joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4212ad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x4214e9
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.004206cd
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x421479
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x42146f
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0040ffed
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x42149a
inc eax
cmp byte [esi + eax], 0
jne 0x421493
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0042064d
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x4214b7
inc edi
cmp byte [edi + ebx], 0
jne 0x4214b0
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x4214c7
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x4214bf
test esi, esi
je 0x4214dc
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0042069d
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4305ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x18
mov eax, edx
push ebx
mov ebx, dword [ebp + 0xc]
shr eax, 4
push esi
mov ecx, ebx
test eax, eax
je 0x43061f
add ebx, 8
mov dword [ebp - 4], eax
nop
mov eax, dword [ecx]
xor dword [edi], eax
mov edx, dword [ebx - 4]
xor dword [edi + 4], edx
mov edx, dword [ebx]
xor dword [edi + 8], edx
mov edx, dword [ebx + 4]
xor dword [edi + 0xc], edx
add ecx, 0x10
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
add ebx, 0x10
call fcn.0043051d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
add esp, 4
dec dword [ebp - 4]
mov dword [edi + 8], edx
mov dword [edi + 0xc], eax
jne 0x4305cd
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x430692
sub ebx, ecx
add ebx, edx
test ebx, ebx
jle 0x43063c
push ebx
push ecx
lea ecx, [ebp - 0x18]
push ecx
call 0x44949d
add esp, 0xc
mov eax, 0x10
sub eax, ebx
lea ecx, [ebp + ebx - 0x18]
je 0x430655
push eax
push 0
push ecx
call 0x4494cd
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor dword [edi], edx
mov ecx, dword [ebp - 0x14]
xor dword [edi + 4], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor dword [edi + 8], edx
xor dword [edi + 0xc], ecx
mov ecx, dword [ebp + 8]
push edi
lea esi, [ebp - 0x18]
call fcn.0043051d
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
add esp, 4
mov dword [edi + 0xc], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43069d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0x18]
push edi
mov edi, ecx
test eax, eax
je 0x43079f
push esi
mov esi, dword [edx]
mov dword [ebp - 0x14], esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edx + 8]
mov edx, dword [edx + 0xc]
shr eax, 4
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edx
test eax, eax
je 0x430766
mov edx, ebx
sub ecx, edx
lea esi, [edx + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp + 0x18], eax
jmp 0x4306ed
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.004329ad
mov eax, dword [edi]
xor dword [ebx], eax
mov ecx, dword [edi + 4]
xor dword [esi - 8], ecx
mov edx, dword [edi + 8]
xor dword [esi - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + esi]
xor dword [esi], ecx
movzx eax, byte [ebp - 8]
movzx edx, byte [ebp - 7]
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, edx
movzx edx, byte [ebp - 5]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
inc eax
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov edx, eax
mov ecx, eax
shr edx, 0x10
shr ecx, 8
add esp, 0x10
add edi, 0x10
add ebx, 0x10
add esi, 0x10
dec dword [ebp + 0x18]
mov byte [ebp - 7], dl
mov byte [ebp - 6], cl
mov byte [ebp - 5], al
jne 0x4306ed
mov ecx, dword [ebp + 0x10]
sub ecx, edi
add ecx, dword [ebp + 0x14]
mov esi, ecx
je 0x43079e
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
call fcn.004329ad
add esp, 0x10
xor eax, eax
test esi, esi
je 0x43079e
sub ebx, edi
mov cl, byte [ebp + eax - 0x24]
xor cl, byte [edi]
inc eax
mov byte [ebx + edi], cl
inc edi
cmp eax, esi
jb 0x43078f
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432a4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor al, al
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x14], al
mov byte [ebp - 4], al
mov byte [ebp - 0xc], al
push 2
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 8], 0x3031
mov dword [ebp - 0x28], 0x32313032
mov word [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x36313032
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0x20], 0x38303032
mov word [ebp - 0x1c], 0
call 0x449b8d
add esp, 0xc
test eax, eax
je 0x432abb
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x64], 1
push 1
lea edx, [ebp - 0x10]
push edx
push esi
call 0x449b8d
add esp, 0xc
test eax, eax
jne 0x432b3c
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call 0x449b8d
add esp, 0xc
test eax, eax
jne 0x432b3c
push 1
lea ecx, [ebp - 0x18]
push ecx
push esi
call 0x449b8d
add esp, 0xc
test eax, eax
jne 0x432b32
push 2
lea edx, [ebp - 8]
push edx
push esi
call 0x449b8d
add esp, 0xc
test eax, eax
jne 0x432b32
push 4
lea eax, [ebp - 0x28]
push eax
push esi
call 0x449b8d
add esp, 0xc
test eax, eax
jne 0x432b32
push 4
lea ecx, [ebp - 0x30]
push ecx
push esi
call 0x449b8d
add esp, 0xc
test eax, eax
jne 0x432b32
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x433a9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x27e]
push ecx
mov word [ebp - 0x280], ax
call 0x4494cd
push 0x40
lea ecx, [ebp - 0x7c]
push 0
push ecx
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call 0x4494cd
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x10]
push ecx
xor edx, edx
push esi
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], dx
call fcn.0043910d
push 0
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x280]
push eax
call 0x4498ad
mov ecx, dword [esi + 0xba0]
push 0xad0121ab
push 0
push 0
push ecx
add esi, 0x1c
push esi
call fcn.004431fd
add esp, 0x44
pop esi
test eax, eax
je 0x433ba2
push 0
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x280]
push edx
push 0
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43523d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
push ebx
xor ebx, ebx
push esi
push 0x1fe
lea eax, [ebp - 0x29e]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x5c], 0x18
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x2a0], dx
call 0x4494cd
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0x401
lea eax, [ebp + 0xc]
push eax
push esi
call 0x44731d
add esp, 0x20
test eax, eax
js 0x4353a4
mov eax, dword [esi + 0xba0]
push edi
push 0xcc145ef7
push ebx
push ebx
push eax
lea edi, [esi + 0x1c]
push edi
mov dword [ebp - 0x2c], 0x65005c
mov dword [ebp - 0x28], 0x700078
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x650072
mov dword [ebp - 0x1c], 0x2e0072
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
call fcn.004431fd
add esp, 0x14
cmp eax, ebx
je 0x435303
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
call eax
push 0x40
lea edx, [ebp - 0x9c]
push ebx
push edx
call 0x4494cd
lea ecx, [ebp - 0x2a0]
push ecx
xor eax, eax
lea edx, [ebp - 0x10]
push edx
push esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0xa0], 0x44
mov dword [ebp - 0x10], 0x690077
mov dword [ebp - 0xc], 0x64006e
mov dword [ebp - 8], 0x720069
mov word [ebp - 4], ax
call fcn.0043910d
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2a0]
push ecx
call 0x4498ad
mov edx, dword [esi + 0xba0]
push 0xad0121ab
push ebx
push ebx
push edx
push edi
call fcn.004431fd
add esp, 0x38
pop edi
cmp eax, ebx
je 0x4353a4
push ebx
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xa0]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2a0]
push ecx
push ebx
call eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435e8d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x3c
push eax
call 0x44973d
add esp, 4
cmp eax, 0x1000
ja 0x436002
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x7d8]
test ecx, ecx
je 0x436001
push ebx
push edi
lea edi, [eax + eax]
lea ebx, [ecx + 0x1ff56c]
mov ecx, dword [ebp + 0xc]
push edi
push ebx
push ecx
call 0x44975d
add esp, 0xc
test eax, eax
jne 0x435fff
mov edx, dword [ebp + 0xc]
push edi
push edx
push ebx
call 0x44944d
add esp, 0xc
xor ecx, ecx
xor eax, eax
push 0x104
mov word [ebp - 4], cx
mov ecx, dword [esi + 0xcc0]
lea ebx, [esi + 0x4464]
push ebx
mov dword [ebp - 0xc], 0xa000d
mov dword [ebp - 8], 0xa000d
mov dword [ebp - 0x3c], 0x6c0043
mov dword [ebp - 0x38], 0x700069
mov dword [ebp - 0x34], 0x6f0062
mov dword [ebp - 0x30], 0x720061
mov dword [ebp - 0x2c], 0x64
mov word [ebp - 0x28], ax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov word [ebp - 0x1e], ax
call ecx
mov edx, dword [esi + 0xcbc]
push eax
call edx
cmp eax, 0x40
jbe 0x435f5f
xor eax, eax
mov word [esi + 0x44e4], ax
jmp 0x435f8e
test eax, eax
jne 0x435f8e
push 0x10
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 0x1c], 0x6e0055
mov dword [ebp - 0x18], 0x6e006b
mov dword [ebp - 0x14], 0x77006f
mov dword [ebp - 0x10], 0x6e
call 0x44944d
add esp, 0xc
push 0x14
lea ecx, [ebp - 0x3c]
push ecx
lea edi, [esi + 0x4ce4]
push edi
call 0x44944d
push 0
lea edx, [ebp - 0xc]
push edx
push edi
call 0x4498ad
push 0
push ebx
push edi
call 0x4498ad
push 0
lea eax, [ebp - 0xc]
push eax
push edi
call 0x4498ad
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push edi
call 0x4498ad
push edi
call 0x44973d
add esp, 0x40
add eax, eax
push edi
mov dword [esi + 0xa08], eax
call 0x44973d
mov edx, dword [esi + 0xa04]
add eax, eax
push eax
push edi
push edx
call 0x44944d
push 0x13
push esi
call fcn.0043c1bd
add esp, 0x18
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4379ad
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
rdtsc
xor ecx, ecx
add ecx, eax
rdtsc
sub eax, ecx
mov dword [ebp - 4], eax
mov eax, 0x50
mov esp, ebp
pop ebp
ret
Function at 0x437c7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push esi
xor bl, bl
call fcn.004361cd
add esp, 8
test eax, eax
jne 0x437ca4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x344]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.004363dd
add esp, 8
push edi
jmp 0x437cbd
lea eax, [ebp - 0x118]
push 0x104
push eax
call 0x44947d
lea ecx, [ebp - 0x320]
push ecx
lea edx, [ebp - 0x118]
push edx
call 0x449aed
add esp, 0x10
mov edi, 0x4f
lea esp, [esp]
lea eax, [ebp - 0x118]
push eax
push edi
push esi
call fcn.0044313d
add esp, 8
push eax
call fcn.0044319d
add esp, 8
test eax, eax
jne 0x437d13
inc edi
cmp edi, 0x62
jbe 0x437ced
jmp 0x437d1e
mov ecx, dword [esi + 0x14]
xor dword [esi + 0x474], ecx
mov bl, 1
lea edx, [ebp - 0x344]
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.0043640d
add esp, 8
test eax, eax
je 0x437d39
test bl, bl
je 0x437cbd
lea ecx, [ebp - 0x14]
push ecx
push esi
call fcn.0043648d
add esp, 8
pop edi
test bl, bl
jne 0x437d5f
rdtsc
xor ecx, ecx
add ecx, eax
rdtsc
sub eax, ecx
mov dword [ebp - 4], eax
add dword [esi + 0x55c], 0xffffffba
add byte [esi + 0x31], bl
mov al, byte [esi + 0x31]
inc al
add byte [esi + 0x32], al
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x437f3d
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
mov edi, 0x100
nop
mov eax, ecx
shl eax, 0x18
mov esi, 8
lea ebx, [ebx]
test eax, eax
jns 0x437f6a
add eax, eax
xor eax, 0x4c11db7
jmp 0x437f6c
add eax, eax
dec esi
jne 0x437f5d
mov dword [edx], eax
inc ecx
add edx, 4
dec edi
jne 0x437f4d
pop edi
pop esi
pop ebp
ret

Function at 0x437f7d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push 0x3fc
lea eax, [ebp - 0x3fc]
push 0
push eax
mov dword [ebp - 0x400], 0
call 0x4494cd
lea ecx, [ebp - 0x400]
push ecx
call fcn.00437f3d
mov esi, dword [ebp + 0xc]
add esp, 0x10
or eax, 0xffffffff
test esi, esi
je 0x437fe0
mov edx, dword [ebp + 8]
push edi
movzx edi, byte [edx]
mov ecx, eax
shr ecx, 0x18
xor ecx, edi
and ecx, 0xff
shl eax, 8
xor eax, dword [ebp + ecx*4 - 0x400]
inc edx
dec esi
jne 0x437fc1
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x437fed
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
pop ebp
ret
Function at 0x438c0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x438c1f
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x438c82
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x438c5d
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x438d2e
mov edi, dword [ebp + 8]
push ebx
jmp 0x438cc3
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x438cbd
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407290
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555140
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x2c]
add eax, 0x34
push eax
lea ecx, [ebp - 0x28]
call fcn.00407e30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404120
movzx ecx, al
test ecx, ecx
jne 0x4072f4
push 0x589fec
lea ecx, [ebp - 0x28]
call fcn.00408030
mov edx, dword [ebp - 0x2c]
add edx, 0x10
push edx
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x28]
call fcn.00408010
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.004041c0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x58], 2
jne 0x407343
mov dword [ebp - 0x30], 0x800000
jmp 0x40734a
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x30]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00408050
push eax
push 0x589ff0
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x24], 0
jne 0x40738f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004041c0
jmp 0x4073ef
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
call edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x4073d1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004041c0
jmp 0x4073ef
mov dword [ebp - 0x34], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004041c0
xor edx, edx
jne 0x4072c2
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret
Function at 0x409710
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
push str.Content_type:_application_json_r_n
lea ecx, [ebp - 0x1c]
call fcn.00404180
mov dword [ebp - 0x20], 0
jmp 0x409742
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jae 0x409775
push 0x20000000
imul ecx, dword [ebp - 0x20], 0x18
lea ecx, [ebp + ecx - 0x1c]
call fcn.00404100
push eax
imul edx, dword [ebp - 0x20], 0x18
lea ecx, [ebp + edx - 0x1c]
call fcn.00408050
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
jmp 0x409739
mov dword [ebp - 0x24], 1
push fcn.004041c0
push 1
push 0x18
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00518dc2
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret 4
Function at 0x421e60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push str.SINGLE_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421e94
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x421e94
mov al, 1
jmp 0x421e96
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x422060
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556f51
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21c], 0
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4220a9
mov ecx, dword [ebp + 0xc]
or ecx, 0x8000
mov dword [ebp + 0xc], ecx
xor edx, edx
mov word [ebp - 0x218], dx
push 0x206
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00516d90
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x4221f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x234], eax
push 0x122
lea eax, [ebp - 0x25c]
push eax
call fcn.0041fe70
add esp, 8
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 4], 0
push 0x58dcd8
lea ecx, [ebp - 0x274]
call fcn.00403ff0
mov dword [ebp - 0x230], eax
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x224], edx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x244]
push eax
call fcn.004644a0
add esp, 4
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x228], ecx
mov byte [ebp - 4], 2
lea edx, [ebp - 0x234]
push edx
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
push str.file:_0__line:_1__LastError_2_n
mov ecx, dword [ebp - 0x228]
call fcn.00405e20
mov ecx, eax
call fcn.00430500
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x244]
call fcn.00410c90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x274]
call fcn.004040e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.004040e0
mov ecx, dword [ebp + 8]
call fcn.00407e90
mov edx, dword [ebp - 0x21c]
or edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp + 8]
jmp 0x422211
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404180
mov ecx, dword [ebp - 0x21c]
or ecx, 1
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret