joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000885b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [edx + 0x37], cl
cmp eax, 0x4b493b4e
inc edx
dec ecx
add esp, 4
call 0x1000886c
add byte [ebx], dh
inc ebx
dec esp
dec ebp
inc edx
inc ebx
aaa
aaa
add esp, 4
pop edi
mov byte [ebp - 0x9dc], 0x56
mov byte [ebp - 0x9db], 0x69
mov byte [ebp - 0x9da], 0x72
mov byte [ebp - 0x9d9], 0x74
mov byte [ebp - 0x9d8], 0x75
mov byte [ebp - 0x9d7], 0x61
mov byte [ebp - 0x9d6], 0x6c
mov byte [ebp - 0x9d5], 0x50
mov byte [ebp - 0x9d4], 0x72
mov byte [ebp - 0x9d3], 0x6f
invalid
invalid

Function at 0x1000886c
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add byte [edx + 0x37], cl
cmp eax, 0x4b493b4e
inc edx
dec ecx
add esp, 4
call 0x1000886c
add byte [ebx], dh
inc ebx
dec esp
dec ebp
inc edx
inc ebx
aaa
aaa
add esp, 4
pop edi
mov byte [ebp - 0x9dc], 0x56
mov byte [ebp - 0x9db], 0x69
mov byte [ebp - 0x9da], 0x72
mov byte [ebp - 0x9d9], 0x74
mov byte [ebp - 0x9d8], 0x75
mov byte [ebp - 0x9d7], 0x61
mov byte [ebp - 0x9d6], 0x6c
mov byte [ebp - 0x9d5], 0x50
mov byte [ebp - 0x9d4], 0x72
mov byte [ebp - 0x9d3], 0x6f
invalid
invalid

Function at 0x10008a10
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
add esi, 0x8763
sub esi, 0xd4fd
xor esi, 0xf30a
pop esi
push edi
xor edi, 0x800b
sub edi, 0xd726
or edi, 0x239a
sub edi, 0xc55b
pop edi
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push esi
call 0x10008a1c
add byte [eax + 0x38], al
cmp cl, byte [edi + 0x38]
cmp eax, dword [ebx - 0x117efb3c]
cld
aad 0
add byte [esi + 0x57], bl
sub edi, 0x13c20
pop edi
push edx
call 0x10008a3d
add byte [esi + 0x47], cl
dec ebx
aaa
xor al, 0x49
cmp al, 0x3e
add esp, 4
pop edx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x104e], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
invalid
invalid

Function at 0x10008a1c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
add esi, 0x8763
sub esi, 0xd4fd
xor esi, 0xf30a
pop esi
push edi
xor edi, 0x800b
sub edi, 0xd726
or edi, 0x239a
sub edi, 0xc55b
pop edi
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push esi
call 0x10008a1c
add byte [eax + 0x38], al
cmp cl, byte [edi + 0x38]
cmp eax, dword [ebx - 0x117efb3c]
cld
aad 0
add byte [esi + 0x57], bl
sub edi, 0x13c20
pop edi
push edx
call 0x10008a3d
add byte [esi + 0x47], cl
dec ebx
aaa
xor al, 0x49
cmp al, 0x3e
add esp, 4
pop edx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x104e], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
invalid
invalid
Function at 0x10008a3d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
push ecx
add esp, 4
add esi, 0x8763
sub esi, 0xd4fd
xor esi, 0xf30a
pop esi
push edi
xor edi, 0x800b
sub edi, 0xd726
or edi, 0x239a
sub edi, 0xc55b
pop edi
lea eax, [ebp - 0x173c]
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0x510]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xccc], edx
xor eax, eax
mov word [ebp - 0x238], ax
xor ecx, ecx
mov word [ebp - 0x4c], cx
push esi
call 0x10008a1c
add byte [eax + 0x38], al
cmp cl, byte [edi + 0x38]
cmp eax, dword [ebx - 0x117efb3c]
cld
aad 0
add byte [esi + 0x57], bl
sub edi, 0x13c20
pop edi
push edx
call 0x10008a3d
add byte [esi + 0x47], cl
dec ebx
aaa
xor al, 0x49
cmp al, 0x3e
add esp, 4
pop edx
mov edx, dword [ebp - 0xccc]
mov ax, word [edx]
mov word [ebp - 0x104e], ax
mov ecx, dword [ebp - 0xccc]
add ecx, 2
mov dword [ebp - 0xccc], ecx
invalid
invalid

Function at 0x10008c0e
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
sub byte [edx], 1
add byte [ecx + 0x549fca], al
add byte [edx + 0x53], bl
add ebx, 0x15319
add ebx, 0x11ac3
pop ebx
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x300], edx
jmp 0x10008bf2
push edx
add edx, 0x4371
or edx, 0xb81f
pop edx
push ecx
call 0x10008c0e
add byte [eax + 0x35], al
dec eax
inc ebp
dec ecx
dec ecx
add esp, 4
and ecx, 0x30fb
xor ecx, 0x401f
add ecx, 0x118ef
pop ecx
cmp dword [ebp - 0x300], 0
jne 0x100094f7
or byte [eax], al
invalid
mov ecx, 0x6b
mov word [ebp - 0x1774], cx
mov edx, 0x65
mov word [ebp - 0x1772], dx
mov eax, 0x72
mov word [ebp - 0x1770], ax
mov ecx, 0x6e
mov word [ebp - 0x176e], cx
mov edx, 0x65
mov word [ebp - 0x176c], dx
mov eax, 0x6c
mov word [ebp - 0x176a], ax
mov ecx, 0x33
mov word [ebp - 0x1768], cx
mov edx, 0x32
mov word [ebp - 0x1766], dx
mov eax, 0x2e
mov word [ebp - 0x1764], ax
mov ecx, 0x64
mov word [ebp - 0x1762], cx
mov edx, 0x6c
mov word [ebp - 0x1760], dx
mov eax, 0x6c
mov word [ebp - 0x175e], ax
xor ecx, ecx
mov word [ebp - 0x175c], cx
push edx
push ebx
add esp, 4
xor edx, 0x29b
and edx, 0x12561
push eax
add eax, 0xc95f
sub eax, 0xa7db
and eax, 0xfe10
pop eax
push eax
sub eax, 0xc6e1
add eax, 0xc9c9
call 0x10009525
add byte [ebp + 0x50], al
inc ebx
inc ebx
cmp dh, byte [ebx]
cmp eax, dword [ebx + 0x645804c4]
mov edx, dword [0x18]
mov dword [ebp - 0x1a50], edx
mov eax, dword [ebp - 0x1a50]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1a54], ecx
mov edx, dword [ebp - 0x1a54]
mov dword [ebp - 0x1674], edx
push edx
call 0x1000955f
add byte [ebx], dh
dec ebp
aaa
dec ebx
inc esi
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
retf 0x94d9
Function at 0x100093ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x784]
add ecx, 1
mov dword [ebp - 0x784], ecx
add esp, 4
and ebx, 0x14f76
pop ebx
mov edx, dword [ebp - 0x788]
add edx, dword [ebp - 0x1d0]
movsx eax, byte [edx]
or eax, 0x20
mov ecx, dword [ebp - 0x1d0]
movsx edx, byte [ebp + ecx - 0x8ac]
or edx, 0x20
cmp eax, edx
jge 0x100093ea
mov dword [ebp - 0xce4], 0xffffffff
jmp 0x100093f4
mov dword [ebp - 0xce4], 1
cmp dword [ebp - 0xce4], 0
jne 0x1000940b
mov eax, dword [ebp - 0x1a44]
mov dword [ebp - 0x3f8], eax
jmp 0x1000941c
jmp 0x100091f5

Function at 0x10009525
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub byte [edx], 1
add byte [ecx + 0x549fca], al
add byte [edx + 0x53], bl
add ebx, 0x15319
add ebx, 0x11ac3
pop ebx
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x300], edx
jmp 0x10008bf2
push edx
add edx, 0x4371
or edx, 0xb81f
pop edx
push ecx
call 0x10008c0e
add byte [eax + 0x35], al
dec eax
inc ebp
dec ecx
dec ecx
add esp, 4
and ecx, 0x30fb
xor ecx, 0x401f
add ecx, 0x118ef
pop ecx
cmp dword [ebp - 0x300], 0
jne 0x100094f7
or byte [eax], al
invalid
mov ecx, 0x6b
mov word [ebp - 0x1774], cx
mov edx, 0x65
mov word [ebp - 0x1772], dx
mov eax, 0x72
mov word [ebp - 0x1770], ax
mov ecx, 0x6e
mov word [ebp - 0x176e], cx
mov edx, 0x65
mov word [ebp - 0x176c], dx
mov eax, 0x6c
mov word [ebp - 0x176a], ax
mov ecx, 0x33
mov word [ebp - 0x1768], cx
mov edx, 0x32
mov word [ebp - 0x1766], dx
mov eax, 0x2e
mov word [ebp - 0x1764], ax
mov ecx, 0x64
mov word [ebp - 0x1762], cx
mov edx, 0x6c
mov word [ebp - 0x1760], dx
mov eax, 0x6c
mov word [ebp - 0x175e], ax
xor ecx, ecx
mov word [ebp - 0x175c], cx
push edx
push ebx
add esp, 4
xor edx, 0x29b
and edx, 0x12561
push eax
add eax, 0xc95f
sub eax, 0xa7db
and eax, 0xfe10
pop eax
push eax
sub eax, 0xc6e1
add eax, 0xc9c9
call 0x10009525
add byte [ebp + 0x50], al
inc ebx
inc ebx
cmp dh, byte [ebx]
cmp eax, dword [ebx + 0x645804c4]
mov edx, dword [0x18]
mov dword [ebp - 0x1a50], edx
mov eax, dword [ebp - 0x1a50]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1a54], ecx
mov edx, dword [ebp - 0x1a54]
mov dword [ebp - 0x1674], edx
push edx
call 0x1000955f
add byte [ebx], dh
dec ebp
aaa
dec ebx
inc esi
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
retf 0x94d9
Function at 0x1000955f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub byte [edx], 1
add byte [ecx + 0x549fca], al
add byte [edx + 0x53], bl
add ebx, 0x15319
add ebx, 0x11ac3
pop ebx
mov edx, dword [ebp - 0x510]
mov dword [ebp - 0x300], edx
jmp 0x10008bf2
push edx
add edx, 0x4371
or edx, 0xb81f
pop edx
push ecx
call 0x10008c0e
add byte [eax + 0x35], al
dec eax
inc ebp
dec ecx
dec ecx
add esp, 4
and ecx, 0x30fb
xor ecx, 0x401f
add ecx, 0x118ef
pop ecx
cmp dword [ebp - 0x300], 0
jne 0x100094f7
or byte [eax], al
invalid
mov ecx, 0x6b
mov word [ebp - 0x1774], cx
mov edx, 0x65
mov word [ebp - 0x1772], dx
mov eax, 0x72
mov word [ebp - 0x1770], ax
mov ecx, 0x6e
mov word [ebp - 0x176e], cx
mov edx, 0x65
mov word [ebp - 0x176c], dx
mov eax, 0x6c
mov word [ebp - 0x176a], ax
mov ecx, 0x33
mov word [ebp - 0x1768], cx
mov edx, 0x32
mov word [ebp - 0x1766], dx
mov eax, 0x2e
mov word [ebp - 0x1764], ax
mov ecx, 0x64
mov word [ebp - 0x1762], cx
mov edx, 0x6c
mov word [ebp - 0x1760], dx
mov eax, 0x6c
mov word [ebp - 0x175e], ax
xor ecx, ecx
mov word [ebp - 0x175c], cx
push edx
push ebx
add esp, 4
xor edx, 0x29b
and edx, 0x12561
push eax
add eax, 0xc95f
sub eax, 0xa7db
and eax, 0xfe10
pop eax
push eax
sub eax, 0xc6e1
add eax, 0xc9c9
call 0x10009525
add byte [ebp + 0x50], al
inc ebx
inc ebx
cmp dh, byte [ebx]
cmp eax, dword [ebx + 0x645804c4]
mov edx, dword [0x18]
mov dword [ebp - 0x1a50], edx
mov eax, dword [ebp - 0x1a50]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1a54], ecx
mov edx, dword [ebp - 0x1a54]
mov dword [ebp - 0x1674], edx
push edx
call 0x1000955f
add byte [ebx], dh
dec ebp
aaa
dec ebx
inc esi
xor dh, byte [ebx + eax*4]
les eax, [ecx + eax*4]
retf 0x94d9

Function at 0x100095c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ecx
add ecx, 0x19d7
sub ecx, 0x70e2
or ecx, 0x9a1d
pop ecx
cmp dword [ebp - 0xcf0], 0
jne 0x100095f7
mov dword [ebp - 0x300], 0
jmp 0x10009842
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x518], eax
push ebx
push edi
add esp, 4
sub ebx, 0x8f1a
add ebx, 0xa14c
xor ebx, 0xce18
or ebx, 0x123b2
pop ebx
push eax
sub eax, 0x1e94
xor eax, 0x345e
or eax, 0x110fe
pop eax
lea ecx, [ebp - 0x173c]
mov dword [ebp - 0xcec], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xce8], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push edx
sub edx, 0xd4dd
or edx, 0x8d96
xor edx, 0x182ec
call 0x1000967f
add byte [ebp + 0x40], al
xor edi, dword [ecx]
cmp al, 0x40
inc ebp
add esp, 4
pop edx
push ecx
sub ecx, 0xe021
and ecx, 0x66ce
pop ecx
invalid
test dword [eax], ebx
Function at 0x1000967f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop eax
push ecx
add ecx, 0x19d7
sub ecx, 0x70e2
or ecx, 0x9a1d
pop ecx
cmp dword [ebp - 0xcf0], 0
jne 0x100095f7
mov dword [ebp - 0x300], 0
jmp 0x10009842
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0x518], eax
push ebx
push edi
add esp, 4
sub ebx, 0x8f1a
add ebx, 0xa14c
xor ebx, 0xce18
or ebx, 0x123b2
pop ebx
push eax
sub eax, 0x1e94
xor eax, 0x345e
or eax, 0x110fe
pop eax
lea ecx, [ebp - 0x173c]
mov dword [ebp - 0xcec], ecx
mov edx, dword [ebp - 0x518]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xce8], eax
xor ecx, ecx
mov word [ebp - 0x240], cx
xor edx, edx
mov word [ebp - 0x54], dx
push edx
sub edx, 0xd4dd
or edx, 0x8d96
xor edx, 0x182ec
call 0x1000967f
add byte [ebp + 0x40], al
xor edi, dword [ecx]
cmp al, 0x40
inc ebp
add esp, 4
pop edx
push ecx
sub ecx, 0xe021
and ecx, 0x66ce
pop ecx
invalid
test dword [eax], ebx
Function at 0x10010987
Capabilities:
Encode data using xor

Disassembly:
mov ch, byte [0x560404f7]
xchg dh, cl
lahf
stosb byte es:[edi], al
add eax, 0x565c5e05
mov cl, cl
or dword [esi + 0x5a217fc], eax
add eax, 0x88575764
leave
or dword [esi + 0x50219e7], eax
add eax, 0x20d2f786
add eax, 0x5bf78605
mov dword [0x5ccf8605], eax
stosb byte es:[edi], al
add eax, 0xc2885f05
sub eax, 0x50404f7
jp 0x100109db
int3
add al, 0x8e
xchg edx, eax
xchg ebp, eax
inc dword [esp + eax]
pop esp
push ebp
mov cl, cl
or ebp, ebp
syscall
add eax, 0x4d390505
inc esi
push eax
push edx
push eax
inc ecx
aas
mov cl, cl
or dword [esi + edx*2 - 0x7a], esp
out 0xa3, al
leave
add eax, 0xafee8605
test eax, 0xf6860505
jl 0x10010a5c
add eax, 0xf3ce8605
pop eax
push es
add eax, 0x5d9a925e
add al, 4
mov ds, word [edx + 0x404f731]
nop
mov dl, byte [ebp - 0x6ffbfb01]
dec ebp
xor eax, 0xf735928e
add al, 4
cmp bh, dl
imul ecx, dword [esi + 0x402819a], 4
cmp ch, al
imul ecx, dword [esi + 0x404758a], 4
pop ebx
pop esp
mov cl, cl
or dword [esi + 0x55ea2fb], eax
add eax, 0xfb865b63
div byte [ebp + 5]
add eax, 0x891feb86
add eax, 0x7ed38605
clts
jle 0x10010a6d
push es
add eax, 0x2885d386
push es
add eax, 0x885b5663
leave
or dword [esi + 0x57d3ce6], eax
out 0x3c, al
jge 0x10010a76
add eax, 0x3592905e
test dword [esp + eax], 0x6b16906b
mov ds, word [edx + 0x404f40b]
nop
mov dh, byte [0x880404f7]
lds eax, [edi]
mov cs, word [edx + 0x404f735]
imul edx, dword [eax + 0x4f40b92], 4
imul ecx, dword [esi + 0x4028192], 4
nop
lcall 0x906b, 0x404f731
pop es
imul ecx, dword [esi + 0x4f4098a], 4
nop
xchg edx, eax
xor edi, esi
add al, 4
mov dh, al
pop es
mov ss, word [edx + 0x404f731]
imul edx, dword [eax + 0x4f4099a], 4
imul ecx, dword [esi + 0x404759a], 4
pop eax
xchg al, dl
mov esp, 0x860505d3
enter 0x5be7, 6
add eax, 0xf0865860
cmp al, 0x98
add eax, 0x93c88605
mov eax, 0xd0860505
jae 0x10010a77
add al, 4
imul edx, dword [eax - 0x657194ea], 0xb
hlt
push es
add eax, 0xd4865c60
mov al, byte [0xf0050553]
or eax, dword [ebp + 0x39]
dec ecx
inc edi
dec ecx
cmp eax, 0x8abc1464
jne 0x10010b08
add al, 4
mov al, ch
jp 0x10010b27
adc al, 0xbc
xchg edx, eax
add dword [edx], 0xbc140404
lcall 0xcf30, 0x4040475
mov ss, word [edx + 0x404f291]
invalid
add al, 4
adc al, 0xbc
xchg edx, eax
jne 0x10010b32
add al, 4
inc eax
invalid
adc al, 0x89
push cs
add al, 4
add al, 0x14
mov esp, 0x402819a
add al, 0x88
mul dword [0x758abc14]
add al, 4
add al, 0x40
aad 0x14
mov ebp, esi
add eax, dword [esp + eax]
adc al, 0xbc
xchg edx, eax
add dword [edx], 0xbc140404
lcall 0xcf40, 0x4040475
adc byte [ecx], 0xcc
mov dl, byte [ebp + 0x40404f2]
add al, 4
add al, 0xf0
bswap esp
mov dl, byte [ebp + 0x60404f2]
add eax, 0x8a900505
xchg ebp, eax
add al, 4
mov cs, word [edx + 0x404f291]
mov dl, al
xchg ecx, eax
add al, 4
add eax, 0x8658457a
invalid
Function at 0x10042d10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e85f6
call fcn.100d5e28
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10042cb8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10045250
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e8781
call fcn.100d5e28
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10002124
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10002124
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10002124
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10002124
or dword [esi + 0x7c], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x64], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004525c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e8781
call fcn.100d5e28
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10002124
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10002124
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10002124
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10002124
or dword [esi + 0x7c], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x64], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004de7f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e8d84
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], 1
mov word [esi + 0x20], 0x100
mov dword [esi + 0x28], 0x40000000
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], ax
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004de8a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e8d84
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], 1
mov word [esi + 0x20], 0x100
mov dword [esi + 0x28], 0x40000000
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], ax
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1005b226
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp edx, 8
jb 0x1005b247
push edi
mov edi, edx
shr edi, 3
mov eax, dword [ecx + 4]
sub edx, 8
xor eax, dword [ecx]
add ecx, 8
xor esi, eax
sub edi, 1
jne 0x1005b234
pop edi
cmp edx, 4
jb 0x1005b251
xor esi, dword [ecx]
add ecx, 4
and edx, 3
cmp edx, 2
jbe 0x1005b262
movzx eax, byte [ecx]
shl eax, 0x10
xor esi, eax
inc ecx
cmp edx, 1
jbe 0x1005b270
movzx eax, byte [ecx]
shl eax, 8
xor esi, eax
inc ecx
test edx, edx
je 0x1005b279
movzx ecx, byte [ecx]
xor esi, ecx
mov eax, esi
pop esi
ret

Function at 0x1006814e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e9ba2
call fcn.100d5e28
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov dword [esi], 1
mov word [esi + 4], bx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.10002124
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1006889e
Capabilities:
Parse credit card information

Disassembly:
cmp dword [ecx + 0x3c], 2
mov eax, dword [esp + 4]
jge 0x100688bc
cmp byte [ecx + 0x42], 0
je 0x10068919
cmp eax, 0x3f
jb 0x10068919
jne 0x100688b9
push 0x46
jmp 0x10068918
dec eax
jmp 0x10068919
cmp eax, 0x2c
jb 0x10068919
cmp dword [ecx + 0x3c], 3
jl 0x100688d1
cmp eax, 0x2c
jne 0x100688d0
push 0x48
jmp 0x10068918
dec eax
cmp dword [ecx + 0x3c], 4
jl 0x100688e1
cmp eax, 0x2c
jne 0x100688e0
push 0x49
jmp 0x10068918
dec eax
cmp eax, 0x3a
jb 0x10068919
cmp byte [ecx + 0x14], 0
je 0x10068901
cmp eax, 0x3a
jne 0x100688f5
push 0x44
jmp 0x10068918
cmp eax, 0x3b
jne 0x100688fe
push 0x45
jmp 0x10068918
sub eax, 2
cmp eax, 0x3f
jb 0x10068911
cmp byte [ecx + 0x42], 0
je 0x10068911
cmp eax, 0x3f
jmp 0x100688b3
cmp eax, 0x44
jne 0x10068919
push 0x47
pop eax
ret 4

Function at 0x1006a08a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100e9c50
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10002124
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.10002327
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
call fcn.1006a018
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.10002124
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.10002124
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1006e13d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100e9eff
call fcn.100d5e28
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
xor edi, edi
mov dword [esi + 4], 0x100eef50
mov dword [esi + 8], 0x100ec3a0
mov dword [esi + 0xc], edi
mov dword [esi], 0x100f51e0
mov dword [esi + 4], 0x100f5214
mov dword [esi + 8], 0x100f5230
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 4
call fcn.10002327
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret