joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4027f8
cmp byte [esi + ebx - 1], 0xa
je 0x4027cc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4040f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
lea ecx, [ebp - 0x14]
push ebx
sub esp, 0x20
mov dword [ebp - 0x14], 0x1fe
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov ebx, eax
test eax, eax
jne 0x402888
cmp dword [ebp - 0x10], 1
je 0x402898
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp word [edi], 0
je 0x4028e8
mov eax, edi
add eax, 2
cmp word [eax], 0
jne 0x4028a0
sub eax, edi
add eax, 2
xor ecx, ecx
mov esi, dword [sym.imp.ucrtbase.dll_wcschr]
mov word [edi + eax], cx
jmp 0x4028c8
xor edx, edx
lea edi, [eax + 2]
mov word [eax], dx
mov dword [esp + 4], 0x2c
mov dword [esp], edi
call esi
test eax, eax
jne 0x4028c0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 2
jmp 0x4028ae
Function at 0x402c70
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x20c]
sub esp, 0x214
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineWineBrowser
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x402cd8
mov esi, 0x4054e0
mov ecx, 0x1f
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x214]
mov eax, ebx
call sym._launch_app
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x210]
mov ecx, ebx
mov edx, str.Browsers
call sym._get_commands.constprop.0
mov esi, eax
mov eax, dword [ebp - 0x210]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test esi, esi
je 0x402cbc
jmp 0x402cae

Function at 0x402d10
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x20c]
sub esp, 0x214
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareWineWineBrowser
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x402d80
mov esi, str._usr_bin_open
mov ecx, 0x21
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movzx eax, word [esi]
mov word [edi], ax
mov edx, dword [ebp - 0x214]
mov eax, ebx
call sym._launch_app
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x210]
mov ecx, ebx
mov edx, str.Mailers
call sym._get_commands.constprop.0
mov esi, eax
mov eax, dword [ebp - 0x210]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test esi, esi
je 0x402d62
jmp 0x402d4e

Function at 0x403c40
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop
Function at 0x442880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
dec eax
push esi
je 0x442965
sub eax, 0x80
je 0x4428fd
sub eax, 0x8e
je 0x4428df
dec eax
je 0x4428b5
sub eax, 0x2ef
je 0x4428ae
pop esi
pop ebp
jmp fcn.00442579
mov eax, 0x487f
jmp 0x4428cb
movzx eax, word [ebp + 0x10]
cmp eax, 2
jne 0x4428d0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x80]
xor eax, eax
pop esi
pop ebp
ret 0x10
cmp eax, 1
jne 0x4428c9
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x7c]
jmp 0x4428c9
mov esi, dword [ebp + 8]
push 0
push 0
push 0x400
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
jmp 0x4428cb
push dword [sym.imp.USER32.dll_DefWindowProcW]
mov esi, dword [ebp + 8]
push 0xfffffffffffffffc
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [esi + 0x2c], 0
je 0x44295d
test byte [esi + 0x48], 1
je 0x44295d
push ebx
push edi
mov edi, 0x48b5d4
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x2c]
and dword [esi + 0x2c], 0
mov ebx, dword [eax + 0x18]
dec dword [eax + 0x6c]
push esi
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push eax
push 0x447
push ebx
call esi
push 0
push 0
push 0x43d
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebx
xor eax, eax
inc eax
jmp 0x4428cb
mov eax, dword [ebp + 8]
test byte [eax + 0x48], 0x10
je 0x4428c9
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x44295d
Function at 0x4612e9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
and eax, 0xffdf
cmp ax, 0x41
je 0x461307
cmp ax, 0x42
je 0x461307
push 0xfffffffffffffffe
pop eax
leave
ret
and word [ebp - 4], 0
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
mov word [ebp - 6], 0x3a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
leave
ret

Function at 0x46148c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop ebp
ret
Function at 0x464a7a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x47da50
call fcn.00464048
mov edi, 0x94
mov eax, edi
call fcn.00462ba0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x48bac4], ecx
mov eax, dword [esi + 4]
mov dword [0x48bad0], eax
mov edx, dword [esi + 8]
mov dword [0x48bad4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x48bac8], esi
cmp ecx, 2
je 0x464ada
or esi, 0x8000
mov dword [0x48bac8], esi
shl eax, 8
add eax, edx
mov dword [0x48bacc], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x464b15
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x464b15
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x464b2d
cmp eax, 0x20b
je 0x464b1a
mov dword [ebp - 0x1c], esi
jmp 0x464b41
cmp dword [ecx + 0x84], 0xe
jbe 0x464b15
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x464b3b
cmp dword [ecx + 0x74], 0xe
jbe 0x464b15
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0046d177
pop ecx
test eax, eax
jne 0x464b55
push 0x1c
call fcn.00464a56
pop ecx
call fcn.0046745b
test eax, eax
jne 0x464b66
push 0x10
call fcn.00464a56
pop ecx
call fcn.0046ef24
mov dword [ebp - 4], esi
call fcn.00466342
test eax, eax
jge 0x464b7f
push 0x1b
call fcn.00464a31
pop ecx
call fcn.0046ee85
mov dword [0x48c470], eax
call fcn.0046ed1b
mov dword [0x48bab8], eax
call fcn.0046ec85
test eax, eax
jge 0x464ba4
push 8
call fcn.00464a31
pop ecx
call fcn.0046ea52
test eax, eax
jge 0x464bb5
push 9
call fcn.00464a31
pop ecx
push 1
call fcn.00464e55
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x464bcb
push eax
call fcn.00464a31
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.0046ea0c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x464bec
movzx eax, word [ebp - 0x40]
jmp 0x464bef
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004067c2
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x464c0d
push edi
call fcn.00464f82
call fcn.00464fa4
jmp 0x464c3f
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00464083
ret
Function at 0x464ebf
Capabilities:
Terminate process

Disassembly:
push 8
push 0x47da88
call fcn.00464048
push 8
call fcn.00466952
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x48bb04], esi
jne 0x464ef3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x48bb00], esi
mov al, byte [ebp + 0x10]
mov byte [0x48bafc], al
cmp dword [ebp + 0xc], edi
jne 0x464f3d
cmp dword [0x48c468], edi
je 0x464f2d
mov eax, dword [0x48c464]
sub eax, 4
mov dword [0x48c464], eax
cmp eax, dword [0x48c468]
jb 0x464f2d
mov eax, dword [eax]
cmp eax, edi
je 0x464f0e
call eax
jmp 0x464f0e
push 0x4890dc
mov eax, 0x4890d4
call fcn.00464e3d
pop ecx
push 0x4890e8
mov eax, 0x4890e0
call fcn.00464e3d
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x464f6e
cmp dword [ebp + 0x10], edi
jne 0x464f7c
mov dword [0x48bb04], esi
push dword [ebp + 8]
call fcn.00464dfb
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x464f7b
push 8
call fcn.0046689d
pop ecx
ret
call fcn.00464083
ret
Function at 0x10001c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1014bde0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov cl, 0x64
mov al, 0x6c
push esi
mov byte [ebp - 0xe], cl
mov byte [ebp - 0xa], cl
mov byte [ebp - 0x23], cl
mov cl, 0x69
push edi
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc], al
mov byte [ebp - 9], al
mov byte [ebp - 8], al
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x24]
mov dl, 0x6e
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1d], cl
mov byte [ebp - 0x1a], cl
push eax
lea ecx, [ebp - 0x10]
mov bl, 0x74
push ecx
mov byte [ebp - 0x10], dl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xb], 0x2e
mov byte [ebp - 7], 0
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x22], 0x72
mov byte [ebp - 0x21], 0x49
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1e], bl
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x19], 0x7a
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x54
mov byte [ebp - 0x16], 0x68
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x6b
mov byte [ebp - 0x12], 0
call fcn.100dc1e0
mov ebx, eax
xor esi, esi
lea edi, [esi + ebx]
push edi
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], 0
call fcn.1000dec0
mov edx, dword [ebp - 0x28]
mov cl, byte [edx]
cmp cl, 0xe8
je 0x10001d51
cmp cl, 0xe9
je 0x10001d51
add esi, eax
cmp esi, 0x1000
jb 0x10001d12
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10072a46
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 1]
mov ecx, dword [ebp - 4]
lea eax, [eax + edi + 5]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10072a46
mov esp, ebp
pop ebp
ret

Function at 0x100028f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x1014bde0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10113f1c
jmp loc.103d82aa

Function at 0x10003190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1014bde0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016a0b0], 0
jne 0x10003240
mov byte [0x1016a0b0], 1
call fcn.100028f0
call fcn.10003250
call fcn.10003690
mov dword [0x1016a0ac], eax
mov al, 0x73
mov cl, 0x65
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], al
lea eax, [ebp - 0x20]
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xc], cl
mov byte [ebp - 0x15], cl
mov dl, 0x6f
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1e], 0x57
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x1c], 0x77
mov byte [ebp - 0x1b], 0x36
mov byte [ebp - 0x1a], 0x34
mov byte [ebp - 0x19], 0x50
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x12], 0
call fcn.10349bae
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10072a46
mov esp, ebp
pop ebp
ret
Function at 0x10003690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1014bde0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0xf], al
mov byte [ebp - 0xc], al
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x24]
mov byte [ebp - 0x22], cl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x18], cl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x6b
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x32
mov byte [ebp - 8], 0
mov byte [ebp - 0x24], 0x47
mov byte [ebp - 0x21], 0x4e
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x76
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0
push esi
call 0x10041c20
push eax
call dword [0x100ed3dc]
test eax, eax
je 0x10003772
xor ecx, ecx
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call eax
mov eax, dword [ebp - 0x48]
cmp ax, 6
je 0x1000375f
cmp ax, 9
jne 0x10003772
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10072a46
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10072a46
mov esp, ebp
pop ebp
ret
Function at 0x10006730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1014bde0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x74
push ebx
mov byte [ebp - 0x23], al
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x15], al
mov al, 0x6c
mov cl, 0x64
push esi
mov byte [ebp - 8], al
mov byte [ebp - 7], al
lea eax, [ebp - 0x28]
mov dl, 0x69
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x10], cl
mov byte [ebp - 9], cl
mov bl, 0x77
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x28], 0x44
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], 0x6d
mov byte [ebp - 0x25], 0x53
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x22], 0x57
mov byte [ebp - 0x21], dl
mov byte [ebp - 0x20], 0x6e
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], bl
mov byte [ebp - 0x1c], 0x41
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], 0x6d
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], dl
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 6], 0
call fcn.100dc1e0
mov esi, eax
test esi, esi
je 0x100067f5
push 4
lea edx, [ebp - 0x30]
push edx
push 2
mov ebx, 1
push edi
mov dword [ebp - 0x30], ebx
call esi
push 4
lea eax, [ebp - 0x2c]
push eax
push 3
push edi
mov dword [ebp - 0x2c], ebx
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10072a46
mov esp, ebp
pop ebp
ret

Function at 0x10009cf0
Capabilities:
Authenticate hmac
Check for software breakpoints
Check http status code
Encode data using base64
Execute anti-debugging instructions
Hash data with crc32
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e28
call fcn.1007b630
mov eax, dword [0x1014bde0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, edx
push 0x10114890
mov edi, ecx
mov dword [ebp - 0x1e18], eax
mov dword [ebp - 0x1e0c], esi
jmp loc.10410cf7

Function at 0x100160f8
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov word [ebp - 0x63c], si
test ax, sp
sbb esi, 0x743b1d6f
mov esi, 0x30
mov word [ebp - 0x63a], si
test cx, cx
clc
jmp loc.104c5954

Function at 0x1001df60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jbe 0x1001df8f
push ebx
push edi
jmp 0x1001df70
movzx edi, byte [ecx + esi]
mov ebx, eax
and ebx, 0xff
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x10150e88]
inc ecx
cmp ecx, edx
jb 0x1001df70
pop edi
pop ebx
not eax
ret
Function at 0x1001f3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0xbdc744
call fcn.10072ae4
mov esi, eax
shl esi, 0x10
call fcn.10072ae4
or eax, esi
mov dword [0xbdc74c], eax
xor esi, esi
call fcn.10072ae4
mov ebx, eax
shl ebx, 0x10
call fcn.10072ae4
mov ecx, dword [0xbdc748]
or eax, ebx
mov dword [esi + ecx], eax
call fcn.10072ae4
mov ecx, dword [0xbdc748]
shl eax, 4
cdq
and edx, 0x7fff
add eax, edx
mov edx, dword [0xbdc74c]
xor edx, dword [ebp + 8]
sar eax, 0xf
mov dword [edi], eax
mov dword [ecx + eax*4], edx
xor dword [edi], 0xc0017921
add esi, 4
cmp esi, 0x40
jl 0x1001f403
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10037aa0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test esi, esi
jbe 0x10037ab8
mov dl, byte [eax + ecx]
xor dl, 0xd1
shr dl, 1
dec dl
mov byte [eax + ecx], dl
inc eax
cmp eax, esi
jb 0x10037aa6
ret

Function at 0x10041ce9
Capabilities:
Encode data using xor

Disassembly:
push 0x3e62dede
call fcn.102a2ff4
js 0x10041cef
add dword [ebx], edx
add byte es:[esi], bh
js 0x10041cef
xor eax, ecx
nop
xchg ebx, eax
and al, 0x94
pop ds
test eax, 0x5d6ba632
cmp dl, dl
imul esp, dword [edx + 0xd], 0xffffff8a
push edx
xchg esp, eax
xchg edx, eax
mov ebp, 0xb29448e4
loopne 0x10041d47
xor al, 2
xchg esp, eax
push 0x14
or eax, 0x69c6bb3
add dl, byte [edx + ebp*2 + 0x6bb30d14]
pushfd
push es
xor ebx, dword [edi]
insb byte es:[edi], dx
adc edi, edi
lodsb al, byte [esi]
push ds
xchg esp, eax
loop 0x10041d12
sub dl, byte [ebx + ebp*8 - 0x6bc7b3eb]
adc al, 0xa1
je 0x10041d5b
push eax
imul esi, dword [ecx], 0xb8ab5815
push esi
add byte [ecx + 0x11250be3], cl
cmpsb byte [esi], byte es:[edi]
mov esi, ebx
invalid
int1
dec dword [ecx - 0x68dbee0d]
sub eax, 0x127bd5cd
js 0x10041d91
invalid
adc dword [ecx], edx
sub byte [ecx + 0x71b82f7b], ah
in eax, dx
inc ecx
push edi
iretd
pushfd
sar byte [ebx - 0x67], 1
test al, 0xf0
lea edi, [ebx - 0x61]
stosb byte es:[edi], al
mov esi, dword [ebx]
invalid

Function at 0x10049be0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e9f5b
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x1014bde0]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push esi
push edi
mov eax, dword [0x1014bde0]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
push 0x101160ec
jmp loc.10179620
Function at 0x1004a100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1014bde0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x6c
mov dl, 0x72
mov byte [ebp - 8], cl
mov byte [ebp - 7], cl
mov cl, 0x74
mov byte [ebp - 0xe], al
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x30]
mov byte [ebp - 0x2e], cl
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0xd], dl
mov byte [ebp - 0x2b], dl
mov byte [ebp - 0x21], dl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 6], 0
mov byte [ebp - 0x30], 0x53
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x70
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], 0x77
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x1f], dl
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x43
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x16], 0x78
mov byte [ebp - 0x14], 0
call fcn.100dc1e0
test eax, eax
je 0x1004a1cc
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10072a46
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10072a46
mov esp, ebp
pop ebp
ret
Function at 0x10054bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9750
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1014bde0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, 0x6f
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x44], al
mov byte [ebp - 0x42], al
mov byte [ebp - 0x3a], al
mov byte [ebp - 0x2c], al
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x22], al
lea eax, [ebp - 0x1c]
push eax
mov dl, 0x73
mov cl, 0x20
mov bl, 0x69
push 0
push 0x1f0001
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x42
mov byte [ebp - 0x19], 0x78
mov byte [ebp - 0x18], 0x54
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0x79
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x48], 0x4d
mov byte [ebp - 0x47], bl
mov byte [ebp - 0x46], 0x63
mov byte [ebp - 0x45], 0x72
mov byte [ebp - 0x43], dl
mov byte [ebp - 0x41], 0x66
mov byte [ebp - 0x40], 0x74
mov byte [ebp - 0x3f], cl
mov byte [ebp - 0x3e], 0x57
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x6e
mov byte [ebp - 0x3b], 0x64
mov byte [ebp - 0x39], 0x77
mov byte [ebp - 0x38], dl
mov byte [ebp - 0x37], cl
mov byte [ebp - 0x36], 0x58
mov byte [ebp - 0x35], 0x50
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x30], 0x4d
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2b], dl
mov byte [ebp - 0x29], 0x66
mov byte [ebp - 0x28], 0x74
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x26], 0x57
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x21], 0x77
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1e], 0x37
mov byte [ebp - 0x1d], 0
call fcn.10387a44

Function at 0x10055770
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100eb511
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x1014bde0]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
mov eax, dword [0x1014bde0]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov esi, ecx
call fcn.100dd270
mov ecx, esi
call fcn.1006d3f1
mov eax, dword [esi + 0x44]
mov dword [0x10169ff8], eax
call fcn.100597e0
xor ebx, ebx
push 0x101161a0
mov esi, eax
mov dword [esp + 0x28], ebx
jmp fcn.1038cea1

Function at 0x10095090
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10094e00