joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100c9c48
mov edi, ecx
jmp loc.101e4538

Function at 0x1005a520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100c9c48
jmp loc.102215c5

Function at 0x1005a6a0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c2f20
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc
mov eax, 0x4ff4
call fcn.100c0ef0
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x4600], edi
mov dword [ebp - 0x4b10], edi
push 0x100c9c48
jmp loc.10221153

Function at 0x1005d890
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], ecx
push 0x100c9c48
jmp loc.10252071

Function at 0x1005e050
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], ecx
push 0x100c9c48
jmp fcn.101ad002

Function at 0x1005e820
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], ecx
push 0x100c9c48
jmp loc.1019d3cb

Function at 0x1005eff0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x80], ecx
push 0x100c9c48
jmp fcn.10196394

Function at 0x1005f7c0
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x88], ecx
push 0x100c9c48
jmp fcn.101a64cb

Function at 0x10060000
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84], ecx
push 0x100c9c48
jmp loc.10241810
Function at 0x10061250
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84], ecx
push 0x100c9c48
jmp 0x10086d11
lea esp, [esp + 4]
and ch, 0x91
nop
cwde
mov eax, dword [ebp - 0x84]
btr cx, si
bsf ecx, edx
sub dh, 0x9f
mov ecx, dword [eax + 0xc]
or edx, eax
add ecx, 1
cmc
mov edx, dword [ebp - 0x84]
test cx, 0x4ea9
cmc
cmp cl, bh
cmp ecx, dword [edx + 4]
jmp 0x100a3e82
jbe 0x10253bd5
mov eax, dword [0x1011a58c]
adc cl, 0x3d
sal cx, cl
mov ecx, dword [eax + 0x4c0]
test cx, 0x558c
cmp bh, 0xa5
mov dword [ebp - 0xa8], ecx
jmp loc.101b0f4a
add edx, 1
cbw
cwde
cmovb eax, ebp
mov eax, dword [ebp - 0x84]
mov dword [eax + 0xc], edx
mov al, byte [ebp - 0x7c]
jmp fcn.10022c26
mov edx, dword [ebp - 0x84]
movzx ecx, si
add ch, 0xa3
mov eax, dword [edx]
bts ecx, esi
mov ecx, dword [ebp - 0x84]
sub dx, sp
ror dh, 0x14
mov edx, dword [ecx + 0xc]
bswap ecx
mov al, byte [eax + edx]
shrd edx, ebp, 0x19
test ebp, 0xca80e324
mov byte [ebp - 0x7c], al
rcl dx, 0xbb
shr dh, 0x38
rcr edx, 4
mov ecx, dword [ebp - 0x84]
bswap eax
sar edx, 0x82
mov edx, dword [ecx + 0xc]
sub al, dh
jmp 0x1015cb45

Function at 0x10061a30
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], ecx
push 0x100c9c48
jmp loc.10182d60

Function at 0x1006201f
Capabilities:
Parse pe header

Disassembly:
sete byte [esp + 0x10]
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x18]
call fcn.10063354

Function at 0x10062200
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
cmovl ecx, eax
ror cx, cl
mov eax, dword [ebp - 0x84]
mov dl, 0x94
test sp, bp
mov ecx, dword [eax]
movzx edx, dx
mov edx, dword [ebp - 0x84]
bt ax, 0x82
bt eax, ebx
or ax, bx
add ecx, dword [edx + 0xc]
adc dh, 0x96
shld edx, ebp, 0x86
sub dx, cx
mov dword [ebp - 0xa0], ecx
shld ax, cx, 0x8e
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x88], eax
rcl al, 0xb4
mov ecx, dword [ebp - 0x88]
sub edx, ebp
add ecx, 1
mov dword [ebp - 0x1cc], ecx
xadd dl, al
mov edx, dword [ebp - 0x88]
mov al, byte [edx]
cmc
stc
mov byte [ebp - 0x7d], al
cmp edi, 0x1136a898
test esp, 0x3a1a6c37
add dword [ebp - 0x88], 1
cmp byte [ebp - 0x7d], 0
jmp fcn.1017dc60
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84], ecx
push 0x100c9c48
jmp 0x1005816b
Function at 0x10062a40
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80], ecx
push 0x100c9c48
jmp loc.1017d689

Function at 0x10063530
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa28
mov eax, dword [0x100cc040]
xor eax, esp
mov dword [esp + 0xa24], eax
push esi
push edi
mov esi, ecx
push 0x100c9c48
mov dword [esp + 0xc], esi
jmp 0x10094745
lea esp, [esp + 4]
mov edx, 0xf7a23c1e
mov ecx, ebp
movzx cx, cl
mov ecx, 0x53c81b6e
jmp loc.101ef09c

Function at 0x10065ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [edx + 0xc], ecx
shr ah, cl
xchg ah, ah
mov dword [edx + 0x10], ecx
dec ah
and eax, 0xfb90d0a4
mov eax, 0x4a2053a0
mov dword [edx + 0x14], ecx
movzx eax, ax
setno al
mov dword [edx + 0x18], ecx
bt eax, 0x91
rcr edx, cl
mov eax, dword [0x1011a58c]
bsf ecx, eax
mov ecx, dword [eax + 8]
mov dword [ebp - 0x28], ecx
xchg edx, eax
setne dl
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x30], ecx
push 0x100c9c48
jmp 0x1008dc23
lea esp, [esp + 4]
sal dx, 0x2c
mov dword [ebp - 8], 0
sub eax, eax
btc edx, 0xbd
shr edx, cl
mov dword [ebp - 0x24], eax
btc edx, 0x1d
bts dx, dx
rcr dx, 0x19
mov dword [ebp - 0x20], eax
or dx, di
mov dword [ebp - 0x1c], eax
shrd edx, edx, 8
or dl, 0x84
mov dword [ebp - 0x18], eax
sal edx, 0x98
shl edx, 0xa4
mov dword [ebp - 0x14], eax
neg dh
btc dx, 3
cwd
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
cdq
shr dh, 0x83
btr edx, edi
xor ecx, ecx
neg ah
bts ax, bx
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
add ax, sp
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
jmp 0x10022f21

Function at 0x10066310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1054
call fcn.100c0ef0
mov eax, dword [0x100cc040]
xor eax, esp
mov dword [esp + 0x1050], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0x100c9c48
jmp loc.10238afe

Function at 0x100695b7
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
movzx edi, di
mov edi, dword [esp + 8]
call fcn.1004b69a
xchg esi, eax
scasb al, byte es:[edi]
retf 0xd49c
push edi
pushfd
mov edi, 0xa1178d8b
lea edi, [edi + 0x50b8c413]
push ecx
mov ecx, 0x93040819
mov dword [esp + 0xc], 0x7eeeb4b1
mov ecx, dword [esp + ecx + 0x6cfbf7e7]
shr di, 0xe2
jbe 0x1022e8ab
jne 0x10056db6
movaps xmmword [ebp - 0x11700], xmm0
call fcn.10163557
movaps xmm0, xmmword [ebp - 0x11ef0]
call fcn.101d5004
Function at 0x10069c00
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x490
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x254], ecx
push 0x100c9c48
jmp loc.10220409

Function at 0x1006a550
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x948
mov eax, dword [0x100cc040]
xor eax, esp
mov dword [esp + 0x944], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x54], eax
push 0x100c9c48
mov dword [esp + 0x20], esi
jmp loc.101c1e96

Function at 0x1006b460
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
mov eax, 0x95b87b1b
bswap dx
mov eax, dword [0x1011a58c]
mov ecx, dword [eax + 0x584]
jmp loc.1014afea
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0xfd28
call fcn.100c0ef0
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x6d80], ecx
push 0x100c9c48
jmp 0x100501fa

Function at 0x1006f88b
Capabilities:
Check http status code
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], 0x6581b1b1
mov ebp, dword [esp + ebp + 0x2ed9]
call fcn.1022180c

Function at 0x10084040
Capabilities:
Check http status code
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c3010
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc
mov eax, 0x11f14
call fcn.100c0ef0
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x9278], ecx
push 0x100c9c48
push ecx
pushfd
mov ecx, 0x37ac373b
push edi
neg cl
mov ecx, dword [esp + ecx*2 - 0x6f586f82]
mov dword [esp + 8], 0xd97db1d1
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10063354
or ax, ax
mov eax, dword [esi + 4]
mov ecx, 0x3724491e
or edx, eax
not edx
shl ecx, 0x95
seta cl
adc ecx, 0xc431d416
mov dword [esi + 4], edx
xor cl, ch
movsx edx, cl
bts edx, ecx
mov ecx, dword [ebp - 4]
inc edx
xor ecx, ebx
mov eax, edx
inc ecx
ror ecx, 2
neg eax
shr edx, 0x73
sbb ecx, 0x8ebae226
not ecx
bts eax, eax
neg ecx
xor eax, 0xca1c1c0b
ror ecx, 2
jmp loc.10194068

Function at 0x10084882
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
jg 0x10237925
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0xf1ddb1d1
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.10063354
Function at 0x10084a7e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x471803ab
jg 0x1023619c
mov word [esi + edx*8 - 0x23638], ax
or edx, 0x103a5525
sal cl, 0xe1
movzx edx, byte [ebp + ecx - 0x4694]
dec ecx
mov eax, ecx
not ecx
lea ebp, [ebp + eax*2 - 0x8d20]
call fcn.1001ba6d
movzx ax, al
cmovge ecx, edx
mov cl, byte [edx + esi - 0x4647]
mov dword [esp + edx - 0x4647], edx
neg edx
pop edx
not al
btc dx, dx
not cl
and al, cl
movsx ecx, dx
jmp 0x10159493

Function at 0x1008cb87
Capabilities:
Check http status code
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
push edi
pushfd
mov edi, 0x62b62392
add dword [esp + edi - 0x62b62386], 0xeff5fdcc
mov dword [esp + 0xc], 0x2686b171
mov edi, dword [esp + edi - 0x62b6238e]
popfd
lea esp, [esp + 8]
call fcn.10063354
movsx eax, cl
not dx
btr cx, cx
setae al
mov ax, dx
mov dx, word [ecx + esi - 0x3d3d2fba]
not ax
jb 0x101736df
add cl, ch
shr cx, 2
not dx
jns 0x100a27dd
call fcn.101fb62b
mov eax, 0x521d4626
movsx ecx, ax
push ecx
lea ebp, [eax + ebp - 0x521d462a]
mov eax, dword [ebp + eax - 0x521d4626]
mov edx, dword [esp + ecx*4 - 0x11898]
xor eax, ebx
xor dx, 0xd706
btr ecx, 0x38
call fcn.101e596a

Function at 0x1008d072
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], 0xe481b451
lea esp, [esp + 8]
call fcn.10063354

Function at 0x10092b16
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
adc esi, 0xfffffff8
not word [esp + 3]
mov eax, 0x63908622
and eax, 0x37273f87
pop ecx
pop edx
jns fcn.10017b2c
bt ecx, 0xf
bswap eax
bts edx, ecx
pop ecx
lea ecx, [edx + edx*4 - 0x7c4d2a75]
xor ebx, eax
shl dl, 0xa7
xor dword [esp + 3], edx
mov dword [esi - 8], eax
jg 0x1003e39e
invalid
and ch, bl
in al, 0x39
xor al, 0x5d
pop edx
jmp 0x10092b19
Function at 0x100958b6
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x14]
call fcn.10063354
movups xmm0, xmmword [ecx + 0x10]
push ebx
pushfd
mov ebx, 0x3d02da32
call fcn.101903e2
jb 0x10019116
mov ecx, 0x10bc989f
lea eax, [ecx + ecx*4 - 0x2e571645]
rol cx, 0x84
mov cx, word [esi + ecx - 0x10bc89f9]
jae 0x101d6465
call fcn.101f8de3
movaps xmm0, xmmword [ebp - 0xc830]
shr dx, cl
cbw
movaps xmmword [ebp - 0x17690], xmm0
mov eax, dword [ebp - 0xde38]
rcl dx, 0x31
movups xmm0, xmmword [eax + 0x480]
shl ch, 0x3e
btc cx, sp
movaps xmmword [ebp - 0x17680], xmm0
add ecx, esp
movaps xmm0, xmmword [ebp - 0x17680]
dec dl
sar edx, cl
xorps xmm0, xmmword [ebp - 0x17690]
shl dl, cl
or ch, 0x9c
rcl dh, 0x1f
movaps xmmword [ebp - 0x176a0], xmm0
rcr ch, 0x99
inc ch
bsf dx, si
movaps xmm0, xmmword [ebp - 0x176a0]
sbb cx, di
mov ecx, dword [ebp - 0xde38]
sar dh, 5
add ecx, 0x480
rcl edx, 0xbe
movups xmmword [ecx], xmm0
mov edx, 1
cmc
test edx, edx
jmp fcn.10063697
movaps xmm0, xmmword [ebp - 0xc840]
bts cx, di
or ecx, edi
not ch
movaps xmmword [ebp - 0x17660], xmm0
shr ax, 0x33
xor cx, ax
test ax, 0x5b98
mov eax, dword [ebp - 0xde38]
sar ch, 0xa2
rcr cx, 7
shld dx, dx, 0xb0
movups xmm0, xmmword [eax + 0x470]
movaps xmmword [ebp - 0x17650], xmm0
test esp, ebp
bsf edx, edi
movaps xmm0, xmmword [ebp - 0x17650]
rol edx, cl
xor edx, 0xf119061f
xorps xmm0, xmmword [ebp - 0x17660]
movzx edx, si
neg cl
movaps xmmword [ebp - 0x17670], xmm0
cwd
sal ecx, 0x8a
cmp cl, 0xab
movaps xmm0, xmmword [ebp - 0x17670]
not dh
bsr cx, bp
adc dl, 0x83
mov ecx, dword [ebp - 0xde38]
lea ecx, [ecx + 0x470]
movups xmmword [ecx], xmm0
shr dh, cl
mov edx, 1
test ax, ax
test edx, edx
jmp 0x102457d6
xor word [esp + eax + 0x53dfbf75], cx
lea ebp, [ebp + eax + 0x53dfbf6f]
movzx eax, byte [ebp + eax + 0x53dfbf70]
or ecx, ecx
push ecx
setp byte [esp + 3]
xor al, bl
sar byte [esp + 4], 0xc1
and ecx, 0xb49e83a4
call fcn.10210dff
je 0x101c74ba
jmp 0x101c754b
je 0x101a84f2
jmp 0x101a856f

Function at 0x1009cb00
Capabilities:
Check http status code
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e8
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2d8], ecx
push 0x100c9c48
call fcn.10199dbe
movaps xmm0, xmmword [ebp - 0x5cc0]
cmc
movaps xmmword [ebp - 0xccf0], xmm0
btr cx, 0xd
mov edx, dword [ebp - 0x6d68]
movups xmm0, xmmword [edx + 0x200]
bt eax, edx
mov cl, 0x1e
movaps xmmword [ebp - 0xcce0], xmm0
cbw
btr eax, 0xbe
movaps xmm0, xmmword [ebp - 0xcce0]
xorps xmm0, xmmword [ebp - 0xccf0]
movaps xmmword [ebp - 0xcd00], xmm0
movaps xmm0, xmmword [ebp - 0xcd00]
cmp ax, 0xe112
sbb cx, sp
rol al, cl
mov eax, dword [ebp - 0x6d68]
rcl ecx, cl
sal cx, 0x93
sbb cx, bp
add eax, 0x200
mov cx, di
shrd cx, cx, 0x2c
movups xmmword [eax], xmm0
adc cx, dx
mov ecx, 1
clc
test di, bp
test ecx, ecx
jmp 0x10052c73
Function at 0x1009d160
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c3128
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x100cc040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x100c9c48
push esi
pushfd
mov esi, 0x849f7f16
push edi
or esi, esi
push esi
mov esi, dword [esp + esi + 0x7b6080f6]
mov dword [esp + 0xc], 0x4fadb3f1
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.10063354
shr dx, cl

Function at 0x1009dc10
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Packed with generic packer
Parse credit card information

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x37c4
call fcn.100c0ef0
mov eax, dword [0x100cc040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1ac4], ecx
call fcn.10056ff0
nop
mov eax, dword [ebp - 0x1ac4]
cmp dword [eax + 0x1c], 0
je 0x1009dc7e
mov ecx, dword [0x101468c8]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x259c], ecx
push 1
mov ecx, dword [ebp - 0x259c]
call fcn.1004db70
nop
movzx edx, byte [0x10114827]
test edx, edx
jne 0x1009dc98
movzx eax, byte [0x10114826]
test eax, eax
je 0x100a021a
push 0x100c9c48
push ebx
pushfd
mov ebx, 0x23a7b92f
shl ebx, 0x4a
test bx, 0xf02d
push edx
mov ebx, dword [esp + 8]
mov dword [esp + 8], 0x44e9b1d1
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.10063354
mov edx, dword [ebp - 0x1ac4]
cmp dword [edx + 0x1c], 0
jne 0x100a02ed
push 0x100c9c48
call fcn.1022a6b4
call fcn.100558e0
nop
movzx ecx, byte [0x1011f406]
test ecx, ecx
je 0x100a0314
movzx edx, byte [0x1011f405]
test edx, edx
je 0x100a0314
movzx eax, byte [0x1011f404]
test eax, eax
jne 0x100a0319
jmp 0x100a29a3
mov ecx, dword [ebp - 0x1ac4]
mov edx, dword [ecx + 0x84]
mov dword [ebp - 0x1b24], edx
mov eax, dword [0x101468c8]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x1b24]
call fcn.1001c080
mov ecx, dword [0x1011f3c8]
call fcn.10083fc0
nop
movzx ecx, byte [0x101468b5]
test ecx, ecx
jne 0x100a17eb
mov edx, dword [0x1011a58c]
mov eax, dword [edx + 0x4ac]
call eax
sub eax, dword [0x1011f410]
cmp eax, 0x2710
jbe 0x100a17eb
mov ecx, dword [ebp - 0x1ac4]
call fcn.100a5280
mov dword [ebp - 0x1b14], eax
cmp dword [ebp - 0x1b14], 0x249f0
jbe 0x100a17eb
push 0x100c9c48
push ebp
pushfd
mov ebp, 0x2b2386be
or ebp, ebp
neg ebp
call fcn.1002b2b1

Function at 0x100a29c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xba8
mov eax, dword [0x100cc040]
xor eax, esp
mov dword [esp + 0xba4], eax
push esi
push edi
push 0x100c9c48
jmp loc.101b9521
Function at 0x100b4c43
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100b4c82
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100b4c82
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100b4c82
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100b4c82
cmp dword [ecx + 0x74], 0xe
jbe 0x100b4c82
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100b606c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c5c38
push 0x100c5c30
push str.FlsAlloc
push 0x1f
call fcn.100b5f88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b60a0
push dword [ebp + 8]
mov ecx, esi
call dword [0x100c4130]
call esi
jmp 0x100b60a6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100b60ea
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c5c48
push 0x100c5c40
push str.FlsGetValue
push 0x21
call fcn.100b5f88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b6121
push dword [ebp + 8]
mov ecx, esi
call dword [0x100c4130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100b6129
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c5c50
push 0x100c5c48
push str.FlsSetValue
push 0x22
call fcn.100b5f88
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b6163
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100c4130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]