joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494f86
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
outsd dx, dword [esi]
mov eax, 0x9572a9e3
inc edi
in al, dx
aad 0x30
mov ch, 0xd4
test dword [ecx], edx
rcl byte [edi - 0x4c], cl
adc byte [edx + 0x49333e32], bl
fst qword [edi + 0x74]
imul ebx, esi, 0x1c
xor byte [esi + 0x20], bl
dec dword [edi + 0x6bb0e9c]
mov dl, 0x30
pop edx
lodsb al, byte [esi]
mov ah, 0x32
out dx, al
sar byte [edx - 0x758ae1d9], 1
xor dh, dh
and dword [ebp - 0xdda8682], ecx
xor byte [ecx - 0x6b], bl
scasb al, byte es:[edi]
je 0x494f9b
xor ecx, dword ds:[ecx - 0x23]
push edi
je 0x49500d
ficomp word [eax + esi]
pop esi
and bh, bh
invalid
pop esp
mov edx, 0x42283b35
invalid
sti
mov ebx, 0x20f2529a
lahf
add byte [0x8bdae774], 0x2e
pushfd
out dx, eax
mov bl, 0xda
and eax, 0xffffff8d
daa
fsub st(3)
xor al, 0xfa
js 0x495083
test eax, 0x5a8b4bb
push ebp
mov dl, 0x3e
xor bh, dh
sub byte [edx - 0x3c], ch
sahf
lodsd eax, dword [esi]
sub dh, byte [ebp - 0x4cff1228]
fldenv [eax + 0x619b3b39]
wait
mov dword [edx], ebp
xor al, 0x9b
neg byte [edx + 0x2909637]
pop eax
in eax, 0xd7
and dword [edi - 0x225e2498], ebp
push esi
invalid
dec edx
stc
dec ebx
inc esp
jmp 0x4950b7
retf 0xb625

Function at 0x4ab436
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5c81a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x14], 8
jb 0x4ab476
mov dword [ebp - 0x1c], 1
jmp 0x4ab47d
mov dword [ebp - 0x1c], 0
mov dl, byte [ebp - 0x1c]
mov byte [ebp - 0xd], dl
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x4ab4f0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x14]
add eax, 1
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
shl ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1000
jb 0x4ab4d9
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.004ab126
add esp, 8
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x24]
push eax
call fcn.005e84bc
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x14], 7
xor eax, eax
mov word [ebp - 0x10], ax
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp - 0x14]
mov cx, word [ebp - 0x10]
mov word [eax + edx], cx
mov ecx, dword [ebp - 0xc]
shl dword [edi + 0x51], 1
sbb ebp, edx
mov word [ecx], es
push ecx
arpl word [eax + 0x7c], cx
cmp esp, ecx
pop esp
Function at 0x4ac416
Capabilities:
Encode data using xor

Disassembly:
invalid
wait
or dword [ebx - 0x7b6cb423], ebx
test bl, ah
mov ah, 0x5e
xlatb
push es
test eax, 0xb95fb586
pop ebp
sub byte [esi], bl
sub dword [eax + 0x31], edx
inc edi
push es
loope 0x4ac3fd
or eax, 0xa5608c29
push es
das
imul eax, dword [esi - 0x38], 0xffffffce
jno 0x4ac43e
das
int 0x2a
invalid
das
or byte [esi - 0x48], dh
lds eax, [edx + 0x4829c8af]
jbe 0x4ac426
salc
je 0x4ac3b4
sub eax, 0x40c4e70
pop eax
scasb al, byte es:[edi]
or dword [ebx], ebp
scasd eax, dword es:[edi]
cmp byte [ebx + 0x79], dl
pushfd
push ebx
jns 0x4ac3b7
push ecx
sbb ecx, dword [ecx - 0x7bf9144]
push ebp
and eax, 0x3a7c4334
jl 0x4ac462
dec esp
shr byte [esi + 0x1e793f5f], 0x1a
outsd dx, dword [esi]
xor ecx, esp
pop ds
or eax, 0xfc79dda0
jns 0x4ac418
popal
lodsb al, byte [esi]
cmp eax, 0xb6ddd795
aaa
mov ah, 0xa
invalid
xchg ebp, eax
xlatb
fnsave dword [esi - 0xff54bc9]
int1
movsb byte es:[edi], byte [esi]
das
sub byte [esi + edx*8 + 0x4a], cl
cmp ch, dl
sbb dword [ecx], esp
or dword [eax], eax
jno 0x4ac461
xor byte [eax + 8], bh
std

Function at 0x4ba400
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x10], eax
push str.TEdit2213
push str.TCaption2212
call fcn.00417e10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4ba44b
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x4c7aac]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
jmp fcn.00685ac4
Function at 0x4bb93d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4368
cmp edx, dword [eax]
je 0x4bb95f
add eax, 8
inc ecx
cmp eax, 0x4c43f8
jl 0x4bb950
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4368]
jne 0x4bba8d
mov eax, dword [0x4c8cec]
cmp eax, 1
je 0x4bba67
test eax, eax
jne 0x4bb990
cmp dword [0x4c4294], 1
je 0x4bba67
cmp edx, 0xfc
je 0x4bba8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb9c7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc320
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc7b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bba0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc7b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0b8c
push edi
call fcn.004be680
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc320
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc330
lea eax, [ebp - 0xa0]
push 0x4c0b6c
push eax
call fcn.004bc330
push dword [esi + 0x4c436c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc330
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be5f4
add esp, 0x2c
pop edi
jmp 0x4bba8d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c436c]
push 0
push eax
push dword [esi]
call fcn.004bc7b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4017f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x164]
cmp dword [edi], ebx
jne 0x40182a
lea ecx, [esi + 0x17c]
call fcn.0040179b
lea edi, [esi + 0x170]
cmp dword [edi], ebx
jne 0x401833
cmp dword [esi + 0x18c], ebx
jne 0x442663
pop edi
pop esi
pop ebx
ret
mov ecx, edi
call fcn.0040280c
jmp 0x401801
mov ecx, edi
call fcn.004855d7
jmp 0x401816
xor al, 0x3e
xor esp, esi
inc eax
push edi
mov ecx, 0x9fd54a47
invalid

Function at 0x406902
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x40692a
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x40691c
pop edi
pop esi
pop ebp
ret 4

Function at 0x42e5b1
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
pop ebp
inc esi
cdq
or ecx, dword [ebp - 0x4409183c]
push ebx
aaa
invalid

Function at 0x441f16
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x3afb9c31]
mul byte [esi + 0x8718111]
push esp
lahf
mov esp, 0x3b43ac46
xor al, 0xf5
imul eax, ecx, 0x72
mov byte [0xfd657a67], al
mov cl, 0x47
xchg edx, eax
aas
invalid
Function at 0x44caad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], edi
lea edx, [edi - 1]
test edi, edi
je 0x44cb15
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [ebp - 4], eax
xor ebx, ebx
xor ecx, ecx
test ax, ax
je 0x44cb0c
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [eax]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, ax
cmp word [ebp - 0xc], ax
je 0x44cb1a
inc ebx
movzx eax, word [edi + ebx*2]
test ax, ax
jne 0x44caf1
mov edi, dword [ebp - 0x10]
test ecx, ecx
jne 0x48c62d
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 4
or eax, 0xffffffff
jmp 0x44cb0e
inc ecx
jmp 0x44caf7
cwde
or byte [edx - 0x5687a695], 0xe2
loop 0x48c5d3
cld
aas
dec edi
aaa
invalid
movsd dword es:[edi], dword [esi]
mov dl, 0x1a
sbb dword [eax], ecx
mov ecx, dword [ebp - 0x6f]
dec ebp
xchg ecx, eax
cld
jl 0x48c651
mov dl, 0xbd
mov eax, dword [0x63932a58]
nop
jp 0x48c64a
lodsb al, byte [esi]
scasd eax, dword es:[edi]
adc edx, edi
mov ebp, 0xedc87a27
pop edi
xchg ecx, eax
mov edi, 0x46cb1e7
push edi
dec eax
xchg ebx, eax
sub dword [edx - 0x53b847a1], 0x62e308e9
mov bh, 0x54
mov dword [ecx], edx
leave
cwde
imul byte [ecx]
fsubr st(2)
adc al, 0xc2
and eax, edx
sbb al, 0xe4
mov ebp, 0x4c8757a3
ror dword [ebx - 0x5b4b8eb5], 0xe2
mov bh, 0xb0
arpl word [edx - 0x2b72697f], si
jae 0x48c5c6
jno 0x48c5e3
movsb byte es:[edi], byte [esi]
loop 0x48c5e9
mov al, 0x63
mov dl, 0x81
xchg esi, eax
invalid
jmp 0xffdafa54
aad 0x7a
movsb byte es:[edi], byte [esi]
push eax
fadd qword [eax]
aam 0x31
xor dword [ebp + 0x71], edx
ja 0x48c61f
push ebp
jno 0x48c6cc
leave
lahf
test ax, 0x9291
push esi
push 0x317942c0
pop ebp
out dx, eax
sub byte [edx], al
in eax, dx
aas
xlatb
in al, dx
daa
insb byte es:[edi], dx
ja 0x48c652
stc
mov word [eax - 6], cs
mov dl, 0x6b
inc edx
mov bh, 9
jae 0x48c661
mov ch, 0x82
mov byte [0xaba3d37c], al
xchg dword [ecx], eax
sub al, 0x53
sbb ah, byte [esi]
mov ebp, 0xd77580c4
push ecx
mov ecx, 0x4dad585d
out dx, eax
pop esp
mov ebx, 0xbf1aac11
outsb dx, byte [esi]
int3
pop edi
mov byte [edi + 0x19], bl
pushfd
shl byte [edx + 0x6ff11069], 0x1a
push edi
ljmp 0xe71c
loopne 0x48c6b2
shl byte [edx + 0x45], 0x23
cmp esp, dword [ecx + edx*2 - 0x52e2b91d]
cmp ch, bh
inc ecx
and edi, dword [ebx]
movsb byte es:[edi], byte [esi]
push ecx
jecxz 0x48c718
sbb eax, 0x41fd38ad
add byte [eax - 0x5a68d361], 0x6a
adc al, 0x84
and ch, bh
out dx, eax
jmp 0x48c6e1
cli
cmp dword [edi], ebp
xchg ebx, eax
je 0x48c730
add al, 0xf4
aaa
mov dh, 0x37
adc ebx, esp
fbstp tbyte [ebp - 0x6c8c7f75]
add dword [edx + 0x4447d8cc], edx
inc esp
mov ecx, 0x9c4a725b
inc esi
jmp 0x48c6c7
Function at 0x44e429
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ecx + 0x14], 0
jne 0x48d098
push dword [ebp + 8]
call fcn.0047853b
pop ecx
leave
ret 4
mov ebp, 0x9f13cf7
xor dword [ecx + 0x49], ebx
aas
xor byte [eax + 0x17], 0x52
pop ss
push edx
jnp 0x48d106
mov al, 0x2f
cwde
bound eax, qword [ecx + 0x14]
pop eax
push ebx
in al, 0x1b
invalid
sub al, 0xcf
jb 0x48d15b
mov esp, 0xd84eb642
pop ds
jne 0x48d0a3
mov byte cs:[edx], cl
inc ecx
xchg ebx, eax
aaa
cdq
pushfd
test byte [eax + 0x5f], cl
les edx, [ebx - 0x67]
xchg dword [ebx + ecx*4], eax
loope 0x48d18b
loope 0x48d186
pop ecx
pop esp
iretd
or byte [edx + 0x4532c17e], 0x59
inc ebp
pop ecx
add dword [ebx + 0x598fd18e], esi
xlatb
mov dword [edx + 0x38], ebp
test eax, edi
div dword [edx]
in al, 0xe2
rol dword [eax - 0x79], 1
xchg edx, eax
sahf

Function at 0x44e7ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 8], 0
je 0x44e832
cmp dword [ebp + 0x10], 0
jne 0x44e82c
cmp dword [ebp + 0x10], 1
mov ebx, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], edx
je 0x48d271
mov eax, dword [edi + 0xc]
cdq
sub ebx, eax
sbb ecx, edx
cmp dword [ebp - 4], ecx
jg 0x44e7f7
jl 0x44e878
cmp esi, ebx
jb 0x44e878
mov eax, dword [edi + 8]
cdq
add eax, ebx
adc edx, ecx
sub eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
sbb edx, 0
cmp eax, edx
jl 0x44e816
jg 0x44e878
cmp esi, dword [ebp - 8]
ja 0x44e878
mov ecx, esi
mov dword [edi + 0x14], eax
sub ecx, ebx
mov dword [edi + 0x10], esi
mov dword [edi + 0xc], ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [ebp + 0x10], 1
je 0x44e7c9
and dword [edi + 8], 0
and dword [edi + 0xc], 0
cmp dword [ebp + 0x10], 1
mov ebx, dword [0x49c1d8]
je 0x48d282
push dword [ebp + 0x10]
push 0
push edx
push esi
push dword [edi]
call ebx
push 1
mov esi, eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push dword [edi]
call ebx
mov eax, dword [ebp + 8]
test esi, esi
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x14], eax
setne al
jmp 0x44e825
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
jmp 0x44e832
xor eax, ecx
stosb byte es:[edi], al
mov dl, 0x40

Function at 0x44fc22
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x44fc4a
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x44fc3c
pop edi
pop esi
pop ebp
ret 4
Function at 0x45000b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, ecx
test esi, esi
je 0x450077
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp ebx, dword [ecx + 4]
jae 0x450077
cmp esi, 0xffffffff
je 0x450070
lea eax, [ebx + esi]
cmp eax, dword [ecx + 4]
ja 0x450070
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
cmp eax, 1
jg 0x48df83
push esi
mov ecx, edi
call fcn.0045021a
mov eax, dword [ebp + 8]
mov dword [edi + 4], esi
add esi, esi
push esi
mov eax, dword [eax]
lea eax, [eax + ebx*2]
push eax
push dword [edi]
call fcn.0046a106
mov eax, dword [edi]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov esi, dword [ecx + 4]
sub esi, ebx
jmp 0x450032
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.00452698
jmp 0x450069
sub ah, bl
invalid

Function at 0x4765d1
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0xe3625e5e
mov dword [0x8a36a940], eax
and al, 0x77
daa
ficomp word [ecx + 0x228cf11c]
arpl word [eax], bp
cdq
add byte [edi + 0x4523ed74], al
and ah, dl
sub byte [ecx], 0xca
push esp
invalid
Function at 0x477baa
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0x20
rcr byte [esi], 0x85
cli
test edx, edi
xor dword [edx], esi
sub bl, byte [esi]
insd dword es:[edi], dx
test eax, 0x54d49e8d
dec edi
xor ah, byte [ebp - 1]
in eax, 0xce
mov ebp, 0x9b6e88e3
xor dword [ebp - 0x29], esp
stosd dword es:[edi], eax
push ss
js 0x477b5d
daa
cmp esi, ecx
arpl word [ecx - 0xdddc7f3], bp
adc byte [esi], al
pop ebx
fcomp dword [edi + 2]
in al, 0x4b
inc ecx
mov dl, 0xa2
mov ss, ecx
shl ebx, cl
and ecx, 0
out dx, eax
or dh, dl
xor al, byte [eax - 0xd]
add esp, dword [edx]
jne 0x477bf4
adc dword [ecx], ecx
xor dword [eax], 0x636be208
loop 0x477c17
arpl word [esi - 0x4e], si
loop 0x477c17
arpl word [esi - 0x4e], si
push ds
pop ebp
lodsb al, byte [esi]
push ebx
mov al, 0x56
and dword [eax - 0x6f], eax
and dword [esi], ebp
add cl, byte [edi + 0x6382ce2b]
loopne 0x477c29
adc esi, eax
mov bl, 0x85
pop dword [eax - 0x5eca1dab]
push ds
insb byte es:[edi], dx
pop ebx
mov al, byte [0x3f6251a0]
jae 0x477b68
add bl, byte [ebp - 8]
dec edi
pop es
stosb byte es:[edi], al
rcr ebp, 1
mov esi, 0x1d4063c2
shl byte [ebx + 0x37], 1
jnp 0x477bf2
dec esi
or byte [ecx - 0x5b], dl
bound eax, qword [ebx]
mov esi, 0xadd70176
jbe 0x477bf5
xlatb
lodsd eax, dword [esi]
push cs
lodsd eax, dword [esi]
sub dh, byte [ecx]
adc eax, 0x5fd131a6
invalid
sar edx, 1
mov ah, 0xf2
mov ch, 0x99
sbb ecx, 0x726ef02a
inc eax
sbb byte [ebx - 0x5e], bl
mov dword [edi + 0x342311c1], 0xa30f9db1
pop ds
rcl dword [ecx], 0x23
xor al, 0xb1
popfd
bt dword [edi], ebx
aas
jno 0x477cb3
pop eax
mov ebp, 0xea3cd9d
popfd
int 0xa3
push cs
das
arpl word [ebp - 0xb], si
aam 0x62
pop ds
invalid
popfd
jp 0x477c37
cmp eax, 0xd4855750
cmp byte [eax], dh
or ah, byte [eax]
jl 0x477cb4
xor dword [ebx], edx
jbe 0x477cf8
adc al, 0x81
inc ecx
cli
lodsb al, byte [esi]
ja 0x477cf1
mov edi, 0xb053e015
or al, 0x8c
push ebp
and ebp, ecx
sbb dl, byte [eax + 0x2ea32d9]
push 0xe68361c5
xor byte [esi - 0x329e9a18], bl
pop edi
sal byte [ecx + 0x7a], cl
add edi, dword [ebx + 0x538597ac]
test dword [ebx - 0x30], edx
arpl word [ebx + 0x5a98c53], si
shl byte [ebx - 0x4d], 1
push ebx
mov word [ecx + 0x4f6f1205], gs
adc ch, byte [edi + 0x4f]
or al, 0xfa
xlatb
adc edx, dword [ebx]
sbb dword [ebp - 0x7c2468b4], esp
dec ebp
inc ecx
xor eax, 0x2d60e305
inc esi
salc
or bl, byte [ebp - 0x1f]
add al, 0x59
sub dword [ecx + ebx*2], ebx
push esp
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
jns 0x477cef
fisub dword [edx - 0x317d5aee]
jg 0x477d5e
out dx, al
or esp, ecx
sbb eax, dword [ecx - 0x6b]
pop ss
dec esi
mov dword [0xbdc2d1ad], eax
or ah, byte [esi]
inc ecx
and ah, byte [edx - 0x26]
fisubr word [ebx + 0x29]
and al, 0xe1
and al, 0xc0
inc esi
int1
out dx, al
jmp 0xe001a0a8
adc bl, dl
loope 0x477d87
scasb al, byte es:[edi]
add ah, bh
stc
mov bh, 0
ret 0xd721
mov al, byte [0xbb6876ea]
push edx
xor dword [0xc240a759], eax
scasd eax, dword es:[edi]
in eax, dx
xchg esp, eax
sar byte fs:[ebp + 0x6e], cl
add esp, dword [eax - 0x31]
sal dh, 1
popfd
xchg byte [eax], dh
rcl ebx, 1
ret
Function at 0x499022
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x49904a
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x49903c
pop edi
pop esi
pop ebp
ret 4

Function at 0x4a27c6
Capabilities:
Encode data using xor

Disassembly:
pop edx
mov ah, byte [edi - 0x72d17a0d]
sbb byte [edx + ebp*4], al
arpl word [ecx + 0xe8d09b8], bp
mov bl, 0x14
inc esp
sbb dword [ebp + 0x4b], esp
sub dword [edi - 0x25de7919], edx
sar byte [ebx - 0x26], 1
jnp 0x4a281f
inc edx
hlt
fadd dword [ecx + 0x69]
xor dword [edi + 0xabc3db1], esi
adc eax, 0xc27cb6bc
or dword [esi + 0x4a], eax
sbb esp, dword [ecx - 0x45]
mov ebp, 0x432a7ce
les eax, [edi - 0x3b7219d3]
mov dl, byte [esi + 0x665b0538]
mov edi, ss
jnp 0x4a2880
fcmovne st(0), st(6)
mov dword [0xfea63575], eax
jl 0x4a2806
or dword [ebx], edi
xor eax, edi
bound esi, qword [edi + edx + 0x359f371d]
mov ebx, edx
invalid
mov ecx, 0x301ac459
cwde
mov bl, 0x4a
mov dh, 0x7b
pop ecx
les ebx, [edx]
xor byte [eax + 0x7bb64ab3], bl
out 0x95, al
add ah, dh
mov cl, 0xf2
les esi, [edi - 0x3ea030f9]
jge 0x4a2881
or eax, 0x4c6b478
mov edi, 0x18a59f0a
sub al, ah
sub esp, esi
inc ecx
movsb byte es:[edi], byte [esi]
dec byte [edi + ecx*2]
inc ebp
in al, dx
lds ebx, [ebx - 0x598f965]
xor al, 0x2a
jg 0x4a28c3
leave
mov bh, byte [ebx]
xor al, 0xf5
imul eax, dword [esi + 0x638e0e7a], 0xffffffcb
not dword [edx - 0x21]
inc eax
pop ebx
push 0x3587ea75
cwde
cmpsb byte [esi], byte es:[edi]
push 0x32dba1e7
shl dword cs:[esi - 0x2b], 1
mov esi, 0x14fb3a2b
mov eax, 0xf060b78b
in eax, 0xd0
ja 0x4a290f
retf
out 0xd9, al
xor bl, ch
sub cl, byte [ebx - 0x72]
mov al, byte [0x45a0b6c4]
mul eax
cld
dec eax
imul esi, dword [ebx - 0x46], 0x64
invalid
invalid
Function at 0x4e2482
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x4e24aa
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x4e249c
pop edi
pop esi
pop ebp
ret 4

Function at 0x4ea786
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xd8f7d10b]
mov word [esi - 0x32], es
sti
aad 0x14
jbe 0x4ea783
mov esi, dword [ebx + 0x30]
add edi, ebx
push ecx
mov dl, 0x80
inc esp
and byte [ebp - 0x52], cl
movsb byte es:[edi], byte [esi]
and bl, al
mov dl, 0xb6
mov ecx, 0x804148ab
test dword [esi], 0x13dfe91
hlt
add esp, esi
xchg esi, eax
xchg esi, eax
xchg esi, eax
jb 0x4ea7ad
dec ebx
invalid
and al, 0x79
sbb eax, dword [ecx]
outsb dx, byte [esi]
std
mov eax, 0x76dfc271
out dx, eax
xchg edi, eax
bound edi, qword [ebp - 0x80]
scasb al, byte es:[edi]
inc edx
mov ah, 0x5a
mov al, byte [0x6e5dcc6f]
or edi, dword [ebx]
imul esi, dword [ebx], 0x26
xor edx, dword [eax + eax - 0x485adc7c]
aaa
sub byte [edi], 0xcf
loop 0x4ea75b
in eax, 0x14
mov al, 0xb0
lahf
adc al, 0xb0
mov al, 0x9f
cli
xor dword [ebx], 0x596da04c
add dh, byte [ebx - 0x55]
mov bh, 0xa7
cmp ebx, dword [esi]
jne 0x4ea7d9
xor bh, byte [ecx - 0x15ed796a]
movsb byte es:[edi], byte [esi]
sub edx, ecx
sar dword [esi - 0x63], 1
mov eax, dword [0x2165322b]
std
push esi
jmp 0x4ea875
invalid

Function at 0x528a3d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], edi
lea edx, [edi - 1]
test edi, edi
je 0x528aa5
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [ebp - 4], eax
xor ebx, ebx
xor ecx, ecx
test ax, ax
je 0x528a9c
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov eax, dword [eax]
movzx eax, word [eax + edx*2]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, ax
cmp word [ebp - 0xc], ax
je 0x528aaa
inc ebx
movzx eax, word [edi + ebx*2]
test ax, ax
jne 0x528a81
mov edi, dword [ebp - 0x10]
test ecx, ecx
jne 0x5685bd
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 4
or eax, 0xffffffff
jmp 0x528a9e
inc ecx
jmp 0x528a87
cli
adc dword [ebp + 0x2e6e6a2f], 0xc1eaa1a
mov ah, 0x26
dec ecx
fisubr dword [ebx]
out dx, eax
jno 0x5685f3
mov ebp, 0x390b3e7b
sub byte [ecx], ah
stc
stosb byte es:[edi], al
pop eax
lcall 0xe298, 0x708bd57d
stc
xor esi, dword [esi + ebx*2 - 0x7d4a2797]
and ecx, dword [esi - 0x42]
add eax, 0x8c9e0e0
int 0x48
push edi
salc
int3
Function at 0x52ad54
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x28
push ebx
push esi
mov esi, dword [0x4d191c]
push edi
cmp eax, 0xc
je 0x56959c
cmp eax, 0xd
jle 0x52ad8f
cmp eax, 0xf
jle 0x56959c
cmp eax, 0x11
je 0x56959c
cmp eax, 0x14
je 0x56959c
cmp esi, 0xffffffff
je 0x569a92
mov eax, dword [0x4d1910]
mov eax, dword [eax + esi*4]
mov ebx, dword [eax]
push ebx
mov dword [ebp - 0x1c], ebx
call fcn.0052b344
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 0xffffffff
je 0x569a92
mov eax, dword [0x4d1924]
mov edx, dword [ebp + 8]
mov eax, dword [eax + edi*4]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
cmp edx, 0xe
je 0x5695c6
cmp edx, 0xf
je 0x5695c6
cmp edx, 0xc
je 0x5695c6
mov byte [esi + 0x92], 0x50
mov ax, word [0x4d18b8]
mov word [esi + 0x86], ax
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 4], edx
mov edx, dword [ebp + 0x28]
and edx, 2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x28], edx
jne 0x5695d2
push ebx
push dword [ebp + 0x1c]
push edi
push ecx
push eax
call fcn.0052b302
mov edi, dword [ebx + 0x60]
mov eax, dword [ebx + 0x58]
mov ecx, dword [ebx + 0x5c]
mov dword [ebp - 8], edi
mov edi, dword [ebx + 0x64]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov edx, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
cmp edx, 0x1d
ja 0x569a86
mov dword [ebp - 0xc], 1
jmp dword [edx*4 + 0x405c92]
fdivr dword [eax + 0x4906b867]
sub dword [edi - 0xb9620e2], esi
jle 0x56957a
sub dword [edx - 0x52a2c9b0], ecx
lodsb al, byte [esi]
push edx
aas
stosb byte es:[edi], al
loopne 0x569ab2
or dl, byte [esi - 0x235b34d7]
leave
fdivr st(2), st(0)
leave
mov edx, 0xf054bcce
dec ebx
mov cl, 0x2b
push ecx
int3
invalid

Function at 0x52bbb2
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x52bbda
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x52bbcc
pop edi
pop esi
pop ebp
ret 4