joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100572fc
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0xe
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x1014f4f0]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0xe
jb 0x10057331
mov eax, esi
call fcn.10110871
ret 4
Function at 0x1005a707
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x1011e669
call fcn.101108a8
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 8]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0xf
mov byte [edi], bl
mov eax, dword [ebp + 0x10]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 1
test eax, eax
je 0x1005a88d
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x1005a7d6
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], ch
cmp dword [0x101e0f4c], 0x10
mov ecx, 0x101e0f38
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x101e0f38]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.1003a3c0
inc edi
cmp edi, 4
jl 0x1005a79e
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1005a741
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x1005a88d
mov eax, edi
cmp edi, esi
jge 0x1005a80c
cmp eax, esi
jae 0x1005a898
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x1005a7f4
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x1005a878
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x101e0f4c], 0x10
mov ecx, 0x101e0f38
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x101e0f38]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.1003a3c0
inc ebx
cmp ebx, edi
jl 0x1005a849
mov edi, dword [ebp - 0x1c]
push 3
pop esi
cmp edi, esi
jge 0x1005a88d
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.1003a3c0
sub esi, 1
jne 0x1005a87e
mov eax, dword [ebp + 8]
call fcn.10110871
ret 0xc
call fcn.1003a3c0
int3
Function at 0x1005b560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x1005b6bf
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov edi, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x1005b6bf
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x1005b5df
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x1005b6ce
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x1005b5fc
mov dl, bl
xor edi, edi
jmp 0x1005b62c
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, di
ja 0x1005b5ce
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x1005b5d1
mov edx, ebx
cmp ebx, 0x800
jae 0x1005b611
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x1005b62c
cmp ebx, 0x10000
jae 0x1005b623
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x1005b62b
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 0xc]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 8]
jl 0x1005b6bf
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x1005b663
cmp edi, 3
jae 0x1005b66e
mov eax, dword [esi]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x1005b671
mov eax, dword [ebp - 8]
test eax, eax
je 0x1005b696
imul ecx, edi, 6
sub ecx, 6
mov edx, ebx
dec eax
shr edx, cl
mov dword [ebp - 8], eax
and dl, 0x3f
mov eax, dword [esi]
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 8]
test eax, eax
jg 0x1005b678
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x1005b589
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x1005b6c7
Function at 0x1005cc55
Capabilities:
Set http header

Disassembly:
push 0x4c
mov eax, 0x1011eba8
call fcn.101108dc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [edi]
mov edi, dword [edi + 4]
jmp 0x1005cd16
push 0x101506d8
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.1003a3c0
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.1003a3c0
add esp, 0x18
lea ecx, [ebp - 0x58]
call fcn.10015273
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.1003a3c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
pop ecx
cmovae eax, dword [ebp - 0x28]
pop ecx
push 0x20000000
push 0xffffffffffffffff
push eax
push dword [ebx]
call dword [sym.imp.winhttp.dll_WinHttpAddRequestHeaders]
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x1005ccf6
lea eax, [eax*2 + 2]
push eax
push dword [ebp - 0x28]
call fcn.1003a3c0
pop ecx
pop ecx
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x40]
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.10015273
add esi, 0x30
cmp esi, edi
jne 0x1005cc71
mov al, 1
call fcn.10110886
ret
Function at 0x10071a56
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x10071ab6
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x10071ab5
cmp eax, 0x29
jne 0x10071aba
cmp dword [esi + 0x10], 0
jne 0x10071ab5
test dword [esi + 0x50], edx
je 0x10071bb2
cmp eax, 0x5d
jne 0x10071a90
test dword [esi + 0x50], edx
je 0x10071ba6
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1003a3c0
mov ecx, esi
call fcn.10073abf
mov ecx, esi
call fcn.1003a3c0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10071a64
pop ebx
mov al, cl
pop esi
ret
cmp eax, 0x2e
jne 0x10071acb
push 5
lea ecx, [esi + 0x24]
call fcn.1003a3c0
jmp 0x10071a9d
cmp eax, 0x5c
jne 0x10071b17
mov ecx, esi
call fcn.10073abf
test byte [esi + 0x50], 0x80
je 0x10071b0e
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x10071af7
push 4
lea ecx, [esi + 0x24]
call fcn.1003a3c0
mov ecx, esi
call fcn.10073abf
jmp 0x10071aab
cmp al, 0x42
jne 0x10071b0e
push 4
lea ecx, [esi + 0x24]
call fcn.1003a3c0
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x10071aee
mov ecx, esi
call fcn.10071bbc
jmp 0x10071aa4
cmp eax, 0x5b
jne 0x10071b3a
mov ecx, esi
call fcn.10073abf
mov ecx, esi
call fcn.10072094
push 4
push 0x5d
mov ecx, esi
call fcn.1003a3c0
jmp 0x10071aa4
cmp eax, 0x28
jne 0x10071b67
mov ecx, esi
call fcn.10073abf
mov ecx, esi
call fcn.10073f55
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.1003a3c0
test bl, bl
je 0x10071aab
jmp 0x10071aa4
cmp eax, 0x5e
jne 0x10071b73
push 2
jmp 0x10071ae6
cmp eax, 0x24
jne 0x10071b7f
push 3
jmp 0x10071ae6
cmp eax, 0x2a
je 0x10071baa
cmp eax, 0x2b
je 0x10071baa
cmp eax, 0x3f
je 0x10071baa
cmp eax, 0x7b
je 0x10071baa
cmp eax, 0x7d
jne 0x10071a82
test dword [esi + 0x50], edx
je 0x10071bae
jmp 0x10071a90
push 4
jmp 0x10071bb4
push 0xa
jmp 0x10071bb4
push 6
jmp 0x10071bb4
push 5
mov ecx, esi
call fcn.1003a3c0
int3
Function at 0x10088290
Capabilities:
Check mutex on windows

Disassembly:
push 0
mov eax, 0x10125c3a
call fcn.101108a8
mov esi, ecx
mov eax, dword [esi]
xor edi, edi
mov dword [ebp - 4], edi
test eax, eax
jne 0x100882e4
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push edi
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x100882e4
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 5
jne 0x100882e4
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push edi
push edi
call dword [sym.imp.kernel32.dll_OpenMutexW]
mov dword [esi], eax
cmp dword [esi], edi
lea ecx, [ebp + 8]
setne bl
call fcn.10015273
mov al, bl
call fcn.10110871
ret 0x18

Function at 0x1008b080
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 9
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x10154a10]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 9
jb 0x1008b0b5
mov eax, esi
call fcn.10110871
ret 4
Function at 0x1008c400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x101d9548]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
mov esi, ecx
cmp bx, di
jne 0x1008c429
xor eax, eax
jmp 0x1008c4f1
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1008c451
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x1008c451
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_unsigned_short_int____thiscall_std::basic_streambuf_unsigned_short_int__struct_std::char_traits_unsigned_short_int__::_Pninc_void_]
mov word [eax], di
mov ax, di
jmp 0x1008c4f1
cmp dword [esi + 0x4c], 0
je 0x1008c4ee
mov ecx, esi
call fcn.1008c335
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1008c47d
push dword [esi + 0x4c]
push edi
call fcn.1003a3c0
pop ecx
pop ecx
test al, al
je 0x1008c4ee
movzx ebx, di
jmp 0x1008c4ee
lea eax, [ebp - 0x2c]
mov word [ebp - 0x28], di
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_unsigned_short_int__char__struct__Mbstatet_::out_struct__Mbstatet___unsigned_short_int_const___unsigned_short_int_const___unsigned_short_int_const____char___char___char___const]
sub eax, 0
je 0x1008c4bb
sub eax, 1
je 0x1008c4bb
dec eax
sub eax, 1
jne 0x1008c4ee
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x1008c46d
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x1008c4df
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x1008c4ee
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
mov ax, di
jne 0x1008c4f1
mov ax, bx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10110860
leave
ret 4
Function at 0x1009a5a1
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0xb
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x10155b80]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0xb
jb 0x1009a5d6
mov eax, esi
call fcn.10110871
ret 4

Function at 0x1009a607
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0xa
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x10155b80]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0xa
jb 0x1009a63c
mov eax, esi
call fcn.10110871
ret 4
Function at 0x100b1baa
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0x55
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x101566c0]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0x55
jb 0x100b1bdf
mov eax, esi
call fcn.10110871
ret 4

Function at 0x100b1c10
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0x3c
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x101566c0]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0x3c
jb 0x100b1c45
mov eax, esi
call fcn.10110871
ret 4

Function at 0x100b1c76
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0x39
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x101566c0]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0x39
jb 0x100b1cab
mov eax, esi
call fcn.10110871
ret 4
Function at 0x100c794f
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0x51
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x10157f98]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0x51
jb 0x100c7984
mov eax, esi
call fcn.10110871
ret 4
Function at 0x100d8971
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x100d8983
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x100d89c8
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, 0x7fffffff
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
and dword [esi], 0
pop esi
pop ebx
ret

Function at 0x100d8a3c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
lea edx, [ecx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100d8a45
pop esi
ret

Function at 0x100db3d7
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0x1e
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x1019ee10]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0x1e
jb 0x100db40c
mov eax, esi
call fcn.10110871
ret 4

Function at 0x100db43d
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0x14
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x1019ee10]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0x14
jb 0x100db472
mov eax, esi
call fcn.10110871
ret 4
Function at 0x100e4f9b
Capabilities:
Encode data using xor

Disassembly:
push 4
mov eax, 0x1011814c
call fcn.101108a8
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
push 0x4d
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], 1
call fcn.1003a3c0
xor edx, edx
mov ecx, 0x10e
mov eax, ebx
div ecx
mov al, byte [edx + 0x1019f7b8]
xor al, byte [ebx + edi]
movzx ecx, al
push ecx
push 1
mov ecx, esi
call fcn.1003a3c0
inc ebx
cmp ebx, 0x4d
jb 0x100e4fd0
mov eax, esi
call fcn.10110871
ret 4

Function at 0x100ea5b4
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100ea614
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100ea613
cmp eax, 0x29
jne 0x100ea618
cmp dword [esi + 0x10], 0
jne 0x100ea613
test dword [esi + 0x50], edx
je 0x100ea713
cmp eax, 0x5d
jne 0x100ea5ee
test dword [esi + 0x50], edx
je 0x100ea707
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1003a3c0
mov ecx, esi
call fcn.100ec5c9
mov ecx, esi
call fcn.1003a3c0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x100ea5c2
pop ebx
mov al, cl
pop esi
ret
cmp eax, 0x2e
jne 0x100ea629
push 5
lea ecx, [esi + 0x24]
call fcn.1003a3c0
jmp 0x100ea5fb
cmp eax, 0x5c
jne 0x100ea678
mov ecx, esi
call fcn.100ec5c9
test byte [esi + 0x50], 0x80
je 0x100ea66f
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x100ea657
push 4
lea ecx, [esi + 0x24]
call fcn.1003a3c0
mov ecx, esi
call fcn.100ec5c9
jmp 0x100ea609
cmp eax, 0x42
jne 0x100ea66f
push 4
lea ecx, [esi + 0x24]
call fcn.1003a3c0
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100ea64e
mov ecx, esi
call fcn.100ea71d
jmp 0x100ea602
cmp eax, 0x5b
jne 0x100ea69b
mov ecx, esi
call fcn.100ec5c9
mov ecx, esi
call fcn.100ea989
push 4
push 0x5d
mov ecx, esi
call fcn.1003a3c0
jmp 0x100ea602
cmp eax, 0x28
jne 0x100ea6c8
mov ecx, esi
call fcn.100ec5c9
mov ecx, esi
call fcn.100eccf2
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.1003a3c0
test bl, bl
je 0x100ea609
jmp 0x100ea602
cmp eax, 0x5e
jne 0x100ea6d4
push 2
jmp 0x100ea646
cmp eax, 0x24
jne 0x100ea6e0
push 3
jmp 0x100ea646
cmp eax, 0x2a
je 0x100ea70b
cmp eax, 0x2b
je 0x100ea70b
cmp eax, 0x3f
je 0x100ea70b
cmp eax, 0x7b
je 0x100ea70b
cmp eax, 0x7d
jne 0x100ea5e0
test dword [esi + 0x50], edx
je 0x100ea70f
jmp 0x100ea5ee
push 4
jmp 0x100ea715
push 0xa
jmp 0x100ea715
push 6
jmp 0x100ea715
push 5
mov ecx, esi
call fcn.1003a3c0
int3
Function at 0x100ea989
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x24]
call fcn.1003a3c0
cmp dword [esi + 0x4c], 0x5e
jne 0x100ea9a9
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.100ec5c9
test dword [esi + 0x50], 0x20000000
je 0x100ea9c9
cmp dword [esi + 0x4c], 0x5d
jne 0x100ea9c9
push 0x5d
lea ecx, [esi + 0x24]
call fcn.1003a3c0
mov ecx, esi
call fcn.100ec5c9
pop edi
mov ecx, esi
pop esi
jmp 0x100eac76
push edi
mov edi, ecx
call fcn.100eab47
test eax, eax
je 0x100ead37
push esi
cmp eax, 2
je 0x100ead0a
cmp dword [edi + 0x44], 0
jne 0x100eac9f
test dword [edi + 0x50], 0x100000
je 0x100ead39
cmp dword [edi + 0x4c], 0x2d
jne 0x100eacfd
mov ecx, edi
call fcn.100ec5c9
movzx esi, word [edi + 0x44]
mov ecx, edi
call fcn.100eab47
test eax, eax
je 0x100ead1f
cmp eax, 2
je 0x100ead1b
test dword [edi + 0x40], 0x800
je 0x100eace8
movzx eax, word [edi + 0x44]
mov ecx, dword [edi + 0x3c]
push eax
call fcn.1003a3c0
mov ecx, dword [edi + 0x3c]
movzx eax, ax
push esi
mov dword [edi + 0x44], eax
call fcn.1003a3c0
movzx esi, ax
movzx eax, word [edi + 0x44]
cmp ax, si
jb 0x100ead1b
push eax
push esi
lea ecx, [edi + 0x24]
call fcn.1003a3c0
jmp 0x100ead0a
movzx eax, word [edi + 0x44]
lea ecx, [edi + 0x24]
push eax
call fcn.1003a3c0
mov ecx, edi
call fcn.100eab47
test eax, eax
jne 0x100eac87
jmp 0x100ead36
push 8
jmp 0x100ead3b
movzx eax, word [edi + 0x44]
lea ecx, [edi + 0x24]
push eax
call fcn.1003a3c0
push 0x2d
lea ecx, [edi + 0x24]
call fcn.1003a3c0
pop esi
pop edi
ret
push 2
mov ecx, edi
call fcn.1003a3c0
int3