joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439daf
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x43cdd8
call fcn.00422778
sub esp, 0x110
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x439e6e
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, 0xff
lea eax, [ebp - 0x11c]
push ebx
push eax
push esi
push dword [ebp - 0x14]
call edi
mov esi, eax
test esi, esi
jne 0x439e4e
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x18]
push eax
call fcn.004268dd
mov ecx, dword [ebp - 0x1c]
and dword [ebp - 4], esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
call fcn.00439daf
mov esi, eax
xor eax, eax
test esi, esi
setne al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov byte [ebp - 0xd], al
call fcn.0042686f
cmp byte [ebp - 0xd], 0
jne 0x439e4e
lea eax, [ebp - 0x11c]
push ebx
push eax
push 0
push dword [ebp - 0x14]
jmp 0x439df8
cmp esi, 0x103
je 0x439e5e
cmp esi, 0x3f2
jne 0x439e6e
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x43a1dc
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x43d1c6
call fcn.00422778
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CNoTrackObject.0
xor eax, eax
push 0xa
lea ecx, [esi + 0x30]
mov dword [ebp - 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.00424880
push 0xa
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.00424880
push 0xa
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 2
call fcn.00424423
mov ecx, dword [ebp - 0xc]
mov dword [esi], vtable.AFX_MODULE_THREAD_STATE.0
mov dword [esi + 0xc], 0x54
mov dword [esi + 0x28], 0x42be53
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x43ae5e
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x43ae8c
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 8]
jl 0x43af2e
cmp dword [esp + 0x10], 0
je 0x43af2e
test esi, esi
jne 0x43aec8
push 0x10
call fcn.0043ac7b
test eax, eax
je 0x43aea1
mov dword [eax], vtable.CThreadData.0
mov esi, eax
jmp 0x43aea3
xor esi, esi
and dword [esi + 8], 0
and dword [esi + 0xc], 0
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [edi + 0x14]
call fcn.0043ac1d
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x43aee0
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x43aef0
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x43aefc
call fcn.004240f7
mov eax, dword [esi + 8]
mov ecx, eax
imul ecx, ecx, 0x3fffffff
add ecx, dword [edi + 0xc]
shl ecx, 2
push ecx
mov ecx, dword [esi + 0xc]
push 0
lea eax, [ecx + eax*4]
push eax
call fcn.00422720
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [eax + edx*4], ecx
pop esi
ret 8
Function at 0x43af63
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov ebx, ecx
pop edi
cmp dword [esi + 8], edi
mov dword [ebp - 4], edi
jle 0x43afb6
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43af99
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + edi*8 + 4], eax
je 0x43af99
mov eax, dword [esi + 0xc]
cmp dword [eax + edi*4], 0
je 0x43afb0
and dword [ebp - 4], 0
jmp 0x43afb0
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x43afa9
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0xc]
and dword [eax + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jl 0x43af7a
cmp dword [ebp - 4], 0
je 0x43aff5
lea edi, [ebx + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [ebx + 0x14]
call fcn.0043ac30
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x43afeb
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x43b6d8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0041dce0
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
je 0x43b754
mov edi, 0x80000000
and byte [eax], 0
lea eax, [ebp + 8]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x43b754
lea eax, [ebp - 0x108]
xor ebx, ebx
push 0x105
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x43b731
push 1
pop ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x43b754
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.00414ed0
pop ecx
test eax, eax
pop ecx
jne 0x43b6ff
push esi
call fcn.0040e3d0
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41b140
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x426138], 0
jne 0x41b1c1
cmp dword [0x426158], 0
jne 0x41b170
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x426158], eax
test eax, eax
jne 0x41b170
push 0x4234dc
call fcn.0041a95c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x426158]
jmp 0x41b184
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004154e4
pop ecx
mov edi, eax
test eax, eax
jne 0x41b17c
lea edi, [ebp + 1]
push edi
call fcn.00414de8
pop ecx
mov ebx, eax
mov dword [0x42613c], ebx
test ebx, ebx
jne 0x41b1ae
xor eax, eax
jmp 0x41b284
push edi
mov edx, dword [0x426158]
push edx
push ebx
call fcn.00415394
add esp, 0xc
jmp 0x41b1e1
xor esi, esi
mov ebx, dword [0x426138]
jmp 0x41b1db
push eax
call fcn.004154e4
pop ecx
test eax, eax
jne 0x41b1d7
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41b1cb
lea ebx, [esi + 4]
push 4
mov dword [0x426140], ebx
inc ebx
push ebx
call fcn.004148c0
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41b204
xor eax, eax
jmp 0x41b284
cmp dword [0x426138], 0
jne 0x41b235
xor esi, esi
mov ebx, dword [0x42613c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41b226
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004154e4
pop ecx
mov edi, eax
test eax, eax
jne 0x41b21c
jmp 0x41b266
xor esi, esi
mov ebx, dword [0x426138]
mov eax, dword [esp]
mov edi, eax
jmp 0x41b260
push eax
call fcn.004154e4
pop ecx
test eax, eax
je 0x41b255
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41b259
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41b244
mov eax, dword [0x426138]
test eax, eax
je 0x41b276
push eax
call fcn.00414df8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x426138], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x41aecd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x41aedc
pop dword [ebp - 0xc]
mov eax, 0x7328a6df
sub eax, 0x72e6f803
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x35740
push 0
mov eax, 0xf2597b38
sub eax, 0xf216bb0c
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xd1c5fd86
add ecx, 0x2e3a3b0f
mov edx, eax
mov ebx, 0x43b800
add ebx, dword [ebp - 0xc]
mov edi, 0x415b6e16
sub edi, 0x807e86f4
mov esi, dword [ebx]
add dword [ebp - 4], esi
xor esi, edi
mov dword [ebp - 8], 0xb4c3654a
mov dword [edx], esi
add dword [ebp - 8], 0xbd2febfc
add edx, 0x5e56c121
sub edx, 0x5e56c11d
add ebx, 0xce734447
add ebx, 0x318cbbbd
loop 0x41af35
add eax, 0xd527
mov ebx, eax
add eax, 0x908a86cb
add eax, 0x6f75793a
mov ecx, 0x5c5d9ab7
sub ecx, 0x5c1d9ab7
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x421730
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x42176d
push str.SetDefaultDllDirectories
push 0x42c874
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x42176d
push 0xc00
call eax
test eax, eax
jne 0x421806
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421806
cmp eax, 0x104
ja 0x421806
cmp word [esp + eax*2 + 6], 0x5c
je 0x42179c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x421806
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x4217db
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x4217c7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x4217bc
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x40ad30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x40ad52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40ad59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40ad48
mov eax, 1
add ebx, ebx
jne 0x40ad6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40ad60
jne 0x40ad7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40ad60
xor ecx, ecx
sub eax, 3
jb 0x40ad90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40ae02
mov ebp, eax
add ebx, ebx
jne 0x40ad9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40ada8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40adcc
inc ecx
add ebx, ebx
jne 0x40adb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40adad
jne 0x40adc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40adad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40adec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40addd
jmp 0x40ad4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40adec
add edi, ecx
jmp 0x40ad4e
pop esi
mov edi, esi
mov ecx, 0x6c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40ae0a
cmp byte [edi], 1
jne 0x40ae0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40ae0f
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40ae7e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc99c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xca08]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40ae3c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xca10]
or eax, eax
je 0x40ae78
mov dword [ebx], eax
add ebx, 4
jmp 0x40ae59
call dword [esi + 0xca0c]
mov ebp, dword [esi + 0xca14]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40aeb2
sub esp, 0xffffff80
jmp 0x401e0a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10015760
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [eax + 4]
push ebp
mov ebp, ebx
push esi
and ebp, 1
shr ebx, 1
push edi
mov edi, dword [eax + 8]
mov esi, 0x9e3779b9
je 0x100157af
movzx eax, word [edi]
push 0
push eax
call fcn.10277780
add esi, eax
movzx eax, word [edi + 2]
push 0
push eax
call fcn.10277780
mov ecx, esi
shl ecx, 5
xor eax, ecx
shl eax, 0xb
xor esi, eax
mov edx, esi
shr edx, 0xb
add esp, 0x10
add edi, 4
add esi, edx
sub ebx, 1
jne 0x10015778
test ebp, ebp
je 0x100157d1
movzx eax, word [edi]
push 0
push eax
call fcn.10277780
add esi, eax
mov eax, esi
shl eax, 0xb
xor esi, eax
mov ecx, esi
shr ecx, 0x11
add esp, 8
add esi, ecx
lea edx, [esi*8]
xor esi, edx
mov eax, esi
shr eax, 5
add esi, eax
lea ecx, [esi*4]
xor esi, ecx
mov edx, esi
shr edx, 0xf
add esi, edx
mov eax, esi
shl eax, 0xa
xor esi, eax
mov eax, 0x80000000
je 0x10015801
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1001dce0
Capabilities:
Decompress data using quicklz

Disassembly:
push ecx
mov ecx, dword [esp + 8]
cmp dword [ecx], 5
mov eax, 0x10c126c8
jg 0x1001dcf1
mov eax, ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [eax]
test edi, edi
je 0x1001dd4a
lea esi, [ecx + 0x18]
mov dword [esp + 0x10], edi
mov eax, dword [esi]
test al, 3
jne 0x1001dd3c
mov ecx, eax
shr ecx, 5
and ecx, 0x7ff
mov edx, ecx
and ecx, 0x1f
mov ebp, 1
shl ebp, cl
mov ebx, eax
shr edx, 5
and ebx, 0xffff0000
test dword [ebx + edx*4 + 0xfde8], ebp
jne 0x1001dd3c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
add esi, 4
sub dword [esp + 0x10], 1
jne 0x1001dd02
mov ecx, dword [esp + 0x18]
mov ebx, dword [ecx]
sub ebx, edi
mov esi, 0
je 0x1001dda9
jmp 0x1001dd64
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x14]
mov eax, dword [ecx + esi*4]
test al, 3
jne 0x1001dda2
mov ecx, eax
shr ecx, 5
and ecx, 0x7ff
mov edx, ecx
and ecx, 0x1f
mov ebp, 1
shl ebp, cl
mov edi, eax
shr edx, 5
and edi, 0xffff0000
test dword [edi + edx*4 + 0xfde8], ebp
jne 0x1001dda2
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
add esi, 1
cmp esi, ebx
jne 0x1001dd60
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x1001e0d0
Capabilities:
Decompress data using quicklz

Disassembly:
test al, 3
jne 0x1001e101
mov ecx, eax
shr ecx, 5
and ecx, 0x7ff
push esi
mov edx, ecx
and ecx, 0x1f
mov esi, 1
shl esi, cl
shr edx, 5
and eax, 0xffff0000
test dword [eax + edx*4 + 0xfde8], esi
pop esi
jne 0x1001e101
xor eax, eax
ret
mov eax, 1
ret

Function at 0x1001e4c0
Capabilities:
Decompress data using quicklz

Disassembly:
push esi
mov esi, ecx
shr ecx, 5
and ecx, 0x7ff
mov eax, esi
and eax, 0xffff0000
mov edx, ecx
shr edx, 5
add eax, 0xfde8
lea eax, [eax + edx*4]
and ecx, 0x1f
mov edx, 1
shl edx, cl
or dword [eax], edx
mov eax, dword [esi + 0x10]
test al, 3
jne 0x1001e52b
mov ecx, eax
shr ecx, 5
push ebx
and ecx, 0x7ff
mov edx, ecx
push edi
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
mov edi, eax
and edi, 0xffff0000
shr edx, 5
test dword [edi + edx*4 + 0xfde8], ebx
pop edi
pop ebx
jne 0x1001e52b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
lea eax, [esi + 4]
pop esi
jmp 0x10024fc0
push ecx
test byte [eax + 0xa], 2
push esi
jne 0x10024fec
cmp dword [eax], 0
je 0x1002505a
mov esi, dword [eax + 4]
mov eax, esi
call fcn.1001e0d0
test al, al
jne 0x1002505a
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
mov ecx, esi
pop esi
add esp, 4
jmp edx
mov eax, dword [eax + 4]
mov esi, dword [eax + 8]
push edi
xor edi, edi
test esi, esi
jle 0x10025059
add eax, 0x18
push ebx
mov dword [esp + 0xc], eax
push ebp
mov eax, dword [eax]
test eax, eax
je 0x10025042
test al, 3
jne 0x10025045
mov ecx, eax
shr ecx, 5
and ecx, 0x7ff
mov edx, ecx
and ecx, 0x1f
mov ebp, 1
shl ebp, cl
mov ebx, eax
shr edx, 5
and ebx, 0xffff0000
test dword [ebx + edx*4 + 0xfde8], ebp
jne 0x10025045
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
jmp 0x10025045
add esi, 1
mov eax, dword [esp + 0x10]
add edi, 1
add eax, 0x10
cmp edi, esi
mov dword [esp + 0x10], eax
jl 0x10025002
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x10020080
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov ecx, esi
push edi
mov eax, 0x9e3779b9
lea edi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x10020090
sub ecx, edi
mov edx, ecx
and edx, 1
shr ecx, 1
je 0x100200ca
push ebx
movzx edi, byte [esi]
add eax, edi
movzx edi, byte [esi + 1]
mov ebx, eax
shl ebx, 5
xor edi, ebx
shl edi, 0xb
xor eax, edi
mov edi, eax
shr edi, 0xb
add esi, 2
add eax, edi
sub ecx, 1
jne 0x100200a5
pop ebx
test edx, edx
je 0x100200e1
movzx ecx, byte [esi]
add eax, ecx
mov edx, eax
shl edx, 0xb
xor eax, edx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
lea edx, [eax*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add eax, ecx
lea edx, [eax*4]
xor eax, edx
mov ecx, eax
shr ecx, 0xf
add eax, ecx
mov edx, eax
shl edx, 0xa
xor eax, edx
pop edi
pop esi
jne 0x10020111
mov eax, 0x80000000
ret

Function at 0x10022cb0
Capabilities:
Decompress data using quicklz

Disassembly:
mov edx, dword [esp + 4]
sub esp, 8
cmp eax, edx
jbe 0x10022cc5
mov ecx, eax
mov eax, edx
mov edx, ecx
mov dword [esp + 0xc], edx
cmp eax, edx
push ebx
mov ebx, dword [0x10c880a4]
push ebp
mov ebp, dword [0x10c880ac]
mov ecx, eax
mov dword [esp + 8], ebx
je 0x10022d70
push esi
push edi
jmp 0x10022ce9
mov ebx, dword [esp + 0x10]
mov eax, dword [ecx]
add ecx, 4
test al, 0x1f
mov dword [esp + 0x14], ecx
jne 0x10022d60
test eax, eax
je 0x10022d60
movzx edx, ax
mov esi, eax
sub esi, edx
xor ecx, ecx
test ebp, ebp
jbe 0x10022d60
mov edi, 0xfdc0
cmp edi, edx
sbb edi, edi
add edi, 1
xor edx, edx
cmp dword [ebx + ecx*4], esi
sete dl
test edi, edx
jne 0x10022d28
add ecx, 1
cmp ecx, ebp
jb 0x10022d13
jmp 0x10022d60
mov edx, dword [eax]
test edx, edx
je 0x10022d60
mov ecx, eax
shr ecx, 5
and ecx, 0x7ff
mov esi, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
mov edi, eax
shr esi, 5
and edi, 0xffff0000
test dword [edi + esi*4 + 0xfde8], ebx
jne 0x10022d60
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x1c]
jne 0x10022ce5
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10022e10
Capabilities:
Decompress data using quicklz

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push ebp
push esi
push edi
call fcn.10022dc0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
lea ecx, [esi + ecx*8]
mov ebx, ecx
cmp ebx, ecx
mov dword [esp + 0x10], ebx
je 0x10022e4a
mov edx, dword [ebx]
test edx, edx
je 0x10022e3f
cmp edx, 0xffffffff
jne 0x10022e46
add ebx, 8
cmp ebx, ecx
jne 0x10022e34
mov dword [esp + 0x10], ebx
mov edx, dword [eax + 4]
lea ecx, [esi + edx*8]
cmp esi, ecx
je 0x10022e66
mov eax, dword [esi]
test eax, eax
je 0x10022e5f
cmp eax, 0xffffffff
jne 0x10022e66
add esi, 8
cmp esi, ecx
jne 0x10022e54
cmp esi, ebx
mov edi, ecx
je 0x10022ec8
lea esp, [esp]
mov eax, dword [esi]
mov ecx, eax
shr ecx, 5
and ecx, 0x7ff
mov edx, ecx
and ecx, 0x1f
mov ebp, 1
shl ebp, cl
mov ebx, eax
shr edx, 5
and ebx, 0xffff0000
test dword [ebx + edx*4 + 0xfde8], ebp
jne 0x10022ea6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
add esi, 8
cmp esi, edi
je 0x10022ec2
lea ecx, [ecx]
mov eax, dword [esi]
test eax, eax
je 0x10022ebb
cmp eax, 0xffffffff
jne 0x10022ec2
add esi, 8
cmp esi, edi
jne 0x10022eb0
cmp esi, dword [esp + 0x10]
jne 0x10022e70
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10032830
Capabilities:
Decompress data using quicklz

Disassembly:
push esi
mov esi, dword [eax]
test esi, esi
je 0x1003287f
push ebx
push edi
lea esp, [esp]
mov eax, dword [esi + 4]
mov ecx, eax
shr ecx, 5
and ecx, 0x7ff
mov edx, ecx
and ecx, 0x1f
mov ebx, 1
shl ebx, cl
mov edi, eax
shr edx, 5
and edi, 0xffff0000
test dword [edi + edx*4 + 0xfde8], ebx
jne 0x10032877
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x20]
call eax
mov esi, dword [esi]
test esi, esi
jne 0x10032840
pop edi
pop ebx
pop esi
ret
Function at 0x100452d0
Capabilities:
Parse credit card information

Disassembly:
cmp esi, 0x3e
mov eax, dword [esp + 4]
jne 0x10045302
cmp ecx, esi
jne 0x100453c1
cmp edx, esi
jne 0x1004538b
cmp dword [esp + 8], 0x3d
jne 0x10045351
mov edx, 4
call fcn.100444e0
mov eax, 0x135
ret 8
cmp esi, 0x3d
jne 0x10045329
cmp ecx, esi
jne 0x10045598
cmp edx, esi
jne 0x10045438
mov edx, 3
call fcn.100444e0
mov eax, 0x124
ret 8
cmp esi, 0x21
jne 0x10045363
cmp ecx, 0x3d
jne 0x10045598
cmp edx, ecx
jne 0x100453dc
mov edx, 3
call fcn.100444e0
mov eax, 0x125
ret 8
mov edx, 3
call fcn.100444e0
mov eax, 0x12e
ret 8
cmp esi, 0x3c
jne 0x100453ee
cmp ecx, esi
jne 0x100453a6
cmp edx, 0x3d
jne 0x10045541
mov edx, 3
call fcn.100444e0
mov eax, 0x133
ret 8
cmp edx, 0x3d
jne 0x10045558
mov edx, 3
call fcn.100444e0
mov eax, 0x134
ret 8
cmp ecx, 0x3d
jne 0x1004553c
mov edx, 2
call fcn.100444e0
mov eax, 0x126
ret 8
cmp ecx, 0x3d
jne 0x10045553
mov edx, 2
call fcn.100444e0
mov eax, 0x127
ret 8
mov edx, 2
call fcn.100444e0
mov eax, 0x123
ret 8
cmp esi, 0x2b
jne 0x10045413
cmp ecx, esi
jne 0x1004544a
mov edx, 2
call fcn.100444e0
mov al, byte [eax + 0x2c]
neg al
sbb eax, eax
and eax, 0x13
add eax, 0x12a
ret 8
cmp esi, 0x2d
jne 0x10045480
cmp ecx, esi
jne 0x10045465
mov edx, 2
call fcn.100444e0
mov al, byte [eax + 0x2c]
neg al
sbb eax, eax
and eax, 0x13
add eax, 0x12b
ret 8
mov edx, 2
call fcn.100444e0
mov eax, 0x122
ret 8
cmp ecx, 0x3d
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x12f
ret 8
cmp ecx, 0x3d
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x130
ret 8
cmp esi, 0x2a
jne 0x100454a0
cmp ecx, 0x3d
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x131
ret 8
cmp esi, 0x2f
jne 0x100454c0
cmp ecx, 0x3d
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x132
ret 8
cmp esi, 0x26
jne 0x100454e0
cmp ecx, 0x3d
jne 0x1004556a
mov edx, 2
call fcn.100444e0
mov eax, 0x136
ret 8
cmp esi, 0x5e
jne 0x10045500
cmp ecx, 0x3d
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x138
ret 8
cmp esi, 0x25
jne 0x10045520
cmp ecx, 0x3d
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x137
ret 8
cmp esi, 0x7c
jne 0x10045598
cmp ecx, 0x3d
jne 0x10045581
mov edx, 2
call fcn.100444e0
mov eax, 0x139
ret 8
cmp ecx, 0x3c
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x12c
ret 8
cmp ecx, 0x3e
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x12d
ret 8
cmp ecx, 0x26
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x129
ret 8
cmp ecx, 0x7c
jne 0x10045598
mov edx, 2
call fcn.100444e0
mov eax, 0x128
ret 8
lea ecx, [esi - 0x21]
cmp ecx, 0x5d
ja case.0x100455a7.34
movzx ecx, byte [ecx + 0x100455cc]
jmp dword [ecx*4 + 0x100455c4]
mov edx, 1
call fcn.100444e0
mov eax, esi
ret 8
or eax, 0xffffffff
ret 8