joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065850
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c49e0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc
mov eax, 0x4ff4
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x45e8], edi
mov dword [ebp - 0x4b08], edi
push 0x100cbc5e
jmp loc.101ce507

Function at 0x10069db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
push 0x100cbc5e
mov dword [ebp - 0xc], ebx
jmp loc.101a9b9a

Function at 0x10069fa0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xce8
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0xce4], eax
push esi
push edi
push 0x100cbc5e
mov esi, ecx
jmp loc.101b2746

Function at 0x1006f000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0x100cbc5e
jmp loc.101778e3

Function at 0x1006fca0
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3
Packed with generic packer

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x2de4
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x1c58], ecx
push 0x100cbc5e
jmp loc.1023066d

Function at 0x10073670
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x928
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x674], eax
push 0x100cbc5e
mov dword [ebp - 0x658], esi
jmp 0x10098263
lea esp, [esp + 4]
movzx eax, sp
setle ah
not ax
push 0x208
lahf
lea eax, [ebp - 0x418]
push 0
jmp loc.10229a2a

Function at 0x100744a0
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x8078
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0x8074], eax
push esi
push edi
push 0x100cbc5e
mov edi, ecx
jmp loc.1015f9f0

Function at 0x1007b007
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions

Disassembly:
call fcn.101bf5b3
movaps xmm0, xmmword [ebp - 0xb4b0]
pushfd
call fcn.1019bfa7
Function at 0x1007e170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.1021f525
movups xmm0, xmmword [ecx + 0x10]
push 0xec15888b
call fcn.1024331f

Function at 0x10081040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4ab0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc
mov eax, 0x16054
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xbc00], ecx
push 0x100cbc5e
call fcn.10265dac

Function at 0x100898e4
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
add dword [esp + ebx + 0x5c7686fb], 0xefea6c3a
mov ebx, dword [esp + ebx + 0x5c768713]
add dword [esp + 0xc], 0xefd80635
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x1c]
call fcn.1021f525

Function at 0x1009572a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esp, eax
push 0x74bf0819
mov dword [esp], edi
push 0xb9bdd7bc
call fcn.101b72a7

Function at 0x10098115
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.1021f525

Function at 0x10099abd
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1001ced0
mov ecx, dword [ebp - 0x150c]
mov dx, 0xcf96
mov dl, bh
mov dword [ecx + 0x568], eax
movzx ecx, bp
lea edx, [ebp - 0x368]
xchg ah, ch
mov ax, bp
mov ch, 0x95
push edx
mov eax, dword [ebp - 0x151c]
movzx ecx, di
mov ecx, 0x2135d498
cmovne cx, bp
push eax
mov ecx, dword [ebp - 0x150c]
jmp 0x1003b86f
call fcn.1001ced0
mov ecx, dword [ebp - 0x150c]
mov dword [ecx + 0x56c], eax
movsx dx, dl
lea edx, [ebp - 0xffc]
bswap ax
movzx ecx, si
push edx
mov eax, dword [ebp - 0x1510]
cmovno ecx, ecx
movzx ecx, dx
push eax
not ch
mov ecx, dword [ebp - 0x1514]
jmp 0x10064f93
push ecx
mov ch, 0x89
mov ecx, dword [ebp - 0x150c]
call fcn.1001bea0
mov edx, dword [ebp - 0x150c]
mov ecx, 0x29ad2826
mov dword [edx + 0x570], eax
movzx cx, cl
cbw
lea eax, [ebp - 0x1010]
cmovns edx, ebx
movsx cx, bl
push eax
mov ecx, 0xcd1c931f
mov edx, ecx
cdq
mov ecx, dword [ebp - 0x1510]
not dh
cwd
push ecx
cdq
mov edx, dword [ebp - 0x1514]
movzx cx, dl
movsx ecx, cx
mov cx, ax
push edx
mov ecx, eax
jmp loc.1020a4fb
mov dword [esp + 4], 0x61403710
lea esp, [esp + 4]
call fcn.1021f525
mov ecx, dword [ebp - 0x150c]
jmp 0x1001f5c3
Function at 0x1009dc10
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4d18
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x100cf040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x1011d59c]
push 0x100cbc5e
mov dword [ebp - 0x14], edi
push esi
mov esi, 0xec27cfb6
pushfd
shl esi, 0x8f
push ebx
push edx
mov esi, dword [esp + esi + 0x1825000c]
mov dword [esp + 0xc], 0xbafd2790
push dword [esp + 8]
daa
std
mov edx, 0x82474ff
popfd
lea esp, [esp + 0xc]
call fcn.1021f525
cmpsb byte [esi], byte es:[edi]
xor dh, 0xec
mov eax, dword [0xbbb2dae5]
dec edi
and ebp, 0x4f2bb2da
cdq
in eax, 0xda
mov dl, 0x53
jnp 0x1009dc63
xchg edi, eax
add bl, byte [edx - 0x5c]
scasb al, byte es:[edi]
out 0xc8, eax
jl 0x1009dcd3
and dword [esi + 0x1b], esi
jmp 0xd75a9fa0
test dl, 0x50
invalid
sub eax, 0x8f78b7b
and cl, byte [edi - 0x21]
jo 0x1009dc71
mov esi, 0x63f54ca9
insd dword es:[edi], dx
cwde
or al, 0x59
fist word [ebp + 0x73]
xchg ebx, eax
cmc
inc ebx
xchg ecx, eax
mov bl, 0xc2
std
outsb dx, byte [esi]
fld qword [ebx - 0x28128451]
xchg ebp, eax
js 0x1009dca6
lodsb al, byte [esi]
sbb bl, byte [edx]
push cs
out dx, al
cmpsd dword [esi], dword es:[edi]
shld edi, esp, 0xc1
mov eax, dword [0xb77a56a8]
idiv dword [edi + 0x2e0ff5a7]
jmp 0x63d79ab4
Function at 0x100a44f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xba8
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0xba4], eax
push esi
push edi
push 0x100cbc5e
jmp fcn.10212123
Function at 0x100aa830
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x6898
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0x6894], eax
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x31cfc]
cmp eax, dword [esi + 0x31d00]
je 0x100aa86a
mov dword [esi + 0x31d00], eax
push 0
call fcn.100ac240
mov edx, dword [esi + 0x31d00]
mov eax, edx
mov ecx, dword [esi + 0x31cfc]
sub eax, ecx
sar eax, 3
mov dword [esp + 0x14], 0
test eax, eax
je 0x100ab1f9
mov eax, dword [0x1011710c]
xor edi, edi
mov ecx, dword fs:[0x2c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
lea eax, [ecx + eax*4]
mov dword [esp + 0x2c], eax

Function at 0x100ad458
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x100ad48d
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x100ad48a
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x100ad496
add edx, 0x28
cmp edx, esi
jne 0x100ad478
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x100ad493

Function at 0x100b681b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100b685a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100b685a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100b685a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100b685a
cmp dword [ecx + 0x74], 0xe
jbe 0x100b685a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100b92b6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c7cc0
push 0x100c7cb8
push str.FlsAlloc
push 0x1f
call fcn.100b91d2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b92ea
push dword [ebp + 8]
mov ecx, esi
call dword [0x100c6130]
call esi
jmp 0x100b92f0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100b9334
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c7cd0
push 0x100c7cc8
push str.FlsGetValue
push 0x21
call fcn.100b91d2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b936b
push dword [ebp + 8]
mov ecx, esi
call dword [0x100c6130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100b9373
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100c7cd8
push 0x100c7cd0
push str.FlsSetValue
push 0x22
call fcn.100b91d2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b93ad
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100c6130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100bc35a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100bc3f7
push ebx
push esi
call fcn.100bc323
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100bc2b7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100bc3a4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100bc3f6
push edi
push eax
call fcn.100b7304
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100bc3c4
call fcn.100b72ca
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100bc3f5
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100bc2b7
add esp, 0x20
test eax, eax
jne 0x100bc3e3
push edi
call fcn.100b72ca
jmp 0x100bc3eb
push ebx
call fcn.100b72ca
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100c2750
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100c277d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100c277d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1014f5d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, ecx
push edx
or cl, byte [edi + edx - 0x248c7a29]
mov byte ss:[eax + edx*2 - 0x4918f45a], cl
shl byte [esp + edx - 0x248c7a19], 0x43
movzx eax, byte [edx + ebp - 0x248c7a29]
add dx, dx
lea ebp, [ebp + edx*2 - 0x4919e8af]
call fcn.1019f3b2

Function at 0x1015dd5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], 0x4ec6b610
lea esp, [esp + 4]
call fcn.1021f525

Function at 0x1017de74
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push 0x4496f420
call fcn.10016608

Function at 0x1019f4cd
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov edi, 0xf61012be
mov edi, dword [esp + edi + 0x9efed5e]
mov dword [esp + 0x1c], 0x7868a590
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x1c]
call fcn.1021f525
movaps xmm1, xmmword [esp + 0x18c0]
jmp 0x1005984e

Function at 0x101ac3d8
Capabilities:
Parse pe header

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.1021f525
Function at 0x101bf5b3
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0xc]
mov dword [esp + 0xc], 0x9376a710
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.1021f525
call fcn.10010710
test eax, eax
jmp 0x10243334
jne 0x1026560d
mov dword [esp + 0xa38], 0x74678947
cwde
setl dl
mov dword [esp + 0xa3c], 0xa8de415e
lahf
mov eax, dword [esp + 0xa38]
movsx cx, dl
setns dh
mov ecx, dword [esp + 0xa3c]
cdq
cmovns dx, bp
movzx edx, ax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cdq
mov ecx, 0x8e8a2008
cbw
mov dword [esp + 0xa40], 0xd69224a7
mov dword [esp + 0xa44], 0x2993342e
cwde
bswap dx
mov eax, dword [esp + 0xa40]
cmovne edx, edx
movzx cx, ah
movzx edx, dx
mov ecx, dword [esp + 0xa44]
mov edx, 0xab8fc114
mov dword [esp + 0x28], eax
movsx dx, dh
cwde
rdtsc
mov dword [esp + 0x2c], ecx
seto dl
mov dword [esp + 0xa48], 0x5f2adf75
mov dword [esp + 0xa4c], 0xbcedf27f
mov eax, dword [esp + 0xa48]
cmovo dx, cx
jmp loc.1009325a

Function at 0x101c31a3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
and edx, edx
bswap eax
and ecx, ecx
adc dl, ch
mov dword [esp + edx*2 - 0x4918f458], edx
inc eax
ror ecx, 0xbb
inc dx
xor ecx, ecx
xor ebx, eax
call fcn.10002c15

Function at 0x101d0b77
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
movzx ecx, byte [ebp - 0xde55]
stc
cmp dh, 0x8b
test ecx, ecx
je 0x101c6e5c
mov edx, dword [ebp - 0xe0f4]
sete cl
push edx
mov cl, ah
movsx ecx, bp
mov ecx, dword [ebp - 0xde50]
jmp 0x101b3755
call fcn.1004f560
nop
jmp 0x101c6e5c
jmp loc.10005f99
lea esp, [esp + 0x10]
call fcn.1021f525
clc
test ecx, ecx
je 0x101a189a
mov dword [ebp - 0xdde4], 0
rdtsc
lea edx, [ebp - 0xdde4]
bswap eax
mov ax, sp
push edx
lea eax, [ebp - 0x370]
movsx ecx, ax
jmp loc.100a00f0

Function at 0x101d9d1f
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
call fcn.1017de74
movaps xmmword [ebp - 0x11690], xmm0
push ebp
pushfd
mov ebp, 0x21a43101
and ebp, ebp
jno 0x1005913a

Function at 0x101e36f2
Capabilities:
Encode data using base64

Disassembly:
push edi
pushfd
mov edi, 0xc9064f03
mov dword [esp + 8], 0xc43ba710
mov edi, dword [esp + edi*2 + 0x6df361fe]
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.1021f525
Function at 0x101f9ce1
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Encode data using xor
Encrypt data using chaskey
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
xchg word [esp + 2], ax
call fcn.101f34a1
xchg ecx, eax
pop ss
invalid
mov eax, 0xad968b
movzx ecx, al
mov ax, word [eax + edi - 0xad9689]
rol cx, 0x28
adc cl, byte [edi + ecx*4 - 0x22bfc]
push 0xa9896d1d
add edi, 4
jmp 0x10049357
push 0xd487e6bb
shrd dx, ax, cl
mov eax, 0x7040d96
xchg byte [esp + eax - 0x7040d91], ah
movsx ecx, byte [esp + eax - 0x7046d92]
mov word [edi + eax - 0x7046d96], dx
sar dword [esp + eax - 0x7046d96], cl
mov eax, dword [eax + ebp - 0x7046d96]
movsx edx, cx
lea ebp, [ebp + ecx*2 - 0x36]
sar byte [esp + ecx - 0x1b], 0xe2
xor eax, ebx
btc ecx, edx
bt ecx, ecx
rol eax, 1
bts dx, 0x1b
lea eax, [ecx + eax + 0x77032afb]
add cl, cl
neg eax
not eax
not byte [esp + ecx - 0x20000039]
shl dx, 0x2e
and dword [esp + ecx*2 - 0x40000073], edx
xor eax, 0x8eb9ea0e
push edx
not dword [esp + ecx - 0x20000036]
xadd cl, ch
xor ebx, eax
sub byte [esp + ecx - 0x20003a34], ch
not word [esp + ecx - 0x20003a32]
adc esi, eax
push edx
call fcn.101fbd62
mov ecx, 0x7069a2f
lea edi, [edi + ecx*4 - 0x1c1a68b6]
not cx
mov byte [eax + ecx*4 - 0x1c199740], dl
jl 0x10004bab
mov eax, 0x103a1820
movzx edx, al
mov edx, dword [ebp + ecx*2 - 0xe0ccba0]
or ecx, eax
xadd eax, ecx
bts cx, cx
lea ebp, [ecx + ebp - 0x103a181d]
not ax
xor edx, ebx
neg edx
btc eax, ecx
shr al, 0x23
xor edx, 0x3fa31b81
rol cx, cl
shl ax, 0xd
bswap edx
xor ecx, 0xd3e49b5
bswap eax
ror edx, 3
neg cl
and ecx, 0xcd999212
sar ecx, 0xc1
xor edx, 0x14142692
add cx, 0xec26
xor ebx, edx
xchg cx, ax
add esi, edx
lea ecx, [ecx*2 - 0x52783954]
btc cx, ax
jmp esi
lea esp, [esp + 0xc]
call fcn.1021f525
movups xmm0, xmmword [ecx + 0x70]
push ecx
mov ecx, 0x4b8946bb
pushfd
xor cx, 0x1280
push esi
mov esi, ecx
jl 0x101f9cd5
lea ecx, [ecx*2 + 0x2e160da7]
mov ecx, dword [esp + esi - 0x4b895433]
mov dword [esp + 8], 0x5086b790
mov esi, dword [esp + esi - 0x4b89543b]
call fcn.10155ecf
mov edx, 0x44220ea0
add edx, edx
mov eax, dword [edi]
mov dl, byte [edi + 4]
je 0x10019f0d
jg 0x1019c1bd

Function at 0x101fd2ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], 0x67aba890
lea esp, [esp + 4]
call fcn.1021f525

Function at 0x10200395
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], 0x8c9b2910
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.1021f525
rcl dx, cl
Function at 0x10203069
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xa0]
jmp 0x102753cf
movaps xmmword [esp + 0x28], xmm1
jmp 0x1019e2ec
mov eax, dword [esp + 0xa8]
movsx cx, dh
mov ecx, dword [esp + 0xac]
jmp 0x101b84d2
push ecx
jmp 0x1025deee
call fcn.100b5978
lea esp, [esp + 8]
test eax, eax
jmp 0x1027ab15
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
lahf
movzx cx, cl
movsx cx, cl
mov dword [esp + 0xb0], 0x5f23df2d
bswap ecx
mov dword [esp + 0xb4], 0xbc9ef21e
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xb4]
jmp loc.10052fb1
pushfd
add dword [esp + 4], 0xeff6254f
mov dword [esp + 4], 0xad89a610
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1021f525
xorps xmm1, xmmword [esp + 0x264]
push eax
jmp 0x1015360d
push ecx
jmp 0x1023d569
push 1
jmp 0x1026e27b
push dword [esp + 0x344]
jmp 0x10203271
call fcn.1006eb70
mov esi, eax
cmp di, 0xd589
clc
cmp esi, 0xffffffff
jmp loc.1002921b
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0x40], eax
cwde
cbw
mov dword [esp + 0x44], ecx
not ax
xchg ch, ch
mov dword [esp + 0xa8], 0xd69c24a8
mov dword [esp + 0xac], 0x29853473
jmp 0x10156456
je 0x10188428
mov dword [esp + 0xa0], 0x74758979
mov dword [esp + 0xa4], 0xa8d04158
mov ch, ah
setg ah
jmp 0x101529bf

Function at 0x1020318d
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
lea esp, [esp + 0x18]
call fcn.1021f525

Function at 0x10203865
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 8]
popfd
lea esp, [esp + 0x1c]
call fcn.1021f525

Function at 0x1020855d
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information
Parse pe header

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x10]
call fcn.1021f525
movaps xmmword [ebp - 0x11d20], xmm0
push 0x2a8de800
not dword [esp]
pushfd
or dword [esp + 4], 0xfa26d497
add dword [esp + 4], 0xe21e1f07
mov dword [esp + 4], 0x5e1e2890
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1021f525
mov ah, 0xae
ljmp 0x29b2
lea ecx, [ecx*2 + 0x56b55723]
not ecx
push esi
mov esi, ecx
and si, si
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], 0x9ad8b710
mov esi, dword [esp]
jge 0x102581f6
jg 0x1015f24b
bswap eax

Function at 0x102115ae
Capabilities:
Check for software breakpoints
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Parse credit card information

Disassembly:
neg ecx
test ecx, ecx
mov cx, 0x379b
not cl
movzx ecx, cx
mov ecx, dword [esp + 8]
mov dword [esp + 8], 0x6d03a890
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.1021f525
Function at 0x10211cff
Capabilities:
Check for software breakpoints
Check http status code
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information

Disassembly:
pushfd
add dword [esp + 8], 0xefe4733b
mov dword [esp + 0xc], 0xc25fb610
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.1021f525
push edx
xor eax, ebx
rol eax, 1
movzx ecx, dl
sub eax, 0xe235290d
mov dword [esp + edx - 0x248c7a28], 0x7b0313a
call fcn.101c31a3

Function at 0x10213e88
Capabilities:
Check http status code
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0xc], 0x660ba790
lea esp, [esp + 0xc]
call fcn.1021f525

Function at 0x10213efb
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 8]
mov dword [esp + 8], 0xa2e83290
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.1021f525
movaps xmm0, xmmword [ebp - 0x11400]
push ecx
push ebp
call fcn.1025b347