joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100070c3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
neg ebp
btr ebp, 0x13
lea ebp, [esp - 0x6c]
movsx eax, di
adc ch, 0xe7
sub esp, 0xf8
movzx ecx, dx
mov al, 0x3c
push esi
mov dword [ebp + 0x64], 0
cwde
mov dword [ebp + 0x5c], 0
mov eax, dword [ebp + 0x7c]
jmp 0x10015946
call fcn.1001687d
add esp, 0xc
mov edx, 0x45b678b9
test sp, 0x1b51
mov dword [ebp + 0x54], 0
bts dx, si
bt dx, bp
lahf
mov dword [ebp + 0x58], 0
mov edx, 4
ror ah, cl
rcr ax, 0x90
add ecx, ebp
imul eax, edx, 0
stc
movzx ecx, dx
sbb cx, si
mov ecx, dword [eax + str.04440]
xor edx, edx
movzx eax, di
movsx eax, cx
mov dword [ebp + 0x54], ecx
mov cl, 0xe
mov dword [ebp + 0x58], edx
mov eax, 4
sar ch, cl
shl eax, 0
bts edx, ebp
setbe ch
mov ecx, 4
bsf edx, esi
or edx, esp
add dh, 0xd
shl ecx, 1
shr dl, 0xe9
sub dx, 0x4c37
sbb edx, esi
mov edx, dword [eax + str.04440]
test dx, si
and edx, dword [ecx + str.04440]
xor eax, eax
movzx ecx, bp
xor edx, dword [ebp + 0x54]
btc ecx, 0xec
bt ecx, 0x59
setb ch
xor eax, dword [ebp + 0x58]
test dx, si
xchg cx, cx
cmp edx, edx
mov dword [ebp + 0x54], edx
clc
bt edx, 0x43
bsr edx, edi
mov dword [ebp + 0x58], eax
sbb cl, 0x51
mov ecx, 4
rdtsc
adc dx, 0x4f41
ror ax, 0x19
imul edx, ecx, 3
adc ch, 0xb4
rol ah, cl
mov eax, 4
neg cl
shl eax, 2
btc cx, 0xe0
mov ecx, dword [edx + str.04440]
test esi, 0x2c2954ad
and ecx, dword [eax + str.04440]
mov al, al
ror ax, 0
sub edx, edx
not al
btr eax, 0x70
xor ecx, dword [ebp + 0x54]
xor edx, dword [ebp + 0x58]
mov dword [ebp + 0x54], ecx
inc al
mov dword [ebp + 0x58], edx
mov eax, dword [ebp + 0x54]
cmc
not eax
rcl ch, 0x8a
cmc
mov ecx, dword [ebp + 0x58]
shr dl, cl
not ecx
test ebx, ebx
clc
inc dx
mov edx, 0x75
stc
jmp loc.1006c782
push eax
bswap cx
push 0
mov ecx, dword [ebp + 0x78]
push ecx
jmp 0x1000ea4c

Function at 0x100080e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add cl, 0xdd
sub esp, 0x114
push esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmc
xchg ch, cl
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
shr eax, cl
bsr cx, di
mov eax, dword [ebp - 0x10]
mov ch, 0xfd
cmovo ecx, ecx
sub ecx, 0x118a395d
mov ecx, dword [eax + 0xc]
cmp ebp, edi
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 8], 0
jne fcn.10021a95
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x18], 0
jmp 0x1000c218
je fcn.10021a95
mov eax, dword [ebp - 0xc]
jmp 0x1001be4b
jmp loc.10063b88
mov eax, dword [eax + 0x18]
jmp 0x1000f679

Function at 0x100097dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
cmp cx, 0x51a2
test bp, ax
sub esp, 0x214
clc
test esp, 0x5f621650
test esp, ebp
push esi
cmp edi, eax
test ch, cl
cmp dword [ebp + 8], 0
jmp loc.10086e75

Function at 0x1000c4b5
Capabilities:
Authenticate hmac
Check for software breakpoints
Check http status code
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions
Hash data using murmur3
Parse pe header

Disassembly:
push ebp
ror ebp, 0x81
lea ebp, [esp - 0x78]
sub esp, 0xc8c
jmp 0x100115c6
push esi
jmp loc.1007d636
Function at 0x10013a0b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
call dword [section..rdata]
call dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov dword [ebp + 0x2c], 0
shr cx, cl
shrd edx, ecx, 0x83
mov dword [ebp + 0x30], 0
test di, 0x3c69
sar cl, 0x30
mov ecx, 4
adc ax, si
bt eax, eax
imul edx, ecx, 0
mov eax, dword [edx + str.04440]
shr dx, cl
xchg dx, dx
cdq
sub ecx, ecx
bt dx, 0x29
rcr dx, 0x5f
mov dword [ebp + 0x2c], eax
shr dx, 0x59
mov dword [ebp + 0x30], ecx
bsf edx, edi
mov edx, 4
bsf cx, bx
btr ax, ax
shl edx, 0
sar ax, cl
nop
inc ax
mov eax, 4
shl eax, 1
cmovb ecx, edi
adc cx, si
sal ecx, cl
mov ecx, dword [edx + str.04440]
cmp ebx, 0x4d332213
test ebp, 0x3c2443f5
cmp bx, cx
and ecx, dword [eax + str.04440]
cmc
inc ax
xor edx, edx
xor ecx, dword [ebp + 0x2c]
xor edx, dword [ebp + 0x30]
mov dword [ebp + 0x2c], ecx
ror al, cl
ror cx, 0x62
mov dword [ebp + 0x30], edx
mov eax, 4
shrd dx, si, 0x8c
stc
cmp al, 0xec
imul ecx, eax, 3
mov edx, 4
shl edx, 2
sal eax, 0xa2
shrd eax, esi, 0x4a
sal eax, cl
mov eax, dword [ecx + str.04440]
clc
test cx, dx
cmp esi, eax
and eax, dword [edx + str.04440]
bswap dx
shrd dx, bx, 0xd6
xor ecx, ecx
rol dx, 0x4e
cmove dx, si
bswap dx
xor eax, dword [ebp + 0x2c]
add dl, bl
bsf dx, ax
clc
xor ecx, dword [ebp + 0x30]
shr edx, 0x4a
mov dword [ebp + 0x2c], eax
mov dh, dh
mov dword [ebp + 0x30], ecx
mov edx, dword [ebp + 0x2c]
sbb ax, di
adc al, 0xed
sal ecx, 0x9f
not edx
bsf ecx, ebx
rol ecx, 0x42
bt ax, 0x6f
mov eax, dword [ebp + 0x30]
bsf cx, bp
not eax
mov ecx, 0x9293728
btr cx, 0xd4
mov ecx, 0x3dc
cmp bl, 0x6f
not ecx
cmc
cmp dx, dx
test edx, eax
sub esi, esi
xor edx, ecx
xor eax, esi
jmp loc.10085fde
push ebp
bts bp, ax
sbb ecx, 0x791848cb
lea ebp, [esp - 0x78]
sub esp, 0x160
cmovg ecx, edi
push esi
mov eax, dword [0x1002f0cc]
mov dword [ebp - 0x6c], eax
movsx ecx, bp
seta cl
mov ecx, ebp
mov ecx, dword [ebp - 0x6c]
jmp 0x10001d7a
Function at 0x10016415
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x10022ba6
cmp dword [0x1002f134], 0
je 0x10022ba6
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
and ecx, esp
mov dword [ebp - 0x10], 0
mov eax, 4
dec ecx
imul ecx, eax, 0
or dx, dx
bsf dx, sp
cmc
mov edx, dword [ecx + str.04440]
sub eax, eax
cmp ax, 0x30c6
not ch
mov ch, bh
mov dword [ebp - 0x14], edx
cmovb cx, sp
btr edx, edi
xadd ch, ch
mov dword [ebp - 0x10], eax
adc eax, ecx
rcr edx, 0xcb
mov ecx, 4
movzx ax, cl
cmp bx, dx
shl ecx, 0
rcr edx, 0x14
test esi, edi
stc
mov edx, 4
and al, dl
shl edx, 1
cmc
bts ax, cx
mov eax, dword [ecx + str.04440]
cmp si, 0x3d1b
and eax, dword [edx + str.04440]
sub ecx, ecx
xor eax, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x10]
and dl, 0xb4
mov dword [ebp - 0x14], eax
dec edx
jmp 0x1001d53a
push ebp
cmp si, 0x5fec
btr ebp, 0x54
mov ebp, esp
test esi, edx
sub esp, 0x44
push esi
clc
jmp 0x100210d0
mov dword [ebp - 0x10], ecx
adc ax, si
cmc
mov edx, 4
stc
sal cl, 0xad
imul eax, edx, 3
mov ecx, 4
add dl, cl
sal dh, 0x15
shl ecx, 2
cdq
shr dh, 0x10
bsr dx, dx
mov edx, dword [eax + str.04440]
cmp ecx, eax
clc
and edx, dword [ecx + str.04440]
xor eax, eax
xor edx, dword [ebp - 0x14]
clc
xor eax, dword [ebp - 0x10]
adc cl, dh
dec ch
rol ecx, cl
mov dword [ebp - 0x14], edx
rcr dx, cl
xor edx, 0x3d177a14
bsr edx, edx
mov dword [ebp - 0x10], eax
test sp, cx
mov dh, 0x1a
mov ax, bp
mov ecx, dword [ebp - 0x14]
btc dx, 0xbf
sal dx, cl
sbb al, 0x6f
not ecx
rdtsc
mov edx, dword [ebp - 0x10]
rcr ax, cl
bsf eax, edx
not edx
btc ax, 0x28
test dl, 0xee
test cx, si
mov eax, 0x31
cmc
not eax
jmp loc.1007a2c6
cmp dword [0x1002f0a4], 0
jmp 0x10002d11
pop esi
jmp loc.100674e8
Function at 0x1002619c
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
test esi, esi
lea ebp, [esp - 0x78]
and dx, bp
sub esp, 0x360
ror ecx, cl
push esi
not al
movzx dx, al
mov dword [ebp + 0x74], 0
shld dx, dx, 0x1e
bt edx, 0x7e
mov dword [ebp + 8], 0
cwd
mov dword [ebp + 0xc], 0
rol eax, 0x41
sub cx, cx
mov eax, 4
imul ecx, eax, 0
clc
and dx, 0x3f9d
mov edx, dword [ecx + str.04440]
bswap ecx
sbb cx, 0x3291
xor eax, eax
movzx ecx, bp
rcr ecx, cl
ror ch, 0xe4
mov dword [ebp + 8], edx
cmovbe edx, eax
test eax, eax
mov dword [ebp + 0xc], eax
add dx, 0x209a
sal eax, cl
mov ecx, 4
lahf
shl ecx, 0
bts ax, si
rcr ax, 0x64
mov edx, 4
bswap ax
cmovb ax, bp
shr al, cl
shl edx, 1
mov eax, dword [ecx + str.04440]
test esp, 0x1add5868
cmp ch, bh
and eax, dword [edx + str.04440]
xor ecx, ecx
cwd
xor eax, dword [ebp + 8]
mov dx, 0x2713
xor ecx, dword [ebp + 0xc]
mov dword [ebp + 8], eax
xor ah, 0xdd
cmp edi, ecx
shr al, cl
mov dword [ebp + 0xc], ecx
rcl cl, 0x1c
mov edx, 4
sal ah, 7
mov ax, si
imul eax, edx, 3
and cl, 0xee
shl dl, cl
mov ecx, 4
movzx dx, ah
shrd edx, eax, 0xc9
movzx edx, di
shl ecx, 2
movsx edx, ax
bts dx, dx
mov edx, dword [eax + str.04440]
and edx, dword [ecx + str.04440]
sub eax, eax
xor edx, dword [ebp + 8]
sar ecx, cl
xor eax, dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp + 8], edx
bts dx, si
or dx, bp
mov dword [ebp + 0xc], eax
sar ch, 0x72
shr dh, 0x37
xadd edx, eax
mov ecx, dword [ebp + 8]
adc edx, esp
not ecx
ror ax, 0xd8
rcr dh, cl
bts eax, edi
mov edx, dword [ebp + 0xc]
or ah, cl
not edx
shl eax, 0x4e
test cx, 0x51fe
mov eax, 0x36
test ebp, esp
not eax
test ch, bh
stc
sub esi, esi
cmp ax, di
cmc
xor ecx, eax
test eax, eax
cmp esi, 0x414d6528
stc
xor edx, esi
clc
test dx, 0x3b79
mov dword [ebp + 8], ecx
shr ecx, cl
setg cl
rol cl, cl
mov dword [ebp + 0xc], edx
shr dx, cl
mov ecx, dword [0x1002f0f0]
adc edx, 0x77b3452f
cdq
bt dx, 0x65
movzx edx, byte [ecx]
stc
cmp edx, dword [ebp + 8]
jmp loc.10077afb
Function at 0x10026588
Capabilities:
Check for peb beingdebugged flag
Execute anti-debugging instructions

Disassembly:
xor edx, esi
cmp ch, 0x95
cmp esi, edi
mov dword [ebp + 0x70], ecx
test dh, 0xd6
and cx, 0x4ded
mov cl, 0x15
mov dword [ebp + 0x74], edx
test dh, 0x82
mov ecx, dword [ebp + 0x7c]
add dx, di
rcl dx, cl
sbb dl, ch
movzx edx, byte [ecx]
jmp loc.1007a228
push ebp
sal cl, 0xb0
sar ch, cl
lea ebp, [esp - 0x78]
rol ecx, cl
sub esp, 0x380
sar al, cl
add ecx, 0x6fc12046
push esi
rcr al, cl
bt ax, 0xa4
mov dword [ebp + 0x70], 0
mov dword [ebp + 0x74], 0
mov eax, 4
sub ecx, 0x2f1259ed
mov edx, edi
rcr edx, cl
imul ecx, eax, 0
mov edx, dword [ecx + str.04440]
bts ecx, edx
xor ch, bl
xor eax, eax
cmovl ecx, eax
mov dword [ebp + 0x70], edx
sbb edx, ebp
shl edx, cl
rcl ch, cl
mov dword [ebp + 0x74], eax
sal edx, 0x10
cbw
mov ecx, 4
rcr ax, 0xb1
sal ax, cl
shl ecx, 0
rol eax, 0xa3
bt eax, 0x81
sub al, 0xc4
mov edx, 4
shl edx, 1
mov ah, dl
btr ax, 0xa9
mov eax, dword [ecx + str.04440]
test esi, 0x587f42a7
clc
and eax, dword [edx + str.04440]
cmovbe edx, ebp
setne dl
xor ecx, ecx
xor eax, dword [ebp + 0x70]
xor dh, al
xor ecx, dword [ebp + 0x74]
movzx edx, bp
bt dx, bp
mov dword [ebp + 0x70], eax
sal al, 0xd6
mov dword [ebp + 0x74], ecx
btc cx, di
rol edx, 0xae
mov cl, 0xd0
mov edx, 4
cbw
adc al, al
neg eax
imul eax, edx, 3
btc cx, 0xf2
xchg ch, ch
cdq
mov ecx, 4
shl ecx, 2
mov edx, dword [eax + str.04440]
cmp esp, 0x39db20fe
cmc
clc
and edx, dword [ecx + str.04440]
sets ch
xor eax, eax
add ch, dh
xor edx, dword [ebp + 0x70]
btr ecx, 0xe0
shl ecx, 0xc6
xor eax, dword [ebp + 0x74]
mov dword [ebp + 0x70], edx
ror cx, 0x8f
rol cx, cl
mov dword [ebp + 0x74], eax
sar dh, cl
cmp edi, 0x3781cab
clc
mov ecx, dword [ebp + 0x70]
or ah, 0x73
not ecx
rol eax, cl
cmovne eax, esp
movzx ax, ch
mov edx, dword [ebp + 0x74]
bts ax, di
not edx
adc eax, esp
btc eax, 0x60
mov eax, 0xf8
cmp ecx, ebp
test ch, dl
cmc
not eax
clc
sub esi, esi
test bp, bp
xor ecx, eax
jmp 0x1001fd93

Function at 0x1002a787
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
push ebp
sbb ebp, edx
rcl ebp, 0x63
adc bp, 0x1709
lea ebp, [esp - 0x78]
jmp loc.10075035
Function at 0x100606d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ret
xor eax, eax
jmp 0x1002d64a
mov esp, ebp
mov bp, ax
pop ebp
jmp 0x1000542a
push ebp
mov ebp, esp
movsx dx, bl
lahf
btc ax, 6
sub esp, 0x30
or al, 0x33
xor ch, cl
mov eax, dword [ebp + 8]
and cx, bx
sar dh, 0xdb
mov dword [ebp - 4], eax
sub ecx, 0x53b36044
ror dh, cl
mov ecx, dword [ebp - 4]
rcr ah, cl
rdtsc
mov edx, dword [ebp - 4]
add ax, ax
sal ah, cl
add edx, dword [ecx + 0x3c]
movsx eax, bp
mov dword [ebp - 0x20], edx
mov eax, 8
xor edx, ecx
bsf cx, bp
btr ecx, edx
imul ecx, eax, 0
rol eax, 0x81
mov edx, dword [ebp - 0x20]
rol ax, cl
lea eax, [edx + ecx + 0x78]
dec cx
shrd edx, edi, 0x2e
movsx cx, bl
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
rol ah, 0xd0
lahf
sar dl, 0x94
mov edx, dword [ebp - 4]
btc ax, sp
add edx, dword [ecx]
ror ecx, cl
adc ch, ah
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr dx, 0x1a
btr cx, 0x6c
or edx, esp
mov ecx, dword [ebp - 4]
cmovp dx, bx
add dx, bx
add ecx, dword [eax + 0x1c]
rcr dx, cl
and dh, 0xad
ror ah, 0x13
mov dword [ebp - 0x10], ecx
cdq
rcl edx, cl
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
shl cl, 6
mov dword [ebp - 0xc], eax
cbw
seta dh
rcr eax, cl
mov ecx, dword [ebp - 8]
add edx, 0x49f70556
stc
mov edx, dword [ebp - 4]
or ax, bp
add edx, dword [ecx + 0x20]
sal eax, 0x2f
movsx ax, cl
mov dword [ebp - 0x18], edx
ror dl, cl
shr al, cl
and ecx, esp
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
btr edx, 0x2f
add ecx, dword [eax + 0x24]
rcr dx, 0x1f
mov dword [ebp - 0x1c], ecx
cmp edi, 0x30df52c6
mov edx, dword [ebp - 0xc]
sbb ah, 0x49
mov dword [ebp - 0x28], edx
dec ax
shr eax, 0xcc
sub ax, 0x15c2
mov eax, dword [ebp - 0xc]
cmp cl, 0xe5
lea eax, [eax - 1]
cmp bx, si
cmp bl, 0x80
clc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x28], 0
jmp 0x1006321b
je 0x10029a9b
mov ecx, dword [ebp - 0x18]
xchg dh, al
mov edx, dword [ebp - 4]
rcl eax, 0xf3
neg eax
and ax, 0x2193
add edx, dword [ecx]
movsx eax, cx
xchg ah, al
mov dword [ebp - 0x2c], edx
jmp loc.10028078

Function at 0x100610cd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
je 0x10061100
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 2]
cmp bh, 1
sub eax, ecx
push ebp
shld ebp, edi, 0xfe
bsf ax, si
mov ebp, esp
shr dh, 0xe6
inc edx
lea esp, [esp - 0xc]
mov eax, dword [ebp + 8]
shr ch, cl
shl ch, 0x77
mov dword [ebp - 8], eax
btr ecx, 0xb8
test esi, esi
sal cl, 0x37
mov ecx, dword [ebp + 0xc]
sbb edx, 0x451d24e8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
xor cx, 0x60ee
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
add ecx, 1
cmp esi, 0xdff5f5a
mov dword [ebp - 8], ecx
movsx ecx, bp
mov edx, dword [ebp - 0xc]
dec al
add ecx, eax
mov al, byte [edx]
mov byte [ebp - 2], al
mov ecx, dword [ebp - 0xc]
sbb edx, esi
sar dh, 0x23
or dx, sp
add ecx, 1
mov dword [ebp - 0xc], ecx
sub edx, ebp
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x1007657e
movzx eax, byte [ebp - 1]
clc
sar cx, 0xeb
or ch, ch
movzx ecx, byte [ebp - 2]
jmp loc.10027ba0
movzx edx, byte [ebp - 1]
setl ah
movzx eax, byte [ebp - 2]
cmp edx, eax
jmp 0x10060cf6
Function at 0x10062f96
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Parse pe header

Disassembly:
push ebp
lea ebp, [esp - 0x78]
lea esp, [esp - 0x1e4]
test ebx, ebp
stc
jmp 0x1007b5d8
push esi
cmc
mov dword [ebp + 0x74], 0
jmp 0x10080801
cmp dword [0x1002f0e8], 0
jmp loc.10029b5c

Function at 0x10065758
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push ebp
inc ah
sar ebp, 0x4e
lea ebp, [esp - 0x74]
bt ax, dx
cmc
sub esp, 0x1d8
bt eax, esp
push esi
mov eax, dword [0x1005f6a0]
and eax, 1
jmp loc.1002cc95

Function at 0x10067455
Capabilities:
Execute anti-debugging instructions

Disassembly:
call dword [section..rdata]
call dword [ebp - 0x50]
mov dword [0x1005f6ac], eax
movsx ecx, ax
cwde
mov eax, dword [0x1002f0cc]
jmp loc.10024670
push ebp
cmp eax, 0x6d685b3b
mov ebp, esp
sar ah, 0x7d
setge ah
lea esp, [esp - 0x164]
rcr eax, cl
btr eax, ebx
push esi
xchg ah, ah
mov eax, dword [0x1005f6a4]
jmp 0x10076b50
and eax, 1
jmp 0x10078867
jne 0x10065a7c
mov ecx, dword [0x1005f6a4]
jmp 0x10082997
or ecx, 1
xchg dl, dl
movzx edx, dx
mov dword [0x1005f6a4], ecx
mov edx, dword [0x1002f0cc]
cmovae ecx, edx
movzx ecx, cx
mov dword [ebp - 0x50], edx
movsx cx, cl
sete cl
mov ecx, dword [ebp - 0x50]
jmp 0x10065a6a

Function at 0x10069eae
Capabilities:
Encode data using base64

Disassembly:
push ebp
cmovo ebp, edx
lea ebp, [esp - 0x78]
sub esp, 0xac
push esi
lea eax, [ebp + 0xc]
jmp loc.1000cd7e

Function at 0x1006cb0b
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
stc
xor bp, bx
lea ebp, [esp - 0x78]
lea esp, [esp - 0x9c]
jmp 0x1006fa92
push esi
cmc
cmp bx, bp
mov dword [ebp + 0x74], 0
test cx, si
clc
test esi, 0x545e4d9f
or dword [ebp + 0x74], 1
jmp loc.1002ce57

Function at 0x10078a40
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
push ebp
movsx ebp, dx
btc bp, 0x43
bts bp, bx
lea ebp, [esp - 0x78]
cmp ebp, 0x378e35fe
lea esp, [esp - 0xdd4]
jmp fcn.100125fb

Function at 0x10079e35
Capabilities:
Authenticate hmac

Disassembly:
call dword [section..rdata]
call dword [ebp - 0x4c]
mov dword [0x1005f698], eax
not eax
mov eax, dword [0x1002f0cc]
bswap ecx
mov dword [ebp - 0x50], eax
xchg ecx, ecx
mov ecx, dword [ebp - 0x50]
jmp loc.10021a75
push ebp
mov ebp, esp
sar eax, 0xd0
and ah, 0x31
sub esp, 0x7c
xadd al, ah
push esi
movsx eax, si
test di, 0xdfe
mov eax, dword [0x1005f68c]
and eax, 1
jne 0x1006a100
mov ecx, dword [0x1005f68c]
test ebx, 0x4d961db6
mov dx, dx
or ecx, 1
mov dword [0x1005f68c], ecx
mov edx, dword [0x1002f0cc]
movzx ecx, sp
setne cl
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x4c]
jmp 0x1006a0f0
Function at 0x1007a24b
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x20], 0
btr cx, sp
mov ecx, 4
sbb dx, sp
imul edx, ecx, 0
shrd eax, edi, 0x5f
xchg ah, ah
bt eax, 0x64
mov eax, dword [edx + str.04440]
movzx edx, si
sub ecx, ecx
rol dl, 0xae
clc
shl dx, cl
mov dword [ebp - 0x24], eax
movzx ax, ch
mov dword [ebp - 0x20], ecx
mov edx, 4
stc
sar eax, 0x20
rcl ecx, cl
shl edx, 0
btr eax, ebp
xadd ax, cx
bts ax, di
mov eax, 4
add cx, sp
shl eax, 1
shrd ecx, esp, 0x4a
adc cl, 0x15
btr cx, si
mov ecx, dword [edx + str.04440]
cmp edx, esp
test si, bx
stc
and ecx, dword [eax + str.04440]
bsf ax, si
movsx eax, sp
sub edx, edx
sar al, 0xdb
bts eax, ecx
or ax, si
xor ecx, dword [ebp - 0x24]
sal al, cl
sbb eax, esp
dec ax
xor edx, dword [ebp - 0x20]
jmp 0x10084dc6
push ebp
cwd
rcr ebp, 0xba
neg dx
mov ebp, esp
movzx eax, cx
rol al, 0xfc
and dx, ax
sub esp, 0x5c
and dl, 0xc5
shld edx, esp, 0xc4
sub dx, sp
push esi
and ecx, ecx
neg ch
adc ch, 0x39
mov dword [ebp - 8], 0
ror ah, 0xa8
mov eax, dword [ebp + 8]
cmc
mov dword [ebp - 0x10], eax
dec dx
mov dword [ebp - 0x24], 0
jmp 0x100641be
mov dword [ebp - 0x24], ecx
lahf
ror ah, cl
mov dword [ebp - 0x20], edx
btc edx, 0x98
mov eax, 4
imul ecx, eax, 3
rdtsc
shl dx, cl
mov edx, 4
sal al, 0x8e
neg al
shl edx, 2
adc ax, 0x6be2
mov eax, dword [ecx + str.04440]
and eax, dword [edx + str.04440]
movsx dx, dh
shl edx, cl
btr dx, 0xf9
xor ecx, ecx
btr edx, 0xc0
xor eax, dword [ebp - 0x24]
shl dx, cl
xor ecx, dword [ebp - 0x20]
xadd dh, dl
sbb dx, 0x7901
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
rdtsc
cmp ecx, 0x642204ed
test esp, 0xb9e4988
mov edx, dword [ebp - 0x24]
not edx
shrd cx, bp, 0x23
sete ah
mov eax, dword [ebp - 0x20]
xchg cl, ch
bswap ecx
not eax
xchg cx, cx
mov cl, 0xab
mov ecx, 0xffffffcb
cmc
clc
not ecx
sub esi, esi
xor edx, ecx
xor eax, esi
jmp loc.10022e3e

Function at 0x1007cd97
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
push ebp
bswap ebp
lea ebp, [esp - 0x78]
cmc
sub esp, 0x298
jmp loc.100096f4

Function at 0x1008682c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
rcr dl, 0x43
rol ax, 0xf8
btr ecx, esi
sub esp, 8
bt eax, edi
mov eax, dword fs:[0x18]
xor cx, di
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
bt dx, si
cwd
adc edx, eax
mov dword [ebp - 8], eax
cmc
mov dh, 0xef
rcr ah, cl
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
shl edx, 0x42
shl edx, cl

Function at 0x100878d6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [ebp + 0x10]
clc
add edx, dword [ebp + 0x14]
jmp loc.1006881e
cmp dword [ebp + 0xc], 0
jne 0x1001e5ed
mov eax, dword [ebp + 0x14]
stc
test esi, esi
test ch, 0xcd
shr eax, 1
jmp loc.100696d9
jne 0x1002d1e9
mov eax, dword [ebp + 0x10]
jmp fcn.1000908a
push ebp
or ebp, 0x210f0995
mov ebp, esp
cmp di, dx
test esi, 0x5c3f5453
sub esp, 8
cmp dword [ebp + 0x14], 0xffffffff
jmp 0x10074679
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x40179e
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4110d4], 0
jne 0x4017ac
call fcn.00401774
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x4017d9
test cl, 7
je 0x4017d9
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4110d0]
dec esi
inc ecx
jmp 0x4017ba
cmp esi, 8
jb 0x40185d
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4110d0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4110d0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4110d0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4110d0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4110d0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4110d0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4110d0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4110d0]
dec edi
jne 0x4017e3
xor edx, edx
test esi, esi
jbe 0x40187d
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4110d0]
inc edx
cmp edx, esi
jb 0x401864
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x40192b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004012c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4019bd
push esi
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407640
lea eax, [ebp - 0x800]
push eax
call fcn.00409bda
mov esi, eax
lea eax, [ebp - 0x800]
push eax
call fcn.00407ad6
test al, al
jne 0x401999
lea eax, [ebp - 0x1000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.00409bda
lea esi, [esi + eax + 1]
mov eax, 0x104
pop edi
cmp esi, eax
pop esi
jbe 0x4019bd
push eax
push 0xaf
call fcn.00409669
push eax
push 0x40f2b0
call fcn.0040a9dd
add esp, 0xc
leave
ret 8