joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002db29
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x100d5625
call fcn.100d1b40
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [esi]
lea ecx, [ebx + 0x18]
mov dword [ebx], eax
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
lea eax, [esi + 0x18]
push eax
call fcn.1002dc20
and dword [ebp - 4], 0
lea eax, [esi + 0x24]
push eax
lea ecx, [ebx + 0x24]
call fcn.1002dce8
lea eax, [esi + 0x30]
lea ecx, [ebx + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.1005bdbc
mov eax, dword [ebp + 8]
push 8
add esi, 0x40
lea edi, [ebx + 0x40]
pop ecx
add eax, 0x60
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x60]
mov byte [ebp - 4], 2
call fcn.10016da1
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100369d6
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x14
pop eax
cmp edx, eax
jb case.0x10036ae1.8
mov esi, dword [ebp + 8]
mov di, word [esi]
mov word [ecx], di
mov di, word [esi + 2]
mov bx, word [ecx]
mov word [ecx + 2], di
mov di, word [esi + 4]
mov word [ecx + 4], di
mov di, word [esi + 6]
mov word [ecx + 6], di
xor edi, edi
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x18], edi
cmp bx, 2
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x1c], edi
je 0x10036b3a
cmp bx, 9
je 0x10036b34
cmp bx, 1
jne 0x10036a62
cmp edx, 0x20
jb case.0x10036ae1.8
mov eax, dword [esi + 0x10]
push 0x20
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
movzx eax, word [esi + 0x18]
cdq
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
movzx eax, word [esi + 0x1a]
mov dword [ecx + 0xc], eax
pop eax
jmp 0x10036bb2
cmp bx, 8
jne 0x10036acb
push 0x28
pop eax
cmp edx, eax
jb case.0x10036ae1.8
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], edi
mov edx, dword [esi + 0x18]
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], edi
movzx edx, word [esi + 0x20]
movzx ebx, word [esi + 0x22]
cmp edx, edi
mov dword [ecx + 0xc], ebx
jbe 0x10036bb2
lea ecx, [eax + 0xc]
cmp ecx, dword [ebp + 0xc]
ja case.0x10036ae1.8
mov ecx, dword [eax + esi + 8]
lea eax, [eax + ecx + 0xd]
cmp eax, dword [ebp + 0xc]
ja case.0x10036ae1.8
cmp ecx, 0x400
ja case.0x10036ae1.8
inc edi
cmp edi, edx
jb 0x10036a98
jmp 0x10036bb2
movzx edx, bx
add edx, 0xfffffffd
cmp edx, 0xb
ja case.0x10036ae1.8
movzx edx, byte [edx + 0x10036bc9]
jmp dword [edx*4 + 0x10036bb9]
cmp dword [ebp + 0xc], 0x18
jb case.0x10036ae1.8
mov esi, dword [esi + 0x14]
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], edi
lea eax, [esi + 0x18]
cmp dword [ebp + 0xc], eax
jb case.0x10036ae1.8
cmp esi, 0x40000000
jbe case.0x10036ae1.6
jmp case.0x10036ae1.8
push 0x18
pop eax
cmp dword [ebp + 0xc], eax
jb case.0x10036ae1.8
cmp bx, 8
jb 0x10036bb2
add eax, 4
cmp dword [ebp + 0xc], eax
jb case.0x10036ae1.8
jmp 0x10036bb2
cmp bx, 2
jne 0x10036b61
cmp edx, 0x20
jb case.0x10036ae1.8
mov eax, dword [esi + 0x10]
push 0x20
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edi
mov eax, dword [esi + 0x14]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edi
jmp 0x10036b8c
cmp edx, 0x38
jb case.0x10036ae1.8
mov eax, dword [esi + 0x10]
push 0x38
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x30]
mov dword [ecx + 0xc], eax
pop esi
push dword [ebp + 0x10]
call fcn.1003698e
push edi
push 4
push edx
push eax
call fcn.100d1cd0
xor ecx, ecx
add eax, esi
adc edx, ecx
cmp edx, ecx
ja case.0x10036ae1.8
jb 0x10036bb2
cmp eax, dword [ebp + 0xc]
jbe 0x10036bb2
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10036dae
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d6031
call fcn.100d1b40
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100e2f70
mov dword [esi + 4], 0x100e2f60
lea ecx, [esi + 0x158]
mov dword [ebp - 4], 0xf
call fcn.100cb180
mov eax, dword [esi + 0x88c]
test eax, eax
je 0x10036de3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x880]
call fcn.1000334c
mov eax, dword [esi + 0x154]
pop ecx
test eax, eax
mov byte [ebp - 4], 0xd
je 0x10036e03
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x14c]
mov byte [ebp - 4], 0xc
test eax, eax
je 0x10036e17
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x144]
mov byte [ebp - 4], 0xb
test eax, eax
je 0x10036e2b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x128]
call fcn.1000334c
push dword [esi + 0x11c]
call fcn.1000334c
push dword [esi + 0x110]
call fcn.1000334c
mov eax, dword [esi + 0xf8]
add esp, 0xc
test eax, eax
mov byte [ebp - 4], 7
je 0x10036e63
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x7c]
call fcn.1000334c
pop ecx
mov byte [ebp - 4], 5
lea ecx, [esi + 0x5c]
call fcn.10036eb4
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.10036eb4
push dword [esi + 0x30]
call fcn.1000334c
push dword [esi + 0x24]
call fcn.1000334c
push dword [esi + 0x18]
call fcn.1000334c
push dword [esi + 0xc]
call fcn.1000334c
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x1003c3dd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d6440
call fcn.100d1b40
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10001d0f
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10001d0f
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x28]
mov byte [esi + 0x28], al
mov al, byte [edi + 0x29]
mov byte [esi + 0x29], al
mov al, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
mov al, byte [edi + 0x2b]
mov byte [esi + 0x2b], al
mov al, byte [edi + 0x2c]
mov byte [esi + 0x2c], al
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1003d768
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d65b4
call fcn.100d1b40
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100dda34
mov dword [esi + 4], 0x100dd7f0
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.1000241b
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov dword [esi], 0x100e3d20
mov dword [esi + 4], 0x100e3d10
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1003d872
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100d65ea
call fcn.100d1b40
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [esi + 0x30]
mov dword [ebp - 4], 2
call fcn.1000334c
pop ecx
lea ecx, [esi + 0x24]
call fcn.1001215a
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.1003d9dd
and byte [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.1003d950
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1004202d
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100d6a9d
call fcn.100d1b40
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov byte [esi], al
mov byte [esi + 1], al
mov byte [esi + 2], al
mov byte [esi + 3], al
mov byte [esi + 4], al
mov byte [esi + 5], al
mov byte [esi + 6], al
mov byte [esi + 7], al
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10041dae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10042a54
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d6ba2
call fcn.100d1b40
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10001cb3
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.10001cb3
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.10001cb3
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10001cb3
or dword [esi + 0x7c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x64], bl
mov byte [esi + 0x65], bl
mov byte [esi + 0x66], bl
mov byte [esi + 0x67], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10043fe7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d6d76
call fcn.100d1b40
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10001d0f
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10001d0f
mov eax, dword [esi + 0x18]
lea ecx, [ebx + 0x4c]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10001d0f
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
mov byte [ebp - 4], 2
call fcn.10001d0f
mov al, byte [esi + 0x64]
push 5
mov byte [ebx + 0x64], al
mov al, byte [esi + 0x65]
mov byte [ebx + 0x65], al
mov al, byte [esi + 0x66]
mov byte [ebx + 0x66], al
mov al, byte [esi + 0x67]
mov byte [ebx + 0x67], al
mov eax, dword [ebp + 8]
add esi, 0x68
lea edi, [ebx + 0x68]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x7c], eax
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1004c554
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x100d7893
call fcn.100d1b40
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x28], 0x40000000
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x18], al
mov byte [esi + 0x19], al
mov dword [esi + 0x1c], 1
mov byte [esi + 0x20], al
mov byte [esi + 0x21], 1
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.1000241b
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100507fe
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d7df0
call fcn.100d1b40
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.1005cf1c
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
lea eax, [esi + 0x3c]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 2
call fcn.100773c6
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
lea eax, [esi + 0x78]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 7
call fcn.100773c6
lea eax, [esi + 0x90]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 9
call fcn.100773c6
lea eax, [esi + 0xa8]
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 0xb
call fcn.100773c6
lea ebx, [esi + 0xc0]
mov byte [ebp - 4], 0xc
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.100773c6
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xd
call fcn.100773c6
lea ebx, [esi + 0xd8]
mov byte [ebp - 4], 0xe
mov ecx, ebx
mov dword [ebp - 0x14], ebx
call fcn.100773c6
lea ecx, [ebx + 0xc]
mov byte [ebp - 4], 0xf
call fcn.100773c6
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100554eb
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x200
jb 0x10055547
cmp word [ecx], 0x5a4d
jne 0x10055547
mov eax, dword [ecx + 0x3c]
cmp eax, 0x1000
jae 0x10055547
push esi
lea esi, [eax + 0x200]
cmp esi, edx
pop esi
ja 0x10055547
test al, 7
jne 0x10055547
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10055547
movzx ecx, word [eax + 4]
add eax, 4
sub ecx, 0x14c
je 0x10055561
sub ecx, 0x74
je 0x1005555a
dec ecx
dec ecx
je 0x1005555a
dec ecx
dec ecx
je 0x10055553
sub ecx, 0x3c
je 0x1005554c
sub ecx, 0x8464
je 0x10055561
xor eax, eax
ret 4
mov ecx, 0x3030401
jmp 0x10055566
mov ecx, 0x3030701
jmp 0x10055566
mov ecx, 0x3030501
jmp 0x10055566
mov ecx, 0x3030103
cmp word [eax + 0x10], 0x400
ja 0x10055547
movzx eax, word [eax + 0x14]
cmp eax, 0x10b
je 0x10055580
cmp eax, 0x20b
jne 0x10055547
mov eax, dword [esp + 4]
push 1
mov dword [eax], ecx
pop eax
jmp 0x10055549

Function at 0x10059037
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d8437
call fcn.100d1b40
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10059333
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.100777f6
mov al, byte [edi + 0x18]
add edi, 0x34
mov byte [esi + 0x18], al
mov al, byte [edi - 0x1b]
mov byte [esi + 0x19], al
mov eax, dword [edi - 0x18]
mov dword [esi + 0x1c], eax
mov al, byte [edi - 0x14]
mov byte [esi + 0x20], al
mov al, byte [edi - 0x13]
mov byte [esi + 0x21], al
mov eax, dword [edi - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov dword [esi + 0x2c], eax
mov al, byte [edi - 4]
mov byte [esi + 0x30], al
mov al, byte [edi - 3]
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
mov byte [esi + 0x31], al
call fcn.100024ce
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100599d4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
xor eax, eax
cmp esi, 8
jb 0x100599f3
push edi
shr edx, 3
mov edi, dword [ecx + 4]
sub esi, 8
xor edi, dword [ecx]
add ecx, 8
xor eax, edi
dec edx
jne 0x100599e2
pop edi
cmp esi, 4
jb 0x100599fd
xor eax, dword [ecx]
add ecx, 4
and esi, 3
cmp esi, 2
jbe 0x10059a0e
movzx edx, byte [ecx]
shl edx, 0x10
xor eax, edx
inc ecx
cmp esi, 1
jbe 0x10059a1a
xor edx, edx
mov dh, byte [ecx]
xor eax, edx
inc ecx
test esi, esi
pop esi
jbe 0x10059a24
movzx ecx, byte [ecx]
xor eax, ecx
ret
Function at 0x1006600c
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [ecx + 0x3c]
cmp edx, 2
jge 0x10066025
cmp byte [ecx + 0x42], 0
mov eax, dword [esp + 4]
je 0x1006608a
cmp eax, 0x3f
jb 0x1006608a
jmp 0x10066079
mov eax, dword [esp + 4]
cmp eax, 0x2c
jb 0x1006608a
cmp edx, 3
jl 0x1006603d
cmp eax, 0x2c
jne 0x1006603c
push 0x48
jmp 0x10066089
dec eax
cmp edx, 4
jl 0x1006604c
cmp eax, 0x2c
jne 0x1006604b
push 0x49
jmp 0x10066089
dec eax
cmp eax, 0x3a
jb 0x1006608a
cmp byte [ecx + 0x14], 0
je 0x1006606b
cmp eax, 0x3a
jne 0x10066060
push 0x44
jmp 0x10066089
cmp eax, 0x3b
jne 0x10066069
push 0x45
jmp 0x10066089
dec eax
dec eax
cmp eax, 0x3f
jb 0x10066082
cmp byte [ecx + 0x42], 0
je 0x10066082
cmp eax, 0x3f
jne 0x1006607f
push 0x46
jmp 0x10066089
dec eax
jmp 0x1006608a
cmp eax, 0x44
jne 0x1006608a
push 0x47
pop eax
ret 4

Function at 0x100676ce
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x100d9037
call fcn.100d1b40
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
or dword [esi + 0x24], 0xffffffff
lea ecx, [esi + 0x30]
mov byte [esi], 1
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], ebx
call fcn.10001cb3
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], ebx
call fcn.1000241b
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x1006782f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d90d3
call fcn.100d1b40
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.10001cb3
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000241b
mov dword [esi + 0x58], edi
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 4
call fcn.100678d0
lea eax, [esi + 0xb8]
mov dword [eax], edi
mov dword [eax + 4], edi
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 6
call fcn.10001cb3
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 7
call fcn.10001cb3
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 0xf0]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
lea eax, [esi + 0xfc]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x1006b22d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d959f
call fcn.100d1b40
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x38]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ax, word [edi + 0x30]
mov word [esi + 0x30], ax
mov al, byte [edi + 0x32]
mov byte [esi + 0x32], al
mov al, byte [edi + 0x33]
mov byte [esi + 0x33], al
mov al, byte [edi + 0x34]
mov byte [esi + 0x34], al
mov al, byte [edi + 0x35]
mov byte [esi + 0x35], al
mov al, byte [edi + 0x36]
mov byte [esi + 0x36], al
lea eax, [edi + 0x38]
push eax
call fcn.10001d0f
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
push eax
lea ecx, [esi + 0x44]
call fcn.100024ce
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov ax, word [edi + 0x64]
mov word [esi + 0x64], ax
mov ax, word [edi + 0x66]
mov word [esi + 0x66], ax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1006fc89
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d9989
call fcn.100d1b40
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100dda34
mov dword [esi + 4], 0x100dff64
mov dword [esi + 8], 0x100e4a60
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 5
call fcn.1000241b
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 6
call fcn.10036ed3
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100e5ed4
mov dword [esi + 4], 0x100e5eb8
mov dword [esi + 8], 0x100e5ea8
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret