joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430577
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
mov dx, word [esp + 1]
lea esp, [esp + 2]
jmp 0x430581
cmp ax, 0x6de4
jl 0x430561
pop ax
jmp 0x43059b
lea esp, [esp + 0x50]
not esi
neg eax
jnp 0x4305c6
jp 0x4305cd
xor dword [ebx + reloc.mscoree.dll__CorExeMain], edi
sbb dword [edx + esi + 0x6966a455], ebx
mov byte [esi - 0x75], ah
push esp
and al, 1
mov dx, word [esp + 1]
lea esp, [esp + 2]
jmp 0x430581
push edi
jmp 0x43078a
push edi
mov word [esp], ax
mov ebx, esi
rdtsc
mov bh, 0x7d
jmp 0x430670
seto bh
call 0x43060d
jnp 0x430674
not edx
sbb ebx, ebx
mov ebx, edi
xchg dword [esp], ebx
setp dh
jmp 0x430644
mov bx, 0xf7ef
xchg al, dh
sbb bh, 0x62
jle 0x430604
seto bh
jmp 0x43069a
setnp dl
mov al, 0x4c
lea ebx, [ebx - 0x1e]
lea eax, [eax + edi]
mov ax, word [esp]
mov eax, edx
jmp 0x4306df
mov bh, 0x7d
lea esp, [esp + 4]
sub esi, 0x48b0f861
mov bx, word [esp]
jmp 0x430630
lea esp, [esp + 0x10]
add esi, 0x392782af
lea ebx, reloc.mscoree.dll__CorExeMain
btc bx, ax
jmp 0x43069f
sub esp, 0x10
jmp 0x430680
ja 0x4306b5
mov ax, si
jmp 0x4306b8
mov ax, si
add esi, dword [ebp]
lea edx, [esi + ebp]
jmp 0x4306c4
shl ebx, cl
jl 0x43070d
jge 0x4306f3
int 0x59
leave
test al, 0x5b
ljmp 0xaba
xchg dword [esp], ebx
mov dl, 0xe0
not al
xchg bh, dl
and dx, 0x70be
push dword [esp]
ret 4
movzx ebx, byte [esi]
mov edx, eax
xchg al, dh
jmp 0x43073c
jmp 0x4306f3
mov dh, byte [esp]
jmp 0x430762
bswap edx
mov al, 0xcd
clc
jns 0x430723
mov dh, byte [esp]
dec al
jmp 0x430764
mov dl, bl
mov ax, 0x9967
bsr eax, eax
jae 0x43076f
jb 0x4307ad
push cs
xchg ecx, eax
add dword [eax - 0x6d], esp
push edi
nop
adc ecx, dword [edx - reloc.mscoree.dll__CorExeMain]
dec al
sub bl, cl
mov eax, 0x6922514
mov dl, 0xf7
jmp 0x43074a
mov ax, word [esp]
inc eax
ror dl, 0
setge ah
jmp 0x430797
mov word [esp], ax
mov ebx, esi
rdtsc
jmp 0x43066e
not eax
call fcn.004307ca
mov edx, 0x39caaf3f
not dword [eax + reloc.mscoree.dll__CorExeMain]
ror byte [0x8b66ef9c], cl
add al, 0x24
mov ax, word [esp]
inc eax
jmp 0x430774
Function at 0x431796
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc al
jae 0x4317c8
push dword [esp]
jmp 0x4317b0
push dword [esp]
rdtsc

Function at 0x431835
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x431857
lea esp, [esp + 2]
mov al, byte [esp + 1]
rdtsc
jmp 0x43181f
pushal
mov edi, dword [esp]
mov dh, byte [esp]
mov dword [esp + 0x14], ebx
call fcn.00431841
or ecx, dword [ecx + reloc.mscoree.dll__CorExeMain]
test al, 0xcb
bound ebx, qword [ebp + 0xc24648d]

Function at 0x4cfe77
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 6], al
mov byte [esp + 6], ch
xchg ebp, edx
pop dword [esp + 3]
jmp 0x4cfeb7
neg bh
setb dh
bswap ebx
pop ebp
push word [esp + 7]
neg eax
jmp 0x4cfef2
rol edx, cl
bsf edi, edi
push word [esp]
lea ecx, reloc.mscoree.dll__CorExeMain
mov byte [esp], ah
mov cl, al
jmp 0x4cfea1
pop edx
mov byte [esp], cl
bts bx, ax
mov ah, byte [esp]
neg ebx
lea esp, [esp + 5]
jmp 0x4cff34
lea esp, [esp]
sete bl
mov bl, al
mov dl, cl
xchg edi, edx
jmp 0x4cff87
push word [esp]
mov dx, word [esp + 1]
xchg word [esp + 1], cx
xchg word [esp], dx
rcr bh, cl
pop word [esp]
jmp 0x4cff1e
lea ecx, [ecx + edx]
sub esp, 0x19
push word [esp + 0x17]
ror si, cl
pop dx
jmp 0x4cffc9
mov eax, 0x35549b32
lea esp, [esp + 1]
rcl esi, cl
lea ecx, [ebx + esi]
bswap edi
dec dx
jmp 0x4cff71
cmc
lea esp, [esp + 1]
mov ebp, 0xd97bd246
sub esp, 0x1a
jmp 0x4cffe1
or cl, bh
bts ebp, ebp
xchg byte [esp + 5], bh
xchg dl, dh
xchg dword [esp + 1], ecx
cmc
jmp 0x4cff9b
mov dh, 0xbb
push word [esp + 3]
mov bx, word [esp + 1]
xchg dword [esp + 0xa], edx
xchg ah, dl
mov byte [esp + 0xd], al
jmp 0x4cffb1
mov dword [esp + 0xe], esi
mov bh, 0xb2
lea esp, [esp + 0x1a]
mov dword [esp + 4], edx
bsr si, ax
pop bx
jmp 0x4d03e6
pop esi
xchg dh, dl
push word [esp + 1]
not edx
neg ax
jmp 0x4d0138
lea esp, [esp + 3]
xchg esi, edi
mov bh, byte [esp + 2]
std
mov cl, byte [esp + 3]
mov dl, byte [esp + 5]
jmp 0x4cfffb
bsr esi, esp
xchg byte [esp + 0x16], dl
xchg dword [esp + 0x1a], ebx
bts si, sp
cpuid
lea esp, [esp + 0x17]
jmp 0x4d0011
dec cx
std
rdtsc
setbe dh
mov word [esp + 3], bx
push esi
jmp 0x4d00a5
mov bl, ch
neg di
cld
pop word [esp + 0xc]
xchg bp, si
lea esp, [esp + 0xd]
jmp 0x4d004c
mov si, word [esp]
pushal
xchg ecx, eax
add esp, 0xd
mov edx, esi
not ecx
jmp 0x4d0062
push word [esp]
lea esi, [ebx*4]
dec ax
push word [esp + 4]
call fcn.004d00d3
sahf
jmp 0x14daabaf
lea edx, [esp + ebx]
xchg byte [esp + 4], ch
lea esp, [esp + 6]
xchg word [esp], di
bts cx, di
rol eax, 0
jmp 0x4d008a
shr si, cl
lea esi, [ebx + edi]
pop word [esp]
lea esp, [esp]
lea ebx, [edx*4]
xchg byte [esp], bh
jmp 0x4d007a
bts ax, cx
rdtsc
not al
lea edx, reloc.mscoree.dll__CorExeMain
mov bx, 0xa0e8
mov di, word [esp]
jmp 0x4d0107
push dword [esp + 0xf]
pop dword [esp + 5]
xor edx, esp
mov ebp, dword [esp + 8]
lea ebx, [edi*4]
push ebx
jmp 0x4d0035
cpuid
xchg ecx, eax
sub esp, 3
mov dl, dh
not esi
btc edx, edx
jmp 0x4d03a3
Function at 0x4d0166
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ecx
pop edi
not cx
mov di, 0x242d
xchg word [esp], si
jmp 0x4d00ef
pop di
xchg ch, ah
jmp 0x4d00bd
xchg edi, esi
bswap eax
mov word [esp], bp
rcr dl, cl
mov byte [esp], dl
jmp 0x4d020e
mov bp, 0x94df
mov bp, cx
mov cl, byte [esp]
lea esp, [esp]
not ah
cmc
jmp 0x4d00d9
lea edx, [ebx + 0x12]
call 0x4d0166
pop edi
inc ebx
outsd dx, dword [esi]
jb 0x4d01a2
js 0x4d01c4
dec ebp
popal
imul ebp, dword [esi], reloc.mscoree.dll__CorExeMain
add al, 0x24
lea ebx, [ebx + ebp]
mov byte [esp], cl
pop bx
bsf si, ax
jmp 0x4d01a6
mov ecx, esp
pop ecx
mov ebx, 0xdfde0762
seto bl
mov dh, 0x7b
push word [esp + 1]
jmp 0x4d0150
rdtsc
add bh, cl
mov bh, byte [esp + 5]
sub esp, 0xf
not ah
cpuid
jmp 0x4d01e2
mov dword [reloc.mscoree.dll__CorExeMain], eax
aam 0x27
lea ecx, [edx]
mov edi, 0xa8d27d4
sub esp, 5
xchg dword [esp + 6], esi
bts ebx, ebx
push dword [esp]
cmc
jmp 0x4d0190
insb byte es:[edi], dx
add byte [eax - 0x25], al
dec ebx
fnsave dword cs:[edx - 0x42]
mov dword [eax], ebp
setae ah
pop word [esp + 1]
bt bx, dx
cpuid
push dx
clc
jmp 0x4d017c
cmc
not al
bswap edi
pop bx
lea esi, [eax + ebp]
cpuid
jmp 0x4d01f4
popal
mov word [esp], cx
mov ecx, ebx
lea ecx, [edx*4]
xchg edi, eax
stc
jmp 0x4d0327
lea edx, [esp + 0xb]
mov si, 0xd280
sub esp, 0x10
pop edx
mov bl, byte [esp + 5]
mov dword [esp + 8], ebp
jmp 0x4d01cf
rdtsc
mov word [esp + 0xc], bp
call fcn.004d0224
dec ecx
push eax
dec eax
dec esp
push eax
inc ecx
push eax
dec ecx
inc esp
dec esp
dec esp
add byte [ebx + ebx*2 + 0x6617ec83], dh
mov edi, 0xdcf60e9f
pop ebx
sub esp, 0x17
mov di, 0xe9f
neg ah
bsf si, sp
cld
jmp 0x4d023a
mov edi, 0x4607bf6f
rcr dh, cl
sub esp, 0xf
stc
inc ebp
lea esp, [esp + 3]
jmp 0x4d0254
Function at 0x4d0403
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0xe06b
add al, 0x4f
mov word [esp + 1], di
sub esp, 0x14
mov ch, ah
jmp 0x4d042f
pop cx
mov cl, byte [esp + 8]
neg al
mov edi, 0x8e1238ff
stc
pop edi
jmp 0x4d0463
pop ax
xchg byte [esp + 0x13], dh
mov dword [esp + 0xb], ebp
popal
mov edx, dword [esp]
xchg ebx, edi
jmp 0x4d04a4
mov dh, bh
mov dword [esp + 0x13], ecx
mov cx, 0xaa03
mov dh, dl
xchg word [esp + 8], bx
xchg cl, al
jmp 0x4d044d
mov byte [esp], bl
pop word [esp]
cpuid
lea esi, [eax + ebx]
bswap ebx
jmp 0x4d04ba
lea esi, reloc.mscoree.dll__CorExeMain
btc bx, ax
mov ecx, 0x2ab31069
btc esi, eax
push edx
clc
jmp 0x4d048e
add esp, 0
lea esp, [esp]
bswap ebx
std
mov dx, bx
mov al, 0x21
jmp 0x4d0508
mov edx, 0x701b0996
mov dl, bl
pop dword [esp + 8]
xchg si, di
jmp 0x4d051c
mov cx, 0x92f4
mov ax, cx
rdtsc
mov ax, word [esp]
rdtsc
sub esp, 0xf
jmp 0x4d04f1
lea eax, reloc.mscoree.dll__CorExeMain
mov bp, 0x24ad
push word [esp + 7]
ror cx, 8
lea eax, [esi*4]
jmp 0x4d055b
lea edx, [ecx*4]
mov al, ah
xchg byte [esp + 0xd], ah
mov dword [esp + 7], eax
lea ecx, [eax + edx]
xchg byte [esp], dh
jmp 0x4d060e
lea ebx, reloc.mscoree.dll__CorExeMain
mov word [esp + 0xb], dx
push di
cpuid
xchg byte [esp + 0xb], ch
call fcn.004d05dc
mov ah, 0x66
mov eax, dword [esp + 1]
mov bx, word [esp + 0xe]
neg al
jmp 0x4d066a
mov bh, byte [esp + 9]
mov word [esp + 4], si
mov word [esp + 0xd], di
jmp 0x4d069d
mov byte [esp + 6], dl
pop ecx
xchg ebp, ebx
xchg dword [esp + 8], edi
pop word [esp + 9]
pop word [esp + 6]
jmp 0x4d0654
push word [esp + 1]
add esp, 3
lea esp, [esp + 0xe]
call fcn.004d0bca
xlatb
push edi
invalid
Function at 0x4d0799
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebp
xchg word [esp + 5], bx
mov dword [esp + 0x12], edi
jmp 0x4d082c
sub ebx, 0x89db6fab
mov ch, dl
add esp, 0x12
xchg dword [esp + 4], ecx
jmp 0x4d0802
bswap edi
mov byte [esp + 8], cl
sbb di, 0x31dc
push dword [esp + 0x26]
push cx
pop word [esp + 9]
jmp 0x4d07be
push word [esp + 0x16]
bts cx, dx
rdtsc
rcr ebp, cl
add esp, 0x10
jmp 0x4d087b
xchg word [esp + 0x14], di
mov byte [esp + 0x1e], al
mov edi, dword [esp + 0xe]
pop cx
mov bx, 0xf1a3
mov dh, 0x68
jmp 0x4d07ec
neg si
inc bl
mov byte [esp + 0x2f], cl
lea ecx, [eax*4]
bt bp, sp
sete cl
jmp 0x4d07d4
xchg ebp, edx
push word [esp + 0x2b]
add esp, 0xd
bts cx, bp
jmp 0x4d08aa
and bl, 0xe
pop edx
sub esp, 0x1d
mov di, bp
pop word [esp + 0x19]
setg ch
jmp 0x4d0845
push dword [esp + 3]
pop dword [esp + 7]
mov bp, sp
mov cl, byte [esp]
push word [esp + 7]
mov bp, 0x7d12
jmp 0x4d085b
mov ebp, 0xa9bbafd5
xchg edi, edx
lea esp, [esp]
cmp eax, 0x5458d6c1
jmp 0x4d08f3
lea eax, reloc.mscoree.dll__CorExeMain
pop word [esp + 7]
neg ecx
lea eax, [ebx*4]
not bh
jmp 0x4d0894
neg bp
cld
mov dl, 0xe1
pop word [esp]
pop word [esp + 0x11]
jmp 0x4d0924
bswap edi
pop dword [esp + 0x15]
lea esi, [esp + ebp]
lea ebp, [ebx*4]
mov di, word [esp + 9]
mov dword [esp + 0x14], edx
jmp 0x4d08dd
sub esp, 0x19
xchg dl, dh
call fcn.004d0938
mov ds, word [esi]
mov ebx, gs
sub edi, 0x6320e1f6
lcall 0xd24, 0x548a310f
rdtsc
mov dl, byte [esp + 0xd]
xchg dword [esp + 4], ecx
xchg edx, eax
mov cl, 0xc8
push dword [esp + 9]
jmp 0x4d090e

Function at 0x4d0cb7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 9]
mov byte [esp + 1], dh
lea esp, [esp + 1]
jmp 0x4d0cf2
xchg ah, ch
cpuid
mov ebp, 0x6c157721
not ch
mov eax, dword [esp]
mov esi, eax
jmp 0x4d0d58
lea esp, [esp + 0xc]
push 0
pushal
not bx
rdtsc
jmp 0x4d0cdc
xchg bl, al
mov ax, si
mov eax, edi
lea ebx, reloc.mscoree.dll__CorExeMain
xchg edi, edx
call fcn.004d0d1f
jnp 0x4d0d3e
or al, dh
push 0xe8d787df
salc
invalid
arpl word [esi], ax
cmc
inc esi
arpl sp, si
push 0xd
cld
push ebp
popal
mov al, byte [0x148b66e3]
and al, 0x66
mov esi, 0xc9b45bcf
mov dx, word [esp]
mov si, 0x5bcf
mov ah, 0xc9
mov edi, 0x832a5948
rdtsc
mov ebp, 0xd5a49230
jmp 0x4d0d35
Function at 0x4d1560
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
std
sub esp, 0x13
lea esp, [esp + 3]
lea esp, [esp + 0x10]
pushal
jmp 0x4d1892
call 0x4d1560
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor ebp, dword cs:[esi]
aaa
xor byte cs:[eax], al
jmp 0x4d1517
rcr bx, 5
not dx
bswap ebx
lea esp, [esp + 8]
pop ebx
jmp 0x4d1620
add esp, 1
mov ecx, dword [esp]
clc
sub esp, 0xe
mov eax, 0xfb3452c5
pop word [esp]
jmp 0x4d15f5
mov bp, 0xacfc
mov bx, 0x84a7
bts esi, ebx
lea esp, [esp]
pushal
pushfd
jmp 0x4d1675
mov bl, byte [esp + 2]
push word [esp + 0x19]
mov dword [esp + 8], edx
bt ebx, esp
jmp 0x4d165f
mov bh, byte [esp]
lea edx, [edx - 0xc0]
sbb bp, bx
not bp
shr dh, 7
xchg bx, cx
jmp 0x4d160b
not ecx
mov byte [esp], bl
mov dword [esp + 0x18], eax
mov si, sp
sub esp, 9
jmp 0x4d169f
bt eax, ebx
push word [esp + 2]
sub esp, 3
sub esp, 3
mov dx, ax
push edx
jmp 0x4d1632
add esp, 0x27
bsf bp, di
lea esi, [esi*4]
rdtsc
jmp 0x4d16ee
mov edi, edx
mov di, word [esp + 0x19]
mov word [esp], si
xchg al, bl
xchg edi, ebx
xchg cx, di
jmp 0x4d1689
xchg bh, al
xchg byte [esp + 0xc], bh
lea esp, [esp + 0x11]
std
mov ch, dl
cld
jmp 0x4d1648
add esp, 0x19
push edx
xor dx, 0x3cab
not eax
shl dl, cl
rdtsc
jmp 0x4d1716
push ebp
xchg dx, cx
push dword [esp]
lea edi, reloc.mscoree.dll__CorExeMain
xchg ebx, edx
pushfd
jmp 0x4d16d1
add esp, 3
xchg byte [esp + 3], ah
mov bl, dh
mov dword [esp], ebp
lea esp, [esp + 5]
jmp 0x4d177a
mov ch, byte [esp + 7]
push dword [esp + 4]
add esp, 3
mov ax, word [esp + 4]
pop ecx
mov si, word [esp]
jmp 0x4d1700
dec edx
sub esp, 0x15
xchg word [esp + 0x12], di
pop si
setle ah
setnp bh
jmp 0x4d16be
mov dh, byte [esp]
xchg edi, ecx
mov ch, ah
lea esp, [esp]
call 0x4d17b6
mov bx, 0xdd2a
cpuid
mov ecx, 0xb2e5346e
mov bl, 0x5e
add esp, 2
jmp 0x4d178c
lea esi, [edi*4]
dec di
adc edi, eax
bswap edi
std
mov cl, 0xdc
jmp 0x4d1755
xchg byte [esp], bh
neg bx
sub esp, 0x17
bswap ebx
pop edi
neg bh
jmp 0x4d17a0
lea edx, [eax + ecx]
mov ecx, esi
neg cl
lea eax, reloc.mscoree.dll__CorExeMain
call fcn.004d17d1
setbe byte [ecx]
sar al, 0x66
pop eax
jmp 0x4d1764
dec di
mov di, 0x9bd4
stc
setae ah
mov ch, al
mov ah, bl
jmp 0x4d173f
dec cl
mov bh, 0xe9
rdtsc
setno cl
bsf bp, dx
xchg di, cx
jmp 0x4d17f9

Function at 0x4d1d35
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esi + edi]
add esp, 0
xchg al, dh
mov ebp, 0x223c10aa
jmp 0x4d1d78
sub si, bp
mov esi, 0x6d6a64cb
bts dx, bp
mov word [esp + 2], ax
jmp 0x4d1d1f
mov cx, 0x4033
rdtsc
lea esp, [esp + 0x14]
xchg word [esp + 1], si
call fcn.004d1dbd
stosd dword es:[edi], eax
ret 0xf66
bsf ax, bp
bsf ecx, ebx
btr bp, sp
inc si
sub esp, 0x1b
rdtsc
jmp 0x4d1d48
xchg byte [esp + 2], dh
lea ebp, [ecx*4]
mov edi, eax
cld
pop word [esp]
not si
jmp 0x4d1d5e
Function at 0x4d223a
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl al, 7
mov dl, byte [esp + 4]
bswap edi
jmp 0x4d227a
rdtsc
mov dh, byte [esp + 2]
xchg dword [esp + 2], ecx
xchg word [esp + 2], bp
pop ebx
jmp 0x4d228d
lea esp, [esp]
mov ah, byte [esp + 6]
mov dl, cl
push dword [esp + 3]
sub esp, 0x1b
popal
jmp 0x4d2264
mov bx, 0x5543
btc bp, dx
cpuid
mov dword [esp], eax
mov ax, si
jmp 0x4d22c4
mov bp, word [esp + 1]
mov ah, 0xbc
add ebp, esp
mov si, word [esp]
xchg dword [esp], esi
bts ax, si
jmp 0x4d22ae

Function at 0x4d24e2
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea esp, [esp]
push bx
lea esp, [esp + 2]
mov dword [esp], ebx
push esp
jmp 0x4d2551
lea esp, [esp + 0x18]
pop word [esp]
lea esp, [esp + 2]
mov dword [esp], esi
call fcn.004d2515
pop edi
enter 0x395e, 0xffffffffffffffc8
popal
cmc
pushfd
outsd dx, dword [esi]
fst dword [edi + eax*4]
cmp dword cs:[eax], ebx
jnp 0x4d25b8
push bp
push ebp
mov byte [esp], dh
lea esp, [esp + 2]
push ebp
pushal
mov dword [esp + 0x1b], esi
jmp 0x4d252b

Function at 0x4d2515
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions
Parse pe header

Disassembly:
call fcn.004d2004
mov dword [esp], edi
jmp 0x4d2578
mov eax, dword [eax]
jmp 0x4d259c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x4d2562
mov eax, dword [eax + 8]
push eax
jmp 0x4d1fff
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.4k07ytbq]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.4k07ytbq]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.4k07ytbq]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.4k07ytbq]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.4k07ytbq]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.4k07ytbq]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x100016e0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019a62
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x430
mov eax, dword [0x10022040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x438], esi
push 0
push 0
push 0
mov dword [ebp - 4], 0
push 1
mov dword [ebp - 0x440], esi
push str.AutoUpdateApp
mov dword [ebp - 0x43c], 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
lea ecx, [ebp - 0x434]
mov edx, 0x10022b44
mov dword [ebp - 0x438], edi
call fcn.10001580
push 0
push 0x80000000
mov dword [ebp - 4], 1
lea eax, [ebp - 0x434]
cmp dword [ebp - 0x420], 7
push 0
cmova eax, dword [ebp - 0x434]
push 0
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
xorps xmm0, xmm0
mov ecx, esi
push 0
movups xmmword [esi], xmm0
push 0x1001c4e4
mov edi, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.10002e40
mov dword [ebp - 0x43c], 1
test edi, edi
je 0x10001840
lea eax, [ebp - 0x41c]
push eax
push 0x3ff
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10001839
nop dword [eax]
mov eax, dword [ebp - 0x41c]
test eax, eax
je 0x10001839
cmp eax, 0x400
jae 0x100018ae
mov byte [ebp + eax - 0x418], 0
mov ecx, esi
lea eax, [ebp - 0x418]
push eax
call fcn.100025b0
lea eax, [ebp - 0x41c]
push eax
push 0x3ff
lea eax, [ebp - 0x418]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x100017f0
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x438]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 0x420]
cmp ecx, 7
jbe 0x1000188e
mov edx, dword [ebp - 0x434]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10001884
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10001884
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10018c76
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001871e
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1001884f
int3
Function at 0x1000ba50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001a6ad
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10022040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.1001892c
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x1000ccd0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1000bad2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001871e
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1000e420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000e44c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1000e474
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000e47a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1000e4e2
jg 0x1000e491
test esi, esi
je 0x1000e4e2
test ecx, ecx
jl 0x1000e4dd
jg 0x1000e49b
test eax, eax
je 0x1000e4dd
cmp edi, ecx
jg 0x1000e4af
jl 0x1000e4a5
cmp esi, eax
jae 0x1000e4af
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1000e4e5
mov ecx, dword [ebp + 8]
jmp 0x1000e4ef
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1000e509
jg 0x1000e4ef
test esi, esi
je 0x1000e509
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000e509
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc