joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f5fa
Capabilities:
Check os version
Get common file path
Get file size
Get startup folder
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x2134]
mov eax, 0x2134
call fcn.0046b070
push 0xffffffffffffffff
push 0x47cb21
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x49b390]
xor eax, ebp
mov dword [ebp + 0x2130], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x213c]
push 1
mov dword [ebp - 0x20], eax
push 0x1a
lea eax, [ebp + 0x130]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x130]
lea ecx, [ebp + 0x114]
call fcn.00404670
mov edi, 0x114
push edi
lea eax, [ebp]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0045c920
add esp, 0xc
lea eax, [ebp]
push eax
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp + 4], 6
jb 0x44f69f
push str.LocalLow
lea eax, [ebp + 0x114]
push eax
call fcn.00405073
push str.BaiduBaiduPlayer
lea eax, [ebp + 0x114]
push eax
call fcn.00405073
push str.conf2.db
lea eax, [ebp + 0x114]
push eax
call fcn.00405073
cmp dword [ebp + 0x12c], 8
mov eax, dword [ebp + 0x118]
jae 0x44f6d6
lea eax, [ebp + 0x118]
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
je 0x44f7d9
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test al, 1
mov dword [ebp - 0x14], eax
mov edi, eax
je 0x44f70d
lea edi, [eax + 1]
lea eax, [edi + 2]
push eax
call fcn.0045b0a4
pop ecx
mov esi, eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x24], esi
push esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jbe 0x44f73b
mov byte [eax + esi], bl
push str._DownLoadSavePath_
shr edi, 1
push esi
mov word [esi + edi*2], bx
call fcn.0045f2d2
cmp eax, ebx
pop ecx
pop ecx
je 0x44f7c9
mov edi, 0x488990
add eax, 0x24
push edi
push eax
call fcn.0045f2d2
cmp eax, ebx
pop ecx
pop ecx
je 0x44f7c9
add eax, 2
push edi
push eax
mov dword [ebp - 0x14], eax
call fcn.0045f2d2
cmp eax, ebx
pop ecx
pop ecx
je 0x44f7c9
mov esi, dword [ebp - 0x20]
mov word [eax], bx
mov eax, dword [ebp - 0x14]
call fcn.00404988
push dword [ebp - 0x24]
call fcn.0045c99a
pop ecx
mov byte [ebp - 0xd], 1
push ebx
push 1
lea esi, [ebp + 0x114]
call fcn.004049f4
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2130]
xor ecx, ebp
call fcn.0045c29b
add ebp, 0x2134
leave
ret
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0045c99a
pop ecx
mov byte [ebp - 0xd], bl
jmp 0x44f795
Function at 0x45405a
Capabilities:
Move file

Disassembly:
push 0x21c
mov eax, 0x47f568
call fcn.0046436b
lea eax, [esi + 0x68]
push eax
lea eax, [ebp - 0x220]
lea ecx, [esi + 0x64]
push eax
call fcn.0041d9e6
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x6c]
sub eax, 0x10
call fcn.00401ad5
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x220]
lea edi, [eax + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
je 0x4540c0
lea eax, [edi - 0x10]
call fcn.00401144
mov eax, dword [ebp - 0x220]
loopne 0x4540af
invalid
inc dword [ebx - 0x77170f40]
sar dl, 1
push dword [ebx]
shr bl, 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x224], eax
lea eax, [edi - 0x10]
call fcn.00401144
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.00401144
mov eax, dword [ebp - 0x224]
cmp eax, ebx
mov byte [esi + 6], bl
je 0x454115
push 7
push 5
pop ebx
mov edi, esi
call fcn.0045598b
push dword [esi + 0x24]
push str._s_:_rename_fail_r_n
push 0x2000005
call fcn.0044aa7a
add esp, 0xc
jmp 0x454214
push dword [esi + 0x24]
push str._s_:_rename_success_r_n
push 1
call fcn.0044aa7a
add esp, 0xc
push ebx
push 5
pop ebx
mov edi, esi
call fcn.0045598b
push 0
xor edi, edi
inc edi
push edi
push ecx
lea eax, [esi + 0xa8]
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
push ecx
call fcn.004045f7
mov dword [ebp - 4], edi
lea edi, [esi + 0x64]
mov eax, dword [edi]
push ecx
sub eax, 0x10
mov dword [ebp - 0x228], esp
mov ebx, esp
call fcn.00401ad5
or dword [ebp - 4], 0xffffffff
add eax, 0x10
mov dword [ebx], eax
call fcn.0044f034
lea eax, [esi + 0x68]
push eax
lea eax, [ebp - 0x224]
push eax
mov ecx, edi
call fcn.0041d9e6
add esp, 0x18
lea edi, [esi + 0x6c]
mov dword [ebp - 4], 2
call fcn.004018be
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call fcn.00401144
push 0x104
push dword [edi]
lea eax, [ebp - 0x21c]
push eax
call fcn.00460544
mov ecx, dword [esi + 0x3b8]
add esp, 0xc
test ecx, ecx
je 0x4541d7
mov eax, dword [ecx]
lea edx, [ebp - 0x21c]
push edx
call dword [eax + connect]
push dword [esi + 0x24]
push str._s_:_add_p2p_share_r_n
push 1
call fcn.0044aa7a
add esp, 0xc
test byte [esi + 0x3c0], 0x40
jne 0x454214
lea eax, [esi + 0x424]
push eax
push dword [esi + 0x84]
lea eax, [ebp - 0x21c]
push dword [esi + 0x80]
push eax
call fcn.00418b55
add esp, 0x10
call fcn.004643ee
ret

Function at 0x457450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61aab140
mov eax, dword fs:[0]
add byte [eax], al
add byte [eax + 0x51], dl
Function at 0x45745d
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax], al
add byte [eax + 0x51], dl
push ebx
push esi
push edi
mov eax, dword [reloc.ole32.dll_CreateStreamOnHGlobal]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00456eb0
mov dword [esi], 0x61ad2980
mov dword [esi + 8], 0x61ad56c8
mov dword [esi + 0xc], 0x61ada73c
mov dword [esi + 0x10], 0x61acfe20
mov ebx, dword [0x61ab4114]
xor edi, edi
lea ecx, [esi + 0x20]
mov dword [ebp - 4], edi
mov dword [esi + 0x1c], edi
call ebx
lea ecx, [esi + 0x34]
call ebx
push esi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call fcn.00457300
mov dword [esi + 0x48], 0x61ae0c3c
mov eax, dword [esi + 0x4c]
mov ecx, 0x61a56910
mov dword [eax + 0x28], ecx
xor edx, edx
mov dword [eax + 0x2c], edx
mov dword [esi + 0x44], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
invalid
invalid

Function at 0x4658f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61aac6d0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [reloc.ole32.dll_CreateStreamOnHGlobal]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov ebx, dword [0x61ab4130]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x20]
lea ecx, [edi + 0x28]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
push ecx
lea ecx, [esi + 0x28]
mov dword [esi + 0x24], eax
call ebx
lea edx, [edi + 0x2c]
push edx
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 0
call ebx
lea eax, [edi + 0x30]
push eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call ebx
lea ecx, [edi + 0x34]
push ecx
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 2
call ebx
add edi, 0x38
push edi
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 3
call ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x465bb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61aac6fc
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [reloc.ole32.dll_CreateStreamOnHGlobal]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 0x30]
mov ecx, edi
call dword [0x61ab4114]
xor eax, eax
push eax
mov ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
call dword [0x61ab4158]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x470640
Capabilities:
Write file on windows

Disassembly:
mov esi, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x5c]
and dword [ebp - 0x54], 0
sub ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x50]
cmp ecx, dword [ebp + 0x524]
jae 0x470607
mov edx, dword [ebp - 0x5c]
inc dword [ebp - 0x5c]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4705f8
inc dword [ebp - 0x68]
mov byte [eax], reloc.WS2_32.dll_connect
inc eax
inc dword [ebp - 0x54]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 0x400
jb 0x4705d8
mov ebx, eax
lea eax, [ebp - 0x50]
sub ebx, eax
push 0
lea eax, [ebp - 0x6c]
push eax
push ebx
lea eax, [ebp - 0x50]
push eax
mov eax, dword [esi]
push dword [edi + eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4707fb
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x60], eax
cmp eax, ebx
jl 0x470804
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x64]
cmp eax, dword [ebp + 0x524]
jb 0x4705c8
jmp 0x470804
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x60], 0
jne 0x470867
cmp dword [ebp - 0x58], 0
je 0x470837
push 5
pop esi
cmp dword [ebp - 0x58], esi
jne 0x47082c
call fcn.0046207f
mov dword [eax], 9
call fcn.00462092
mov dword [eax], esi
jmp 0x470862
push dword [ebp - 0x58]
call fcn.004620a5
pop ecx
jmp 0x470862
mov esi, dword [ebp - 0x70]
mov eax, dword [esi]
test byte [edi + eax + 4], 0x40
je 0x47084f
mov eax, dword [ebp - 0x64]
cmp byte [eax], 0x1a
jne 0x47084f
xor eax, eax
jmp 0x47086d
call fcn.0046207f
mov dword [eax], 0x1c
call fcn.00462092
and dword [eax], 0
or eax, 0xffffffff
jmp 0x47086d
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x68]
pop edi
pop ebx
mov ecx, dword [ebp + 0x510]
xor ecx, ebp
pop esi
call fcn.0045c29b
add ebp, 0x514
leave
ret
Function at 0x473a50
Capabilities:
Get geographical location

Disassembly:
and dword [esi + 8], 0
xor eax, eax
inc eax
jmp 0x473b0f
or byte [ecx + 0x4e8b1c7e], cl
or byte [eax + 0x300], bh
and ecx, eax
cmp ecx, eax
je 0x473b04
push 0x78
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [esi + 0x10]
neg eax
sbb eax, eax
and eax, 0xfffff002
add eax, 0x1001
push eax
push edi
call ebx
test eax, eax
je 0x4739a1
lea eax, [ebp - 0x7c]
push eax
push dword [esi]
call fcn.0046fa89
pop ecx
xor ebx, ebx
test eax, eax
pop ecx
jne 0x473acb
or dword [esi + 8], 0x200
cmp dword [esi + 0x10], ebx
mov eax, dword [esi + 8]
je 0x473ab5
or eax, 0x100
mov dword [esi + 8], eax
jmp 0x473afc
cmp dword [esi + 0xc], ebx
je 0x473af5
push dword [esi]
call fcn.0045ce20
cmp eax, dword [esi + 0xc]
pop ecx
jne 0x473af5
push 1
jmp 0x473ae7
cmp dword [esi + 0x10], ebx
jne 0x473b04
cmp dword [esi + 0xc], ebx
je 0x473b04
lea eax, [ebp - 0x7c]
push eax
push dword [esi]
call fcn.0046fa89
test eax, eax
pop ecx
pop ecx
jne 0x473b04
push ebx
push edi
mov ecx, esi
call fcn.004738de
test eax, eax
pop ecx
pop ecx
je 0x473b04
or dword [esi + 8], 0x100
cmp dword [esi + 0x18], ebx
jne 0x473b04
mov dword [esi + 0x18], edi
mov eax, dword [esi + 8]
shr eax, 2
not eax
and eax, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045c29b
leave
ret 4

Function at 0x473cf0
Capabilities:
Get geographical location

Disassembly:
jl 0x473d48
push 0x40
push 0x484598
call fcn.00473706
add esp, 0xc
test eax, eax
je 0x473d64
mov edi, dword [edi]
cmp edi, ebx
je 0x473d16
cmp byte [edi], bl
je 0x473d16
call fcn.00473bdf
jmp 0x473d64
call fcn.00473c44
jmp 0x473d64
or byte [esi*2 + 0x85e8918], al
jmp 0x473d64
cmp dword [esi + 8], ebx
je 0x473e5c
mov ecx, ebp
add ebp, 0x80
neg ecx
sbb ecx, ecx
and ecx, ebp
mov edi, esi
call fcn.00473766
mov ebx, eax
test ebx, ebx
je 0x473e5c
cmp ebx, 0xfde8
je 0x473e5c
cmp ebx, 0xfde9
je 0x473e5c
movzx eax, bx
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x473e5c
push 1
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x473e5c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x473de4
mov cx, word [esi + 0x18]
mov word [eax], cx
mov cx, word [esi + 0x1c]
mov word [eax + 2], cx

Function at 0x473de0
Capabilities:
Get geographical location

Disassembly:
mov word [eax + 4], bx
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x473e57
cmp word [eax], 0x814
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jne 0x473e1e
push 0x484874
push 0x40
push edi
call fcn.00468c78
add esp, 0xc
test eax, eax
je 0x473e2f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045d1c5
add esp, 0x14
jmp 0x473e2f
push 0x40
push edi
push ntohl
push dword [esi + 0x18]
call ebp
test eax, eax
je 0x473e5c
push 0x40
lea eax, [edi + 0x40]
push eax
push ntohl
push dword [esi + 0x1c]
call ebp
test eax, eax
je 0x473e5c
push 0xa
push 0x10
add edi, 0x80
push edi
push ebx
call fcn.00477f72
add esp, 0x10
xor eax, eax
inc eax
jmp 0x473e5e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10003510
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x100a2c08
mov esi, ecx
jmp loc.10178755

Function at 0x100037b0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x24f8
call fcn.10099a30
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100a2c08
mov dword [ebp - 0x2350], ecx
jmp 0x1003fcef
lea esp, [esp + 4]
mov edx, dword [0x101208d8]
xor edi, edi
mov eax, dword fs:[0x2c]
jmp loc.101d703d
Function at 0x10003c60
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
call fcn.10189734
jle 0x100390b5
mov edx, 0xfd8f918a
mov eax, 0x79b93dba
mov edx, dword [ebp + eax - 0x79b93dba]
inc eax
lea ebp, [eax + ebp - 0x79b93db7]
lea ecx, [eax*2 - 0x467949d7]
shl ecx, 0x2a
xor edx, ebx
or ax, 0x929f
dec ax
rol edx, 1
imul ecx, ecx
call fcn.101cf753
xor ecx, ecx
jmp loc.101c9f4a
movaps xmm0, xmmword [ebp - 0x13e10]
stc
test cx, 0x5b6
movaps xmmword [ebp - 0x12360], xmm0
cmp bh, 0xb0
test ecx, 0xb992b906
cmp ecx, ebx
xor eax, eax
jmp 0x10065ae5
movaps xmm0, xmmword [ebp - 0xce60]
movaps xmmword [ebp - 0x13e30], xmm0
movaps xmm0, xmmword [ebp - 0x12350]
clc
movaps xmmword [ebp - 0x13e20], xmm0
movaps xmm0, xmmword [ebp - 0x13e20]
test bh, 0xa
stc
xorps xmm0, xmmword [ebp - 0x13e30]
movaps xmmword [ebp - 0x13e40], xmm0
cmc
test ebp, 0x71a3b30
test bp, sp
movaps xmm0, xmmword [ebp - 0x13e40]
movaps xmmword [ebp - 0x12350], xmm0
jmp 0x10007a4e
ror ecx, 1
cdq
bts ax, 0xa3
xor ebx, ecx
bt dx, ax
mov dword [edx + esi], ecx
or dl, byte [edx + ebp + 8]
lea ebp, [ebp + eax - 0x57dbffff]
lea ecx, [eax + eax*8 - 0x4bc6b7f9]
bts cx, cx
xor dl, bl
btc ecx, ecx
and ecx, eax
push ecx
adc dl, 0x12
dec dword [esp + eax - 0x57dc0008]
jne 0x1015e63f
mov dword [ecx + esi - 0x27a50000], edx
neg dword [esp + ecx - 0x27a50000]
xor eax, dword [ebp + ecx - 0x27a50000]
pop edx
lea ebp, [ebp + ecx*2 - 0x4f49fffc]
xor eax, ebx
lea eax, [eax + ecx*2 - 0x14be02f3]
neg eax
inc cx
and dx, dx
rol eax, 3
neg eax
dec eax
sub edx, 0x66256387
call fcn.1001343a
movaps xmm0, xmmword [ebp - 0xce70]
test bp, si
cmp di, bx
movaps xmmword [ebp - 0x13e00], xmm0
movaps xmm0, xmmword [ebp - 0x12360]
clc
cmp si, cx
movaps xmmword [ebp - 0x13df0], xmm0
clc
movaps xmm0, xmmword [ebp - 0x13df0]
test sp, ax
xorps xmm0, xmmword [ebp - 0x13e00]
test edi, 0xed91759f
cmp edx, ebp
movaps xmmword [ebp - 0x13e10], xmm0
test esp, 0x85a9fc8f
jmp 0x1000ad8a
je 0x10020e31
jmp 0x10007a4e
sal dword [esp + eax - 0x57dc0008], cl
neg dl
bswap eax
add dl, 0x8f
xor dl, 0xbd
xchg byte [esp + eax*2 - 0x1001b8ac], ah
sub byte [esp + eax - 0x8000057], cl
dec dl
bts cx, cx
and dword [esp + eax*4 - 0x2000015c], 0x31975e99
not dl
xor ecx, eax
neg dl
xor bl, dl
cwde
rol eax, cl
lea edx, [esp + edx + 4]
bts ecx, 0x1a
inc cx
mov ecx, dword [ecx + edx - 0x4ed40160]
movzx edx, ax
lea edx, [edx + eax*4 - 0x61ddb974]
div byte [esp + 1]
mov dword [esi - 4], ecx
movsx ecx, dl
call fcn.1014c97c

Function at 0x100040e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100a2c08
jmp loc.101f5237

Function at 0x10005580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
push esi
push edi
mov esi, ecx
push 0x100a2c08
mov dword [esp + 0x2c], esi
jmp loc.101a8fea
Function at 0x1001cf64
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push edx
mov edx, 0xf8b3ce24
mov dword [esp + 0x10], 0x10016fd0
mov edx, dword [esp + edx*2 + 0xe9863b8]
shl dword [esp + 0xc], 0xd4
jne 0x10083400
call fcn.10136ace
mov esp, esi
pop ebx
mov ecx, 0xcf325395
popfd
movzx esi, cx
pop ecx
call fcn.10157528
mov al, 0x85

Function at 0x10028858
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0x460cdf94
sub eax, ecx
jmp loc.1016904a

Function at 0x1002fb47
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 4], 0x10067cb9
lea esp, [esp + 4]
call fcn.1004cea8
je 0x1012bc1c
jmp 0x1012bc72
movaps xmm0, xmmword [ebp - 0x89a0]
rol cl, cl
sub cl, ch
cmp sp, bp
movaps xmmword [ebp - 0xf320], xmm0
add cx, 0xea3f
or ch, dl
movaps xmm0, xmmword [ebp - 0xa390]
and ch, 0xb4
ror ecx, 0x8a
xor cl, 0x3b
movaps xmmword [ebp - 0xf310], xmm0
movaps xmm0, xmmword [ebp - 0xf310]
xorps xmm0, xmmword [ebp - 0xf320]
movaps xmmword [ebp - 0xf330], xmm0
movaps xmm0, xmmword [ebp - 0xf330]
movaps xmmword [ebp - 0xa390], xmm0
mov ecx, 1
cmp ecx, eax
test cx, 0xea01
stc
test ecx, ecx
jmp 0x10130f69
je 0x1016bc21
jmp 0x1016bc7e
movaps xmm0, xmmword [ebp - 0x8990]
shld dx, bx, 0xa
sub edx, edx
movaps xmmword [ebp - 0xf350], xmm0
sar dx, cl
add dh, 0xa1
movaps xmm0, xmmword [ebp - 0xa380]
movaps xmmword [ebp - 0xf340], xmm0
cmc
movaps xmm0, xmmword [ebp - 0xf340]
movsx edx, si
xorps xmm0, xmmword [ebp - 0xf350]
xadd edx, edx
movaps xmmword [ebp - 0xf360], xmm0
movaps xmm0, xmmword [ebp - 0xf360]
btc edx, esp
shld edx, ecx, 2
cmp cx, dx
movaps xmmword [ebp - 0xa380], xmm0
mov edx, 1
stc
test edx, edx
je 0x101f5be3
jmp 0x101f5c45
movaps xmm0, xmmword [ebp - 0x8980]
movaps xmmword [ebp - 0xf380], xmm0
cmovle ax, cx
movaps xmm0, xmmword [ebp - 0xa370]
rcr al, cl
btr eax, ebx
movaps xmmword [ebp - 0xf370], xmm0
movsx ax, cl
shr ah, 0x17
movaps xmm0, xmmword [ebp - 0xf370]
neg ax
bts ax, bp
xorps xmm0, xmmword [ebp - 0xf380]
movaps xmmword [ebp - 0xf390], xmm0
clc
movaps xmm0, xmmword [ebp - 0xf390]
btr eax, 0xaf
shld ax, sp, 5
movaps xmmword [ebp - 0xa370], xmm0
test edi, ebx
mov eax, 1
test eax, eax
jmp fcn.10027624

Function at 0x10030980
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
add dword [esp + 0x10], 0xefea1738
call fcn.1013032e
movaps xmm0, xmmword [ebp - 0x1890]
push edi
mov edi, 0x5ba68492
push ecx
pushfd
call fcn.101bc43b
lea eax, [esp + 4]
movzx dx, byte [eax]
mov word [esi - 2], dx
mov ecx, 0x63a2cebc
movzx eax, cx
mov edx, ecx
mov edx, dword [eax + ebp - 0xcebc]
lea ebp, [ebp + ecx - 0x63a2ceb8]
xor edx, ebx
ror ecx, cl
ror eax, 0x11
inc edx
add cx, cx
call fcn.10054ef8
Function at 0x10032d65
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
ja 0x10145913
mov eax, 0x3dbf6f3c
mov edx, 0x66912a92
mov edx, esp
bt eax, 0x2c
shr eax, 0xcc
mov ecx, 0xf4362720
lea ecx, [eax - 0x3db8a]
cwde
lea eax, [esi - 0x80]
jb 0x101c0403
and eax, 0xfffffffc
call fcn.10028858
adc ecx, eax
shl dx, 0xee
or byte [esp + edx], 7
mov dword [edx + esi], ecx
movsx ecx, dx
mov dword [esp + edx*2], edi
ret
jb 0x1003b1c2
mov dword [esp + 0xc], 0x860d076e
jmp loc.10174be0
je 0x10142f01
jmp 0x10142f71
movaps xmm0, xmmword [ebp - 0x90e0]
stc
clc
neg cx
movaps xmmword [ebp - 0xd670], xmm0
xchg cx, cx
movaps xmm0, xmmword [ebp - 0x99c0]
movsx ecx, bx
movaps xmmword [ebp - 0xd660], xmm0
ror cl, 0x13
movaps xmm0, xmmword [ebp - 0xd660]
or cx, 0xcc12
test esi, esi
and ecx, 0x4711c63b
xorps xmm0, xmmword [ebp - 0xd670]
movzx ecx, di
shr ch, 0x1c
not cl
movaps xmmword [ebp - 0xd680], xmm0
shld ecx, ebx, 0x2e
mov ecx, 0x37808435
cmc
movaps xmm0, xmmword [ebp - 0xd680]
movaps xmmword [ebp - 0x99c0], xmm0
movzx cx, cl
mov ecx, 1
test ebx, esp
cmc
test ecx, ecx
jmp fcn.1007ae5c
call fcn.10003c60
jb 0x1005cc71
movaps xmm0, xmmword [ebp - 0x90f0]
test ebx, 0x7aaff43e
cmc
test eax, esi
movaps xmmword [ebp - 0xd640], xmm0
stc
test bh, bh
cmc
movaps xmm0, xmmword [ebp - 0x99d0]
movaps xmmword [ebp - 0xd630], xmm0
clc
movaps xmm0, xmmword [ebp - 0xd630]
cmp esp, esi
xorps xmm0, xmmword [ebp - 0xd640]
cmc
stc
movaps xmmword [ebp - 0xd650], xmm0
cmp bh, 0x28
movaps xmm0, xmmword [ebp - 0xd650]
movaps xmmword [ebp - 0x99d0], xmm0
test sp, 0x1b9d
xor eax, eax
jmp 0x1012cec0

Function at 0x10034759
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
add esi, esi
mov esi, dword [esp + 8]
mov dword [esp + 8], 0x101b7f20
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.1004cea8

Function at 0x10036ea6
Capabilities:
Parse pe header

Disassembly:
add edx, ecx
cwde
mov dword [esi + eax - 0xd], edx
mov ecx, dword [ebp + eax*2 - 0x16]
bt eax, eax
lea ebp, [ebp + eax - 5]
xor ecx, ebx
xadd word [esp + eax*2 - 0x10], ax
mov dword [esp + eax - 6], eax
dec ecx
lea edx, [eax + eax*4 - 0x38db71e2]
ror byte [esp + eax - 5], 6
xor ecx, 0xd221a218
pop eax
and eax, 0x88af8dbb
ror ecx, 1
pop edx
not ecx
shl byte [esp + eax*2 - 1], 1
xadd dl, dh
inc ecx
dec eax
jg 0x101fe5a5
call fcn.10052690
push dword [ebp - 0x45d8]
jmp loc.1016047e
xor ecx, 0x3186409d
or eax, 0x12064096
sub edx, 0xd7240b3e
bt edx, 0x22
bswap ecx
cwde
sbb ecx, 0xb926b899
push eax
not al
neg eax
ror ecx, 3
bswap ecx
not dword [esp + edx - 0x4a53caa0]
lea edx, [edx*4 - 0x3bf740d4]
xor ebx, ecx
add edi, ecx
movzx ecx, al
call fcn.101cf463

Function at 0x10037b70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp byte [edi + 0x12f], 0
jne 0x10037c77
push ebx
push 0x100a2c08
jmp loc.10155ee5