joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bc7f
Capabilities:
Connect to http server
Create http request

Disassembly:
push 0x1c
mov eax, 0x42a39d
call fcn.0042864a
mov esi, ecx
push 0x14000000
xor ebx, ebx
push ebx
push ebx
push ebx
push str.Mozilla_4.0__compatible__MSIE__Windows_NT_6.1__Trident_4.0_
mov dword [ebp - 0x14], ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
cmp eax, ebx
mov dword [esi + 0x58], eax
jne 0x41bccf
call dword [0x42d120]
push eax
push str.BeforeDownload_InternetOpen_Failed_error_code_0x_x_
push str.HttpStatus.txt
call dword [sym.imp.QQPlayer.DLL_int___cdecl_DoLog_wchar_t_const__]
add esp, 0xc
push 2
pop eax
call fcn.00428722
ret
push 0x41ba9c
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x41bcc6
mov eax, dword [0x445268]
or dword [ebp - 0x20], 0xffffffff
mov ecx, 0x445268
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax - 0xc]
cmp ecx, ebx
mov dword [ebp - 0x24], ebx
jne 0x41bd25
mov eax, dword [esi + 0x18]
sub eax, 0x10
call fcn.00405ab9
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 1
jmp 0x41bd3c
add eax, 0xfffffff0
call fcn.00405ab9
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 2
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [esi + 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov eax, dword [eax]
push ecx
push ecx
sub eax, 0x10
mov dword [ebp - 0x28], esp
mov edi, esp
call fcn.00405ab9
add eax, 0x10
mov dword [edi], eax
call fcn.0041c4c2
add esp, 0x14
cmp eax, ebx
sete byte [ebp - 0xd]
test byte [ebp - 0x14], 2
je 0x41bd87
mov eax, dword [ebp - 0x1c]
and dword [ebp - 0x14], 0xfffffffd
add eax, 0xfffffff0
call fcn.00401518
mov dword [ebp - 4], ebx
test byte [ebp - 0x14], 1
je 0x41bd9b
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.00401518
cmp byte [ebp - 0xd], bl
je 0x41bdb0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401518
jmp 0x41bcc6
cmp dword [ebp - 0x20], 3
jne 0x41bda0
mov eax, dword [esi + 0x64]
cmp eax, ebx
je 0x41bdc4
push eax
call dword [0x42d13c]
mov edi, dword [ebp - 0x18]
push esi
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x24]
push edi
push dword [esi + 0x58]
call dword [sym.imp.WININET.dll_InternetConnectW]
cmp eax, ebx
mov dword [esi + 0x5c], eax
jne 0x41be25
call dword [0x42d120]
cmp eax, 0x3e5
je 0x41be00
push 2
pop esi
lea eax, [edi - 0x10]
call fcn.00401518
mov eax, esi
jmp 0x41bcc9
push dword [esi + 0x44]
mov ecx, dword [esi + 0x64]
mov eax, esi
call fcn.0041b653
cmp eax, ebx
je 0x41be30
cmp eax, dword [esi + 4]
jne 0x41be1b
xor esi, esi
inc esi
jmp 0x41bdf1
cmp eax, dword [esi + 0x64]
jne 0x41bdee
cmp dword [esi + 0x5c], ebx
je 0x41bdee
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov esi, eax
jmp 0x41bdf1
push 7
jmp 0x41bdf0
Function at 0x41bedf
Capabilities:
Check http status code

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa8
mov eax, dword [0x443054]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0xc]
xor edi, edi
cmp eax, edi
jne 0x41bf82
push 0x9e
lea eax, [ebp - 0x2a]
push edi
push eax
mov word [ebp - 0x2c], di
call fcn.00427cf8
add esp, 0xc
push edi
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x13
push dword [esi + 0x60]
mov dword [ebp - 0x30], 0x50
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x41bf3c
push 2
jmp 0x41bf81
lea eax, [ebp - 0x2c]
push eax
call dword [0x42d280]
cmp eax, edi
pop ecx
je 0x41bf38
mov ecx, 0x133
cmp eax, ecx
ja 0x41bfb4
je 0x41bf9c
cmp eax, 0xc8
je 0x41bf93
cmp eax, 0xce
je 0x41bf93
cmp eax, 0x12c
jbe 0x41bfc9
cmp eax, 0x12f
jbe 0x41bf9c
add ecx, 0xfffffffd
cmp eax, ecx
jne 0x41bfc9
push ecx
call fcn.0041c365
push 3
pop eax
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.00427ce2
add ebp, 0x78
leave
ret
mov edi, esi
call fcn.0041c04e
jmp 0x41bf82
dec dword [esi + 0x48]
cmp dword [esi + 0x48], edi
jle 0x41bfad
mov ecx, esi
call fcn.0041c278
jmp 0x41bf82
push 0x194
jmp 0x41bf7a
mov edx, eax
mov ecx, 0x194
sub edx, ecx
je 0x41bfda
sub edx, 0xc
je 0x41bfd3
sub edx, 0x57
je 0x41bfcc
push eax
jmp 0x41bf7a
push 0x1f7
jmp 0x41bf7a
push 0x1a0
jmp 0x41bf7a
dec dword [esi + 0x4c]
cmp dword [esi + 0x4c], edi
jle 0x41bf79
push 5
jmp 0x41bf81
Function at 0x41c4c2
Capabilities:
Parse url

Disassembly:
push ebp
lea ebp, [esp - 0x229c]
mov eax, 0x229c
call fcn.00428600
push 0xffffffffffffffff
push 0x42a33b
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x443054]
xor eax, ebp
mov dword [ebp + 0x2298], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x22a8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x22ac]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x22b0]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x22b4]
mov dword [ebp - 0x1c], eax
xor edi, edi
mov dword [ebp - 4], edi
mov esi, dword [ebp + 0x22a4]
cmp dword [esi - 0xc], edi
jne 0x41c560
lea eax, [esi - 0x10]
call fcn.00401518
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2298]
xor ecx, ebp
call fcn.00427ce2
add ebp, 0x229c
leave
ret
push 0x1046
lea eax, [ebp + 0x104e]
push edi
push eax
mov word [ebp + 0x104c], di
call fcn.00427cf8
add esp, 0xc
mov dword [ebp - 0x10], 0x824
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push 0x20000000
lea eax, [ebp - 0x10]
push eax
lea ebx, [ebp + 0x104c]
mov eax, ebx
push eax
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
jne 0x41c628
call dword [0x42d120]
cmp eax, 0x7a
je 0x41c5cb
lea esi, [ebp - 0x18]
call fcn.0041c6f1
mov eax, dword [ebp + 0x22a4]
add eax, 0xfffffff0
jmp 0x41c536
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042790e
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x41c613
lea esi, [ebp - 0x18]
call fcn.0041c6f1
push 4
mov dword [ebp - 0x18], ebx
call fcn.00427cf2
cmp eax, edi
pop ecx
je 0x41c608
mov dword [eax], 1
jmp 0x41c60a
xor eax, eax
mov esi, dword [ebp + 0x22a4]
mov dword [ebp - 0x14], eax
push 0x20000000
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
test eax, eax
je 0x41c5b5
push 0x200
lea eax, [ebp + 0x2096]
push edi
push eax
mov word [ebp + 0x2094], di
call fcn.00427cf8
push 0x1048
lea eax, [ebp + 2]
push edi
push eax
mov word [ebp], di
call fcn.00427cf8
push 0x38
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.00427cf8
lea eax, [ebp + 0x2094]
mov dword [ebp - 0x54], eax
lea eax, [ebp]
push ebx
mov dword [ebp - 0x64], 0x3c
mov dword [ebp - 0x50], pe_nt_image_headers32
mov dword [ebp - 0x34], 0x824
mov dword [ebp - 0x38], eax
call dword [0x42d3a0]
add esp, 0x28
lea ecx, [ebp - 0x64]
push ecx
push edi
push eax
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x41c6bf
lea esi, [ebp - 0x18]
call fcn.0041c6f1
mov eax, dword [ebp + 0x22a4]
add eax, 0xfffffff0
call fcn.00401518
mov eax, edi
jmp 0x41c53d
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
lea eax, [ebp + 0x2094]
push eax
push dword [ebp - 0x28]
call fcn.00401774
lea eax, [ebp]
push eax
push dword [ebp - 0x20]
call fcn.00401774
mov ax, word [ebp - 0x4c]
mov ecx, dword [ebp - 0x1c]
xor edi, edi
mov word [ecx], ax
inc edi
jmp 0x41c6a2
Function at 0x41cd00
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, eax
jne 0x41cd11
xor eax, eax
jmp 0x41cd46
cmp dword [ebp + 8], 0
je 0x41cd43
cmp dword [ebp + 0xc], 0
jbe 0x41cd43
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x60]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x41cd0d
call fcn.0041cd4b
test eax, eax
jne 0x41cd46
jmp 0x41cd0d
push 2
pop eax
pop esi
leave
ret 8

Function at 0x41d823
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, eax
jne 0x41d834
xor eax, eax
jmp 0x41d869
cmp dword [ebp + 8], 0
je 0x41d866
cmp dword [ebp + 0xc], 0
jbe 0x41d866
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x60]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
jne 0x41d830
call fcn.0041d86e
test eax, eax
jne 0x41d869
jmp 0x41d830
push 2
pop eax
pop esi
leave
ret 8

Function at 0x41daf9
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x42aa58
call fcn.0042864a
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
jne 0x41db22
add eax, 0xfffffff0
call fcn.00401518
xor eax, eax
call fcn.00428722
ret
lea ecx, [ebp - 0x14]
lea eax, [ebp + 8]
call fcn.00417697
push 0x437c24
push eax
mov byte [ebp - 4], 1
call fcn.004058f5
test eax, eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add eax, 0xfffffff0
call fcn.00401518
cmp byte [ebp - 0xd], bl
je 0x41db85
push 0x5c
lea esi, [ebp + 8]
call fcn.00414a6a
lea ecx, [eax + 1]
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00414a89
mov edi, esi
mov byte [ebp - 4], 2
call fcn.00405a78
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00401518
xor ecx, ecx
jmp 0x41dbc2
lea edi, [eax + 1]
mov ecx, edi
lea edx, [ebp - 0x14]
lea eax, [ebp + 8]
call fcn.00414a89
mov esi, dword [ebp - 0x14]
cmp dword [esi - 0xc], ebx
je 0x41dbd3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41dbb8
push ebx
push esi
call dword [0x42d1d8]
test eax, eax
je 0x41dbe3
lea eax, [esi - 0x10]
call fcn.00401518
mov ecx, edi
lea esi, [ebp + 8]
call fcn.00417671
cmp eax, ebx
jg 0x41db89
xor ebx, ebx
inc ebx
jmp 0x41dbeb
lea eax, [esi - 0x10]
call fcn.00401518
mov eax, dword [ebp + 8]
jmp 0x41db12
lea eax, [esi - 0x10]
call fcn.00401518
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00401518
mov eax, ebx
jmp 0x41db1c
Function at 0x424950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x2c]
push edi
lea esp, [esp]
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea edx, [ecx + ebp - 0x106]
cmp eax, edx
mov dword [esp + 0xc], edi
jb 0x4249e0
mov eax, dword [esi + 0x38]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call fcn.00427d64
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], ebp
sub dword [esi + 0x6c], ebp
add esp, 0xc
sub dword [esi + 0x5c], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x4249af
sub eax, ebp
jmp 0x4249b1
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4249a0
mov ecx, dword [esi + 0x40]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x4249d0
sub eax, ebp
jmp 0x4249d2
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x4249c1
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x424a9a
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [esp + 0xc]
mov ebx, eax
cmp ebx, ecx
mov dword [esp + 0x10], edx
jbe 0x424a08
mov ebx, ecx
test ebx, ebx
je 0x424a5c
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x424a2a
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.00426c60
jmp 0x424a43
cmp eax, 2
jne 0x424a4a
mov ecx, dword [edi]
test ecx, ecx
mov eax, dword [edi + 0x30]
jne 0x424a3c
xor eax, eax
jmp 0x424a47
mov edx, ebx
call fcn.00426ee0
mov edx, dword [esp + 0x10]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.00427d64
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x424a86
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
add edx, eax
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x424a9a
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x424960
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x426ee0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x426f12
lea esp, [esp]
test cl, 3
je 0x426f12
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x433a80]
add ecx, 1
sub esi, 1
jne 0x426ef0
cmp esi, 0x20
push ebx
push edi
jb 0x4270fc
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x433e80]
xor edx, dword [ebx*4 + 0x434280]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x433a80]
add ecx, 4
xor edx, dword [eax*4 + 0x434680]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x433e80]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x434280]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x433a80]
add ecx, 4
xor eax, dword [edx*4 + 0x434680]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x433e80]
xor edx, dword [ebx*4 + 0x434280]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x433a80]
xor edx, dword [eax*4 + 0x434680]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x433e80]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x434280]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x433a80]
xor eax, dword [edx*4 + 0x434680]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x433e80]
xor edx, dword [ebx*4 + 0x434280]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x433a80]
xor edx, dword [eax*4 + 0x434680]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x433e80]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x434280]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x433a80]
and edx, 0xff
xor eax, dword [edx*4 + 0x434680]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x433e80]
xor edx, dword [ebx*4 + 0x434280]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x433a80]
add ecx, 4
xor edx, dword [eax*4 + 0x434680]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x433e80]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x434280]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x433a80]
and edx, 0xff
xor eax, dword [edx*4 + 0x434680]
sub edi, 1
jne 0x426f22
cmp esi, 4
jb 0x427149
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x433e80]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x434280]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x433a80]
and eax, 0xff
xor edi, dword [eax*4 + 0x434680]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x427106
test esi, esi
pop edi
pop ebx
je 0x42716d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x433a80]
add ecx, 1
sub esi, 1
jne 0x427150
not eax
pop esi
ret
Function at 0x35b3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.035b378f
jae 0x35b370e
xor ecx, ecx
call fcn.035b378f
jae 0x35b373d
xor eax, eax
call fcn.035b378f
jae 0x35b374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.035b378f
adc al, al
jae 0x35b372f
jne 0x35b3779
stosb byte es:[edi], al
jmp 0x35b3711
call fcn.035b379b
sub ecx, ebx
jne 0x35b3756
call fcn.035b3799
jmp 0x35b3775
lodsb al, byte [esi]
shr eax, 1
je 0x35b3783
adc ecx, ecx
jmp 0x35b3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.035b3799
cmp eax, 0x7d00
jae 0x35b3772
cmp ah, 5
jae 0x35b3773
cmp eax, 0x7f
ja 0x35b3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x35b3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x105e2500
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x105e26ed
pushal
mov esi, section.UPX1
lea edi, [esi - 0x362000]
push edi
or ebp, 0xffffffff
jmp 0x105e252a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x105e2531
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105e2520
mov eax, 1
add ebx, ebx
jne 0x105e2543
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x105e2554
jne 0x105e2573
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105e2573
dec eax
add ebx, ebx
jne 0x105e2560
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x105e2538
add ebx, ebx
jne 0x105e256f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x105e25c5
xor ecx, ecx
sub eax, 3
jb 0x105e258b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x105e25fa
sar eax, 1
mov ebp, eax
jmp 0x105e2596
add ebx, ebx
jne 0x105e2596
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105e2564
inc ecx
add ebx, ebx
jne 0x105e25a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105e2564
add ebx, ebx
jne 0x105e25b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x105e25a6
jne 0x105e25c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x105e25a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x105e25e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x105e25d6
jmp 0x105e2526
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x105e25e4
add edi, ecx
jmp 0x105e2526
pop esi
mov edi, esi
mov ecx, 0x6e8c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x105e2602
cmp byte [edi], 0x22
jne 0x105e2602
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x105e2607
lea edi, [esi + 0x5d7000]
mov eax, dword [edi]
or eax, eax
je 0x105e267f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5ef074]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ef1a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x105e2634
mov ecx, edi
jns 0x105e2663
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ef1a8]
or eax, eax
je 0x105e2679
mov dword [ebx], eax
add ebx, 4
jmp 0x105e2651
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x105e26b0
cmp al, 0xef
ja 0x105e26a3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x105e2685
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x105e2692
mov ebp, dword [esi + 0x5ef1ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x105e26e4
sub esp, 0xffffff80
jmp 0x101063b2
Function at 0x40896b
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
mov ebx, dword [esp]
add esp, 4
call fcn.00408995
add ecx, 0xb6853835
xor dword [edi], ebx
mov ecx, 0xf46965a6
dec eax
inc edi
cmp edi, edx
jne fcn.0040896b
add ecx, 0x8f966df9
ret
Function at 0x40cd38
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40cdec
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040ccc8
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40cdc5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cdf8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40ce13
test ebp, ebp
je 0x40ce13
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40ce1b
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40ce5b
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40ceb7
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40ceb2
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40ce9d
test dl, dl
je 0x40ce99
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40ce9d
add ecx, 2
add eax, 2
test dl, dl
jne 0x40ce7d
xor eax, eax
jmp 0x40cea2
sbb eax, eax
or eax, 1
test eax, eax
je 0x40cec1
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40ce6a
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40ced8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040cd38
test eax, eax
jne 0x40cef0
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040cdf8
mov esi, eax
test esi, esi
jne 0x40cf26
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40cf40
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret