joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [0x489300]
mov ecx, 0xe5692d3a
sub ecx, eax
add dword [0x48a8fc], ecx
mov eax, dword [0x48a184]
lea ecx, [eax + 1]
mov dword [0x48a184], ecx
mov ecx, dword [0x488b58]
dec ecx
mov dword [0x488b58], ecx
or ecx, eax
mov eax, dword [0x48b17c]
dec eax
mov dword [0x48b17c], eax
imul eax, eax, 0x46b379e6
mov edx, dword [0x48c020]
inc edx
mov dword [0x48c020], edx
or edx, eax
cmp ecx, edx
jne 0x401074
mov eax, dword [0x489578]
lea ecx, [eax + 1]
mov dword [0x489578], ecx
mov ecx, dword [0x48b650]
sub ecx, eax
mov dword [0x48b650], ecx
mov eax, dword [0x486c98]
shl eax, 5
add eax, 0x7e84
or eax, 0x9f9a
mov cx, word [0x48e120]
and ecx, eax
mov word [0x48e120], cx
push esi
call fcn.0043d100
add esp, 4
mov ecx, eax
mov eax, dword [0x4885a0]
imul eax, eax, 0x522835f8
mov dword [0x4885a0], eax
add dword [0x48a52c], 0x965df6fb
movzx eax, byte [ecx + esi - 1]
cmp eax, 0x22
jne 0x40115b
mov eax, dword [0x489250]
cmp eax, 0x14a982b8
jne 0x4010df
add dword [0x4877f0], 0x5f3e75fd
mov byte [esi], 0x22
mov ax, word [0x48e0f2]
mov eax, ecx
add eax, esi
mov byte [esi + ecx - 1], 0
and dword [0x48b50c], 0xf5f5ba94
mov cx, word [0x48eeb6]
mov ecx, dword [0x48bf7c]
imul ecx, ecx, 0x83c26696
mov dword [0x48bf7c], ecx
movzx ecx, byte [eax - 2]
dec eax
cmp ecx, 0x22
jne 0x4010fb
mov cx, word [0x48e99e]
movsx ecx, cx
sar ecx, 4
xor ecx, 0xd868935
mov edx, dword [0x4877a8]
shl edx, 3
or edx, ecx
mov dword [0x48a99c], edx
mov cx, word [0x48d0ca]
xor ecx, 0x3f26
mov word [0x48d0ca], cx
jmp 0x40120e
mov dword [0x487424], 0x883abc9f
mov byte [esi], 0x20
mov ax, word [0x48ef92]
add eax, 0x2200
mov word [0x48ef92], ax
add ecx, esi
mov eax, ecx
xor dword [0x489840], 0x11fc9ef9
mov cx, word [0x48c1ec]
imul ecx, ecx, 0x4042
mov word [0x48c1ec], cx
movzx ecx, byte [eax - 2]
dec eax
cmp ecx, 0x20
jne 0x40117d
mov ecx, dword [0x487eb0]
imul ecx, ecx, 0xcb6c4ef1
mov dword [0x487eb0], ecx
mov ecx, dword [0x48afc0]
or ecx, 0xd9fd21f2
xor ecx, 0x2402060c
mov dx, word [0x48f10e]
lea esi, [edx + 1]
mov word [0x48f10e], si
movsx edx, dx
mov esi, 0x84ec5539
sub esi, edx
cmp ecx, esi
jl 0x40120e
mov ecx, dword [0x489150]
sar ecx, 7
mov edx, dword [0x489c30]
add edx, 0x756883cc
xor edx, ecx
mov ecx, dword [0x487a78]
imul ecx, edx
mov dword [0x487a78], ecx
and dword [0x4876c0], 0x518b4a92
pop esi
ret
Function at 0x406a7b
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [0x48b490]
lea ecx, [eax + 1]
mov dword [0x48b490], ecx
add eax, 0x64bec7f0
or dword [0x488954], eax
mov ax, word [0x48c344]
imul eax, eax, 0xfffff400
or eax, 0xffffe524
mov cx, word [0x48cd5e]
and ecx, eax
mov word [0x48cd5e], cx
cmp dword [0x48fc0c], 0
jne 0x406aea
mov ax, word [0x48d7be]
xor eax, 0xef7e
mov word [0x48d7be], ax
call fcn.00417ed2
mov dword [0x48fc0c], eax
mov ax, word [0x48c772]
dec eax
mov word [0x48c772], ax
mov ebx, dword [esp + 0x14]
mov word [0x48c510], 0xc583
push 3
push 0x8d7a
call fcn.00418b05
add esp, 8
mov edi, eax
mov eax, dword [0x48a998]
cmp eax, 0xd9c9a7e3
jg 0x406b2e
mov eax, dword [0x48afd0]
shr eax, 4
mov cx, word [0x48d770]
add ecx, eax
mov word [0x48d770], cx
jmp 0x406b40
mov ax, word [0x48dc90]
imul eax, eax, 0xfffffd94
mov word [0x48dc90], ax
push edi
push ebx
call fcn.0043d566
add esp, 8
mov esi, eax
mov eax, dword [0x486b30]
cmp eax, 0xd2e42430
je 0x406b7e
mov ax, word [0x48e44c]
lea ecx, [eax - 1]
mov word [0x48e44c], cx
mov cx, word [0x48d13e]
xor ecx, eax
xor ecx, 0x57df
mov word [0x48d13e], cx
push edi
push 3
call fcn.0042862d
add esp, 8
add dword [0x487050], 0xba26e557
test esi, esi
jne 0x406c22
mov ax, word [0x48f162]
add eax, 0xffffe4e1
mov word [0x48f162], ax
push 0x442
call dword [0x485fd8]
or dword [0x486470], 0xca4cf635
mov ebp, 3
push ebp
push 0x8d7a
call fcn.00418b05
add esp, 8
mov edi, eax
mov dword [0x4895b4], 0xb3461d12
push edi
push ebx
call fcn.0043d566
add esp, 8
mov esi, eax
mov eax, dword [0x489e34]
lea ecx, [eax + 1]
mov dword [0x489e34], ecx
mov ecx, 0x9d2bc38c
sub ecx, eax
add dword [0x487300], ecx
push edi
push ebp
call fcn.0042862d
add esp, 8
mov ax, word [0x48e664]
add eax, 0xffffd797
mov word [0x48e664], ax
mov eax, dword [0x489910]
mov ecx, dword [0x487c64]
sar ecx, 9
add ecx, eax
mov eax, dword [0x48627c]
or eax, ecx
mov ecx, dword [0x488438]
not ecx
cmp eax, ecx
jne 0x406c51
add dword [0x4888e8], 0xef1a22d3
jmp 0x406c5b
xor dword [0x48bf1c], 0xf763ccde
test esi, esi
je 0x406ca9
mov eax, dword [0x4882bc]
shr eax, 1
and eax, 0x28f9
mov cx, word [0x48d4e6]
or ecx, eax
mov word [0x48d4e6], cx
push esi
push 1
push 4
push 0x48fc0c
call fcn.0043d90f
add esp, 0x10
mov word [0x48cdc6], 0x5181
push esi
call fcn.0043d9f5
add esp, 4
and dword [0x48895c], 0xdfef86bb
xor dword [0x486fb8], 0xb6feef25
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408d54
Capabilities:
Encode data using xor

Disassembly:
and dword [0x488380], 0x4faea412
mov eax, dword [0x48967c]
cmp eax, 0xad180aaf
jne 0x408d74
add dword [0x489194], 0x7fc37975
push edi
push esi
sub esp, 0x10
add dword [0x486c80], 0x2d9b5d96
xor dword [0x48a908], 0xdb90d2b3
add dword [0x4875ec], 0x957043d6
lea eax, [esp]
push eax
call dword [0x485f80]
xor dword [0x486b6c], 0x6a3594d3
movzx eax, word [esp + 0xe]
mov cx, word [0x48d156]
movsx ecx, cx
mov edx, dword [0x48ad5c]
lea edx, [edx + edx + 0x4f5e57a6]
or edx, ecx
mov ecx, dword [0x487b38]
imul ecx, edx
mov dword [0x487b38], ecx
xor edi, edi
mov ecx, 0x15
mov edx, dword [0x486b84]
or edx, 0x92be6027
xor dword [0x4889a0], edx
mov edx, dword [0x488d74]
shl edx, 5
mov esi, dword [0x488554]
and esi, edx
and esi, 0xdaa469c0
mov dword [0x488554], esi
lea edi, [edi + eax*2]
add eax, eax
mov edx, dword [0x4889c8]
imul edx, edx, 0x37f86a40
mov si, word [0x48de70]
xor esi, edx
mov word [0x48de70], si
dec ecx
jne 0x408ddf
xor dword [0x48a9e8], 0xb80a1390
call fcn.00430d60
mov esi, eax
xor esi, edi
and dword [0x488b38], 0xf1e9aec4
call dword [0x485f40]
xor eax, esi
mov ecx, dword [0x48b560]
add ecx, 0x53d3
xor ecx, 0x3c2e
mov dx, word [0x48cb0c]
and edx, ecx
mov word [0x48cb0c], dx
push eax
call fcn.00441c0e
add esp, 4
mov eax, dword [0x489850]
lea ecx, [eax + 1]
mov dword [0x489850], ecx
mov dword [0x486ddc], eax
add esp, 0x10
pop esi
pop edi
ret
Function at 0x41ab16
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4887b0]
lea ecx, [eax + 1]
mov dword [0x4887b0], ecx
cmp eax, 0x1bd015b8
jne 0x41ab3e
mov ax, word [0x48ca1c]
add eax, 0x1a02
mov word [0x48ca1c], ax
jmp 0x41ab48
xor dword [0x48a148], 0x20baa864
push ebp
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x1c]
inc dword [0x48b834]
mov eax, dword [0x4896c8]
and eax, 0xca82
mov dx, word [0x48e612]
imul edx, eax
mov word [0x48e612], dx
mov eax, dword [0x4863f8]
lea edx, [eax + 1]
mov dword [0x4863f8], edx
add eax, 0xb9912864
cmp eax, 0x9d39bd7b
jg 0x41ab96
or dword [0x488a9c], 0x4eeeefe
mov esi, dword [esp + 0x18]
mov eax, dword [0x48c078]
xor eax, 0xfd4ca3bc
mov edx, dword [0x488358]
dec edx
mov dword [0x488358], edx
or edx, eax
xor dword [0x48884c], edx
mov eax, ecx
and eax, 0x1f
mov dx, word [0x48d21a]
movsx edx, dx
sar edx, 4
mov edi, 0x4b929858
sub edi, edx
and dword [0x48a13c], edi
cmp ecx, 0x20
jl 0x41ac5a
mov edx, ecx
sar edx, 0x1f
shr edx, 0x1b
add edx, ecx
sar edx, 5
add dword [0x48a820], 0x46e159f2
xor ecx, ecx
cmp dword [esi + 4], edx
jle 0x41ac1b
lea edi, [edx*4]
xor ecx, ecx
mov ebx, dword [esi + 8]
lea ebp, [ebx + edi]
mov ebp, dword [ebp + ecx*4]
mov dword [ebx + ecx*4], ebp
inc ecx
mov ebx, dword [esi + 4]
sub ebx, edx
cmp ecx, ebx
jl 0x41ac04
mov edx, dword [0x48801c]
or edx, 0x83db6378
mov edi, dword [0x48a200]
imul edi, edx
mov dword [0x48a200], edi
jmp 0x41ac43
mov edx, dword [esi + 8]
mov dword [edx + ecx*4], 0
inc ecx
cmp ecx, dword [esi + 4]
jl 0x41ac38
mov ecx, dword [0x48a22c]
imul ecx, ecx, 0xd188e696
mov dword [0x48a22c], ecx
add dword [0x489f44], 0x1f930681
test eax, eax
je 0x41ad31
mov ecx, dword [0x4881e8]
imul ecx, ecx, 0x2429ecb6
mov dword [0x4881e8], ecx
mov edi, dword [esi + 4]
test edi, edi
jle 0x41ad27
mov ecx, 0x20
mov edx, eax
sub ecx, edx
mov dword [esp], ecx
inc edi
xor ebp, ebp
and dword [0x487784], 0x9d4742cd
mov ecx, dword [esi + 8]
mov ebx, dword [ecx + edi*4 - 8]
mov ecx, dword [0x488cfc]
mov eax, 0xd4ffd9d0
sub eax, ecx
mov ecx, dword [esp]
shl ebx, cl
and dword [0x48a5a8], eax
mov eax, dword [esi + 8]
mov cl, dl
shr dword [eax + edi*4 - 8], cl
mov ax, word [0x48df68]
or eax, 0x3922
mov word [0x48df68], ax
mov eax, dword [esi + 8]
or dword [eax + edi*4 - 8], ebp
mov eax, dword [0x4866c4]
lea ecx, [eax + 1]
mov dword [0x4866c4], ecx
mov ecx, 0xf1a380d0
sub ecx, eax
xor dword [0x4891a0], ecx
mov eax, dword [0x48b6e8]
mov eax, dword [0x489158]
xor eax, 0x12083b99
mov ecx, dword [0x48a2b0]
imul ecx, eax
mov dword [0x48a2b0], ecx
dec edi
cmp edi, 1
mov ebp, ebx
jg 0x41ac98
add dword [0x4881bc], 0x792ecc75
mov eax, dword [0x488864]
or eax, 0xd7ffbfff
cmp eax, 0xdaf2a0f8
lea esp, [esp + 4]
pop esi
pop edi
pop ebx
pop ebp
ja 0x41ad54
or dword [0x487f34], 0xfab447ef
xor eax, eax
ret
Function at 0x424c66
Capabilities:
Hash data with md5

Disassembly:
push esi
mov ax, word [0x48cf10]
xor eax, eax
mov dword [ecx], eax
mov edx, dword [0x48988c]
shl edx, 4
mov esi, dword [0x48a570]
and esi, edx
and esi, 0x44daf390
mov dword [0x48a570], esi
mov dword [ecx + 4], eax
mov eax, dword [0x487c18]
mov edx, 0x8003fdb9
sub edx, eax
xor dword [0x489ec0], edx
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x4897dc]
mov dx, word [0x48cbf2]
and edx, eax
mov word [0x48cbf2], dx
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x48a820]
dec eax
mov dword [0x48a820], eax
xor eax, 0xb457d79
cmp eax, 0x133c300c
jl 0x424ce7
mov dword [0x487024], 0xdf7fb9b7
mov dword [ecx + 0x10], 0x98badcfe
xor dword [0x486b14], 0x917b1ef5
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x4874fc]
cmp eax, 0x59d2b686
jg 0x424d37
mov eax, dword [0x488134]
mov ecx, dword [0x487970]
shl ecx, 2
sub eax, ecx
mov ecx, dword [0x489518]
inc ecx
mov dword [0x489518], ecx
and ecx, eax
mov eax, dword [0x48ab38]
imul eax, ecx
mov dword [0x48ab38], eax
pop esi
ret

Function at 0x4255bb
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
cmp ecx, edx
je 0x40ede1
mov esi, edx
sub esi, ecx
lea edi, [eax - 1]
mov bl, byte [ecx - 1]
dec ecx
mov byte [edi], bl
dec edi
cmp edx, ecx
jne 0x40edd4
add eax, esi
pop esi
pop edi
pop ebx
ret
mov eax, dword [0x486b48]
inc eax
mov dword [0x486b48], eax
and eax, 0xf0a3
mov cx, word [0x48c490]
imul ecx, eax
mov word [0x48c490], cx
push dword [0x48f444]
call fcn.004087bf
add esp, 4
mov eax, dword [0x48ade8]
dec eax
mov dword [0x48ade8], eax
mov cx, word [0x48e96e]
imul eax, eax, 0xddf6151d
add eax, ecx
mov word [0x48e96e], ax
xor eax, eax
inc eax
push eax
call fcn.00441bc1
add esp, 4
jmp 0x40edba
Function at 0x45faf2
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f8e6

Function at 0x461d86
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00461560

Function at 0x461d91
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046179b
Function at 0x2e01b247
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.2e015dc1
and dword [ebp - 4], 0
cmp dword [0x2e022c68], 0
mov ebx, eax
jne 0x2e01b2f8
push 0x2e002d40
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x2e01b3a9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2e002d34
push edi
call esi
test eax, eax
je 0x2e01b3a9
push eax
call fcn.2e015d4f
mov dword [esp], 0x2e002d24
push edi
mov dword [0x2e022c68], eax
call esi
push eax
call fcn.2e015d4f
mov dword [esp], 0x2e002d10
push edi
mov dword [0x2e022c6c], eax
call esi
push eax
call fcn.2e015d4f
mov dword [esp], 0x2e002cf4
push edi
mov dword [0x2e022c70], eax
call esi
push eax
call fcn.2e015d4f
pop ecx
mov dword [0x2e022c78], eax
test eax, eax
je 0x2e01b2f8
push 0x2e002cdc
push edi
call esi
push eax
call fcn.2e015d4f
pop ecx
mov dword [0x2e022c74], eax
mov eax, dword [0x2e022c74]
cmp eax, ebx
je 0x2e01b350
cmp dword [0x2e022c78], ebx
je 0x2e01b350
push eax
call fcn.2e015dca
push dword [0x2e022c78]
mov esi, eax
call fcn.2e015dca
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x2e01b350
test edi, edi
je 0x2e01b350
call esi
test eax, eax
je 0x2e01b347
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x2e01b347
test byte [ebp - 0xc], 1
jne 0x2e01b350
or dword [ebp + 0x10], 0x200000
jmp 0x2e01b389
mov eax, dword [0x2e022c6c]
cmp eax, ebx
je 0x2e01b389
push eax
call fcn.2e015dca
pop ecx
test eax, eax
je 0x2e01b389
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x2e01b389
mov eax, dword [0x2e022c70]
cmp eax, ebx
je 0x2e01b389
push eax
call fcn.2e015dca
pop ecx
test eax, eax
je 0x2e01b389
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2e022c68]
call fcn.2e015dca
pop ecx
test eax, eax
je 0x2e01b3a9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x2e01b3ab
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x435db8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x435db8
lcall 0x5de5, 0x8b10c483
jmp fcn.00969830
Function at 0x426325
Capabilities:
Encode data using xor

Disassembly:
push eax
invalid
push 0x56
fimul word [edx - 0x42347ae4]
fistp qword ds:[ecx]
js 0x4262e9
jp 0x426379
aam 0xc1
stosb byte es:[edi], al
imul edx, dword [ecx], 0x51c8ba1c
invalid
sal byte [ecx + eax*4 - 0x27e745c5], 1
invalid

Function at 0x442224
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebx + 0x35bff638], ecx
push cs
mov edi, 0x87a08253
sub byte [ecx - 0x7568e35d], ah
wait
mov ebx, edi
fist dword [edi]
pop ss
pushal
movsb byte es:[edi], byte [esi]
push 0xfffffffffffffff5
mov ch, 0xe0
mov byte [eax], ah
imul edi, esi, 0xffffffd0
invalid
or al, byte [edx - 0x51cffe25]
or esp, dword [esi + 0x4d73d96a]
inc esp
jo 0x442151
push ecx
adc dword [eax + eax*2 + 0x4046a6b3], edi
mov bl, 0xa6
inc esi
inc eax
adc bh, byte cs:[eax + edx + 0x3b]
sbb eax, 0xf02f8e66
or esi, dword [ebp - 0x23]
shr byte [ebp - 0x766b5e01], 1
push esp
or edx, edi
fdivr st(2)
je 0x442231
jle 0x4421ff
loope 0x44213b
mov cl, 3
push edi
cmp byte [ebx], 0x16
push ss
mov ecx, dword [esi - 0x6d]
xchg ebx, eax
loop 0x442221
mov esp, 0x32924077
adc byte cs:[eax + ecx + 0xa], ah
xor dword [ebx], ecx
jl 0x442195
jbe 0x4421d3
int 0xf5
pop ss
lodsb al, byte [esi]
mov eax, dword [0xb7b1884b]
scasd eax, dword es:[edi]
out dx, eax
pushfd
cmp al, 0xfb
add al, 0x33
push edi
mov bh, 0x56
or ebp, dword [eax - 0x5c]
loopne 0x442184
and byte [edi - 0x2b41faad], cl
cmp eax, 0x5dab3874
adc al, 0x29
jp 0x442198
xor ch, ah
stosd dword es:[edi], eax
ja 0x44220b
dec edi
xchg byte [edi + 0x7fce8b54], dh
aad 0xc7
imul esp, edx, 0xed096ff
je 0x4421bf
mov byte [edi], dh
mov dh, 0x55
push 0xffffffffffffff8b
cmpsd dword [esi], dword es:[edi]
push ecx
invalid
xor ch, bl
imul esi, dword [ebx - 0x7c], 0xffffffd8
jae 0x4421aa
fadd st(0)
cmpsd dword [esi], dword es:[edi]
mov ss, word [ecx - 0x37]
pop ss
or edi, dword [ecx + 0x54]
dec esi
stosb byte es:[edi], al
inc ebp
popfd
pop eax
xor dword [ebx + 0x1d], ebx
cmp edi, dword [esi]
or dword [esi], edx
jns 0x442221
add ch, byte [ecx - 0x485a97ef]
out dx, eax
xchg edx, eax
mov edx, ds
or al, 0x2f
sti
and eax, 0x100386ed
in al, 0x68
mov dl, 0x7a
xchg ebp, eax
ja 0x442251
ljmp 0xdb1b:0x7e497619
rol byte [edx], 1
imul edi, ecx, 0xffffffd3
retf 0xee3a

Function at 0x468e3e
Capabilities:
Encode data using xor

Disassembly:
test dword [esi], esp
bound edx, qword [ebx - 0x40b6a971]
test byte [ecx + 0x18581cb9], dh
inc ecx
inc edi
Function at 0x46f662
Capabilities:
Check http status code

Disassembly:
mov ebp, 0xc5e7aa10
insd dword es:[edi], dx
mov ecx, 0xd6a78ae3
outsb dx, byte [esi]
mov ch, 0x6c
mov dl, 0xb1
cld
mov edi, 0x6f0161c8
xchg ecx, eax
sub dword [edi], 0x6e
or byte [ebx + 0x78], al
sub byte [ebx - 0x587746f], 0xea
add esp, dword [eax - 0xbfe75e5]
js 0x46f6b9
push 0xffffffffffffffbc
out dx, eax
xchg edx, eax
adc al, 0x81
add byte [ebx + 0x6620ab7a], 0xa4
sbb edx, edi
push eax
mov dl, dh
xor al, 0xe0
mov dword [ecx], edx
in al, dx
jge 0x46f6f6
fcmovnu st(0), st(7)
jecxz 0x46f65d
and ch, byte [edx + 0x77]
mov ah, 0x35
imul edx, ebp, 0xffffffac
xchg ecx, eax
shl dword [eax + 0x64], cl
jmp 0x46f6c8
inc ecx
jge 0x46f6d0
fidiv dword [eax]
sbb dword [ebx], ebp
xchg ecx, eax
invalid
test al, 0xfe

Function at 0x488d8f
Capabilities:
Encode data using xor

Disassembly:
adc byte [edi - 0x63fd22b], ah
hlt
cmpsd dword [esi], dword es:[edi]
aad 0x2d
sar cl, 0xf4
sub bl, byte [ebx + ebp - 0x555715be]
popal
push 0x5aa93128
xchg bl, bl
js 0x488dcc
push ecx
retf
pop ss
push ecx
jno 0x488d8e
sar byte [ebx], 0x80
imul esi, edx, 0x47a9bdf4
pushal
test dword [ecx - 0x4b], ecx
test esi, edi
mov ebp, 0x856047a9
dec ecx
mov ch, 0x64
test esi, edi
mov ds, word [ecx - 0x1b]
pop ebx
dec ecx
dec edx
js 0xc5179bb7
and dword [eax - 0x6abbc1e5], ebp
add esp, dword [ecx + esi*8 + 0x402e9025]
push edx
in al, 0x5b
in al, 0x3a
mov ebp, 0x22eaf2e5
mov byte [ebx - 0x5f], ah
adc al, dl
ficom dword [ebx - 2]
sub al, 0x5e
xor al, 0x3b
rcr dword [ebp - 0x75], cl
or eax, 0x82dbb2e
xchg ebx, eax
push 0xfffffffffffffffb
cdq
shl dword [ebx + ebx*4 - 0x699044ce], cl
mov ah, 0xd
mov ebx, dword [edx + 0x66]
jo 0x488dd6
sbb ebx, dword [edi - 0x75]
push ss
pinsrw mm0, word [eax - 0x4b], 0x3f
push ebx
aaa
add ebx, dword [ebx - 0x32]
or dword [edx], ecx
inc ecx
out 0x6a, al
xor al, 0xa4
fxch st(3)
salc
mov eax, 0x8d6afb9
iretd
Function at 0x60298e
Capabilities:
Encode data using xor

Disassembly:
cmp esi, dword [edx - 0x6ab8c023]
and ebp, dword [eax - 0x45]
pop edx
mov ah, 0x88
lea ecx, [ebp - 0x32]
pop eax
push ss
mov ebx, 0x2927baa5
push ss
sbb bl, bl
pushfd
js 0x60299e
inc esi
add ebx, dword [ebx - 0x34]
inc ebp
xor dword [edi - 0x71b07096], ebx
cmp ebx, 9
xor bl, dl
clc
push es
pop edi
push ebp
in al, dx
mov edx, 0xe54f536
movsd dword es:[edi], dword [esi]
out dx, al
not dword [esi + 0x1ed5f700]
mov esi, 0x2f5a3c5c
neg esi
mov ebp, 0x22e7de80
stosb byte es:[edi], al
rcl byte [ecx + 0xa9d626c], cl
add dword [ebx + 0x60], eax
add ebp, dword [edx + 0x34f2cf43]
mov byte [0xe2855353], bl
jl 0x6029b5
cld
pop edi
leave
or al, 0xb1
cmp eax, 0xc275f8cb
mov ecx, 0xf5d21aa2
sbb dl, dl
cmc
adc al, cl
fisub word [eax - 0x3b]
inc ecx
inc esp
pop es
mov esp, 0x2e4b3ee
fcmovnu st(0), st(4)
push ss
dec bp
inc byte [ebp + ebx*4 + 0x65]
jp 0x602a0e
sbb eax, 0xf5af894
lodsd eax, dword [esi]
aaa
mov ebx, 0x7e0a5561
push 0xfffffffffffffffe
fcom st(6)
pushfd
push ss
cld
mov dword [ebx - 0x29], ebx
cwde
pop ss
aad 0xec
imul esi, dword [ecx + ebp*8], 0xaab7a74b
xchg edi, eax
inc dx
salc
jmp 0x6029fc

Function at 0x627585
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x62e3d0
cmp edx, dword [eax]
je 0x6275a7
add eax, 8
inc ecx
cmp eax, 0x62e460
jl 0x627598
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x62e3d0]
jne 0x6276d5
mov eax, dword [0x636d78]
cmp eax, 1
je 0x6276af
test eax, eax
Function at 0x1000101a
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
push 0x1000a02c
push 1
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1000b1f4], eax
cmp dword [0x1000b1f4], 0
je 0x10001075
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100010a5
push str.Globalwmpinst1998
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [0x1000b1f4], eax
cmp dword [0x1000b1f4], 0
jne 0x10001097
jmp 0x100010a5
push 0xffffffffffffffff
push dword [0x1000b1f4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret

Function at 0x100010c1
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0xc], 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
push 0x1000a054
push 1
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x1000b1f8], eax
cmp dword [0x1000b1f8], 0
je 0x1000111c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000114c
push str.Globalwmpproc1998
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [0x1000b1f8], eax
cmp dword [0x1000b1f8], 0
jne 0x1000113e
jmp 0x1000114c
push 0xffffffffffffffff
push dword [0x1000b1f8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
Function at 0x1000114e
Capabilities:
Delete file
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4ac
and dword [ebp - 0x4a0], 0
and byte [ebp - 0x4ac], 0
mov dword [ebp - 0x98], 1
push 0x94
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.100071f9
add esp, 0xc
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 5
pop eax
cmp eax, dword [ebp - 0x90]
sbb eax, eax
neg eax
mov dword [ebp - 0x49c], eax
push 0x1000a07c
call dword [sym.imp.MSVCRT.dll_getenv]
pop ecx
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a0], 0
jne 0x100011e3
push 0x1000a08c
call dword [sym.imp.MSVCRT.dll__strdup]
pop ecx
mov dword [ebp - 0x4a0], eax
mov byte [ebp - 0x4ac], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push dword [ebp - 0x4a0]
push str._s_d.dat
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0xffffffff
jne 0x10001253
movzx eax, byte [ebp - 0x4ac]
test eax, eax
je 0x1000124b
push dword [ebp - 0x4a0]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 1
pop eax
jmp 0x10001321
push 0
lea eax, [ebp - 0x4a4]
push eax
push 4
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x4a8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x4a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0xffffffff
jne 0x100012d3
movzx eax, byte [ebp - 0x4ac]
test eax, eax
je 0x100012ce
push dword [ebp - 0x4a0]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 1
pop eax
jmp 0x10001321
and dword [ebp - 0x98], 0
push 0
lea eax, [ebp - 0x4a4]
push eax
push 4
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x4a8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x4a8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x98], 0
je 0x1000131e
xor eax, eax
jmp 0x10001321
push 1
pop eax
leave
ret