ef0
add esp, 0x44
mov byte [esi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 8]
lea edi, [edx + 4]
mov esi, dword [ebp + 8]
mov ecx, 0x21
mov dword [edx], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov dword [edx + 0x88], 1
mov eax, dword [ecx + 0xc]
mov eax, dword [esi + eax]
mov dword [edx + 0x8c], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + eax], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10034780
Capabilities:
Execute anti-debugging instructions
Get cpu information
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x150
mov eax, dword [0x1010b520]
xor eax, esp
mov dword [esp + 0x14c], eax
cmp byte [0x1031f148], 0
push esi
push edi
jne 0x1003489a
mov byte [0x1031f148], 1
call fcn.1005db27
test eax, eax
je 0x100347f2
rdtsc
push 0x64
mov edi, edx
mov esi, eax
call fcn.10047d70
add esp, 4
rdtsc
sub eax, esi
mov ecx, eax
sbb edx, edi
call fcn.1009536f
mulsd xmm0, qword [0x101074d0]
call fcn.100951cf
mov ecx, eax
call fcn.1009536f
movsd qword [0x1010cbf0], xmm0
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0x114
push eax
mov dword [esp + 0x14], 4
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1003484a
cmp dword [esp + 0x48], 2
jne 0x1003484a
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push str.MHz
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
js 0x1003484a
mov eax, dword [esp + 0xc]
mov ecx, 0xf4240
mul ecx
jmp 0x10034877
rdtsc
push 0x1f4
mov edi, edx
mov esi, eax
call fcn.10047d70
add esp, 4
rdtsc
sub eax, esi
mov ecx, eax
sbb edx, edi
call fcn.1009536f
mulsd xmm0, qword [0x101074c0]
call fcn.100951cf
mov ecx, eax
call fcn.1009536f
lea eax, [esp + 0x14]
movsd qword [0x1010cbf0], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x28]
mov dword [0x1010cbec], eax
mov ecx, dword [esp + 0x154]
pop edi
pop esi
xor ecx, esp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret

Function at 0x10034940
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x18], 0
lea eax, [esi + 0x18]
push edi
push eax
push dword [esi + 0x14]
jne 0x10034962
mov dword [eax], 0x224
call dword [sym.imp.KERNEL32.dll_Module32First]
jmp 0x10034968
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x100349e0
mov eax, dword [ebp + 8]
mov edi, dword [esi + 0x2c]
test eax, eax
je 0x1003497f
mov dword [eax], edi
mov dword [eax + 4], 0
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x10034994
mov eax, dword [esi + 0x30]
xor ecx, ecx
add eax, edi
mov dword [edx], eax
adc ecx, ecx
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x100349a1
mov dword [eax], 0x1010cc00
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100349b5
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x100349c9
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x100349d8
lea eax, [esi + 0x138]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebp
ret 0x2c
pop edi
xor al, al
pop esi
pop ebp
ret 0x2c
Function at 0x10035530
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x14], ebx
test edi, edi
je 0x1003573a
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1003573a
mov edi, dword [edi]
push 0x1031ef9c
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi], 0xffffffff
je 0x100356ac
cmp dword [esi + 8], 0
je 0x10035598
test bl, 4
je 0x100356a0
lea ecx, [esp + 0xe0]
and ebx, 0xfffffffb
call fcn.10012e80
jmp 0x100356a0
mov eax, dword [esi]
mov edi, dword [edi + eax*4]
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
test bl, bl
jns 0x100355ba
lea ecx, [esp + 0xe0]
and ebx, 0xffffff7f
call fcn.10012e80
push ecx
call fcn.10035750
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x10035713
push dword [esp + 0x14]
push edi
call fcn.100357b0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x10035713
xor al, al
xor edi, edi
mov byte [esp + 0x13], al
lea esp, [esp]
cmp edi, 3
jge 0x1003568c
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi]
push 0x40
push 4
mov dword [esp + 0x20], 0
lea eax, [ecx + eax*4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1003562d
call fcn.100353d0
test bl, 0x10
je 0x1003567f
and ebx, 0xffffffef
jmp 0x10035676
mov eax, dword [esi]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [ecx + eax*4]
mov dword [edx + 0x18], eax
push eax
mov eax, dword [esi]
lea ecx, [ecx + eax*4]
call fcn.100354a0
mov ecx, dword [esi]
add esp, 4
mov byte [esp + 0x13], al
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push dword [esp + 0x18]
push 4
lea ecx, [eax + ecx*4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1003567f
test bl, 0x20
je 0x1003567f
and ebx, 0xffffffdf
lea ecx, [esp + 0x20]
call fcn.10012e80
mov al, byte [esp + 0x13]
inc edi
test al, al
je 0x100355f0
test al, al
je 0x100356c2
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
call fcn.100353f0
mov edi, dword [esp + 0x1c]
add esi, 0xc
cmp dword [esi], 0xffffffff
jne 0x10035575
push 0x1031ef9c
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, 0x100
je 0x100356d9
lea ecx, [esp + 0x20]
and ebx, 0xfffffeff
call fcn.10012e80
mov eax, dword [esp + 0x18]
push eax
push 0
push dword [0x1031efd0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test bl, 0x40
je 0x100356fa
lea ecx, [esp + 0x20]
call fcn.10012e80
push 0x1031ef9c
mov esi, 0x80004005
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test bl, 8
je 0x10035721
lea ecx, [esp + 0x20]
call fcn.10012e80
push 0x1031ef9c
mov esi, 0x8007000e
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036dcf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x10036af7
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret

Function at 0x10036de9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push eax
push eax
push 0x10036b79
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
pop ebp
ret
Function at 0x10038306
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1010b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
xor edi, edi
mov word [ebp - 0x20c], ax
push 0x206
lea eax, [ebp - 0x20a]
mov dword [ebp - 0x240], edi
push edi
push eax
call fcn.100438b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x100383b9
push ebx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.100020d0
push esi
lea ecx, [ebp - 0x224]
call fcn.100020d0
push edi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.1000ebf0
add esp, 0xc
lea ecx, [ebp - 0x224]
mov bl, al
neg bl
push edi
sbb bl, bl
push 1
inc bl
call fcn.10002960
push edi
push 1
lea ecx, [ebp - 0x23c]
call fcn.10002960
mov al, bl
pop ebx
jmp 0x100383bb
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10041ad4
mov esp, ebp
pop ebp
ret
Function at 0x1005dac6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1010b520]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x31
pop eax
push 0x62
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push 0
push eax
call fcn.100438b0
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x64
push eax
push str.RUNNING_ON_VALGRIND
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jle 0x1005db17
lea ecx, [ebp - 0x68]
cmp byte [ecx], 0x30
jne 0x1005db12
movzx eax, byte [ecx + 1]
test al, al
je 0x1005db17
xor eax, eax
inc eax
jmp 0x1005db19
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10041ad4
mov esp, ebp
pop ebp
ret

Function at 0x10060f85
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov bl, 1
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100610e2
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100610e2
cmp eax, 0x29
jne 0x10060fbf
cmp dword [esi + 0x10], 0
jne 0x100610e2
test dword [esi + 0x50], edx
je 0x100610e7
cmp eax, 0x2e
jne 0x10060fda
push 5
lea ecx, [esi + 0x24]
call fcn.100632e1
mov ecx, esi
call fcn.1006331b
jmp 0x100610ca
cmp eax, 0x5c
jne 0x10061035
mov ecx, esi
call fcn.1006331b
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x1006100c
cmp byte [esi + 0x48], 0x62
jne 0x1006100c
push 4
lea ecx, [esi + 0x24]
call fcn.100632e1
mov ecx, esi
call fcn.1006331b
jmp 0x100610d1
test eax, eax
je 0x10061029
cmp byte [esi + 0x48], 0x42
jne 0x10061029
push 4
lea ecx, [esi + 0x24]
call fcn.100632e1
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x10061000
mov ecx, esi
call fcn.10061259
jmp 0x100610ca
cmp eax, 0x5b
jne 0x10061055
mov ecx, esi
call fcn.1006331b
mov ecx, esi
call fcn.10061743
cmp dword [esi + 0x4c], 0x5d
je 0x10060fce
push 4
jmp 0x100610e9
cmp eax, 0x28
jne 0x10061072
mov ecx, esi
call fcn.1006331b
mov ecx, esi
call fcn.10063a36
cmp dword [esi + 0x4c], 0x29
mov bl, al
je 0x100610bf
jmp 0x100610e7
cmp eax, 0x5e
jne 0x1006107e
push 2
jmp 0x10060ff8
cmp eax, 0x24
jne 0x1006108a
push 3
jmp 0x10060ff8
cmp eax, 0x2a
je 0x100610de
cmp eax, 0x2b
je 0x100610de
cmp eax, 0x3f
je 0x100610de
cmp eax, 0x7b
je 0x100610de
cmp eax, 0x7d
jne 0x100610a8
test dword [esi + 0x50], edx
je 0x100610da
cmp eax, 0x5d
jne 0x100610b2
test dword [esi + 0x50], edx
je 0x1006104e
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10060919
mov ecx, esi
call fcn.1006331b
test bl, bl
je 0x100610d1
mov ecx, esi
call fcn.10063344
mov cl, 1
mov bl, cl
jmp 0x10060f8d
push 6
jmp 0x100610e9
push 0xa
jmp 0x100610e9
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.100403dc
int3
Function at 0x100610ef
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov bl, 1
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1006124c
mov edx, 0x10000000
cmp eax, 0x7c
je 0x1006124c
cmp eax, 0x29
jne 0x10061129
cmp dword [esi + 0x10], 0
jne 0x1006124c
test dword [esi + 0x50], edx
je 0x10061251
cmp eax, 0x2e
jne 0x10061144
push 5
lea ecx, [esi + 0x24]
call fcn.100632e1
mov ecx, esi
call fcn.1006331b
jmp 0x10061234
cmp eax, 0x5c
jne 0x1006119f
mov ecx, esi
call fcn.1006331b
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x10061176
cmp byte [esi + 0x48], 0x62
jne 0x10061176
push 4
lea ecx, [esi + 0x24]
call fcn.100632e1
mov ecx, esi
call fcn.1006331b
jmp 0x1006123b
test eax, eax
je 0x10061193
cmp byte [esi + 0x48], 0x42
jne 0x10061193
push 4
lea ecx, [esi + 0x24]
call fcn.100632e1
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x1006116a
mov ecx, esi
call fcn.10061303
jmp 0x10061234
cmp eax, 0x5b
jne 0x100611bf
mov ecx, esi
call fcn.1006331b
mov ecx, esi
call fcn.1006178c
cmp dword [esi + 0x4c], 0x5d
je 0x10061138
push 4
jmp 0x10061253
cmp eax, 0x28
jne 0x100611dc
mov ecx, esi
call fcn.1006331b
mov ecx, esi
call fcn.10063ab7
cmp dword [esi + 0x4c], 0x29
mov bl, al
je 0x10061229
jmp 0x10061251
cmp eax, 0x5e
jne 0x100611e8
push 2
jmp 0x10061162
cmp eax, 0x24
jne 0x100611f4
push 3
jmp 0x10061162
cmp eax, 0x2a
je 0x10061248
cmp eax, 0x2b
je 0x10061248
cmp eax, 0x3f
je 0x10061248
cmp eax, 0x7b
je 0x10061248
cmp eax, 0x7d
jne 0x10061212
test dword [esi + 0x50], edx
je 0x10061244
cmp eax, 0x5d
jne 0x1006121c
test dword [esi + 0x50], edx
je 0x100611b8
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10060919
mov ecx, esi
call fcn.1006331b
test bl, bl
je 0x1006123b
mov ecx, esi
call fcn.10063344
mov cl, 1
mov bl, cl
jmp 0x100610f7
push 6
jmp 0x10061253
push 0xa
jmp 0x10061253
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.100403dc
int3