joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66cb38
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x66cd3e
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x820
mov dword [esp + 8], edx
mov edi, dword [ecx + 0x44]
mov eax, dword [ecx + 0x54]
mov ebx, eax
shl eax, 0xa
mov dword [esp + 0x14], eax
add eax, edi
add eax, 0xfffffc00
lea edx, [esp + 0x18]
push 0x400
push eax
push edx
mov esi, ecx
call fcn.00786d70
add esp, 0xc
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
mov dword [esp + 4], eax
cmp eax, 2
jb 0x66cc97
mov edx, ebx
shl edx, 0xb
mov esi, dword [esp + 4]
imul esi, ebx
shl esi, 0xa
add esi, edi
lea eax, [esp + 0x18]
cmp eax, esi
lea esi, [edi + edx - 0x400]
setb cl
lea eax, [esp + 0x418]
cmp esi, eax
setb ch
and ch, cl
shr ebx, 0x15
and ebx, 1
or bl, ch
mov dword [esp + 0x10], ebx
lea ecx, [edi + edx]
add ecx, 0xfffffc30
add edx, edi
add edx, 0xfffffc08
mov edi, 1
jmp 0x66cbf3
inc edi
mov eax, dword [esp + 0x14]
add ecx, eax
add edx, eax
cmp edi, dword [esp + 4]
je 0x66cc97
cmp byte [esp + 0x10], 0
je 0x66cc30
xor esi, esi
nop dword [eax]
mov eax, dword [edx + esi*8 - 8]
mov ebx, dword [edx + esi*8 - 4]
xor dword [esp + esi*8 + 0x18], eax
xor dword [esp + esi*8 + 0x1c], ebx
mov eax, dword [edx + esi*8]
mov ebx, dword [edx + esi*8 + 4]
xor dword [esp + esi*8 + 0x24], ebx
xor dword [esp + esi*8 + 0x20], eax
add esi, 2
cmp esi, 0x80
jne 0x66cc00
jmp 0x66cbe0
xor esi, esi
nop word cs:[eax + eax]
movups xmm0, xmmword [ecx + esi*8 - 0x30]
movups xmm1, xmmword [ecx + esi*8 - 0x20]
movups xmm2, xmmword [esp + esi*8 + 0x18]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x28]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x18], xmm2
movups xmmword [esp + esi*8 + 0x28], xmm0
movups xmm0, xmmword [ecx + esi*8 - 0x10]
movups xmm1, xmmword [ecx + esi*8]
movups xmm2, xmmword [esp + esi*8 + 0x38]
xorps xmm2, xmm0
movups xmm0, xmmword [esp + esi*8 + 0x48]
xorps xmm0, xmm1
movups xmmword [esp + esi*8 + 0x38], xmm2
movups xmmword [esp + esi*8 + 0x48], xmm0
add esi, 8
cmp esi, 0x80
jne 0x66cc40
jmp 0x66cbe0
xor eax, eax
nop dword [eax]
mov ecx, dword [esp + eax*8 + 0x18]
mov edx, dword [esp + eax*8 + 0x1c]
mov dword [esp + eax*8 + 0x420], edx
mov dword [esp + eax*8 + 0x41c], ecx
inc eax
cmp eax, 0x80
jne 0x66cca0
mov edi, dword [esp + 0xc]
mov ecx, dword [edi + 0x5c]
lea esi, [esp + 0x41c]
mov edx, dword [esp + 8]
push 0x400
push esi
push dword [edi + 4]
call fcn.0066cd40
add esp, 0xc
push 0x400
lea eax, [esp + 0x1c]
push eax
call fcn.005e8480
add esp, 8
push 0x400
push esi
call fcn.005e8480
add esp, 8
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x4c]
shl ecx, 0xa
cmp dword [edi + 0x40], 0
je 0x66cd23
push 0x310
push 0xa3b698
push ecx
push eax
call fcn.005dc920
jmp 0x66cd34
push 0x313
push 0xa3b698
push ecx
push eax
call fcn.005db780
add esp, 0x10
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6a20a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6a20e1
mov esi, dword [esp + 0x1c]
movzx ebx, byte [esi]
mov edi, ebx
and edi, 0xffffff80
test edx, edx
je 0x6a20c1
mov dword [edx], edi
mov dword [esp], edi
cmp eax, 1
jne 0x6a2118
mov eax, 1
test ecx, ecx
je 0x6a2110
movzx edx, byte [esi]
cmp byte [esp], 0
je 0x6a20dd
neg dl
mov byte [ecx], dl
jmp 0x6a2110
call fcn.005b5b10
push 0xa477e2
push 0xa0
push 0xa47792
call fcn.005b5c10
add esp, 0xc
push 0
push 0xde
push 0xd
call fcn.005b5d00
add esp, 0xc
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
movzx edx, byte [esi]
test edx, edx
je 0x6a21bf
cmp edx, 0xff
jne 0x6a21fa
cmp eax, 9
jae 0x6a213d
xor edi, edi
mov edx, 1
jmp 0x6a21b0
lea ebp, [eax - 1]
mov dword [esp + 4], ebp
and ebp, 0xfffffff8
lea edx, [ebp + 1]
pxor xmm1, xmm1
xor edi, edi
pxor xmm2, xmm2
pxor xmm0, xmm0
nop dword [eax + eax]
movd xmm3, dword [esi + edi + 1]
movd xmm4, dword [esi + edi + 5]
punpcklbw xmm3, xmm1
punpcklwd xmm3, xmm1
por xmm2, xmm3
punpcklbw xmm4, xmm1
punpcklwd xmm4, xmm1
por xmm0, xmm4
add edi, 8
cmp ebp, edi
jne 0x6a2160
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movd edi, xmm0
cmp dword [esp + 4], ebp
je 0x6a21bb
nop dword [eax + eax]
movzx ebp, byte [esi + edx]
or edi, ebp
inc edx
cmp eax, edx
jne 0x6a21b0
test edi, edi
je 0x6a21fa
mov edi, eax
movzx edx, byte [esi + 1]
and dl, 0x80
cmp byte [esp], dl
mov eax, 0xffffffff
jne 0x6a21fe
call fcn.005b5b10
push 0xa477e2
push 0xc1
push 0xa47792
call fcn.005b5c10
add esp, 0xc
push 0
push 0xdd
jmp 0x6a2104
mov edi, eax
xor eax, eax
add eax, edi
test ecx, ecx
je 0x6a2110
test eax, eax
je 0x6a210e
mov dh, bl
sar dh, 7
add esi, edi
add ecx, eax
shr ebx, 7
test al, 1
mov byte [esp], dh
jne 0x6a2230
mov edi, eax
cmp eax, 1
je 0x6a2110
jmp 0x6a224e
lea edi, [eax - 1]
mov dl, byte [esi - 1]
xor dl, dh
dec esi
movzx edx, dl
add ebx, edx
mov byte [ecx - 1], bl
dec ecx
shr ebx, 8
cmp eax, 1
je 0x6a2110
mov dword [esp + 4], eax
neg edi
xor ebp, ebp
movzx eax, byte [esp]
nop word [eax + eax]
movzx edx, byte [esi + ebp - 1]
xor dl, al
movzx edx, dl
add edx, ebx
mov byte [ecx + ebp - 1], dl
shr edx, 8
mov ah, byte [esi + ebp - 2]
xor ah, al
movzx ebx, ah
add ebx, edx
mov byte [ecx + ebp - 2], bl
shr ebx, 8
add ebp, 0xfffffffe
cmp edi, ebp
jne 0x6a2260
mov eax, dword [esp + 4]
jmp 0x6a2110
Function at 0x701230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0xb4]
mov dword [esp + 4], ecx
mov ecx, dword [ecx]
xor eax, eax
cmp ecx, 1
sbb eax, eax
mov dword [esp], eax
mov eax, 1
test ebx, ebx
je 0x7013ae
mov edx, dword [ebx]
test edx, edx
je 0x7013ae
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x3c]
mov dword [esp + 8], eax
or dword [esp], ecx
nop word [eax + eax]
xorps xmm0, xmm0
movsd qword [esp + 0x70], xmm0
xorps xmm1, xmm1
movups xmmword [esp + 0x60], xmm1
movups xmmword [esp + 0x50], xmm1
movups xmmword [esp + 0x40], xmm1
movups xmmword [esp + 0x30], xmm1
movups xmmword [esp + 0x20], xmm1
movups xmmword [esp + 0x10], xmm1
lea eax, [esp + 0x88]
movsd qword [eax + 0x10], xmm0
movups xmmword [eax], xmm1
mov eax, dword [esp + 0xc]
mov dword [esp + 0x78], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], eax
mov eax, dword [esp]
mov dword [esp + 0x84], eax
mov dword [esp + 0x94], edx
lea ecx, [esp + 0x78]
mov edx, 0xa5d320
push 0x56
call fcn.007015d0
add esp, 4
mov esi, eax
mov edi, fcn.007009b0
test eax, eax
je 0x701317
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 0x24]
test edi, edi
mov ecx, fcn.007009b0
cmove edi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x10]
push eax
push esi
push 7
call edi
add esp, 0xc
mov ebp, eax
test eax, eax
jle 0x70135f
cmp dword [esp + 0x14], 0
je 0x70135f
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0xc]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.005d0f80
add esp, 0x18
mov ebp, eax
test ebp, ebp
jle 0x701378
mov dword [esp + 0x24], ebp
lea eax, [esp + 0x10]
push eax
push esi
push 8
call edi
add esp, 0xc
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x701393
push 0x2c9
push 0xa5d1ac
push eax
call fcn.005db5b0
add esp, 0xc
test ebp, ebp
jle 0x7013ac
mov edx, dword [ebx + 0x14]
add ebx, 0x14
test edx, edx
jne 0x701280
mov eax, 1
jmp 0x7013ae
xor eax, eax
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x70a440
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov esi, dword [edx]
test esi, esi
je 0x70a51f
mov ebx, dword [esp + 0x28]
test byte [edx + 0x5c], 2
mov eax, 0xa61c2a
mov edi, esi
mov esi, 0xa61be9
cmove esi, eax
test edi, edi
jle 0x70a526
mov dword [esp + 4], esi
lea ebp, [edx + 9]
mov dword [esp], 4
mov esi, edi
nop dword [eax + eax]
movzx eax, byte [ebp - 1]
mov edi, eax
shl edi, 0x10
cmp esi, 2
mov dword [esp + 8], esi
jbe 0x70a535
movzx ebx, byte [ebp]
shl ebx, 8
movzx ecx, byte [ebp + 1]
mov dword [esp + 0xc], ecx
lea edx, [ebx + ecx]
or ebx, edi
shr eax, 2
mov esi, dword [esp + 4]
movzx eax, byte [esi + eax]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp]
mov byte [edi + ecx - 4], al
shr ebx, 0xc
and ebx, 0x3f
movzx eax, byte [esi + ebx]
mov byte [edi + ecx - 3], al
shr edx, 6
and edx, 0x3f
movzx eax, byte [esi + edx]
mov byte [edi + ecx - 2], al
mov eax, dword [esp + 0xc]
and eax, 0x3f
movzx eax, byte [esi + eax]
mov esi, dword [esp + 8]
mov byte [edi + ecx - 1], al
add ecx, 4
mov dword [esp], ecx
add ebp, 3
add esi, 0xfffffffd
jne 0x70a490
mov ebx, dword [esp + 0x28]
mov esi, dword [esp]
lea eax, [esi + ebx]
add eax, 0xfffffffc
add esi, 0xfffffffc
jmp 0x70a587
xor esi, esi
jmp 0x70a5a7
xor esi, esi
mov eax, ebx
mov byte [eax], 0
test byte [edx + 0x5c], 1
je 0x70a598
jmp 0x70a59d
jne 0x70a540
movzx eax, byte [ebp]
shl eax, 8
or edi, eax
mov eax, edi
shr eax, 0x12
mov edx, dword [esp + 4]
movzx eax, byte [edx + eax]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp]
mov byte [ebx + esi - 4], al
mov eax, edi
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [edx + eax]
mov byte [ebx + esi - 3], al
mov cl, 0x3d
cmp dword [esp + 8], 1
je 0x70a57b
shr edi, 6
and edi, 0x3f
movzx ecx, byte [edx + edi]
lea eax, [ebx + esi]
mov byte [ebx + esi - 2], cl
mov byte [ebx + esi - 1], 0x3d
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov byte [eax], 0
test byte [edx + 0x5c], 1
jne 0x70a59d
mov byte [ebx + esi], 0xa
inc esi
mov byte [ebx + esi], 0
mov dword [edx], 0
mov dword [ecx], esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x739de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
xor esi, esi
test ebx, ebx
jle 0x739e00
nop
movzx eax, byte [ecx + esi]
cmp al, byte [edx + esi]
jne 0x739e00
inc esi
cmp ebx, esi
jne 0x739df0
mov esi, ebx
mov ebp, ebx
sar ebp, 0x1f
and ebp, ebx
lea eax, [ebp - 1]
mov dword [esp], eax
lea edi, [ebx - 1]
mov eax, ebx
lea ebx, [edi + 1]
test ebx, ebx
jle 0x739e2d
cmp byte [ecx + edi], 0
jne 0x739e3d
cmp byte [edx + edi], 0xff
lea edi, [edi - 1]
lea ebx, [eax - 1]
je 0x739e10
jmp 0x739e32
mov eax, ebp
mov ebx, dword [esp]
mov ebp, 0xffffffff
cmp esi, ebx
jge 0x739e4a
jmp 0x739eb5
mov eax, ebx
mov ebx, edi
mov ebp, 0xffffffff
cmp esi, ebx
jl 0x739eb5
cmp esi, eax
jge 0x739e78
movzx ecx, byte [ecx + esi]
movzx edx, byte [edx + esi]
mov ch, dl
xor ch, cl
movzx eax, ch
lea ebx, [eax - 1]
cmp ebx, 0x1e
ja 0x739e7f
mov edi, 7
jmp dword [ebx*4 + 0xa6aaa8]
shl esi, 3
mov ebp, esi
jmp 0x739eb5
cmp eax, 0x3f
je 0x739ea5
cmp eax, 0x7f
jne 0x739eb5
mov edi, 1
jmp 0x739eaa
mov edi, 2
not dl
or cl, dl
test ch, cl
jne 0x739eb5
lea ebp, [edi + esi*8]
mov eax, ebp
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x628b85
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edx
lea esp, [esp + 0xc]
jne 0x7945d0
test esp, 0xb3350f52
and al, 0x6a
sub edx, edx
rcr ah, cl
shld ax, bp, 5
movsx ax, dl
mov eax, edx

Function at 0x62922f
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
xor al, 0x9e
mov al, ah
sub ebx, edi
adc al, dl
dec al
bswap di
rol di, 1
add ebx, esp
bts di, sp
mov edi, ebx
dec al
mov al, 0x2e
cmp dh, bh
repne scasb al, byte es:[edi]
jmp 0x628e68
pushal
lea esp, [esp + 0x30]
ja 0x793151
jmp 0x628c24

Function at 0x793045
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
bt bx, 3
sub edi, 4
stc
push dword [edi]
pop dword [esp]
bt si, si
cmc
stc
cmp ah, 0xab
cmp edi, ebx
pushfd
push 0x265a7d09
mov dword [esp], ecx
lea esp, [esp + 8]
ja 0x793151
push edi
sal al, 5
adc al, dh
clc
sub ebx, edi
rol al, 2
bswap di
sub esp, 0xfffffffc
add ebx, esp
movsx edi, cl
mov edi, ebx
or al, ah
mov al, 0x2e
pushal
repne scasb al, byte es:[edi]
push dword [esp + 4]
lea esp, [esp + 0x24]
jne 0x7a0e90
not al
bswap eax
call fcn.00a1862f
add byte [eax], al
inc edi
je 0x793102
push 0x64616572
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
add byte gs:[eax], al
add byte [edi + 0x72], dl
imul esi, dword [ebp + 0x43], 0x6f736e6f
insb byte es:[edi], dx
inc ecx
add byte [eax], al
add byte [ecx + ebp*2 + 0x73], al
jo 0x793132
je 0x793136
push 0x7373654d
popal
inc ecx
add byte [eax], al
add byte [edi + 0x65], al
je 0x793126
push eax
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte [edi + 0x6c], al
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc ecx
inc ecx
je 0x793166
insd dword es:[edi], dx
inc ecx
add byte [eax], al
add byte [ecx + 0x6d], cl
popal
dec esp
imul esi, dword [ebx + 0x74], 0x7465475f
inc edx
imul eax, dword [ebx + 0x6f], 0x6c
outsd dx, dword [esi]
jb 0x793111
arpl word [edi + 0x6d], bp
insb byte es:[edi], dx
xor esi, dword [bp + si]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x510d7506], al
cmp dl, 0x8a
repne scasb al, byte es:[edi]
pushfd
pushfd
lea esp, [esp + 0x10]
and al, 0x10
jne 0xa19c4a
sub si, 0x2d6d
sal cl, cl
insd dword es:[edi], dx
sub eax, 0xf528f1d2
sub ch, dh
mov ecx, edi
shl si, 0xa
pushal
pushal
sal si, 5
sub ecx, ebx
lea esp, [esp + 0x40]
dec ebp
outsd dx, dword [esi]
add byte gs:[ebp + 0xf042464], cl
lea esp, [esp + 4]
jb 0x79b7a4
pushal
test ch, ch
pushfd
cmp byte [edi - 1], 0
pushfd
push 0x71fb33e5
lea esp, [esp + 0x2c]
jne 0x79b81d
clc
bsr di, bx
mov edi, dword [edx + 0x24]
pushal
mov byte [esp], 0xf4
add edi, eax
jmp 0xa1c088
clc

Function at 0x793b91
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp esi, 0x663b5586
test di, 0xb41
repne scasb al, byte es:[edi]
jmp 0xa1a02d
Function at 0x794dc8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
clc
cmp ch, dl
mov dword [ebp - 4], ecx
movzx cx, cl
sal ecx, 9
movzx si, cl
or cl, cl
mov ecx, dword [ebp - 8]
dec si
or si, 0xfb6
test ax, bp
add ecx, dword [ebp - 4]
xchg si, di
xchg edi, esi
shr ecx, 1
test dh, dl
bts si, 5
call fcn.006288ea
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x628f9d
inc esi
imul ebp, dword [ebp + 0x41], 0x53000000
push 0x6957776f
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x628f4b
add byte [eax], al
dec esp
outsd dx, dword [esi]
popal
dec ebx
jns 0x628fb7
outsd dx, dword [esi]
popal
jb 0x628fbd
dec esp
popal
jns 0x628fcc
jne 0x628fd3
inc ecx
add byte [eax], al
add byte [ebx + 0x68], al
popal
jb 0x628fb6
js 0x628fdf
inc ecx
add byte [eax], al
add byte [edi + 0x65], al
je 0x628fb6
jne 0x628fe7
jb 0x628fdc
outsb dx, byte [esi]
je 0x628fca
jb 0x628feb
arpl word [ebp + 0x73], sp
jae 0x628fca
add byte fs:[eax], al
add byte [edi + 0x65], al
je 0x628fe0
imul ebp, dword [esi + 0x64], 0x776f
add byte [ecx + 0x73], cl
inc esp
bound esi, qword gs:[ebp + 0x67]
jb 0x628fec
jb 0x629003
jae 0x629005
jae 0x629005
outsb dx, byte [esi]
je 0x628fa3
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x629010
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 0xf], si
retf
mov esi, 0xf78766f1
int1
movzx edi, dl
mov dh, 0xf1
cmc
add byte ds:[esi + 0x60], bl
and al, 0x10
in al, dx
add byte [eax], al
add byte [ebx + 0x68], al
popal
jb 0x629044
jo 0x629061
jb 0x629036
push edi
imul ebp, dword [esi + 0x64], 0x654d776f
jae 0x629080
inc ecx
push ebp
pushal
push dword [esp]
lea esp, [esp + 0x3c]
jbe 0xa19c4a
stc
sub ecx, 1
jmp 0x628ef9

Function at 0x79ba7f
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
dec dl
cmc
stc
pushal
clc
neg dl
push 0x6d1d3781
not dl
test dl, al
call fcn.00a1a70f
pushf
mov dl, 0xe2
mov dl, byte [esi]
jmp 0x79b04f
jmp 0x628985
mov byte [esp], 0x7f
lea esp, [esp + 0x10]
jne 0xa1d6ba
jmp 0x7931b0

Function at 0x79c459
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], bh
lea esp, [esp + 0x24]
jne 0x7a0e90
pushfd
pushfd
mov byte [edi - 1], 0
pop eax
lea esp, [esp + 4]
jbe 0x6289fc
push ebx
bswap ax
not ax
jmp 0xa1d448

Function at 0x79fde1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x24]
call fcn.0079fe79
pushal
push dword [esp + 4]
pushfd
adc ecx, ecx
jmp 0x628d5b
jmp 0x793976
jmp 0x79c6d4

Function at 0xa18a4d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi + 0x7c]
clc
add ecx, edx
pushfd
lea esp, [esp + 0x14]
je 0xa19c4a
setbe dl
mov esi, dword [eax + 0x3c]
clc
add esi, eax
movsx dx, cl
btc dx, di
mov edx, dword [esi + 0x78]
test ch, dh
pushfd
test edx, edx
pushal
mov byte [esp], al
mov byte [esp], 0xf
lea esp, [esp + 0x24]
je 0xa19c4a
inc cl
not cx
bsr ecx, ebx
bts cx, 0xd
add edx, eax
jmp 0x79b9be

Function at 0xa19fa9
Capabilities:
Check http status code
Resolve function by parsing pe exports

Disassembly:
pushal
cmp dl, cl
push ebp
xor ecx, ecx
lea esp, [esp + 0x24]
Function at 0xa1a6c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
clc
cmp ecx, dword [ebp - 8]
call fcn.00794dc8

Function at 0xa1a6cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor al, al
clc
cmp dx, si
stc
repne scasb al, byte es:[edi]
mov byte [esp], cl
push dword [esp]
lea esp, [esp + 8]
jne 0xa19c4a
sub cx, 0x3c8a
btr cx, 1
mov ecx, edi
bt di, 0xf
pushfd
test al, al
stc
sub ecx, ebx
pushfd
pushal
lea esp, [esp + 0x28]
jmp 0x79314a
cmp eax, dword [ebp - 0x10]
pushfd
lea esp, [esp + 8]
jae 0x6291ab
sal bx, cl
mov ebx, eax
push edi
xchg ecx, edi
and di, ax
mov edi, eax
rcl cx, 6
shl cl, 3
movzx cx, dl
movzx ecx, dl
mov ecx, 0x104
jmp 0x62415c

Function at 0x1001e34
Capabilities:
Parse pe header

Disassembly:
push 0x60
push 0x10011e0
call fcn.01002c88
mov edi, 0x94
mov eax, edi
call 0x1002df0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x10010a8]
mov ecx, dword [esi + 0x10]
mov dword [0x10062b8], ecx
mov eax, dword [esi + 4]
mov dword [0x10062c4], eax
mov edx, dword [esi + 8]
mov dword [0x10062c8], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x10062bc], esi
cmp ecx, 2
je 0x1001e94
or esi, 0x8000
mov dword [0x10062bc], esi
shl eax, 8
add eax, edx
mov dword [0x10062c0], eax
cmp word [0x1000000], 0x5a4d
jne 0x1001ed0
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1001ed0
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1001ee9
cmp ecx, 0x20b
je 0x1001ed6
and dword [ebp - 0x1c], 0
jmp 0x1001efd
cmp dword [eax + 0x84], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1001ef7
cmp dword [eax + 0x74], 0xe
jbe 0x1001ed0
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
push 0
call fcn.01002c2a
pop ecx
test eax, eax
jne 0x1001f2a
cmp dword [0x10062a8], 1
jne 0x1001f17
call fcn.01002406
push 0x1c
call fcn.01002219
push 0xff
call fcn.01002078
pop ecx
pop ecx
and dword [ebp - 4], 0
call fcn.01002a5a
test eax, eax
jge 0x1001f3f
push 0x1b
call fcn.01001e05
pop ecx
call dword [0x10010ac]
mov dword [0x1006854], eax
call fcn.0100292d
mov dword [0x10062a0], eax
call fcn.01002884
test eax, eax
jge 0x1001f65
push 8
call fcn.01001e05
pop ecx
call fcn.0100262a
test eax, eax
jge 0x1001f76
push 9
call fcn.01001e05
pop ecx
call fcn.010020d2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1001f89
push eax
call fcn.01001e05
pop ecx
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [0x10010b0]
call fcn.010025bc
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x1001fab
movzx eax, word [ebp - 0x40]
jmp 0x1001fae
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push 0
push 0x1000000
call fcn.01001c3d
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], 0
jne 0x1001fcf
push esi
call fcn.010021b2
call fcn.010021ea
jmp 0x1002001
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x7c]
call 0x1002cc3
ret
Function at 0x4015f4
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0xb7e15163
mov dword [ebp - 0x10], 1
jmp 0x40165b
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp + 8]
add eax, edx
mov edx, dword [ebp - 0x10]
add edx, 0x3fffffff
lea ecx, [edx*4]
mov edx, dword [ebp + 8]
add edx, ecx
mov edx, dword [edx]
sub edx, 0x61c88647
mov dword [eax], edx
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x19
jbe 0x401629
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x4e
jmp 0x40172d
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp + 8]
lea ebx, [edx + eax]
mov eax, dword [ebp - 0x10]
lea edx, [eax*4]
mov eax, dword [ebp + 8]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 8]
add edx, eax
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [esp + 4], 3
mov dword [esp], eax
call fcn.00401482
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax*4 + 0x405040]
mov eax, dword [ebp - 8]
add ecx, eax
mov eax, dword [ebp - 0xc]
add eax, ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00401482
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax*4 + 0x405040], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x405040]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 1]
mov edx, 0x4ec4ec4f
mov eax, ecx
mul edx
mov eax, edx
shr eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add eax, 1
and eax, 3
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
lea edx, [eax - 1]
mov dword [ebp - 0x18], edx
test eax, eax
jg 0x40167a
nop
add esp, 0x28
pop ebx
pop ebp
ret
Function at 0x4024f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40253b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x402534
test esi, esi
je 0x402534
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402510
mov dword [esp], 0x408044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402720
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x402770
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x402848
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4027ae
cmp eax, 4
jne 0x4027d0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4027be
cmp edx, 4
je 0x4027be
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402720