joyce8/EMBER2024-capa huggingface dataset:
Function at 0x642d8602
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x642d88d8
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x6c80d659
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x6c80461f
push 0xffffffffffffffff
call fcn.642cf802
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x642d866c
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.642d8684
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x642d88cc
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x642d88a0
Function at 0x642e80d2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x642e80f4
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x642e80f4
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x642e80f4
ret
cmp word [ebx + 4], 0x14c
jne 0x642e80f4
test word [ebx + 0x16], 2
je 0x642e80f4
test word [ebx + 0x16], 0x100
je 0x642e80f4
cmp word [ebx + 0x18], 0x10b
jne 0x642e80f4
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x642e80f4
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x642e8180
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x642e8114
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.642cf05f
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x642e80f4
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x642e8180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x642e80f4
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x642e80f4
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x642e80f4
ret
cmp word [ebx + 4], 0x14c
jne 0x642e80f4
test word [ebx + 0x16], 2
je 0x642e80f4
test word [ebx + 0x16], 0x100
je 0x642e80f4
cmp word [ebx + 0x18], 0x10b
jne 0x642e80f4
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x642e80f4
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x642e8180
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x642e8114
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.642cf05f
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x642e80f4
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x642e8237
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x642e8290
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x642e8237
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x642e8246
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x646edee9
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x642e8297
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.642cf10d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x642e8336
add edi, 4
add eax, 2
dec ecx
jne 0x642e827c
call 0x642e82e3
loope 0x642e82d9
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x642e8333
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x642e8344
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x642e82f7
cmp eax, ecx
ja 0x642e82f7
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x642e8381
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x642e8377
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.642cf5ec
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x642e8246
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x642e8290
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x642e8237
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x642e8246
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x646edee9
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x642e8297
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.642cf10d
cmp eax, dword [ebp + 0xc]
pop eax
je 0x642e8336
add edi, 4
add eax, 2
dec ecx
jne 0x642e827c
call 0x642e82e3
loope 0x642e82d9
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x642e8333
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x642e8344
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x642e82f7
cmp eax, ecx
ja 0x642e82f7
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x642e8381
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x642e8377
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.642cf5ec
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4012a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0040a2b3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4012ea
xor eax, eax
jmp 0x4012ed
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0040a8e8
lea eax, [edi + 0x7c]
test eax, eax
je 0x401308
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0040ac4d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x401346
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0040ac4d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.00409fcd
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040a969
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40db34
Capabilities:
Encode data using xor

Disassembly:
adc ebx, dword [ebx - 0x2e8bd917]
cmc
pop edx
adc ah, bl
push esi
push edx
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x4127e4
Capabilities:
Encode data using xor

Disassembly:
inc esp
add al, 0xa0
shl dword [edx], cl
mov bh, 0x3d
mov dword [edi + ebp - 0x4e], edx
invalid
dec esp
scasb al, byte es:[edi]
and al, 0xd8
stosd dword es:[edi], eax
cmp ah, ah
fimul word [ecx + eax*2]
dec ebp
pushal
mov ebp, 0xed01bb4f
mov bh, 0xa2
movsd dword es:[edi], dword [esi]
mov ah, 0xbc
lea ecx, [edi + 0x1985885a]
mov byte [0xf7cb5c0d], al
lds ecx, [eax - 0x5d]
jo 0x4127a4
movsd dword es:[edi], dword [esi]
pop ebp
adc esi, dword [ebp - 0x28]
cmpsb byte [esi], byte es:[edi]
call 0xf5c2e8ac
pop ebp
add al, 0x2f
je 0x412898
cld
invalid
or al, 0x2d
add edi, dword [ebp - 0x4aba76fc]
invalid

Function at 0x41330a
Capabilities:
Encode data using xor

Disassembly:
in al, 0x76
sal byte [eax + 0x1f5604dd], cl
xor dword [ecx - 0x7f844c95], 0x5e94bc77
cmp dword [edx + 0x16], 0xffffffeb
out 0x21, eax
test dword [edi + edx*4], edi
out dx, al
mov bl, 0x35
mov ss, word [0x2bded574]
Function at 0x42c4a9
Capabilities:
Encode data using xor

Disassembly:
dec ecx
and byte [edx + 0x63], 0x10
invalid
jle 0x42c481
sub eax, 0x1b943d51
adc al, 4
test byte [ebx - 0x1cf56eb0], dl
imul esp, edi, 0x74488200
daa
mov ebx, 0x53bcf294
in al, 0x1b
xchg byte [ebx], ah
mov ecx, 0xe574a3e4
push eax
out 0xbc, eax
in eax, dx
mov eax, 0xb398f423
pop ss
jo 0x42c53f
sar dword [edx + 0x44b01261], 1
shr byte [edx - 0x44c8ed2d], 1
xchg eax, esi
inc ebx
push esi
hlt
sub ah, byte [edx - 0x3a]
mov eax, dword [0x33985237]
xlatb
mov al, 0xf8
mov bh, 0xdc
aad 0x3c
aam 0x5b
dec edi
mov dh, 0xa5
mov esp, 0xde4b6489
xor al, 0x1c
je 0x42c548
dec ebx
arpl word [ecx + edi*4 - 0x4cbeb514], di
pop ss
and dword [esi + 0x2670e081], edi
mov esp, esi
adc esp, eax
mov byte [edi + 0x53], ah
sbb dl, byte [eax - 0x22]
xor dword [eax], edx
iretd

Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x652eb4
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x44a62d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDeb124705_128b_40d4_8dd8_d93ed12589a4InProcServer32
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa531b0], eax
jne 0x44a6aa
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x652eb4
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa531b0], eax
jne 0x44a692
cmp dword [esp + 8], ebx
je 0x44a694
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44a6aa
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa531b0]
test ecx, ecx
jne 0x44a6cd
test eax, eax
jle 0x44a6c8
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa531b0], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret
Function at 0x494124
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0049d133
mov dword [esp + 0x28], 0
test esi, esi
jne 0x49416a
xor eax, eax
jmp 0x49416d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0049d768
lea eax, [edi + 0x7c]
test eax, eax
je 0x494188
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0049dacd
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x4941c6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0049dacd
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0049ce4d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0049d7e9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49f9ae
Capabilities:
Encode data using xor

Disassembly:
test al, 0xe3
adc byte [ebp + 0x600d211d], 0x45
mov dword [0x79df416d], eax
or esp, esp
invalid
lcall 0x728c, 0x51e7d247
push ss
dec ecx
xchg edx, eax
push edi
nop
push edi
mov es, word [ebp - 0x9643f59]
inc ebx
inc esi
imul eax, dword [ecx], 0x81060d17
cld
repe scasb al, byte es:[edi]
invalid
das
or al, 0xa6
dec eax
mov bh, 0xf2
ror byte [eax], 1
cmpsb byte [esi], byte es:[edi]
inc esp
dec eax
and al, 0xe1
loope 0x49f961
mov cl, 0xad
loope 0x49f961
mov cl, 0xad
jbe 0x49f936
xor byte es:[ecx - 0x4c], bl
test byte [eax + 0x2de679f2], al
arpl word [ebp + 7], sp
add byte [edi - 0x5b1a68a8], dl
popfd
pop eax
or dword [edx + edx + 0x70874a07], edi
jbe 0x49f9a2
invalid
Function at 0x4cb800
Capabilities:
Encode data using xor

Disassembly:
salc
inc ebp
out dx, eax
in al, 0xf3
shl byte [ecx], 0x1a
and al, 0x87
and ah, byte [ecx + 0x20]
inc eax
xchg dword [edx], esp
popal
and byte [eax - 0x14], al
in al, dx
jl 0x4cb7a2
ja 0x4cb7b1
mov edx, dword [esi + eax + 0x3f891dc0]
dec ebp
xor cl, bl
into
jae 0x4cb7fb
inc ecx
jecxz 0x4cb823
cmc
inc esp
fcmovb st(0), st(5)
test byte [eax + ecx*8 - 0x4fdfcb6c], al
push ebp
adc byte [esi + 0x52], ah
push dx
add esi, edi
push ebp
lea ecx, [eax]
cdq
sahf
fdivr dword [edi + 0x1a36c6cd]
push ebx
mov ch, 0x2e
int3
sbb esi, dword [ebx + 0x148071e6]
push ecx
adc al, 0x51
jbe 0x4cb7d4
mov al, byte [0xe0b7a5e7]
sub eax, 0x75d6008b
test al, 7
inc eax
sbb al, 0x56
not esp
lock xor byte [ebp - 0x2fff26f3], ah
call 0xdf097fd2
inc edi
mov edx, 0xf5b40265
jae 0x4cb822
add dh, byte gs:[ebp + esi*8 - 0x7e1c068d]
jecxz 0x4cb7ac
pop ebx
mov bh, 0xb7
mov dh, 0x20
fdivr dword [esi]
outsb dx, byte [esi]
push cs
salc
and eax, 0x418720e0
wait
xor al, 0xf9
leave
shl ah, 1
in al, 0xab
enter 0x59ac, 0xffffffffffffffa3
jo 0x4cb889
popfd
call 0x4581ce8f
cmp byte [esi + 0x4b], cl
rcl ecx, 1
test al, 0x9d
mov fs, word [ecx]
mov ebx, 0x51d7b84
sal bh, 1
test al, 0xc3
loope 0x4cb868
int1
xchg dword [edx + 0x3f], eax
xor bh, 0xa4
stosb byte es:[edi], al
dec edi
invalid
mul dword [edx + ebp*4 - 0x24d00fb1]
xor bh, byte [edx - 0x20]
dec esi
dec eax
dec byte [ecx]
stosd dword es:[edi], eax
or dword [edx], edx
in al, 0xe5
pop ds
dec ebx
xor dword [esi + ecx + 0x19], ecx
push ebp
xchg esi, eax
xchg edi, eax
adc byte [edx + 0x6d169d19], bl
popfd
push ss
insd dword es:[edi], dx
or dword [edi - 0x1dbc3f9c], 0x60
add edx, eax
in eax, 0x6b
mov bl, 0x17
pop ss
dec ebp
add al, 0x74
push ebp
mov al, byte [0x56d6b492]
push esi
dec esi
sbb dword [ebp - 0x4d4d871f], 0xffffff82
adc byte [esi + 0x795888f3], dl
cdq
push edx
out dx, al
jb 0x4cb8bf
push ebx
mov byte [eax - 0x4f], al
or eax, 0x22895631
and eax, edx
mov cl, 0xce
pmullw mm0, qword [ebp - 0x2d]
clc
mov byte [0xb6c0d6d6], al
sub eax, 0x6c3e2c64
cmpsb byte [esi], byte es:[edi]
shr dword [eax - 0x37497160], 1
jge 0x4cb8a1
inc eax
popal
jne 0x4cb951
in eax, dx
ficomp dword [edi + 0x62]
in al, 0x73
in eax, dx
xchg ecx, eax
cld
mov dh, 0xa5
push ecx
xlatb
sti
movsd dword es:[edi], dword [esi]
salc
not byte [0x13bbc146]
inc esi
shl ebp, 1
xor dh, byte [esi + 0x47731f80]
jo 0x4cb8e4
inc edi
aad 0xa4
push esi
in eax, dx
jle 0x4cb898
sbb ebx, dword [edi - 0x41495f8a]
cmpsd dword [esi], dword es:[edi]
push 0x2f
mov dword [ebx + 0x4c], ecx
cli
pop ecx
aam 0x62
inc edx
sub al, 0xc6
salc
and eax, 0x2253e28c
or dl, 0xb4
out 0xa4, eax
sbb esp, dword gs:[edi - 0x38bed95f]
loopne 0x4cb987
aam 0xcc
cmp al, 0x6a
or byte [esi + 0x50], dl
adc dword [edx + 0x46feb117], esp
xchg esp, eax
les esp, [esi]
push ds
cwde
push cs
ljmp 0x76d0
int1
jmp 0x311b7614
movd mm5, dword [ebx + ecx*8 + 0x3677b018]
hlt
Function at 0x540ec1
Capabilities:
Encode data using xor

Disassembly:
aas
push esi
popfd
ljmp 0xb2cc
jb 0x540e4e
inc ecx
cmp eax, 0x51ad17b8
jle 0x540ee7
dec ecx
popal
adc byte [esi], 0x72
cmp al, 0x82
fisub dword [ecx + esi*2 + 0x4a]
in eax, dx
mov ecx, 0xd8be680c
popfd
invalid
inc ebp
scasb al, byte es:[edi]
sbb dword [edx], esi
or bl, byte [0x487f1cfb]
pop eax
and eax, eax
fucompi st(2)
mov eax, dword [eax + 0x40c8811d]
xor al, 0x4d
pushfd
mov ah, 0x88
xchg eax, ebx
push ss
push ebp
scasb al, byte es:[edi]
inc eax
sub al, 0x8d
bound esi, qword [edi]
popal
imul ebp, dword [edi], 0x45
les ecx, [ebp - 0xc2a0c55]
les ebp, [edi - 0x12]
mov word [ebx - 0x746fc82f], gs
std
xor dl, byte [edi]
scasb al, byte es:[edi]
sti
or bl, byte [ecx]
outsd dx, dword [esi]
push ebp
pop edx
pop es
wait
stc
loope 0x540f1f
call 0xd30c995b
sub ah, bl
mov ecx, 0xfa1c53ef
bound eax, qword [esi - 0x11570a63]
push 0x8448a225
aaa
adc edi, 0x2f
xchg ebp, eax
hlt

Function at 0x57b492
Capabilities:
Check http status code

Disassembly:
in eax, 0xf4
stosb byte es:[edi], al
push 0x29d8f5f1
mov cl, 0x13
and eax, 0xec1283bf
jnp 0x57b4ef
or eax, 0xf947b80a
cmp byte [ecx + 0x31], bh
in al, 0x51
pop ebp
sub ecx, eax
inc ebp
iretd
invalid

Function at 0x57f14b
Capabilities:
Encode data using xor

Disassembly:
in al, 0x3c
pop esi
add byte [ecx + ecx*4 + 0x31], bh
les ecx, [ecx]
xor al, 0x94
cmp byte [eax - 0x3ebb1365], bh
or eax, 0x573684b7
push edi
xchg esp, eax
pop eax
fisub dword [esi - 0x4834e70b]
xor byte [0x6653eac8], dh
xor ah, al
mov ebx, 0xa42ce83c
sbb edi, ebx
fsub st(3), st(0)
sbb dword [edi + 0x6a], ecx
mov edi, dword [eax + 0x2d]
js 0x57f17a
inc edi
cwde
pop eax
cmp dword [ebx], 0x5c7b4758
imul al
js 0x57f12c
or esi, dword [ecx]
push esp
test dword [eax + 0x1da25ada], 0x5a3cf662
retf 0xada5

Function at 0x581cd0
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
inc esi
or eax, ebp
mov ch, 0xfe
push ecx
mov word [eax + 0x4d], fs
lodsb al, byte [esi]
cli
dec esp
sbb esi, dword [ebp + 0x344e489b]
pop ebx
cmp dword [edx], edx
aam 0x4b
cdq
sbb eax, 0xc68ec9db
leave
inc edx
fdiv st(1), st(0)
mov ah, 0xf6
scasb al, byte es:[edi]
jecxz 0x581cba
inc edi
stc
stosb byte es:[edi], al
fisub dword [ebx + ebp*8 - 0x6bc890ca]
cli
dec eax
or dword [eax + 0x3a3d5a13], ebp
and eax, dword [0xf8769c16]
adc ebx, dword [edx + 0x3d]
cmp ah, byte [ebx]
add eax, 0xf8769c16
cmpsb byte [esi], byte es:[edi]
mov ch, 0xaa
xlatb
push esi
and al, 0xa8
pop ss
and edx, dword [edi]
xchg byte [edx], cl
daa
test byte [ecx], 0x6b
sbb byte [esi - 0x27294fd8], dl
sub eax, 0x4a8e630
pop es
mov ds, word [ebx + 0x10]
sub al, 0x87
imul ebx, dword [ecx + 0x32], 0xffffffaa
pop esp
push eax
mov edx, 0x36aa35b3
inc edi
sbb byte [esi - 0x789ea3a8], dh
sbb byte [eax], cl
xor dword [ebx - 0x53c14027], esi
div byte [edx - 0x1735576c]
jb 0x581cf0
ret
Function at 0x5bb024
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.005c4033
mov dword [esp + 0x28], 0
test esi, esi
jne 0x5bb06a
xor eax, eax
jmp 0x5bb06d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.005c4668
lea eax, [edi + 0x7c]
test eax, eax
je 0x5bb088
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.005c49cd
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x5bb0c6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.005c49cd
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.005c3d4d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.005c46e9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret