joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f798
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45f837
cmp dword [ebx + 0x94], 0
jne 0x45f831
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45f720
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45f831
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f7f7
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45f831
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004185fc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45f806
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45fa50
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x475cd0]
cmp dword [eax + 0x30], 0
je 0x45fbad
test bl, bl
jne 0x45fafe
cmp dword [esi + 0x9c], 0
jne 0x45faf3
mov eax, esi
call fcn.0046225c
push eax
push 0x45f97c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45fac4
mov eax, dword [0x475cd0]
call fcn.0046293c
test al, al
je 0x45fac4
mov eax, dword [0x475cf4]
call fcn.00406088
mov edi, eax
cmp edi, 0
jl 0x45fac4
push 0
mov eax, dword [0x475cf4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45faae
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45faf3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004185fc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45fad3
inc dword [esi + 0x9c]
jmp 0x45fbad
cmp dword [esi + 0x9c], 0
jle 0x45fbad
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45fbad
cmp dword [esi + 0x44], 0
je 0x45fb59
mov eax, dword [0x475cd0]
call fcn.0046293c
test al, al
je 0x45fb59
mov eax, dword [0x475cf4]
call fcn.00406088
mov edi, eax
cmp edi, 0
jl 0x45fb59
push 5
mov eax, dword [0x475cf4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45fb43
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45fb88
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004185fc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45fb68
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x475cf4
mov ecx, 1
mov edx, dword [0x45f95c]
call fcn.0040623c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x460640
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4606aa
mov eax, ebx
call fcn.0046293c
test al, al
jne 0x4606aa
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404fe0
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x460697
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4606b7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f44
jmp 0x4606b7
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404f44
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x461a60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461ace
mov eax, esi
call fcn.0044b61c
test al, al
je 0x461ace
mov eax, dword [ebx + 0x84]
call fcn.0044b26c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461ace
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x461ac2
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044b26c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00443200
jmp 0x461ace
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0046189c
pop esi
pop ebx
ret

Function at 0x465ecc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov edi, eax
mov eax, ebp
mov edx, edi
call fcn.00404f44
mov eax, edi
test eax, eax
je 0x465ee8
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x465f0a
mov ebx, 1
mov eax, ebp
call fcn.004053e0
movzx edx, byte [edi + ebx - 1]
xor dl, 8
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x465ef3
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x465f10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov edi, eax
mov eax, ebp
mov edx, edi
call fcn.00404f44
mov eax, edi
test eax, eax
je 0x465f2c
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x465f4e
mov ebx, 1
mov eax, ebp
call fcn.004053e0
movzx edx, byte [edi + ebx - 1]
xor dl, 8
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x465f37
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46af78
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b017
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x200]
push eax
push 0
push 0x46b024
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetTempFileNameA
lea eax, [ebp - 0x204]
lea edx, [ebp - 0x200]
mov ecx, pe_nt_image_headers32
call fcn.00405160
mov eax, dword [ebp - 0x204]
call fcn.00405380
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
lea edx, [ebp - 0x200]
mov ecx, pe_nt_image_headers32
call fcn.00405160
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b01e
lea eax, [ebp - 0x204]
call fcn.00404ef0
ret

Function at 0x46b884
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46ba7d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.0040329c
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.004099a0
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x46ba90
call fcn.00405208
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.0040366c
lea eax, [ebp - 0x1d0]
call fcn.00403408
call fcn.0040300c
mov edx, 0x46baa8
lea eax, [ebp - 0x1d0]
call fcn.004056a0
call fcn.00403b20
call fcn.0040300c
push 0x46bab8
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.0040329c
push dword [ebp - 0x234]
push 0x46bac8
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00405284
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.004056a0
call fcn.00403b20
call fcn.0040300c
push 0x46bad4
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.0040329c
push dword [ebp - 0x23c]
push 0x46bac8
push 0x46bae8
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00405284
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.004056a0
call fcn.00403b20
call fcn.0040300c
mov edx, 0x46bafc
lea eax, [ebp - 0x1d0]
call fcn.004056a0
call fcn.00403b20
call fcn.0040300c
lea eax, [ebp - 0x1d0]
call fcn.00403734
call fcn.0040300c
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.0040389c
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405380
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x46ba57
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ba84
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.00404f14
lea eax, [ebp - 4]
call fcn.00404ef0
ret
Function at 0x46bb04
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405370
lea eax, [ebp - 0x168]
mov edx, dword [0x407ff8]
call fcn.00405988
xor eax, eax
push ebp
push 0x46bc7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test eax, eax
je 0x46bb5e
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x46bb75
lea eax, [ebp - 4]
mov edx, 0x46bc94
call fcn.004051bc
lea eax, [ebp - 0x16c]
mov ecx, 0x46bca0
mov edx, dword [ebp - 4]
call fcn.00405208
mov eax, dword [ebp - 0x16c]
lea ecx, [ebp - 0x168]
mov edx, 0x10
call fcn.00409888
test eax, eax
jne 0x46bc3a
test dword [ebp - 0x158], 0x10
jle 0x46bc02
mov eax, dword [ebp - 0x154]
cmp byte [eax], 0x2e
je 0x46bc02
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x170]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00405208
mov eax, dword [ebp - 0x170]
call fcn.0046bb04
pop ecx
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00405208
mov eax, dword [ebp - 0x174]
call fcn.00409b20
jmp 0x46bc27
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00405208
mov eax, dword [ebp - 0x178]
call fcn.00405380
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x168]
call fcn.004098d8
test eax, eax
je 0x46bba6
lea eax, [ebp - 0x168]
call fcn.004098fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bc83
lea eax, [ebp - 0x178]
mov edx, 4
call fcn.00404f14
lea eax, [ebp - 0x168]
mov edx, dword [0x407ff8]
call fcn.00405a58
lea eax, [ebp - 4]
call fcn.00404ef0
ret
Function at 0xe712a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx + 0xc]
jb 0xe712da
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0x10]
cmp dword [ebp + 8], ecx
jb 0xe712ff
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jle 0xe712eb
mov eax, dword [ebp + 8]
jmp 0xe71314
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
jmp 0xe712be
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
sub edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x14]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0xe837e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorpd xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
mov eax, dword [0x10095fa0]
or eax, dword [0x10095fa4]
jne 0xe83847
push 0x33
call fcn.00e8380d
mov eax, dword [0x10095fa0]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x10095fa4]
mov dword [ebp - 8], ecx
push 0x33
call fcn.00e8385f
Function at 0xe8da60
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
cmp dword [0x10096060], 0
jne 0xe8da83
xor eax, eax
xor edx, edx
jmp 0xe8dc4f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x48], eax
cmp dword [ebp + 0x10], 0
jle 0xe8dab2
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x54], edx
jmp 0xe8dabb
xorpd xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
jle 0xe8daf0
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x48]
add eax, 8
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x68], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x64], eax
jmp 0xe8daf9
xorpd xmm0, xmm0
movlpd qword [ebp - 0x68], xmm0
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x28], edx
cmp dword [ebp + 0x10], 0
jle 0xe8db2e
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x48]
add ecx, 8
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0xe8db37
xorpd xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x38], eax
cmp dword [ebp + 0x10], 0
jle 0xe8db6c
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0xe8db75
xorpd xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
sub eax, 8
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call 0xe8dbd0
add dword [esp], 5
retf
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ed06f4
mov esp, ebp
pop ebp
ret
Function at 0xe8dc60
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
cmp dword [ebp + 8], 0
je 0xe8dc8a
cmp dword [ebp + 0xc], 0
jne 0xe8dc84
cmp dword [ebp + 0x10], 0
je 0xe8dc8a
cmp dword [ebp + 0x14], 0
jne 0xe8dc8e
xor al, al
jmp 0xe8dcf2
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
push 0x33
call fcn.00e8dca5
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ed06f4
mov esp, ebp
pop ebp
ret

Function at 0xe8e0f0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
cmp dword [ebp + 8], 0
je 0xe8e11a
cmp dword [ebp + 0xc], 0
jne 0xe8e114
cmp dword [ebp + 0x10], 0
je 0xe8e11a
cmp dword [ebp + 0x14], 0
jne 0xe8e11c
jmp 0xe8e16f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
push 0x33
call 0xe8e12f
add dword [esp], 5
retf
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00ed06f4
mov esp, ebp
pop ebp
ret

Function at 0xe8e1d0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100928f0]
xor eax, ebp
mov dword [ebp - 4], eax
xorpd xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
push 0x33
call 0xe8e1f0
add dword [esp], 5
retf

Function at 0xe95c50
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0xe95c99
mov al, byte [esi]
push eax
call fcn.00ea3040
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0xe95c77
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret

Function at 0xe9ece0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x71e], 0
je 0xe9ed63
cmp dword [edi + 0x1b0], 0
je 0xe9ed2d
push esi
push 1
push edi
call fcn.00e91bc0
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00e91bc0
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0xe9ed63
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x10081650
push 2
push eax
call fcn.00ed1365
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00ed1365
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0xea13e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
call fcn.00e84280
add esp, 4
mov dword [ebp + 0x10], eax
pop ebp
jmp fcn.00edd412
Function at 0xea6e50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0xea6e6e
cmp dword [esi + 0x78], 0
je 0xea6e6e
push 2
push 3
push esi
call fcn.00ea3660
add esp, 0xc
push dword [ebp + 0xc]
call fcn.00ea6850
add esp, 4
test esi, esi
je 0xea6e8e
cmp dword [esi + 0x78], 0
je 0xea6e8e
push 3
push esi
call fcn.00ea36a0
add esp, 8
pop esi
pop ebp
ret
Function at 0xeb2a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.00ed5ff4
add esp, 0x18
test eax, eax
je 0xeb2a32
cmp eax, 0xffffffff
jne 0xeb2a34
xor eax, eax
pop ebp
ret

Function at 0xeb86f0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, 0x51eb851f
imul ecx
push ebx
sar edx, 5
push esi
mov esi, dword [ebp + 8]
mov eax, edx
shr eax, 0x1f
push edi
add eax, edx
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 2
je 0xeb872d
push 0x100861ec
push esi
call fcn.00e9ed70
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0xeb8744
push ecx
push 0x10086208
push esi
call fcn.00e9ee30
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0xeb875d
push ebx
push esi
call fcn.00eb83b0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0xeb8772
push esi
call fcn.00eb73e0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0xeb8787
push esi
call fcn.00eb8390
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0xeb8797
push esi
call fcn.00eb85d0
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xeceec0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x100928cc]
mov edi, eax
add esp, 4
test edi, edi
jne 0xeceeed
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0xecef34
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0xecef3a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0xecef9a
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0xecef60
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0xecefc7
nop
mov eax, dword [esi + 4]
push 1
push 0x10089165
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x10089164
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0xecefa0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xf48d1c
Capabilities:
Encode data using xor

Disassembly:
and byte [eax], 0x59
sub byte [esi], dh
dec esp
sahf
into
adc al, al
inc esp
cld
lahf
mov eax, 0xe84b7018
mov ecx, dword [esi + 0x54990562]
mov dword [ebp - 0x1047e341], esp
jecxz 0xf48d0c
popfd
push ds
pop edx
sub byte [edx - 0xa396914], ah
ficomp word [edi]
mov dh, 0x95
sbb byte [edx - 0x3de40a0e], bl
insd dword es:[edi], dx
adc al, 0x5f
std
push edi
test dword [edx - 0x5c5a4280], eax
pop ebx
cmpsb byte [esi], byte es:[edi]
cdq
fcmovnu st(0), st(4)
ja 0xf48c8d
sar esp, 1
test al, 0xa5
enter 0xffffffffffffb1ec, 0xffffffffffffffc9
add bl, byte [esi + eax*2 - 0x4ea24d65]
std
mov byte [esi - 0x22044e88], dl
movsd dword es:[edi], dword [esi]
jns 0xf48cd7
mov edx, 0x7ab2efa5
in al, dx
test ebx, ebx
push eax
pop edx
pop edx
rep lodsb al, byte [esi]
push es
cmp al, 0x5a
mov eax, 0x22bf7160
int 0x72
out dx, eax
insd dword es:[edi], dx
jge 0xf48c6e
sub byte [eax], ch
adc byte [ebx], dh
in eax, dx
sbb dword [eax + 0x5a], eax
hlt
inc esp
test cl, ah
xchg esp, eax
mov bh, 0x5c
jns 0xf48ca6
lodsd eax, dword [esi]
nop
xor ecx, dword [ebx + esi*2 - 0x67]
jb 0xf48d4b
invalid
pop ecx
pop ecx
test al, 0x53
push esp
or byte [edi + ecx*2], bh
mov dword [0xd9225a5f], eax
cmp al, 0xeb
cmp dword [edi - 0xe], edx
aas
loopne 0xf48d20
jg 0xf48cd9
leave
sub eax, 0x3759159a
salc
aad 0xb0
movsd dword es:[edi], dword [esi]
push ebp
insb byte es:[edi], dx
xchg ebp, eax
push esp
mov ch, 0x2e
xor eax, 0xc22b5a34
push es
xor byte [edx + edx*8 - 0x62], dh
lahf
add eax, dword [ecx]
pop esi
rcr byte [esi + 0x5e01039f], cl
invalid