joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ec8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x14c
call fcn.00403130
lea eax, [ebx + 0x14c]
mov dword [ebx + 0x14], eax
mov word [ebx + 4], 0xd7b0
xor eax, eax
jmp loc.00413409

Function at 0x4030e4
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov ebx, eax
or esi, 0xffffffff
mov ax, word [ebx + 4]
cmp ax, 0xd7b0
jbe 0x40311e
cmp ax, 0xd7b3
ja 0x40311e
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x403113
jmp loc.00414c71
mov eax, esi
jmp loc.0041f9f2
jmp loc.0041d528

Function at 0x403150
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x40b008], 0x8088405
inc edx
mov dword [ebx + 0x40b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403728
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
jmp loc.0041e14f

Function at 0x403860
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je fcn.0040386b
mov dl, 1
jmp loc.0041416e

Function at 0x4039a8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
jmp loc.00420a9a

Function at 0x403a34
Capabilities:
Packed with generic packer

Disassembly:
test ecx, ecx
je 0x403a51
jmp loc.00414226
ret

Function at 0x403a98
Capabilities:
Packed with generic packer

Disassembly:
push eax
push edx
cmp byte [0x40b018], 1
jbe fcn.00403ab3
push esp
push 2
push 0
push 0xeedfae3
jmp loc.00414888

Function at 0x403c67
Capabilities:
Packed with generic packer

Disassembly:
xor eax, eax
add esp, 0x14
mov edx, dword fs:[eax]
pop ecx
mov edx, dword [edx]
mov dword [ecx], edx
pop ebp
pop edi
pop esi
pop ebx
jmp loc.00415935

Function at 0x403fbc
Capabilities:
Packed with generic packer

Disassembly:
xor eax, eax
xchg dword [section.DATA], eax
neg eax
sbb eax, eax
inc eax
mov edi, 0x40c620
jmp loc.004218ce

Function at 0x403fec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40c034], 0
je 0x40404d
jmp loc.0041bc40
jmp loc.00421bfe

Function at 0x4041a8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402884
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x40c035], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404170
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x404284
Capabilities:
Packed with generic packer

Disassembly:
test edx, edx
je 0x404292
mov ecx, dword [edx - 8]
inc ecx
jle 0x404292
lock inc dword [edx - 8]
xchg dword [eax], edx
test edx, edx
je 0x4042ac
mov ecx, dword [edx - 8]
dec ecx
jl 0x4042ac
lock dec dword [edx - 8]
jne 0x4042ac
lea eax, [edx - 8]
jmp 0x41674a
ret
Function at 0x4042dc
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
mov eax, edi
call fcn.004042b0
mov ecx, edi
mov edi, eax
test esi, esi
je fcn.004042fd
mov edx, eax
mov eax, esi
jmp loc.0041c207

Function at 0x404404
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
test edx, edx
je 0x404437
push edx
cmp cx, word [edx]
je 0x404430
cmp cx, word [edx + 2]
je 0x40442d
cmp cx, word [edx + 4]
je 0x40442a
cmp cx, word [edx + 6]
je 0x404427
add edx, 8
jmp 0x40440b
add edx, 2
add edx, 2
add edx, 2
mov ecx, edx
pop edx
sub ecx, edx
shr ecx, 1
jmp 0x4182a6

Function at 0x404664
Capabilities:
Packed with generic packer

Disassembly:
test eax, eax
je 0x40466a
ret
jmp loc.00413f50

Function at 0x404704
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
call fcn.004046b4
mov edx, dword [ebx]
test edx, edx
je fcn.00404748
mov ecx, dword [edx - 4]
dec esi
jl fcn.00404748
cmp esi, ecx
jge fcn.00404748
test edi, edi
jle fcn.00404748
sub ecx, esi
cmp edi, ecx
jle 0x40472e
mov edi, ecx
sub ecx, edi
add edx, esi
lea eax, [edi + edx]
call fcn.004029c4
mov edx, dword [ebx]
mov eax, ebx
mov edx, dword [edx - 4]
sub edx, edi
jmp loc.0041e30d

Function at 0x404890
Capabilities:
Packed with generic packer

Disassembly:
mov edx, dword [eax]
test edx, edx
je 0x4048a4
jmp loc.0041c3d6
ret

Function at 0x4048cc
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [ecx + edx + 0xa]
mov edi, dword [ecx + edx + 6]
jmp loc.0041da47

Function at 0x404990
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
push ebx
mov cl, byte [edx + 1]
push esi
push edi
mov ebx, eax
lea esi, [ecx + edx + 0xa]
mov edi, dword [ecx + edx + 6]
jmp loc.00415f53

Function at 0x404bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
jmp loc.0041ee61

Function at 0x404c4c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404cb2
jmp loc.00417730

Function at 0x404e1c
Capabilities:
Set thread local storage value

Disassembly:
push ebx
call fcn.00404e14
mov ebx, eax
test ebx, ebx
je fcn.00404e5e
jmp loc.00419ac7

Function at 0x404e60
Capabilities:
Get thread local storage value

Disassembly:
mov cl, byte [0x40c64c]
mov eax, dword [0x40b0b0]
test cl, cl
jne 0x404e95
jmp loc.00421a53
push eax
jmp loc.00421ed1

Function at 0x405298
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
jmp loc.0041ea4e

Function at 0x405500
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x405605
jmp loc.0041998f
Function at 0x4074a0
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket
Initialize winsock library

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x44]
push eax
mov dl, 1
mov al, 2
call fcn.00405078
push eax
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x30], eax
mov word [ebx + 0x34], 2
mov ax, word [ebx + 4]
push eax
call sub.wsock32.dll_htons
jmp loc.0041d2e7

Function at 0x40767c
Capabilities:
Copy file
Delete file
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff678
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x988], edx
mov dword [ebp - 0x984], edx
mov dword [ebp - 0x980], edx
mov dword [ebp - 0x97c], edx
mov dword [ebp - 0x978], edx
mov dword [ebp - 0x974], edx
mov dword [ebp - 0x970], edx
jmp loc.0041af49

Function at 0x407b54
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x407c2f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 8]
mov eax, 0x407c44
call fcn.00409454
mov eax, dword [ebp - 8]
call fcn.00404664
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
je 0x407b96
jmp loc.00419bd0
jmp loc.0041603a

Function at 0x408250
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp loc.004169d4

Function at 0x4083d4
Capabilities:
Copy file

Disassembly:
lea eax, [ebp - 0x194]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.004044b0
mov eax, dword [ebp - 0x194]
lea edx, [ebp - 0x190]
call fcn.004096a8
mov eax, dword [ebp - 0x190]
push eax
lea edx, [ebp - 0x19c]
xor eax, eax
call fcn.004093ac
mov eax, dword [ebp - 0x19c]
lea edx, [ebp - 0x198]
call fcn.004096a8
mov edx, dword [ebp - 0x198]
pop eax
call fcn.004045b0
jne fcn.00408481
lea eax, [ebp - 0x1a4]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.004044b0
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x1a0]
call fcn.004096a8
mov eax, dword [ebp - 0x1a0]
push eax
lea edx, [ebp - 0x1ac]
xor eax, eax
jmp loc.004200da

Function at 0x408dc4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
jmp loc.00421c2b

Function at 0x408de4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00404464
mov ebx, eax
mov eax, edi
mov edx, ebx
jmp loc.0041cb82

Function at 0x408e20
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, ebx
mov edx, 0x408f50
jmp loc.00421c58

Function at 0x408fc8
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push ecx
mov ebx, eax
mov dword [esp], 2
jmp loc.0041fa12

Function at 0x409048
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40918f
jmp loc.0041f9b1
Function at 0x409208
Capabilities:
Create process on windows
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40925c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov al, bl
push eax
push 0
push 0
mov eax, dword [ebp - 4]
jmp loc.0041cbf7

Function at 0x409304
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
jmp loc.0041ab90

Function at 0x4093ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x40943b
jmp loc.0041a14d

Function at 0x409454
Capabilities:
Get common file path
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404654
xor eax, eax
push ebp
push 0x4094e3
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x101
call fcn.0040444c
push dword [ebp - 0x10c]
push 0x4094f8
push dword [ebp - 4]
mov eax, ebx
mov edx, 3
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094ea
lea eax, [ebp - 0x10c]
call fcn.004041ec
lea eax, [ebp - 4]
jmp loc.00414645

Function at 0x4094fc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp loc.0041f4e3

Function at 0x4095e8
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00404464
mov ebx, eax
cmp ebx, 1
jl 0x40961f
jmp loc.0041b006
pop edi
pop esi
pop ebx
ret

Function at 0x4097b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x56c], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404654
jmp loc.0041ff11

Function at 0x409afc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409b71
jmp loc.00414380

Function at 0x409b94
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, dword [0x40b164]
mov dword [eax], 0xffffffff
jmp loc.0041e5b8
Function at 0x409c74
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x198], edx
mov dword [ebp - 0x194], edx
mov edi, eax
xor eax, eax
push ebp
push 0x409d8a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
jmp loc.0041ae41

Function at 0x409dd8
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404664
push eax
jmp loc.00417890

Function at 0x40a060
Capabilities:
Connect network resource
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
jmp loc.0041abea

Function at 0x40a62c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
jmp loc.0041ad73

Function at 0x41318d
Capabilities:
Download url
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov al, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
call fcn.00404464
jmp loc.0040573f

Function at 0x413c23
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket
Initialize winsock library

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x409264
push 0x40924c
push 0x46adc0
push eax
mov edi, 0x4c30a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
call sub.wsock32.dll_WSACleanup
jmp loc.0040750f

Function at 0x415083
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call fcn.004039c8
jmp fcn.00403c56

Function at 0x415630
Capabilities:
Copy file

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
push 0x8001
push ebx
push 8
push ebx
push 0x160
push eax
push ebx
push 0x420cb0
push 0x40a810
push 0x425b00
mov edi, 0x42c000
push eax
push edi
push ebx
mov eax, edi
add esp, 0x3c
leave
popal
popfd
jne fcn.00408481
jmp loc.00408371

Function at 0x41933f
Capabilities:
Download url
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40a264
push 0x40a24c
push 0x476aa0
push eax
mov edi, 0x4cf0a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
mov edx, dword [ebp - 4]
mov eax, ebx
jmp loc.0040570f
Function at 0x4194c3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
mov ebx, 0xa
jmp loc.00401171

Function at 0x41e972
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call fcn.00405694
jmp fcn.0040750a

Function at 0x41f0c6
Capabilities:
Copy file

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41aa50
push loc.0041810c
push eax
push ebx
push edi
xor ebx, ebx
push 2
pop ecx
mov ecx, dword [0x4081a0]
mov ecx, dword [0x40e341]
add esp, 0x18
leave
popal
popfd
call fcn.004045b0
jmp loc.0040836b

Function at 0x41f5fd
Capabilities:
Download url
Receive data
Receive data on socket

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
xor eax, eax
mov ecx, 0x11
push edi
push ebx
mov edi, edx
mov al, 0x30
and eax, 0xfffffff0
add esp, 8
leave
popal
popfd
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
jmp loc.00405703

Function at 0x4201ca
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
xor eax, eax
xor eax, eax
push 0x40a102
xor edx, edx
push 0x40a0cb
mov eax, dword [0x40c014]
xor eax, eax
mov eax, 0x40cde4
push 2
push 0
push 1
mov ecx, dword [0x40cde4]
mov dl, 1
mov eax, 0x4072a4
xor edx, edx
push 0x40a083
mov eax, dword [0x40cdf0]
add esp, 0x20
leave
popal
popfd
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0xc]
jmp loc.004073d8
Function at 0x116eb70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd79660
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0xd89008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 0x10
mov ecx, 0xd8a02c
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.01183640
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
mov ecx, 0xd89a14
push eax
call fcn.01183640
mov esi, dword [0xd8a03c]
xor ebx, ebx
mov edi, dword [0xd8a040]
nop word [eax + eax]
cmp edi, 0x10
mov byte [ebx + 0xd8b230], bl
mov eax, ebx
mov ecx, 0xd8a02c
cmovae ecx, dword [0xd8a02c]
cdq
idiv esi
mov al, byte [edx + ecx]
mov byte [ebx + 0xd8b338], al
inc ebx
cmp ebx, 0x100
jl 0x116ebf0
xor edi, edi
xor esi, esi
mov dl, byte [esi + 0xd8b230]
movzx eax, byte [esi + 0xd8b338]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x116ec44
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0xd8b230]
mov byte [esi + 0xd8b230], al
inc esi
mov byte [edi + 0xd8b230], dl
cmp esi, 0x100
jl 0x116ec20
mov esi, dword [ebp - 0x10]
mov ecx, esi
call fcn.0116e8d0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x116ec99
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x116ec8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x116ecef
push edx
push ecx
call fcn.01184cbf
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x116ecdb
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x116ecd1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x116ecef
push edx
push ecx
call fcn.01184cbf
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0118931c
int3
Function at 0x1185269
Capabilities:
Parse pe header

Disassembly:
push 0
push edx
call fcn.013a7705
test eax, eax
je 0x11852a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x11852a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x11852a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x11852a9
cmp dword [ecx + 0x74], 0xe
jbe 0x11852a9
cmp dword [ecx + 0xe8], 0
je 0x11852a9
mov al, 1
ret
xor al, al
ret
Function at 0x11fe00e
Capabilities:
Encode data using xor

Disassembly:
lea esi, [esi + 0x38292ac2]
jb fcn.013dc843
jb 0x146e8fb
call fcn.011b3433
stc

Function at 0x12058e3
Capabilities:
Check http status code

Disassembly:
ja 0x148071c
jae 0x1254404
push dword [esp + 0x34]
popfd
lea esp, [esp + 0x40]
ret
mov ebp, dword [esp + ebp*4 - 0x7fffffe4]
sub word [esp + 0x2c], 0x4920
sub byte [esp + 0x10], 0xc5
sete byte [esp + 0x2c]
jne 0x135f5e8
jmp esi

Function at 0x1231bc5
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x53f1611d
call fcn.014e9a17
bound edx, qword [edx]
dec ecx
leave
sub byte [esi - 0x3d928c1e], al
salc
cmp ch, byte [eax + 0x6d]
insd dword es:[edi], dx
sahf
xchg ebp, esp
mov ch, 0x4c
xchg ebp, eax
test eax, 0x9993529d
sub dword [ecx + eax*2 - 0x4d], esi
inc ecx
aad 0x3a
scasb al, byte es:[edi]
insb byte es:[edi], dx
inc ebp
out dx, eax
xor bl, ch
dec esp
stosd dword es:[edi], eax
fst dword [eax + ebp - 0x4d]
xchg ebp, eax
push es
inc eax
ror byte [eax - 0x45], 1
add al, 0x7b
xchg ebx, eax
popfd
mov al, 0x60
push ss
mov bl, 0xdb
btc dword [ebx], ebp
inc eax
xchg edx, eax
mov al, byte [0xf14765c5]
daa
dec ebx
cmpsb byte [esi], byte es:[edi]
adc eax, 0x67326d8b
lodsd eax, dword [esi]
js 0x1231bdc
ret 0xa9c2

Function at 0x1259aba
Capabilities:
Encode data using xor

Disassembly:
sub byte [esp + ebx - 0x6900e4f8], 0x9b
xchg dword [esp + ebx - 0x6900e4e0], edx
mov ebx, dword [esp + ebx - 0x6900e4e8]
mov ebp, dword [esp + 0x10]
mov byte [esp + ebp*2 - 0x7901e0c], 0xa
test word [esp + ebp*8 - 0x1e407848], 0x3419
not byte [esp + ebp*8 - 0x1e407840]
mov ebp, dword [esp + ebp - 0x3c80efe]
sets byte [esp + 8]
xor byte [esp + 8], 0xe
lea esp, [esp + 4]
ret 4
je 0x120fac3
add dword [esp + 4], 0xfffca657
mov edx, 0x10f804d0
add edx, 0x44a37b66
shl edx, 0x13
mov dword [esp + edx - 0x1affff4], edx
jbe 0x139414d
movsx edx, dl
mov edx, dword [esp + edx*2 + 4]
mov edx, dword [edx]
not dword [esp + 0xc]
shr word [esp + 0xc], 0x73
xor dword [esp + 0xc], 0x6eac12ee
call fcn.014f3b3e
call fcn.01281784
xchg dword [edx - 0x790a12ec], eax
fcmovnbe st(0), st(5)
adc ah, cl
in eax, 0x1d
xlatb
add cl, byte [eax + 0x7d341e5a]
sbb eax, 0x5a8802d7
push ds
xor al, 0x7d
xchg ecx, eax
jl 0x1259b16
xor ebp, ebp
pop ebx
add ebp, dword [ecx]
cmp dword [ebp + 0x42], ebp
out 0xe0, eax
insd dword es:[edi], dx
or byte [ecx + 0x6702f7cd], cl
mov ch, 0xd7
lea edx, [ebp + 0x64f30a83]
dec ecx
dec ecx
mov cl, dl
xchg ebp, eax
in eax, dx
fsubr qword [0xa04fc7d3]
fld st(3)
ja 0x1259b3a
xchg ebp, eax
int 0x8c
dec edi
pop ss
fmul qword [ebx + ebp]
add al, 0x6a
sub ch, byte [ebp + edi*2 + 0x53ff0bea]
in al, dx
ret