joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
call fcn.100c1170
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10006cb9
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x77
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x69
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x14], 0x6f
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x14], 0x50
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x14], 0x57
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x64
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x14], 0x73
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x53
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x14], 0x74
mov ecx, 1
imul edx, ecx, 0xc
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0xd
jae 0x10006c4d
jmp 0x10006c52
call fcn.1001d926
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x14], 0
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x14], 0x6e
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x6f
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10006cad
mov ecx, dword [ebp + 0x20]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x18]
push edx
call fcn.100bc340
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1000bb50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x14], 0x73
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x14], 0x57
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x72
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x77
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x14], 0x50
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x14], 0x36
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x14], 0x63
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x14], 0x73
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x14], 0x6f
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x49
mov edx, 1
imul eax, edx, 0xe
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xf
jae 0x1000bbfb
jmp 0x1000bc00
call fcn.1001d926
mov ecx, dword [ebp - 0x20]
mov byte [ebp + ecx - 0x14], 0
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x6f
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x14], 0x34
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0x73
lea eax, [ebp - 0x14]
push eax
call fcn.100b94f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000bc63
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1000c2b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], 0xffffffff
mov eax, 1
imul ecx, eax, 0x15
mov byte [ebp + ecx - 0x20], 0x68
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x20], 0x6c
mov ecx, 1
imul edx, ecx, 0x18
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0x19
jae 0x1000c2f4
jmp 0x1000c2f9
call fcn.1001d926
mov eax, dword [ebp - 0x2c]
mov byte [ebp + eax - 0x20], 0
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x20], 0x68
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x20], 0x6f
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 0x14
mov byte [ebp + edx - 0x20], 0x73
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x20], 0x54
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x20], 0x6f
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x20], 0x70
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x20], 0x74
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x20], 0x61
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x20], 0x33
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x20], 0x43
mov ecx, 1
imul edx, ecx, 0x12
mov byte [ebp + edx - 0x20], 0x61
mov eax, 1
imul ecx, eax, 0x13
mov byte [ebp + ecx - 0x20], 0x70
mov edx, 1
imul eax, edx, 0x11
mov byte [ebp + eax - 0x20], 0x6e
mov ecx, 1
imul edx, ecx, 0xf
mov byte [ebp + edx - 0x20], 0x32
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x20], 0x6c
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x20], 0x65
mov ecx, 1
shl ecx, 4
mov byte [ebp + ecx - 0x20], 0x53
mov edx, 1
imul eax, edx, 0x17
mov byte [ebp + eax - 0x20], 0x74
mov ecx, 1
imul edx, ecx, 0x16
mov byte [ebp + edx - 0x20], 0x6f
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x20], 0x72
lea ecx, [ebp - 0x20]
push ecx
call fcn.100b94f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000c445
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1000c670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x14], 0x56
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x14], 0x69
mov ecx, 1
imul edx, ecx, 0xf
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0x10
jae 0x1000c6b4
jmp 0x1000c6b9
call fcn.1001d926
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x14], 0
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x14], 0x66
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0x6e
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x14], 0x6c
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x69
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x14], 0x4f
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x77
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x70
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x14], 0x55
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x6d
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x14], 0x61
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x14], 0x46
lea edx, [ebp - 0x14]
push edx
call fcn.100b94f0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000c78c
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1000c820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 1
call fcn.100bfca0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x1000c986
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x18], 0x6e
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x18], 0x73
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
imul edx, ecx, 0x11
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x12
jae 0x1000c882
jmp 0x1000c887
call fcn.1001d926
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax - 0x18], 0
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x18], 0x79
mov eax, 1
imul ecx, eax, 0xf
mov byte [ebp + ecx - 0x18], 0x67
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x18], 0x69
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x18], 0x51
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x18], 0x63
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x18], 0x72
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x18], 0x74
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], 0x6f
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x18], 0x72
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x75
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], 0x41
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
shl edx, 4
mov byte [ebp + edx - 0x18], 0x41
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x18], 0x53
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1000c97a
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.100bc340
add esp, 4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1000c9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 1
call fcn.100bdb20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000cace
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x14], 0x70
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x14], 0x4f
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x52
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x4b
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x79
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x14], 0x41
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x14], 0x65
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x14], 0x45
mov ecx, 1
imul edx, ecx, 0xd
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0xe
jae 0x1000ca51
jmp 0x1000ca56
call fcn.1001d926
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0x14], 0
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x65
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x14], 0x78
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x67
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x6e
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x1000cac2
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x18]
push edx
call fcn.100bc340
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1000cae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 1
call fcn.100bfca0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000cc13
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x53
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x14], 0x65
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x14], 0x75
mov eax, 1
imul ecx, eax, 0xe
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0xf
jae 0x1000cb43
jmp 0x1000cb48
call fcn.1001d926
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x14], 0
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x14], 0x48
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x14], 0x61
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x14], 0x6c
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x14], 0x74
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x14], 0x41
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x14], 0x65
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x14], 0x6c
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x14], 0x44
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x65
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x14], 0x56
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x1000cc07
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x18]
push edx
call fcn.100bc340
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x1000d6e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000d704
xor eax, eax
jmp 0x1000d784
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000d71b
xor eax, eax
jmp 0x1000d784
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x1000d767
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x1000d767
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1000d73e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x1000d773
xor eax, eax
jmp 0x1000d784
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x1000d781
xor eax, eax
jmp 0x1000d784
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1000e270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be528
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000e395
push 4
lea ecx, [ebp - 0x20]
call fcn.1000e180
lea ecx, [ebp - 0x20]
call fcn.1000e890
mov dword [ebp - 4], 0
push 0x70
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x72
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x6f
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x67
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x72
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x61
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x6d
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x69
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x6e
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x66
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x6f
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x73
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x2e
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x63
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x6f
lea ecx, [ebp - 0x20]
call fcn.1000ea50
push 0x6d
lea ecx, [ebp - 0x20]
call fcn.1000ea50
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000e8b0
mov edx, dword [ebp - 0x24]
or edx, 1
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.1000e950
mov eax, dword [ebp + 8]
jmp 0x1000e44e
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x1c], 0x73
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x1c], 0x63
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x1c], 0x6f
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x1c], 0x6d
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x1c], 0x73
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x1c], 0x70
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x1c], 0x6d
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x1c], 0x61
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x1c], 0x2e
mov eax, 1
imul ecx, eax, 0xa
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xb
jae 0x1000e41c
jmp 0x1000e421
call fcn.1001d926
mov edx, dword [ebp - 0x28]
mov byte [ebp + edx - 0x1c], 0
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x1c], 0x6f
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000e8d0
mov edx, dword [ebp - 0x24]
or edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x10014e0a
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov al, byte [ebx]
xor edi, edi
mov dword [ebp - 0x14], ebx
test al, al
je 0x10014f1c
mov ecx, dword [ebp + 0x10]
dec ecx
mov dword [ebp - 0x1c], ecx
cmp al, 0x24
je 0x10014e72
cmp al, 0x26
je 0x10014e72
cmp al, 0x2b
je 0x10014e72
cmp al, 0x2c
je 0x10014e72
cmp al, 0x2f
je 0x10014e72
cmp al, 0x3a
je 0x10014e72
cmp al, 0x3b
je 0x10014e72
cmp al, 0x3d
je 0x10014e72
cmp al, 0x3f
je 0x10014e72
cmp al, 0x40
je 0x10014e72
cmp al, 0x23
je 0x10014e72
cmp al, 0x20
je 0x10014e72
mov byte [esi], al
inc esi
inc edi
jmp 0x10014f0a
movsx eax, al
push eax
lea eax, [ebp - 0xc]
mov word [ebp - 0xa], 0x3025
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
mov word [ebp - 7], 0x78
push 4
push eax
mov word [ebp - 0xc], 0x2525
mov byte [ebp - 8], 0x32
call fcn.1001a929
lea ecx, [ebp - 0x10]
add esp, 0x14
and dword [ebp - 0x18], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10014eaa
sub ecx, edx
je 0x10014edf
mov ebx, dword [ebp - 0x18]
movsx eax, byte [ebp + ebx - 0x10]
push eax
call fcn.100217df
pop ecx
lea ecx, [ebp - 0x10]
mov byte [ebp + ebx - 0x10], al
inc ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10014ecf
sub ecx, edx
cmp ebx, ecx
jb 0x10014eb8
mov ebx, dword [ebp - 0x14]
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0x10]
sub eax, edi
push eax
push esi
call fcn.100215f7
lea ecx, [ebp - 0x10]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10014efa
sub ecx, edx
add esi, ecx
add edi, ecx
mov ecx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x14], ebx
cmp edi, ecx
jae 0x10014f1c
mov al, byte [ebx]
test al, al
jne 0x10014e39
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi], 0
xor ecx, ebp
pop esi
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015054
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x6c6c642e
push eax
mov dword [ebp - 0x14], 0x6e72654b
mov dword [ebp - 0x10], 0x32336c65
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015095
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0x6c6c642e
push eax
mov word [ebp - 0x14], 0x6441
mov dword [ebp - 0x11], 0x33697061
mov byte [ebp - 8], 0
mov byte [ebp - 0x12], 0x76
mov byte [ebp - 0xd], 0x32
call fcn.10016b99
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret
Function at 0x100150dd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69737265
push eax
mov dword [ebp - 0xa], 0x6c642e6e
mov word [ebp - 6], 0x6c
mov byte [ebp - 0x10], 0x56
mov byte [ebp - 0xb], 0x6f
call fcn.10016b99
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x10015165
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x7061
push eax
mov word [ebp - 7], 0x6c6c
mov word [ebp - 0xf], 0x6c68
mov word [ebp - 0xa], 0x2e69
mov byte [ebp - 5], 0
mov byte [ebp - 8], 0x64
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xd], 0x77
call fcn.10016b99
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x100153b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.10015014
mov esi, eax
test esi, esi
je 0x10015428
lea eax, [ebp - 0x1c]
mov word [ebp - 6], 0x77
push eax
push esi
mov dword [ebp - 0x14], 0x6765726f
mov dword [ebp - 0xf], 0x646e756f
mov dword [ebp - 0xb], 0x646e6957
mov byte [ebp - 7], 0x6f
mov word [ebp - 0x17], 0x7465
mov dword [ebp - 0x1c], 0x6b636f4c
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x18], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015421
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret

Function at 0x1001543a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100cf614]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
call fcn.10015014
mov esi, eax
test esi, esi
je 0x100154bb
lea eax, [ebp - 0x20]
mov word [ebp - 0x14], 0x7267
push eax
push esi
mov dword [ebp - 0x11], 0x57646e75
mov word [ebp - 0xd], 0x6e69
mov dword [ebp - 0x18], 0x65726f46
mov word [ebp - 0xa], 0x776f
mov word [ebp - 0x1a], 0x7465
mov word [ebp - 0x1d], 0x776f
mov word [ebp - 0x20], 0x6c41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 8], bl
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x1b], 0x53
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100154b4
push dword [ebp + 8]
call eax
mov ebx, eax
push esi
call fcn.10016bf9
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.10019cf8
mov esp, ebp
pop ebp
ret