joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496abd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x496b24
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x496b41
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x496baa
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfa8d
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x496b7d
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x496b6d
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x496ba4
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496bfe
inc edi
cmp edi, ecx
jb 0x496b91
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.004ca42d
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004de309
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x496ba4
cmp dword [esi + 0x14], 0x10
jb 0x496c0d
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x496c27
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfa8d
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x496c5d
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x496c4d
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496c9b
cmp ecx, edx
je 0x496d12
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x496c83
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.004b59fd
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004ca55d
mov eax, esi
jmp 0x496be3
or ecx, 0xffffffff
jmp 0x496c9d
Function at 0x496f3d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca42d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497060
push ecx
lea ecx, [esi + 0x18]
call fcn.004b675d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x497077
push ecx
lea ecx, [esi + 0x24]
call fcn.004b666d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ace5d
Capabilities:
Encode data using xor

Disassembly:
inc esi
jbe 0x4ace55
mov al, byte [0x673488ab]
int3
sub byte [edx + 0x33], dh
mov bl, 0x7c
stosd dword es:[edi], eax
wait
sahf
jle 0x4ace2e
mov eax, dword [0xfa47fa36]
jle 0x4acede
dec edx
invalid
push cs
dec ebp
cmp ecx, ebx
ljmp 0x5fbe
std
cdq
popfd
push 0x4c
xor eax, dword [esi + 0x2d]
pop ebx
fld xword [esi]
stosd dword es:[edi], eax
xor al, 0xad
cmp eax, 0xe98caaa4
stosb byte es:[edi], al
mov ecx, gs
ja 0x4acede
jl 0x4aceaf
mov ebx, gs
js 0x4acf4b
push esi
push edi
pop ebx
cmpsb byte [esi], byte es:[edi]
retf 0x1f58
add dword [eax + 0x1553aa08], edi
js 0x4acf60
stosb byte es:[edi], al
push ebx
adc eax, 0x2d594378
sbb dword [edi + edx*4], esi
cmp al, 0x9a
cmpsd dword [esi], dword es:[edi]
jp 0x4acee3
pop ecx
sub eax, 0x3c973419
lcall 0xfa2d, 0x38bc7aa7
dec ebp
dec eax
nop
cmp byte [0x90484dfa], ch
ret
int 0x9b
js 0x4acf5a
add ah, bl
loope 0x4acf15
mov edx, esp
pop ds
das
or esi, esi
dec ebx
cmp byte [eax + 0x77], ch
sbb byte [eax - 0x33738270], al
or byte [eax + ecx*8 + 0x1c], 0xa9
rcr byte [eax], 0x29
bound esp, qword [eax*4 - 0x781346f4]
salc
stc
pushfd
mov dword [eax + 0x30], ecx
popfd
jge 0x4aceee
int3
popfd
push edx
inc ecx
dec edx
jle 0x4acf18
jne 0x4acf7a
outsb dx, byte [esi]
clc
in eax, 0xa8
push esi
or al, 0xc
insb byte es:[edi], dx
les ebx, [eax + 0x6a]
invalid
Function at 0x4e039d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051388d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e04c0
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffbbd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e04d7
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffacd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4fc6dd
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebx - 0x4f913188], ebx
imul ecx, dword [eax + 0x7d], 0x4c69e959
push 0x4c
out dx, al
lodsb al, byte [esi]
cmc
js 0x4fc63d
mov edx, ds
push eax
mov byte [eax], ch
imul ecx, edx, 0xa9b71b8f
xchg ebx, eax
mov eax, 0x9b4a9474
mov edx, 0x11e9c39
or byte [esi + 0x10], bl
sub dword [edi - 0x5cea7953], esi
mov ebx, 0xd6e8e6bf
xor al, dh
add dh, dh
adc ah, dh
pushal
adc al, 0x62
call 0x68c61c07
cmp ecx, dword [ebp + esi*8 - 0x78]
invalid
mov byte [edx + edi*2 + 0x78], cl
inc ebx
xchg edx, eax
sbb bl, byte [ecx]
and eax, 0xff1ee20d
cli
stc
and dword [esi], esp
push cs
mov ebp, ebx
js 0x4fc60a
cmp dword [edx - 0x58], 0xffffff9a
wait
loop 0x4fc68e
pop ebx
sub eax, 0x339e1e4
ljmp 0x558a
loopne 0x4fc673
jmp 0x1214b308
Function at 0x529acd
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cfbd
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529bf0
push ecx
lea ecx, [esi + 0x18]
call fcn.005492ed
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c07
push ecx
lea ecx, [esi + 0x24]
call int.005491fd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x55c83d
Capabilities:
Encode data using xor

Disassembly:
xor ch, 0x18
mov bl, 0xe9
lea esp, [eax]
mov dl, 0
js 0x55c84c
ficom word [edi - 0x1e7954c8]
xchg cl, ah
or al, 0xa0
jbe 0x55c892
sal dword [edi - 0x17], cl
mov al, byte [0xc51ba5b4]
invalid
or al, 0x97
wait
sub byte [ebx - 0x24de267b], 0xa9
lds eax, [ebp + 0x1446d109]
mov esi, 0x69012853
salc
outsd dx, dword [esi]
arpl word [esi + 0x13], sp
and dword [esp + ebx*8 - 0x47], esp
int3
Function at 0x5730dd
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a65cd
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x573200
push ecx
lea ecx, [esi + 0x18]
call fcn.005928fd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x573217
push ecx
lea ecx, [esi + 0x24]
call fcn.0059280d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5bd2dd
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005f07cd
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bd400
push ecx
lea ecx, [esi + 0x18]
call fcn.005dcafd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bd417
push ecx
lea ecx, [esi + 0x24]
call fcn.005dca0d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x60696d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639e5d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606a90
push ecx
lea ecx, [esi + 0x18]
call fcn.0062618d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606aa7
push ecx
lea ecx, [esi + 0x24]
call fcn.0062609d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x60eead
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x65
nop
pop edx
dec edx
enter 0x1840, 0x47
pushal
sar byte [esi + 0x94bda66], cl
test byte [edx + 6], cl
cld
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
cmp dword [esi - 0x6a68164d], ebp
out 0x19, al
cmp ecx, esp
out dx, eax
mov word [edx], ds
and dword [edx - 0x68], esp
pop edx
sbb byte [ebx - 0x37], ah
arpl cx, cx
or bl, cl
xor byte [ebp + 0x51], ch
xor eax, 0x1c14b9d7
cmpsd dword [esi], dword es:[edi]
aas
sub byte [edi - 0x1477b688], 0x26
jbe 0x60eeb9
js 0x60ef14
mov bl, ch
jbe 0x60eeb9
pop edx
xchg ecx, eax
cmp dword [edx - 0x44], 0xffffffb0
adc dword [ebp + edi*4 + 0x3a32a465], ebp
movsb byte es:[edi], byte gs:[esi]
xor bh, byte [edx]
and cl, ch
cmp byte [ebp - 0x635f75f0], ch
shl dword [ecx], cl
mov bl, 0x4e
nop
xchg esi, eax
cmp eax, 0xd134f703
xor byte [edx + ebp*8], al
js 0x60ee91
push eax
mov esi, 0xc90c32ec
inc esi
jo 0x60ef5b
out dx, al
jbe 0x60ef1d
sbb ax, 0x3e58
scasb al, byte es:[edi]
push esp
dec ebp
salc
jo 0x60eed9
outsb dx, byte [esi]
lea ecx, [ebx + 7]
or eax, 0x41847aa4
movsb byte es:[edi], byte [esi]
jp 0x60ee9b
inc ecx
int3
pop ecx
inc edi
add esi, dword [edi + 0x37]
je 0x60eec9
sub esi, esp
and byte [eax - 0x4f05e018], dh
add al, 0x6c
cli
sti
inc edx
jno 0x60ef27
cmp bh, byte [ecx - 0x40]
sub al, 0x3d
sbb eax, 0xb8ee443a
ljmp 0x5322
push ss
invalid
Function at 0x62514d
Capabilities:
Authenticate hmac

Disassembly:
bound edi, qword [ebp + 0x55]
cmp eax, 0x4e7cc6fe
mov dh, 0x5c
shl byte [edi + 0xf], cl
mov dword [esp + edx + 0x366a2054], ebx
out 0xa2, eax
out dx, eax
add esp, esi
adc eax, 0x78102d5b
mov esp, 0xe6bfc18e
adc al, 0xf0
jge 0x625199
xlatb
imul eax, dword [eax + 0x15], 0xffffffb6
inc eax
adc eax, 0x9d1edcb6
inc eax
adc eax, 0x9d1edcb6
push esi
cmp byte [esi - 0x2f], al
adc bh, ch
jae 0x625162
dec esi
invalid
mov ah, 0x54
jo 0x625124
sub al, 0xb2
mov ah, 0xe6
test byte [edi - 0x7d], dl
popfd
jge 0x6251e5
jecxz 0x625162
adc al, 0xbd
test esp, eax
inc eax
fdiv qword [edi]
fidiv word [ecx]
mov word [edi - 0x26], cs
mov ebp, 0xd7e4931d
pushfd
out 0xa3, al
add eax, 0x399446fd
inc ebx
out 0x70, eax
xor esp, dword [ebx + 0x46]
xor al, 0x26
inc esp
xor al, 0xf7
dec esi
sbb al, 0xa7
xor ch, byte [ecx + 0xa]
sub al, 0xcc
push ebp
sub dl, byte [ebp - 0x2392adf8]
stosd dword es:[edi], eax
push 0x9b7c4869
inc ebp
xor ch, al
mov word [edx], fs
jl 0x625224
imul ebx, dword [esi + 0x460c075c], 0x3c
pop esp
jg 0x6251d0
nop
cmc
push cs
std
inc esp
bound edi, qword [edx - 0x2b703dee]
xor ah, dl
push 0xbc0648e2
inc eax
mov esi, 0xcf1db437
push 0xffffffffffffffdd
add eax, 0x4417f64c
dec eax
push es
mov esp, 0xb437be40
sbb eax, 0x5dd6acf
dec esp
not byte [edi]
inc esp
sbb al, 0x66
and dl, dh
cmc
xor dh, ah
jns 0x625245
mov byte [esi - 0x59154eef], 0x36
pushfd
push edx
pop ebp
push edi
fidiv dword [edi]
mov cl, 0x36
mov word [esi - 0x5c], fs
outsb dx, byte [esi]
retf 0x1c6b
sbb al, 0x71
sbb ch, ah
shl dword [ebp - 0x571441da], 0xc4
ja 0x625258
push esp
into
sub eax, 0xf20ae81e
clc
sar dword [edi - 0x18], 1
mov ch, byte [eax + 0x41c77795]
pop esp
inc ecx
jb 0x6251bf
cmp byte es:[edx], dh
pop esi
lodsb al, byte [esi]
xor bl, byte [esi - 0x54]
mov dh, 0xd7
je 0x6251fe
invalid
daa
mov esp, 0x18c0dd72
sbb eax, ebp
fbstp tbyte [esi + ebx + 0x7a]
cmpsb byte [esi], byte es:[edi]
cld
fild dword [ebp - 0x50]
invalid
Function at 0x1000bec2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x100123ff
call fcn.100110a9
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x1000bf70
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.1000cb35
add esp, 0xc
test eax, eax
js 0x1000bf70
mov edi, dword [ebp - 0x41c]
cmp edi, 0x400
jg 0x1000bf56
push edi
call fcn.10001a54
pop ecx
test al, al
je 0x1000bf56
mov eax, edi
call fcn.10010fd0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000bf62
push edi
lea ecx, [ebp - 0x428]
call fcn.1000cb35
push 3
push edi
push esi
push eax
call fcn.1000cb35
cmp eax, ebx
jne 0x1000bfad
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000bf89
lea ecx, [ebp - 0x418]
call fcn.1000a9be
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10001519
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.10011105
ret 0x10
push 2
push ebx
push eax
call fcn.1000abcb
mov edi, eax
mov dword [ebp - 0x41c], edi
cmp edi, ebx
jne 0x1000bfce
call fcn.1000235a
mov esi, eax
jmp 0x1000c098
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x1000bff1
call fcn.1000235a
jmp 0x1000c08a
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, ebx
je 0x1000bfe7
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x424], esi
cmp eax, esi
jae 0x1000c021
mov esi, 0x8007000e
jmp 0x1000c08c
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000cb35
mov dword [ebp - 4], 1
jmp 0x1000c04f
cmp dword [ebp - 0x418], ebx
je 0x1000c01a
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.1000cb35
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.1000cb35
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000bf8e
lea ecx, [ebp - 0x418]
call fcn.1000a9be
jmp 0x1000bf8e
Function at 0x1000cb35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000cb44
pop dword [ebp - 0xc]
mov eax, 0x993a064b
sub eax, 0x89393b07
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x38b13
push 0
mov eax, 0x960c2cb8
add eax, 0x79f50444
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x2527e01a
sub ecx, 0x25279988
mov ebx, eax
mov esi, 0xe984e39b
sub esi, 0xd982dd9b
add esi, dword [ebp - 0xc]
mov edi, 0xac2c046a
add dword [ebp - 8], 0xeec2081b
mov edx, dword [esi]
mov dword [ebp - 4], 0x9b72d023
add edx, edi
xor dword [ebp - 8], 0xcd8df0a1
mov dword [ebx], edx
mov dword [ebp - 8], 0x142cb65c
add ebx, 0x2a36ce60
sub ebx, 0x2a36ce5c
add esi, 4
loop 0x1000cb9d
add eax, 0xdeb3d10e
sub eax, 0xdeb2c3f3
mov ebx, eax
add eax, 0x9d3b965c
sub eax, 0x9d3b9657
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1000d596
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x3c
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.MSVCR100.dll__wcsicmp]
push edi
mov edi, dword [eax + 8]
push str.http:__
push ebx
add edi, 0x568
call esi
pop ecx
pop ecx
test eax, eax
je 0x1000d61b
push str.file:__
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1000d61b
push dword [ebp + 0xc]
push ebx
call esi
pop ecx
pop ecx
test eax, eax
je 0x1000d61b
push 0x38
xor esi, esi
lea eax, [ebp - 0x38]
push esi
push eax
mov dword [ebp - 0x3c], 0x3c
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push ebx
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x1000d61e
cmp dword [ebp - 0x30], 1
je 0x1000d617
cmp dword [ebp - 0x30], 2
jle 0x1000d61e
cmp dword [ebp - 0x30], 4
jg 0x1000d61e
mov edi, ebx
jmp 0x1000d61e
mov edi, dword [ebp + 0xc]
push edi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.1000cb35
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret 0x20