joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a73
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.0040cce0
mov eax, dword [0x2a9f420]
mov ecx, dword [0x2a9e374]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402b50
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2a9f420], 0x959
jne 0x402b3e
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.0040289d
add edi, 8
dec ebx
jne 0x402a9f
pop edi
pop ebx
pop esi
leave
ret
Function at 0x403bc0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a0c8]
jne 0x403bca
repz ret
jmp fcn.00406afe

Function at 0x406724
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040495f
and dword [ebp - 4], 0
cmp dword [0x42bcac], 0
mov ebx, eax
jne 0x4067d5
push 0x401a38
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406886
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401a2c
push edi
call esi
test eax, eax
je 0x406886
push eax
call fcn.004048ed
mov dword [esp], 0x401a1c
push edi
mov dword [0x42bcac], eax
call esi
push eax
call fcn.004048ed
mov dword [esp], 0x401a08
push edi
mov dword [0x42bcb0], eax
call esi
push eax
call fcn.004048ed
mov dword [esp], 0x4019ec
push edi
mov dword [0x42bcb4], eax
call esi
push eax
call fcn.004048ed
pop ecx
mov dword [0x42bcbc], eax
test eax, eax
je 0x4067d5
push 0x4019d4
push edi
call esi
push eax
call fcn.004048ed
pop ecx
mov dword [0x42bcb8], eax
mov eax, dword [0x42bcb8]
cmp eax, ebx
je 0x40682d
cmp dword [0x42bcbc], ebx
je 0x40682d
push eax
call fcn.00404968
push dword [0x42bcbc]
mov esi, eax
call fcn.00404968
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40682d
test edi, edi
je 0x40682d
call esi
test eax, eax
je 0x406824
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406824
test byte [ebp - 0xc], 1
jne 0x40682d
or dword [ebp + 0x10], 0x200000
jmp 0x406866
mov eax, dword [0x42bcb0]
cmp eax, ebx
je 0x406866
push eax
call fcn.00404968
pop ecx
test eax, eax
je 0x406866
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406866
mov eax, dword [0x42bcb4]
cmp eax, ebx
je 0x406866
push eax
call fcn.00404968
pop ecx
test eax, eax
je 0x406866
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42bcac]
call fcn.00404968
pop ecx
test eax, eax
je 0x406886
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406888
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405eba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405ede
xor eax, eax
test eax, eax
je 0x405ef0
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405ef0
xor ecx, ecx
jmp 0x405ef3
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x405f97
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422acc], 0
push esi
jne 0x405fce
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fa8
mov dword [ecx*4 + 0x422ac8], eax
inc ecx
cmp ecx, 0x100
jl 0x405fa3
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405fff
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ac8]
xor eax, esi
inc ecx
dec edx
jne 0x405fe1
pop edi
not eax
pop esi
ret 0xc

Function at 0x401e10
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401e80
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401360
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x10001050
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1234
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1200], ecx
push 0x10046bec
jmp 0x10001fe1
lea esp, [esp + 4]
seta al
movzx ax, dl
movsx eax, bx
mov byte [ebp - 0x738], 0x6b
cbw
movzx ax, dl
lahf
mov byte [ebp - 0x737], 0x65
setge al
jmp 0x10009cfc
mov byte [ebp - 0x72e], 0x2e
cwde
cmovg ax, sp
not ax
mov byte [ebp - 0x72d], 0x64
mov byte [ebp - 0x72c], 0x6c
cmovs ax, ax
mov byte [ebp - 0x72b], 0x6c
mov eax, esp
not ah
mov byte [ebp - 0x72a], 0
lahf
not al
xchg ah, ah
mov byte [ebp - 0x498], 0x6b
cwde
mov byte [ebp - 0x497], 0x65
mov byte [ebp - 0x496], 0x72
mov byte [ebp - 0x495], 0x6e
movzx ax, ah
bswap ax
xchg al, ah
mov byte [ebp - 0x494], 0x65
nop
cbw
mov byte [ebp - 0x493], 0x6c
movzx eax, bp
setb ah
mov byte [ebp - 0x492], 0x33
movzx ax, cl
mov byte [ebp - 0x491], 0x32
mov byte [ebp - 0x490], 0x2e
movzx ax, ch
mov byte [ebp - 0x48f], 0x64
lahf
jmp loc.1020e527
mov byte [ebp - 0x736], 0x72
mov byte [ebp - 0x735], 0x6e
not ah
mov byte [ebp - 0x734], 0x65
mov byte [ebp - 0x733], 0x6c
mov byte [ebp - 0x732], 0x62
bswap eax
movsx eax, bx
mov byte [ebp - 0x731], 0x61
mov byte [ebp - 0x730], 0x73
not al
jmp 0x1001f24f
mov byte [ebp - 0x72f], 0x65
jmp 0x10003dc0

Function at 0x1000b5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x10046bec
mov dword [ebp - 0x4e0], edi
mov dword [ebp - 0x4f0], esi
jmp 0x1000b729
lea esp, [esp + 4]
push 0xc48
jmp 0x100105f3
push 0
push ebx
jmp loc.102079fa

Function at 0x1000c210
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
setb ah
cwde
movsx eax, sp
mov eax, dword [0x1008e8fc]
jmp 0x10013e9e
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x318c
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, esp
mov dword [esp + 0x3188], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0x10046bec
mov dword [esp + 0x14], ebx
mov dword [esp + 0x48], edi
jmp 0x10001c12
push 0
jmp loc.1020a3ed

Function at 0x1000d240
Capabilities:
Authenticate hmac
Check for software breakpoints
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
lea esp, [esp + 4]
adc al, 0x12
mov eax, dword [ebp - 0x7778]
movzx ecx, byte [eax]
test ecx, ecx
jmp loc.1020e448
push ebp
mov ebp, esp
mov eax, 0x7ba8
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x7778], ecx
push 0x10046bec
jmp 0x10005c1b

Function at 0x10012f00
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [edi + 0xd0]
jmp loc.1021c1f0
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp byte [edi + 0xcb], 0
jne 0x10013007
push ebx
push 0x10046bec
jmp 0x1000a6c8
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10013460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x10003f2e
mov eax, dword [0x1008e8fc]
mov ch, bh
bswap ecx
lea ecx, [esp + 0xd4]
jmp loc.10208447
mov esi, dword [0x10206c98]
test esi, esi
jmp loc.1020ae2e
lea esp, [esp + 4]
test esi, edx
sub eax, eax
cmp bh, dl
mov dword [esp + 0xac], 0x700073
test esi, eax
mov dword [esp + 0xb0], 0x650065
test si, cx
mov dword [esp + 0xb4], 0x680064
cmp ax, 0x1a29
stc
mov dword [esp + 0xb8], 0x630061
cmc
cmp si, 0xb082
mov dword [esp + 0xbc], 0x2d006b
mov dword [esp + 0xc0], 0x330069
mov dword [esp + 0xc4], 0x360038
mov dword [esp + 0xc8], 0x64002e
cmc
test di, 0xeb9a
cmp ecx, ebp
mov dword [esp + 0xcc], 0x6c006c
cmc
mov word [esp + 0xd0], ax
cmp byte [0x10206ca0], al
jne 0x1001211f
mov eax, dword [0x1008e8fc]
not ecx
lea ecx, [esp + 0xac]
jmp 0x100149d3
sub eax, eax
test dh, ch
mov dword [esp + 0xd4], 0x65006b
test cx, 0x2933
cmc
mov word [esp + 0xec], ax
rol al, 0x9e
xadd eax, eax
sar eax, 0x93
mov eax, dword [0x10206c9c]
cmp esp, edi
mov dword [esp + 0xd8], 0x6e0072
cmp edi, 0x7895e89f
mov dword [esp + 0xdc], 0x6c0065
test ebp, 0xbc30231e
mov dword [esp + 0xe0], 0x320033
clc
test dx, sp
mov dword [esp + 0xe4], 0x64002e
cmc
mov dword [esp + 0xe8], 0x6c006c
cmp si, cx
test sp, 0x3d25
test eax, eax
jmp 0x10003306
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x108c
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, esp
mov dword [esp + 0x1088], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10046bec
jmp 0x10006511
push ecx
mov eax, dword [eax + 0x38c]
jmp loc.1020d2a2

Function at 0x10013880
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x1008e900]
push 0x10046bec
jmp loc.10211d49

Function at 0x10013920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
push ebx
mov ebx, dword [0x1008e900]
not eax
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10013955
push edi
mov edi, dword [ebp + 8]
mov edi, edi
movzx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
cmp edx, esi
jb 0x10013940
pop edi
pop esi
not eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10013960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esp, [esp + 4]
cbw
lahf
mov eax, dword [0x1008e8fc]
jmp 0x10009180
push 0x40
push 0x3000
jmp loc.1020eb01
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10046bec
mov esi, ecx
jmp 0x10008db7
Function at 0x10015030
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x228], 0x654d6c61
cmp edx, 0x30a71329
cmp ebx, esi
jmp loc.1020b1c2
lea esp, [esp + 4]
cmp edx, 0x64115d8d
stc
mov dword [esp + 0x2f4], 0x6c41775a
test ebp, 0xa105ff92
mov dword [esp + 0x2f8], 0x61636f6c
cmp bp, 0xc9bc
mov dword [esp + 0x2fc], 0x69566574
test dx, 0xb0bf
mov dword [esp + 0x300], 0x61757472
clc
mov dword [esp + 0x304], 0x6d654d6c
mov dword [esp + 0x308], 0x79726f
test ah, ch
cmp bp, ax
mov dword [esp + 0x1b8], 0x7246775a
mov dword [esp + 0x1bc], 0x69566565
mov dword [esp + 0x1c0], 0x61757472
cmp cl, 0x3f
mov dword [esp + 0x1c4], 0x6d654d6c
mov dword [esp + 0x1c8], 0x79726f
cmp dx, bx
mov dword [esp + 0x80], 0x7551775a
stc
jmp 0x10024426
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4e4
mov eax, dword [0x10049004]
xor eax, esp
mov dword [esp + 0x4e0], eax
push ebx
push esi
push edi
push 0x10046bec
mov ebx, ecx
jmp 0x10008303
mov dword [esp + 0x84], 0x4f797265
clc
stc
mov dword [esp + 0x88], 0x63656a62
cmp esp, esp
mov word [esp + 0x8c], 0x74
cmp esp, ebp
mov dword [esp + 0x21c], 0x7551775a
mov dword [esp + 0x220], 0x56797265
cmc
mov dword [esp + 0x224], 0x75747269
jmp 0x10003d31
Function at 0x10016600
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [ebp - 0xe], 0xff
bt cx, 0x8a
mov byte [ebp - 0xd], 0xff
rdtsc
mov byte [ebp - 0xc], 0xff
dec ah
sal ah, cl
cwde
mov byte [ebp - 0xb], 0xff
movzx edx, sp
sub ecx, esp
mov byte [ebp - 0xa], 0xcd
rcl dl, cl
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0xc3
rcl edx, cl
mov edx, 1
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [ebp + edx - 0x14], eax
shr ecx, cl
bswap cx
mov ecx, 1
imul edx, ecx, 6
cbw
mov eax, dword [ebp + 0x14]
jmp 0x1001ec39
mov eax, dword [ebp - 0xb0]
jmp 0x10016ebd
mov byte [ebp - 0x14], 0xb8
or ch, 9
mov byte [ebp - 0x13], 0xff
btc dx, 0x39
mov edx, edi
mov byte [ebp - 0x12], 0xff
bts dx, ax
mov byte [ebp - 0x11], 0xff
rcr dx, 0x38
mov byte [ebp - 0x10], 0xff
shrd edx, eax, 0x90
mov byte [ebp - 0xf], 0xba
cdq
or dx, 0xd293
jmp 0x100022a8
jmp 0x10019c0f
mov byte [eax + 0xc], dl
mov eax, dword [ebp - 0xc8]
jmp 0x10011b03
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe4], 0
jmp 0x1000c800
jge 0x10005b28
call fcn.10031530
imul eax, dword [ebp - 0xe4]
inc cx
mov ecx, dword [ebp - 0xec]
jmp 0x1001e324
mov eax, dword [0x1008e8fc]
cmp dword [eax + 0x28], 6
jne 0x1020b734
mov ecx, dword [0x1008e8fc]
stc
cmp dword [ecx + 0x2c], 2
jmp loc.1021480a
lea esp, [esp + 4]
test di, 0xd9a0
neg eax
mov eax, dword [0x1008e8fc]
cmp ax, bp
cmp dword [eax + 0x144], 0x40
jne 0x1000637c
mov ecx, dword [0x1008e8fc]
test bp, 0x1a01
cmc
cmp dword [ecx + 0x28], 0xa
jmp 0x1001e5c0
call eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xcc]
mov cl, 0xad
mov ecx, dword [eax]
jmp 0x1000f43f
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0xcc], ecx
push 0x10046bec
jmp 0x10011216
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028937
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 0xe4], 0x64
jmp 0x1000f54f
add ecx, dword [ebp - 0xe4]
jmp loc.1020bdc5
jne 0x10010ed9
mov edx, dword [0x1008e8fc]
test di, 0xd5b9
cmp dword [edx + 0x2c], 0
jmp loc.1020d89e
mov dword [ebp + edx - 0x14], eax
rdtsc
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ecx]
cwde
mov ah, 0x8b
cbw
mov dword [ebp - 0xc8], edx
bswap dx
cdq
rdtsc
mov eax, dword [ebp - 0xc8]
not edx
mov ecx, dword [ebp - 0x14]
xchg dl, dh
bswap dx
setne dl
mov dword [eax], ecx
cdq
mov dx, 0x1203
mov edx, dword [ebp - 0x10]
xchg ecx, ecx
mov dword [eax + 4], edx
mov cl, bh
setg ch
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov dl, byte [ebp - 8]
jmp 0x1000f3ed
mov eax, dword [0x1008e8fc]
cmp bx, bp
test si, di
cmc
cmp dword [eax + 0x28], 6
jmp loc.10008269

Function at 0x100186d0
Capabilities:
Parse pe header

Disassembly:
call fcn.10019860
push 0x1312d00
jmp 0x10013cdb
push 0x1312d00
jmp 0x10015860
mov dword [0x1009374c], eax
jmp 0x100071de
call fcn.10028945
add esp, 4
jmp 0x100117d2
push 0
jmp loc.1021ca00
push ebp
mov ebp, esp
mov eax, 0x20ec
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10046bec
jmp 0x10026e57
lea esp, [esp + 4]
jmp 0x10003f3b
Function at 0x100199b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esp, [esp + 4]
cmc
stc
test si, 0xeba
xor eax, eax
cmc
mov dword [ebp - 0x18], 0x74006e
cmp ecx, edx
mov dword [ebp - 0x14], 0x6c0064
test bp, 0x44bb
cmp edx, 0x47a71832
mov dword [ebp - 0x10], 0x2e006c
cmc
test cx, ax
mov dword [ebp - 0xc], 0x6c0064
mov dword [ebp - 8], 0x6c
mov dword [ebp - 0x30], 0x730075
cmp eax, 0xb34e38e
clc
test si, si
mov dword [ebp - 0x2c], 0x720065
mov dword [ebp - 0x28], 0x320033
mov dword [ebp - 0x24], 0x64002e
mov dword [ebp - 0x20], 0x6c006c
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x48], 0x690077
cmp sp, 0xbe1d
mov dword [ebp - 0x44], 0x33006e
test cx, bx
clc
cmp cx, sp
mov dword [ebp - 0x40], 0x750032
stc
cmc
mov dword [ebp - 0x3c], 0x64002e
test si, cx
test bh, 0x14
cmp cx, 0x1097
mov dword [ebp - 0x38], 0x6c006c
mov word [ebp - 0x34], ax
cmp dword [0x10206cac], eax
jmp 0x1002348e
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10046bec
mov esi, edx
mov edi, ecx
jmp 0x100080bf
jne 0x1020c2ff
mov eax, dword [0x1008e8fc]
lea ecx, [ebp - 0x18]
jmp loc.1020c8e7
cmp dword [0x10206ca8], 0
jmp loc.10005e0b

Function at 0x1001aed0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ebx + 0x54], 0x98badcfe
jmp loc.102084b4
mov dword [ebx + 0x48], 0
mov dword [ebp - 0x2c], eax
mov dword [eax], 0x67452301
mov dword [ebx + 0x50], 0xefcdab89
jmp 0x100021e7
lea esp, [esp + 4]
jmp 0x1000eeae
mov byte [ebx], 0
movzx eax, si
movzx cx, bl
lea edi, [ebx + 0x44]
lea eax, [ebx + 0x4c]
movzx cx, ch
xchg cx, cx
mov ecx, 0xdd3b2295
mov dword [ebp - 0xc], 0x78323025
mov byte [ebp - 8], 0
lea ecx, [esi + 1]
jmp 0x100271bc
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x10046bec
mov dword [ebp - 0x18], esi
jmp 0x1000b13c
mov dword [ebp - 0x28], edi
mov dword [edi], 0
jmp 0x10009cdd

Function at 0x1001b230
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push 0x10046bec
mov dword [ebp - 0x18], edi
jmp loc.1021d84a

Function at 0x1001b570
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x10046bec
mov dword [ebp - 0x10], esi
jmp loc.10216e96

Function at 0x1001bfc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10046bec
mov esi, ecx
jmp loc.1021afe8
Function at 0x1001ca40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp + 0xc]
push 0x10046bec
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x1a4], eax
jmp loc.10208387

Function at 0x1001cc90
Capabilities:
Check http status code
Encode data using base64
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040180
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x5668
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x5620], edi
mov dword [ebp - 0x5658], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x5628], ebx
push 0x10046bec
jmp 0x1002829b
lea esp, [esp + 4]
cmc
jmp loc.10216c19
Function at 0x1001ed70
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
cmp edx, 0x290462b8
mov eax, dword [ebp - 0x4c]
rcl ch, cl
mov ecx, dword [eax + 0xc]
rcr dh, 0xb3
add ecx, 1
mov edx, dword [ebp - 0x4c]
cmp bp, 0xa7a2
cmc
cmp ecx, dword [edx + 4]
jmp loc.1020be07
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], ecx
push 0x10046bec
jmp 0x10001446
Function at 0x1001f310
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], ecx
push 0x10046bec
jmp loc.1020a41a

Function at 0x100201e0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push 0
bswap ecx
mov ecx, ebx
lea ecx, [ebp - 0x1b44]
jmp loc.1020a9d3
lea esp, [esp + 4]
jmp 0x100188a0
mov eax, dword [ebp - 0x1b5c]
mov byte [eax + 0x3e8], 0
setne cl
mov dword [ebp - 0x1b54], 0
mov dword [ebp - 0x1b50], 0
setno cl
mov dword [ebp - 0x1b4c], 0
bswap cx
movsx ecx, ax
not cx
push 0x1001
jmp 0x10010729
push ebp
mov ebp, esp
mov eax, 0x1b8c
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x1b5c], ecx
push 0x10046bec
jmp 0x10010f69

Function at 0x10020c50
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x238], ecx
push 0x10046bec
jmp loc.10214210

Function at 0x10020fd0
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x5e34
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, esp
mov dword [esp + 0x5e30], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
push 0x10046bec
mov dword [esp + 0x18], edi
jmp loc.10207646

Function at 0x10021fb0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
call fcn.1001f780
push eax
jmp 0x1001f25b
call fcn.10031551
add esp, 4
jmp loc.1020b23f
lea esp, [esp + 4]
cmc
xor ecx, ecx
jmp 0x10016985
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100401b0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2f44
call fcn.1003e870
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2cf0], ecx
push 0x10046bec
jmp 0x100219e5

Function at 0x10024f40
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
lahf
mov byte [ebp - 0x2d1], 0
or eax, ebp
mov eax, dword [ebp - 0x2d8]
test bl, al
cmc
cmp dword [eax + 0xc], 0
je 0x1020c1bf
mov ecx, dword [ebp - 0x2d8]
btc edx, 0x13
dec ah
mov edx, dword [ecx + 0xc]
xor edx, 0x1a1b6aef
movsx ecx, dx
mov ecx, esi
nop
mov dword [ebp - 0x2dc], edx
mov eax, dword [ebp - 0x2dc]
not ch
mov ecx, esp
movsx ecx, bp
push eax
mov ecx, dword [ebp + 8]
jmp loc.1020fadf
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x10049004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2d8], ecx
push 0x10046bec
jmp 0x1000ff9d
nop
jmp loc.10007242

Function at 0x100250e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 4], ecx
push 0x10046bec
jmp loc.102105a2