joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006f9b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
mov eax, dword [0x101a8cb0]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x88]
push ebx
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov esi, dword [esp + 0x8c]
push edi
mov edi, dword [esp + 0x7c]
push 0x54
xor ebx, ebx
lea edx, [esp + 0x24]
push ebx
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], ecx
call fcn.1002a420
push 0x68
push esi
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x4000
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
call fcn.10009ed0
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x1006fa4f
push 0x17f6
push str..pdu.c
push 0x66
push 0x40003
call fcn.10002e30
add esp, 0x10
pop edi
pop esi
pop ebp
lea eax, [ebx + 0x66]
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1002aab0
add esp, 0x68
ret
push 0x68
push ebx
push esi
call fcn.1002a420
mov dword [esi], edi
mov eax, dword [edi]
mov dword [esp + 0x24], eax
mov cl, byte [esp + 0x27]
mov dl, byte [esp + 0x26]
mov byte [edi], cl
mov byte [edi + 2], ah
mov byte [edi + 3], al
mov eax, dword [esp + 0x20]
mov byte [edi + 1], dl
xor ecx, ecx
lea ebx, [esi + 4]
mov dword [ebx], ecx
mov dword [esi + 0x64], ecx
add dword [eax], 6
mov eax, dword [ebp]
add esp, 0xc
add edi, 6
cmp eax, ecx
jne 0x1006fa99
mov dword [ebp], esi
mov dword [esi + 0x60], ecx
jmp 0x1006faae
cmp dword [eax + 0x64], ecx
je 0x1006faa8
mov edi, edi
mov eax, dword [eax + 0x64]
cmp dword [eax + 0x64], ecx
jne 0x1006faa0
mov dword [eax + 0x64], esi
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x10]
push eax
push esi
call fcn.10068c70
movzx ebp, ax
mov ecx, 0x19a
add esp, 8
cmp bp, cx
jne 0x1006fae6
push 0x1816
push str..pdu.c
push str.DPParsePresDataItem.
push ecx
push 0x40003
call fcn.10002bc0
add esp, 0x14
mov ecx, dword [esi]
mov dl, byte [ecx + 5]
test dl, 1
je 0x1006faf6
lea eax, [esp + 0x20]
jmp 0x1006fb02
mov eax, dword [esp + 0x10]
test bp, bp
jne 0x1006fb02
lea eax, [esi + 0xc]
mov ebp, dword [ecx]
sub ebp, 2
cmp word [esp + 0x94], 0
je 0x1006fb81
test dl, 2
je 0x1006fb81
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x90]
push edx
add eax, 6
push eax
push 0
lea ecx, [esp + 0x20]
push ecx
push ebp
push ebx
push edi
mov dword [esp + 0x30], 0
call fcn.1006f600
movzx edi, ax
add esp, 0x20
test di, di
je 0x1006fb78
push 0x1832
push str..pdu.c
push edi
push 0x40003
call fcn.10002e30
add esp, 0x10
mov ax, di
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1002aab0
add esp, 0x68
ret
mov dword [esi + 8], 1
jmp 0x1006fb88
mov dword [esi + 8], 2
mov eax, dword [esp + 0x14]
add dword [eax], ebp
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1002aab0
add esp, 0x68
ret
Function at 0x10071660
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8118
call fcn.100352e0
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x1007168d
mov eax, dword [ebp + 8]
push eax
call fcn.1002d6f0
add esp, 4
test eax, eax
jne 0x10071697
mov eax, 1
jmp 0x100717c1
push 0x101aaa64
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003c90
add esp, 8
mov dword [ebp - 0x8114], eax
cmp dword [ebp - 0x8114], 0
jne 0x100716be
xor eax, eax
jmp 0x100717c1
push 0x8000
push 0
lea edx, [ebp - 0x8108]
push edx
mov eax, dword [ebp - 0x8114]
push eax
call fcn.100356e0
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
xor edx, edx
mov word [ebp - 0x8110], dx
movzx eax, word [ebp - 0x8110]
mov byte [ebp + eax - 0x108], 0
mov ecx, 1
test ecx, ecx
je 0x10071778
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x8110]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x810c]
push edx
lea eax, [ebp - 0x8118]
push eax
mov ecx, dword [ebp - 0x8114]
push ecx
call fcn.10071530
add esp, 0x18
mov word [ebp - 4], ax
movzx edx, word [ebp - 4]
test edx, edx
je 0x10071742
jmp 0x10071778
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x810c]
push edx
mov eax, dword [ebp - 0x8118]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1006de00
add esp, 0x1c
mov word [ebp - 4], ax
movzx edx, word [ebp - 4]
test edx, edx
je 0x10071776
jmp 0x10071778
jmp 0x100716fc
mov eax, dword [ebp - 0x8114]
push eax
call fcn.1002ac50
add esp, 4
movzx ecx, word [ebp - 4]
cmp ecx, 0xcc
jne 0x10071799
xor eax, eax
jmp 0x100717c1
movzx edx, word [ebp - 4]
test edx, edx
je 0x100717bd
push 0x3b4
push str..Rdiodata.c
movzx eax, word [ebp - 4]
push eax
push 0x40003
call fcn.10002e30
add esp, 0x10
mov ax, word [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x10075f50
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 8], eax
push str.DICOM.DIC
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x278]
push ecx
call fcn.10066340
add esp, 0xc
mov word [ebp - 4], ax
movzx edx, word [ebp - 4]
test edx, edx
je 0x10075fb5
cmp dword [0x10155218], 0
je 0x10075fac
push 0x62a
push 0x101ab0c4
movzx eax, word [ebp - 4]
push eax
push 0x40003
call fcn.10002e30
add esp, 0x10
mov ax, word [ebp - 4]
jmp 0x100760a5
mov byte [ebp - 0x108], 0
xor ecx, ecx
mov word [ebp - 0x10c], cx
mov edx, 1
test edx, edx
je 0x10076092
movzx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x278]
push edx
call fcn.100757b0
add esp, 0x18
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
cmp eax, 0xcc
jne 0x10076018
xor ecx, ecx
mov word [ebp - 4], cx
jmp 0x10076092
movzx edx, word [ebp - 4]
test edx, edx
je 0x10076047
cmp dword [0x10155218], 0
je 0x10076045
push 0x63c
push 0x101ab0d0
movzx eax, word [ebp - 4]
push eax
push 0x40003
call fcn.10002e30
add esp, 0x10
jmp 0x10076092
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x110]
push edx
call fcn.10075cf0
add esp, 8
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
test eax, eax
je 0x1007608d
cmp dword [0x10155218], 0
je 0x1007608b
push 0x644
push 0x101ab0dc
movzx ecx, word [ebp - 4]
push ecx
push 0x40003
call fcn.10002e30
add esp, 0x10
jmp 0x10076092
jmp 0x10075fc5
lea edx, [ebp - 0x278]
push edx
call fcn.10066620
add esp, 4
mov ax, word [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x1007a500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x101a8cb0]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x84]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x8c]
push edi
push 0x54
xor ebp, ebp
lea ecx, [esp + 0x38]
push ebp
push ecx
mov dword [esp + 0x1c], eax
call fcn.1002a420
mov edi, 1
push edi
push ebp
push esi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], 0x4000
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], ebp
call fcn.1000c5c0
lea edx, [esp + 0x4c]
push edx
mov ebx, eax
push esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.10079e30
add esp, 0x2c
test eax, eax
jl 0x1007a643
mov eax, 0xfffe
cmp word [esp + 0x1c], ax
jne 0x1007a643
mov ecx, 0xe000
cmp word [esp + 0x1e], cx
jne 0x1007a643
mov eax, dword [esp + 0x20]
cmp eax, ebp
jbe 0x1007a5b0
push edi
push eax
push esi
call fcn.1000c5c0
add esp, 0xc
mov edi, edi
lea edx, [esp + 0x34]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.10079e30
add esp, 0x14
test eax, eax
jl 0x1007a5f5
mov eax, 0xfffe
cmp word [esp + 0x1c], ax
jne 0x1007a5f5
mov ax, word [esp + 0x1e]
mov ecx, 0xe000
cmp ax, cx
jne 0x1007a5f9
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
jne 0x1007a5a3
push 0
jmp 0x1007a644
mov edx, 0xe0dd
cmp ax, dx
jne 0x1007a5f5
cmp dword [esp + 0x20], ebp
je 0x1007a60e
mov ebp, 2
push edi
push 0
push esi
call fcn.1000c5c0
push 0
mov edi, eax
push ebx
push esi
sub edi, ebx
call fcn.1000c5c0
mov eax, dword [esp + 0x28]
add esp, 0x18
mov dword [eax], edi
pop edi
pop esi
mov ax, bp
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1002aab0
add esp, 0x7c
ret
push ebp
push ebx
push esi
call fcn.1000c5c0
mov ecx, dword [esp + 0x94]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 2
call fcn.1002aab0
add esp, 0x7c
ret
Function at 0x100867e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x101a8cb0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x114], ax
mov byte [ebp - 0x110], 0
lea ecx, [ebp - 0x110]
push ecx
call fcn.10065ac0
add esp, 4
push 0
push 0xa66
push 0x101ab970
lea edx, [ebp - 0x110]
push edx
call fcn.10004aa0
add esp, 0x10
movsx eax, byte [ebp + eax - 0x111]
cmp eax, 0x5c
je 0x10086889
push 0
push 0xa66
push 0x101ab97c
lea ecx, [ebp - 0x110]
push ecx
call fcn.10004aa0
add esp, 0x10
movsx edx, byte [ebp + eax - 0x111]
cmp edx, 0x2f
je 0x10086889
lea eax, [ebp - 0x110]
push eax
call fcn.1002d6f0
add esp, 4
test eax, eax
jbe 0x10086889
push 0x101ab988
lea ecx, [ebp - 0x110]
push ecx
call fcn.10003e40
add esp, 8
push str.CE16.DLL
lea edx, [ebp - 0x110]
push edx
call fcn.10003e40
add esp, 8
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x101ccb74], eax
cmp dword [0x101ccb74], 0
jne 0x100868c2
mov eax, 0xd
jmp 0x100869a3
push str.Comp16
mov ecx, dword [0x101ccb74]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101ccb48], eax
cmp dword [0x101ccb48], 0
jne 0x100868ee
mov edx, 0xe
mov word [ebp - 0x114], dx
push str.Comp16_BufToBuf
mov eax, dword [0x101ccb74]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101ccb4c], eax
cmp dword [0x101ccb4c], 0
jne 0x10086919
mov ecx, 0xe
mov word [ebp - 0x114], cx
push str.Decomp16
mov edx, dword [0x101ccb74]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101ccb50], eax
cmp dword [0x101ccb50], 0
jne 0x10086945
mov eax, 0xe
mov word [ebp - 0x114], ax
push str.Decomp16_GetDim
mov ecx, dword [0x101ccb74]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101ccb54], eax
cmp dword [0x101ccb54], 0
jne 0x10086971
mov edx, 0xe
mov word [ebp - 0x114], dx
push str.Decomp16_BufToBuf
mov eax, dword [0x101ccb74]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x101ccb58], eax
cmp dword [0x101ccb58], 0
jne 0x1008699c
mov ecx, 0xe
mov word [ebp - 0x114], cx
mov ax, word [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002aab0
mov esp, ebp
pop ebp
ret
Function at 0x100bb740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [ebp + 8], 0
je 0x100bb75c
mov eax, dword [ebp + 8]
push eax
call fcn.1002d6f0
add esp, 4
test eax, eax
jne 0x100bb766
mov eax, 1
jmp 0x100bb87f
push 0x101b023c
mov ecx, dword [ebp + 8]
push ecx
call fcn.10003c90
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100bb78a
mov eax, 0xc9
jmp 0x100bb87f
mov edx, dword [ebp - 4]
push edx
push 1
push 2
lea eax, [ebp - 0x40]
push eax
call fcn.10032e00
add esp, 0x10
cmp eax, 1
je 0x100bb7b9
mov ecx, dword [ebp - 4]
push ecx
call fcn.1002ac50
add esp, 4
mov eax, 0xca
jmp 0x100bb87f
movzx edx, word [ebp - 0x40]
cmp edx, 0x4d42
je 0x100bb7e6
movzx eax, word [ebp - 0x40]
cmp eax, 0x4952
je 0x100bb7e6
mov ecx, dword [ebp - 4]
push ecx
call fcn.1002ac50
add esp, 4
mov eax, 0xb
jmp 0x100bb87f
movzx edx, word [ebp - 0x40]
cmp edx, 0x4952
jne 0x100bb7fd
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
jmp 0x100bb806
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
mov edx, dword [ebp - 4]
push edx
push 0xc
push 1
lea eax, [ebp - 0x3e]
push eax
call fcn.10032e00
add esp, 0x10
cmp eax, 0xc
je 0x100bb832
mov ecx, dword [ebp - 4]
push ecx
call fcn.1002ac50
add esp, 4
mov eax, 0xca
jmp 0x100bb87f
mov edx, dword [ebp - 4]
push edx
push 0x2c
push 1
lea eax, [ebp - 0x30]
push eax
call fcn.10032e00
add esp, 0x10
cmp eax, 0x2c
je 0x100bb85e
mov ecx, dword [ebp - 4]
push ecx
call fcn.1002ac50
add esp, 4
mov eax, 0xca
jmp 0x100bb87f
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x36]
mov dword [edx], eax
mov ecx, dword [ebp - 0x3e]
sub ecx, dword [ebp - 0x36]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
push eax
call fcn.1002ac50
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100bfb30
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
jle 0x100bfb9a
mov eax, dword [ebp + 0xc]
movsx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov dword [ebp + 8], ecx
mov dword [ebp - 4], 0
jmp 0x100bfb5e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 8
jge 0x100bfb86
mov eax, dword [ebp + 8]
and eax, 1
je 0x100bfb7c
mov ecx, dword [ebp + 8]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp + 8], ecx
jmp 0x100bfb84
mov edx, dword [ebp + 8]
shr edx, 1
mov dword [ebp + 8], edx
jmp 0x100bfb55
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
jmp 0x100bfb34
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x100bfcc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x10], 0x7d00
lea eax, [ebp - 0x20]
push eax
call fcn.10009b30
add esp, 4
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
test ecx, ecx
je 0x100bfcee
mov ax, word [ebp - 4]
jmp 0x100bfe2d
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.10009ed0
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x100bfd1d
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.10009d90
add esp, 4
mov eax, 0x66
jmp 0x100bfe2d
push 0x101b0a64
mov edx, dword [ebp + 8]
push edx
call fcn.10003c90
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100bfd4d
mov eax, dword [ebp - 0x20]
push eax
call fcn.10009d90
add esp, 4
mov eax, 0xc9
jmp 0x100bfe2d
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10033a60
add esp, 0xc
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffff
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp + 0x10]
jae 0x100bfe06
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 0x18]
cmp dword [ebp - 0x10], edx
jae 0x100bfd8e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
jmp 0x100bfd97
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 0x1c]
push edx
call fcn.10032e00
add esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jae 0x100bfddd
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.10009d90
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.1002ac50
add esp, 4
mov eax, 2
jmp 0x100bfe2d
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
push eax
call fcn.100bfc10
add esp, 0xc
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
jmp 0x100bfd6f
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
xor ecx, 0xffffffff
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1002ac50
add esp, 4
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.10009d90
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100c0050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.100c0100
add esp, 4
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x20]
xor ecx, dword [ebp - 8]
push ecx
call fcn.10035310
add esp, 4
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
cmp eax, dword [ebp - 0x14]
jae 0x100c0093
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
jmp 0x100c00a5
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jae 0x100c00e6
call fcn.10035330
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + 1]
add ecx, eax
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + 2]
mov edx, dword [ebp - 0xc]
movzx edx, byte [edx + 3]
sub eax, edx
xor ecx, eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
mov byte [eax], cl
jmp 0x100c009c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100c0300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
jmp 0x100c0318
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x100
jae 0x100c032e
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 4]
mov dl, byte [ebp - 4]
mov byte [ecx], dl
jmp 0x100c030f
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
jmp 0x100c0347
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
jae 0x100c03cc
mov dword [ebp - 0x10], 0
jmp 0x100c035f
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x100
jae 0x100c03c7
mov eax, dword [ebp - 0xc]
xor edx, edx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
xor ecx, eax
and ecx, 0xff
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
je 0x100c03bc
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ebp - 0x11], al
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
mov dl, byte [ebp - 0x11]
mov byte [ecx], dl
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x100c0356
jmp 0x100c033e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100c1390
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 2
push str.PROT_
mov edx, dword [ebp - 8]
push edx
call fcn.10003cb0
add esp, 8
mov eax, dword [ebp - 8]
push eax
call fcn.1002d6f0
add esp, 4
add eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
test edx, edx
je 0x100c14d8
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
sub ecx, 0x30
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 1
jne 0x100c13ff
mov dword [ebp - 0x10], 5
jmp 0x100c148d
cmp dword [ebp - 0x10], 2
jne 0x100c140e
mov dword [ebp - 0x10], 8
jmp 0x100c148d
cmp dword [ebp - 0x10], 3
jne 0x100c141d
mov dword [ebp - 0x10], 1
jmp 0x100c148d
cmp dword [ebp - 0x10], 4
jne 0x100c142c
mov dword [ebp - 0x10], 9
jmp 0x100c148d
cmp dword [ebp - 0x10], 5
jne 0x100c143b
mov dword [ebp - 0x10], 2
jmp 0x100c148d
cmp dword [ebp - 0x10], 6
jne 0x100c144a
mov dword [ebp - 0x10], 3
jmp 0x100c148d
cmp dword [ebp - 0x10], 7
jne 0x100c1459
mov dword [ebp - 0x10], 6
jmp 0x100c148d
cmp dword [ebp - 0x10], 8
jne 0x100c1468
mov dword [ebp - 0x10], 4
jmp 0x100c148d
cmp dword [ebp - 0x10], 9
jne 0x100c1477
mov dword [ebp - 0x10], 0
jmp 0x100c148d
cmp dword [ebp - 0x10], 0
jne 0x100c1486
mov dword [ebp - 0x10], 7
jmp 0x100c148d
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
cdq
mov ecx, 0xa
idiv ecx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x14], 0
je 0x100c14b0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [edx], cl
jmp 0x100c14bb
mov edx, dword [ebp - 0x10]
add edx, 0x30
mov eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x100c13cc
mov ecx, dword [ebp - 8]
mov byte [ecx], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100ce270
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x12], 0xca
jne 0x100ce2ba
mov ecx, dword [ebp + 8]
push ecx
call fcn.100cd090
add esp, 4
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x3e]
test eax, eax
je 0x100ce2b0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x12], 0xcf
mov al, 1
jmp 0x100ce3ee
mov edx, dword [ebp + 8]
mov dword [edx + 0x12], 0xcb
mov eax, dword [ebp + 8]
cmp dword [eax + 0x12], 0xcb
jne 0x100ce3a3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x188]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x100ce395
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x100ce302
mov esi, esp
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
call edx
add esp, 4
cmp esi, esp
call fcn.1002a390
mov esi, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x188]
mov eax, dword [edx]
call eax
add esp, 4
cmp esi, esp
call fcn.1002a390
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100ce32f
xor al, al
jmp 0x100ce3ee
cmp dword [ebp - 4], 2
jne 0x100ce337
jmp 0x100ce395
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x100ce390
cmp dword [ebp - 4], 3
je 0x100ce34c
cmp dword [ebp - 4], 1
jne 0x100ce390
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 4]
add ecx, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [edx + 4]
cmp edx, dword [ecx + 8]
jl 0x100ce390
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
add edx, dword [eax + 0x114]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
mov dword [eax + 8], edx
jmp 0x100ce2df
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x76]
mov dword [ecx + 0x7e], eax
jmp 0x100ce3e2
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x12], 0xcc
je 0x100ce3e2
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax + 0x14], 0x14
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x12]
mov dword [edx + 0x18], ecx
mov esi, esp
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
call edx
add esp, 4
cmp esi, esp
call fcn.1002a390
mov eax, dword [ebp + 8]
push eax
call fcn.100ce400
add esp, 4
pop esi
add esp, 4
cmp ebp, esp
call fcn.1002a390
mov esp, ebp
pop ebp
ret