joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439df0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b161
mov eax, dword fs:[0]
push eax
mov eax, 0x1010
call fcn.0044fef0
mov eax, dword [0x486d80]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x1024]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00431600
mov edi, eax
test edi, edi
je 0x439fef
mov eax, dword [0x485064]
mov dword [esp + 0x14], eax
mov ecx, esi
mov dword [esp + 0x102c], 0
call fcn.004315b0
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
je 0x439fc6
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00434d10
push 0x800
lea edx, [esp + 0x24]
push 0
push edx
call fcn.0044efc0
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
push str.modules360Inst.exe
push eax
lea ecx, [esp + 0x28]
push ecx
call esi
push 0x800
lea edx, [esp + 0x824]
push 0
push edx
call fcn.0044efc0
mov eax, dword [esp + 0x20]
add esp, 0xc
push str.360ver.dll
push eax
lea ecx, [esp + 0x828]
push ecx
call esi
push str._URL:http:__pinst.360.cn_360safe_uninst_inst.cab
lea ecx, [esp + 0x20]
call fcn.0041a210
push str.http:__down.360safe.com_inst.exe
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1030], 1
call fcn.0041a210
lea edx, [esp + 0x820]
push edx
mov byte [esp + 0x1030], 2
call fcn.00404850
test eax, eax
je 0x439f3a
push str.IsBetaVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x439f3a
call eax
test eax, eax
je 0x439f3a
push str._URL:http:__pinst.360.cn_360safebeta_uninst_instbeta.cab
lea ecx, [esp + 0x20]
call fcn.004182b0
push str.http:__down.360safe.com_instbeta.exe
lea ecx, [esp + 0x1c]
call fcn.004182b0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test eax, eax
jne 0x439f74
push esi
call fcn.004385e0
add esp, 4
test eax, eax
je 0x439f8a
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x439f8a
mov ecx, dword [edi]
mov eax, dword [ecx + 0x20]
push 0
push 0
push 1
push 5
push ebx
lea edx, [esp + 0x34]
push edx
push edi
call eax
lea ecx, [esi - 0xc]
cmp ecx, dword [0x485060]
je 0x439fa8
add esi, 0xfffffff4
push esi
call ebp
test eax, eax
jg 0x439fa8
push esi
call fcn.0044fbd4
add esp, 4
lea edx, [ebx - 0xc]
cmp edx, dword [0x485060]
je 0x439fc6
lea esi, [ebx - 0xc]
push esi
call ebp
test eax, eax
jg 0x439fc6
push esi
call fcn.0044fbd4
add esp, 4
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x485060]
je 0x439fef
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x439fef
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.0044fbd4
add esp, 4
mov ecx, dword [esp + 0x1024]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.0044efac
add esp, 0x101c
ret
Function at 0x43b690
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
mov esi, ecx
call fcn.004315b0
mov edi, eax
xor ebp, ebp
cmp edi, ebp
jne 0x43b6ae
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push ebx
lea ebx, [esi + 0x50]
push ebx
mov ecx, edi
call fcn.00434d10
test eax, eax
je 0x43b6d4
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push ebp
call edx
mov ecx, esi
call fcn.00431640
cmp eax, ebp
jne 0x43b6de
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
mov edx, dword [ebx]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 4]
call eax
mov ecx, edi
call fcn.00434290
cmp eax, ebp
je 0x43b6ff
mov edx, dword [ebx]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, 0x43b510
mov dword [esp + 0x10], vtable.CSimpleThread.0
mov dword [esp + 0x28], 0x43b510
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
test ecx, ecx
je 0x43b74e
lea edx, [esp + 0x18]
push edx
push ebp
push esi
push 0x43b510
push ebp
push ebp
call fcn.0045147e
add esp, 0x18
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
call fcn.004034d0
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x20
ret

Function at 0x43bcd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46b333
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x486d80]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00431860
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
or eax, 0xffffffff
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0xc], 0x3e8
mov dword [esi], vtable.CUninstallProgressDialog.1.0
mov dword [esi + 0x10], vtable.CUninstallProgressDialog.0
mov eax, dword [0x485064]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x54]
mov byte [esp + 0x18], 1
call fcn.00437d30
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x43d4d0
Capabilities:
Get file size

Disassembly:
push ecx
mov ecx, dword [ecx]
push esi
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43d4f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43d4f8
xor al, al
pop esi
pop ecx
ret 4
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
call fcn.00452c00
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
pop ecx
ret 4

Function at 0x43d5e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [ecx]
push 0
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push edx
push eax
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp]
test eax, eax
mov dword [edx], ecx
setne al
pop ecx
ret 0xc
mov eax, dword [esp + 8]
mov edx, dword [0x48653c]
cmp eax, edx
jbe 0x43d5f0
mov eax, edx
mov dword [esp + 8], eax
jmp 0x43d5a0

Function at 0x43d650
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [0x48653c]
cmp eax, edx
jbe 0x43d660
mov eax, edx
mov ecx, dword [ecx]
push 0
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
test eax, eax
mov dword [edx], ecx
setne al
ret 0xc

Function at 0x43d820
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x43d860
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push esi
call fcn.0043d820
add esp, 8
test al, al
jne 0x43d876
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
ret
Function at 0x43b630
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
push edx
pop eax
call fcn.0043b668
dec eax
sub eax, edx
xor dword [ebx], ecx
sub eax, 0x984325ae
add edx, 0xfce16e59
inc ebx
or eax, eax
cmp ebx, edi
jne fcn.0043b630
dec eax
mov eax, 0x6ac2596b
ret
Function at 0x4013b0
Capabilities:
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call fcn.00403012
push eax
push 0x4196fc
push str.CONIN_
call fcn.00402f52
add esp, 0xc
call fcn.00403012
add eax, 0x20
push eax
push 0x419708
push str.CONOUT_
call fcn.00402f52
add esp, 0xc
call fcn.00403012
add eax, 0x40
push eax
push 0x419708
push str.CONOUT_
call fcn.00402f52
add esp, 0xc
push str.HVNC___Tinynuke_Clone__Melted_HF_
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0x41975c
call fcn.00402dd0
add esp, 4
call fcn.00402540
push 0x419778
call fcn.00402dd0
add esp, 4
push 0x41beef
call fcn.00402dd0
add esp, 4
call fcn.00402540
test eax, eax
je 0x40145d
push str.pause
call fcn.004034a1
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x419794
call fcn.00402dd0
add esp, 8
push 0xffffffffffffffff
call fcn.0040348d
int3

Function at 0x402540
Capabilities:
Compress data via winapi
Create thread
Get local ipv4 addresses
Get socket information
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x41b280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4198f4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.RtlDecompressBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41d388
mov dword [0x41d384], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x4000
push 0
push 0x41d3a0
call fcn.00409b90
add esp, 0xc
call fcn.00401030
lea eax, [ebp - 0x1b8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4025fd
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x4025fd
mov eax, 2
mov dword [ebp - 0x10], 0
push 0x2767
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4025fd
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x402610
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402672
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x1bc], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
push 0x41991c
call fcn.00402dd0
mov edi, dword [sym.imp.WS2_32.dll_accept]
add esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call edi
push 0
push 0
push eax
push 0x401f10
push 0
push 0
call ebx
jmp 0x402652
Function at 0x40b35b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406327
mov dword [ebp - 0x14], eax
cmp dword [0x41d330], esi
jne 0x40b44e
push 0x800
push esi
push 0x415efc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40b3db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b52e
push esi
push esi
push 0x415efc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40b52e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b52e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41d330], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41d334], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41d338], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41d340], eax
test eax, eax
je 0x40b44b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41d33c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b473
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b466
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40b488
push 4
pop eax
jmp 0x40b530
cmp dword [ebp - 0x14], esi
je 0x40b488
push dword [0x41d330]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b46d
mov eax, dword [0x41d33c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40b4e6
cmp dword [0x41d340], edi
je 0x40b4e6
push eax
call ebx
push dword [0x41d340]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b4e6
test eax, eax
je 0x40b4e6
call ecx
test eax, eax
je 0x40b4db
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b4db
test byte [ebp - 8], 1
jne 0x40b4e6
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40b516
mov eax, dword [0x41d334]
cmp eax, edi
je 0x40b513
push eax
call ebx
test eax, eax
je 0x40b513
call eax
mov esi, eax
test esi, esi
je 0x40b513
mov eax, dword [0x41d338]
cmp eax, edi
je 0x40b513
push eax
call ebx
test eax, eax
je 0x40b513
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41d330]
call ebx
test eax, eax
je 0x40b52e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40b530
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402672
mov esp, ebp
pop ebp
ret
Function at 0x76bd78
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
pushfd
call fcn.0076bbf8
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x15db602e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2e67e45
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xea86ca6
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5873332c
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x49c000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x49c00c
pop ebx
sub ebx, 0x8c60c
mov eax, 0
push ebx
not dword [ebx + 0x134]
xor dword [ebx + 0x2d0], 0x762f3dae
not dword [ebx + 0x128]
xor dword [ebx + 0x1d8], 0x7da01a97
not dword [ebx + 0x364]
not dword [ebx + 0x230]
sub dword [ebx + 0x234], 0x63034218
add dword [ebx + 0x2c4], 0x580f150e
sub dword [ebx + 0xe0], 0x104343db
not dword [ebx + 0x110]
not dword [ebx + 0x320]
sub dword [ebx + 0x200], 0x41c490d
not dword [ebx + 0x3a0]
not dword [ebx + 0x6c]
xor dword [ebx + 0x30c], 0x2ef67af8
add dword [ebx + 0x1b8], 0xd2b594e
sub dword [ebx + 0x148], 0x5fc92235
sub dword [ebx + 0x304], 0x40b460eb
xor dword [ebx + 0x394], 0x23980c8b
xor dword [ebx + 0x2dc], 0x615b185b
sub dword [ebx + 0x1c0], 0x8af0c35
xor dword [ebx + 0x30], 0x69b634f6
sub dword [ebx + 0x138], 0x5ff8310c
xor dword [ebx + 0xb4], 0x48fa7aa0
not dword [ebx + 0x70]
add dword [ebx + 0x34], 0x76466c88
not dword [ebx + 0x2a0]
add dword [ebx + 0x3cc], 0x3bae144f
sub dword [ebx + 0x108], 0x4b370429
xor dword [ebx + 0x168], 0x2223f96
xor dword [ebx + 0x20], 0x7f7c051e
add dword [ebx + 0x1dc], 0x315931f1
sub dword [ebx + 0x354], 0x20a67af2
not dword [ebx + 0x120]
add dword [ebx + 0x278], 0x24f570a5
sub dword [ebx + 0x22c], 0x3aa30f6a
not dword [ebx + 0x294]
not dword [ebx + 0x3f0]
not dword [ebx + 0x154]
invalid
Function at 0x498a77
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x498a90
mov eax, dword [ebp - 4]
jmp 0x498b6a
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x498b45
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x692d38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x692d38]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x692d38]
dec ebp
jne 0x498aaf
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x498b61
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x692d38]
dec ecx
jne 0x498b4f
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d4210
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x4d4242
push 0x61e968
push esi
call fcn.004ade30
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x4d4259
push ecx
push 0x61e984
push esi
call fcn.004adef0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x4d4272
push ebx
push esi
call fcn.004d3ed0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x4d4287
push esi
call fcn.004d2f00
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x4d429c
push esi
call fcn.004d3eb0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x4d42ac
push esi
call fcn.004d40f0
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4e0e30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x6ba08c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4e0e5d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4e0ea4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4e0eaa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4e0f0b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4e0ed0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4e0f37
mov eax, dword [esi + 4]
push 1
push 0x620f48
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x620f49
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4e0f10
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x526970
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov eax, dword [0x6ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 0x538], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x53c], edi
test esi, esi
jne 0x5269ad
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a6f7
mov esp, ebp
pop ebp
ret
push ebx
push 0x693620
push edi
call fcn.00552d50
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x5269da
push 0x62
push 0x62f6c0
push 0x79
push 0x6f
push 0x24
call fcn.005288a0
push edi
jmp 0x526b1f
lea eax, [ebp - 0x534]
push eax
push ebx
call fcn.005f21ab
add esp, 4
push eax
call fcn.005fbc05
add esp, 8
test eax, eax
jns 0x526a33
push 0x69
push 0x62f6c0
push 0x71
push 0x6f
push 0x24
call fcn.005288a0
push edi
push 0x62f6e0
push 2
call fcn.00528180
push ebx
call fcn.005e4ecd
add esp, 0x24
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a6f7
mov esp, ebp
pop ebp
ret
test esi, esi
jns 0x526a4d
test dword [ebp - 0x52e], 0x8000
mov esi, 0x100
cmovne esi, dword [ebp - 0x520]
push 0
push ebx
call fcn.005fc44a
add esp, 8
test esi, esi
jle 0x526a6c
cmp esi, 0x500
mov eax, 0x400
cmovle eax, esi
jmp 0x526a71
mov eax, 0x500
push ebx
push eax
lea eax, [ebp - 0x504]
push 1
push eax
call fcn.005edda7
push ebx
mov edi, eax
call fcn.005e4e2c
add esp, 0x14
test eax, eax
je 0x526aa9
call fcn.005f071c
cmp dword [eax], 4
jne 0x526aa9
push ebx
call fcn.005fc39a
add esp, 4
test edi, edi
je 0x526a58
jmp 0x526aad
test edi, edi
je 0x526ae1
movd xmm0, edi
lea eax, [ebp - 0x504]
cvtdq2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push edi
push eax
call fcn.00525c80
add dword [ebp - 0x538], edi
add esp, 0x10
test esi, esi
jle 0x526a6c
sub esi, edi
test esi, esi
jg 0x526a5c
lea eax, [ebp - 0x504]
push 0x500
push eax
call fcn.00537800
push ebx
call fcn.005e4ecd
add esp, 0xc
call fcn.00525e30
test eax, eax
jne 0x526b42
push 0xa6
push 0x62f6c0
push 0x76
push 0x6f
push 0x24
call fcn.005288a0
push dword [ebp - 0x53c]
push 0x62f6e0
push 2
call fcn.00528180
add esp, 0x20
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049a6f7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x538]
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.0049a6f7
mov esp, ebp
pop ebp
ret