joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f93b061
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f93b083
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f93b083
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f93b083
ret
cmp word [ebx + 4], 0x14c
jne 0x4f93b083
test word [ebx + 0x16], 2
je 0x4f93b083
test word [ebx + 0x16], 0x100
je 0x4f93b083
cmp word [ebx + 0x18], 0x10b
jne 0x4f93b083
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f93b083
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f93b10f
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f93b0a3
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f921fee
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f93b083
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x4f93b10f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f93b083
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f93b083
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f93b083
ret
cmp word [ebx + 4], 0x14c
jne 0x4f93b083
test word [ebx + 0x16], 2
je 0x4f93b083
test word [ebx + 0x16], 0x100
je 0x4f93b083
cmp word [ebx + 0x18], 0x10b
jne 0x4f93b083
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f93b083
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f93b10f
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f93b0a3
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f921fee
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f93b083
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x4f93b1c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f93b21f
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f93b1c6
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f93b1d5
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fd40e78
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f93b226
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f92209c
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f93b2c5
add edi, 4
add eax, 2
dec ecx
jne 0x4f93b20b
call 0x4f93b272
loope 0x4f93b268
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f93b2c2
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f93b2d3
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f93b286
cmp eax, ecx
ja 0x4f93b286
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f93b310
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f93b306
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f92257b
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4f93b1d5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f93b21f
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f93b1c6
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f93b1d5
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fd40e78
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f93b226
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f92209c
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f93b2c5
add edi, 4
add eax, 2
dec ecx
jne 0x4f93b20b
call 0x4f93b272
loope 0x4f93b268
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f93b2c2
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f93b2d3
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f93b286
cmp eax, ecx
ja 0x4f93b286
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f93b310
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f93b306
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f92257b
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x7003301
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x7003310
pop dword [ebp - 0x3c]
mov eax, 0x7003310
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xd95c51d4
sub dword [ebp - 0x4c], 0x8b0a0c89
mov dword [ebp - 0x48], 0x4b2d8314
sub dword [ebp - 0x48], 0x18fa36cf
mov dword [ebp - 0x44], 0x6021d768
add dword [ebp - 0x44], 0xec2a6cc6
mov dword [ebp - 0x40], 0x53897984
sub dword [ebp - 0x40], 0x53897984
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x8df8ad56
add eax, 0x790872da
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x848d7c7e
sub dword [ebp - 0x4c], 0x101b1328
mov dword [ebp - 0x48], 0xda61aeca
add dword [ebp - 0x48], 0x670ab2ab
mov dword [ebp - 0x44], 0x59396c2f
sub dword [ebp - 0x44], 0xf5c9ffc3
mov dword [ebp - 0x40], 0xf796a72b
sub dword [ebp - 0x40], 0xf796a72b
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xdfb84bc7
sub eax, 0xd8b72b93
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a7f7
push 0
call eax
mov ecx, 0x4785
xor edi, edi
add edi, eax
mov ebx, 0x3e9dce93
sub ebx, 0x379bee93
add ebx, dword [ebp - 0x3c]
mov edx, 0x1ad9721f
xor dword [ebp - 0x34], 0x5dabc809
mov esi, dword [ebx]
sub dword [ebp - 0x2c], esi
xor esi, edx
sub dword [ebp - 8], eax
mov dword [edi], esi
mov dword [ebp - 0x38], 0x914a712c
add edi, 0xf682eacf
sub edi, 0xf682eacb
add ebx, 4
loop 0x7003423
add eax, 0x110e7
mov ebx, eax
add eax, 0x2ecc73fc
sub eax, 0x2ecc73f7
mov ecx, 0x7000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x700c938
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x7010cdd
call fcn.07001ea6
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700cc00
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700d3f5
lea ecx, [ebp - 0x10]
call fcn.0700c8d5
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700c9a5
mov eax, dword [eax + 0x14]
jmp 0x700c9aa
mov eax, 0x70127b2
push 0x701411c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700c9dc
mov ecx, dword [edi + 4]
call fcn.07007826
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003301
mov eax, edi
call fcn.07002b7f
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003301
int3
Function at 0x700d4d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d534
cmp byte [esi + 0x10], 0
je 0x700d4f2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov eax, dword [esi + 0xc]
pop ecx
mov byte [esi + 0x10], 0
push edi
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d522
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
pop ecx
test eax, eax
je 0x700d53b
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d536
xor eax, eax
pop esi
pop ebp
ret 8
push str.stream_read_error
push 0
call fcn.07003301
int3

Function at 0x700d7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
jne 0x700d833
cmp dword [esi + 0xc], 0
je 0x700d82e
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d821
push str.stream_write_error
jmp 0x700d838
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8
push str.Attempt_to_write_read_only_stream
push 0
call fcn.07003301
int3
Function at 0x401110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ecx, 0x8c
push edi
mov ebx, 0x72de
lea esi, [ecx + 0xb]
mov edi, 0xaae
lea esp, [esp]
mov eax, 0x1b4e81b5
imul edi
sar edx, 3
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401130
mov edx, dword [ebp + 8]
mov edi, 0x6c0b
test edx, edx
je 0x4011f3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4011f3
cmp edx, eax
jae 0x4011f3
sub eax, edx
mov dword [ebp + 8], 0x7746
mov dword [ebp - 4], 0xbb
jmp 0x401180
cmp ecx, 0xbb
cmovl ecx, dword [ebp - 4]
dec dword [ebp + 8]
jne 0x401180
xor ecx, ecx
test eax, eax
je 0x4011b0
mov esi, eax
mov al, byte [ecx + edx + 1]
sub al, 0x49
xor byte [ecx + edx], al
inc ecx
cmp ecx, esi
jb 0x401197
mov esi, 0x97
lea ebx, [ebx]
mov eax, 0x82082083
imul ebx
add edx, ebx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x4011b0
mov eax, 0x5b6
mov ecx, 0xf5
nop
cmp esi, ecx
cmovg esi, ecx
dec eax
jne 0x4011d0
jmp 0x4011e0
mov eax, 0x30c30c31
imul edi
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x4011e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403190
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x4031ed
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x4031a0
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x4a77df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
pop eax
dec eax
pop eax
push dword [0x405cf4]
lea ecx, [ecx + 0x62]
mov edi, dword [esp]
or ebx, edi
imul dword [esp + 0x54]
lea ebx, [edx]
mov bl, cl
mov cl, bl
lea edx, [esp]
call dword [fcn.004010ac]
or ebx, esp
inc dword [0x405e36]
or ebx, 0x3bc79b
cmp eax, 0x6a
jb 0x4a7835
jne 0x4a784d
mov ebx, 0x402f62
lea ecx, [eax]
pop dword [0x405b01]
push 0x21
pop edi
sub edi, dword [0x403f93]
xor ebx, eax
mov bl, 0x98
push 0x405a2b
call dword [fcn.0040102c]
sub ebx, 0x405739
leave
ret
mov eax, dword [ebp]
mov dword [0x405ced], 0x4055d6
jbe 0x4a785e
and ebx, edx
add bh, bh
sbb ebx, ebp
mov eax, dword fs:[0x30]
jbe 0x4a786f
add bh, al
lea ebx, [eax + edx]
sbb ebx, eax
mov edx, eax
mov bl, al
jbe 0x4a7879
sbb ebx, ecx
add ebx, edi
lea ebx, [eax]
mov eax, dword [edx + 0x2c]
mov bl, cl
mov cl, 0xa9
mov cl, bl
and ebx, esp
mov cl, byte [eax + 0x6f]
jae 0x4a7893
sub ebx, eax
mov ebx, ecx
mov ecx, ebx
shr eax, 0x10
sub ebx, edx
add bl, al
sub cl, ah
je 0x4a78c1
sub dword [ebp + 8], ecx
mov dword [0x405fa8], 0x404bc9
or ebx, 0xffffffff
push esp
add bh, bh
add ecx, ecx
call dword [fcn.00401070]
lea ebx, [0x40303b]
leave
ret
and ebx, ebp
lea edx, [edx]
jae 0x4a78c9
add ebx, esi
add bl, cl
mov eax, dword [edx + 0xc]
not ebx
dec bl
mov esi, dword [eax + 0x1c]
jbe 0x4a78db
or ebx, ecx
mov ebx, eax
lodsd eax, dword [esi]
sbb ebx, edi
mov eax, dword [eax + 8]
jbe 0x4a78e9
mov ebx, eax
mov eax, ebx
add bl, ch
jbe 0x4a78ef
sub ebx, ebp
xor ebx, edi
mov edx, dword [eax + 0x3c]
lea edx, [edx]
jbe 0x4a78fc
inc bh
pop ebx
sub esp, 4
add edx, 0x104
add eax, dword [eax + edx]
or ebx, edx
neg bh
or ebx, edi
inc eax
jbe 0x4a7913
lea eax, [eax]
add bh, 8
mov ecx, dword [eax]
dec bl
and ecx, dword [eax + 4]
mov eax, eax
add bl, ch
add ecx, 0x4021e6
mov ebx, esp
cmp ecx, 0x558322b
jne 0x4a7909
lea ebx, [eax + ecx]
add ebx, ebx
xchg edx, eax
mov ebx, ebp
or ebx, esi
sub edx, 1
and ebx, ebp
mov eax, dword [edx]
xor ebx, 0x49
and eax, 0xffff
lea ebx, [ebx]
add eax, 0x402412
and ebx, ebp
sub eax, 0x40af67
jne 0x4a7936
or ebx, esp
jbe 0x4a795d
mov ebx, ebp
xor dword [0x405fda], edx
add ebx, eax
push 0x405fef
jae 0x4a7972
sbb ebx, ecx
mov bl, al
mov al, bl
push 0x2f
add dword [esp], 0x11
and ebx, esi
push 0x2fd0
jg 0x4a7983
not ebx
sbb ebx, edx
push 0x40121c
mov ebx, ebx
sub ebx, esp
push 0xfffffffffffffffe
xor ebx, edi
inc dword [esp]
lea ebx, [edx]
sub ebx, ebp
add bh, 8
or ebx, 0x4240a6
jg 0x4a79a9
sub ebx, ebp
lea ebx, [eax + edi]
mov ebx, dword [0x405fda]
call ebx
sbb ebx, eax
lea ecx, [0x403c86]
jg 0x4a79bd
mov ebx, eax
sub ecx, 0x403bf0
sbb ebx, edx
mov edx, 0x401502
sub ebx, eax
mov edi, 0xeb
xor dword [edx], edi
lea ebx, [eax + edx]
add bl, bl
mov ebx, ecx
mov ecx, ebx
mov esi, dword [edx]
sbb ebx, eax
and ebx, edi
add esi, 4
mov dword [edx], esi
jbe 0x4a79f0
mov ebx, ebp
sub ebx, ebp
jbe 0x4a79f6
add bh, bl
inc bh
add edx, 0xffffffff
or ebx, esp
jg 0x4a79ff
xor ebx, ebx
lea ebx, [edi]
sub ecx, 1
jne 0x4a79ca
lea ebx, ds:[esp]
mov eax, eax
invalid
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4aa904
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
call fcn.00406c24
xor eax, eax
push ebp
push 0x4aa9c4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a64
push ebp
call fcn.004aa83c
pop ecx
xor eax, eax
push ebp
push 0x4aa9a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
mov eax, dword [ebp - 0x40]
call fcn.00407984
push eax
call sub.wininet.dll_InternetCrackUrlW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x41], al
mov eax, ebx
mov edx, dword [ebp - 0x2c]
call fcn.004079dc
mov eax, esi
mov edx, dword [ebp - 0x10]
call fcn.004079dc
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.004079dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aa9ae
push ebp
call fcn.004aa8c4
pop ecx
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x670309
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xbc4e43aa
test dl, 0xff
invalid
inc esp
mov dword [ebp], esi
call fcn.00900eac
jne 0x670296
and al, 0x6a
mov al, 0x8d
fld qword [ebx + 0x5a247c71]
cwde
mov ebp, 0x207d6ef1
jge 0x670345
add byte [esi - 0x70], dl
je 0x670353
shl dword [eax + 0x40], cl
bound ecx, qword [ebx - 0x14]
mov ch, dh
cmp al, 0xe9
loope 0x670361
sub dword [edx - 0x35af8782], eax
dec edx
xor ch, byte [esi + 0x39]
retf
out dx, eax
mov ecx, 0x96e50120
stosd dword es:[edi], eax
pop edi
invalid
call 0xef36de6e
fcmovne st(0), st(7)
out dx, al
in eax, 0x19
and al, 0xaf
rol al, 1
scasb al, byte es:[edi]
jae 0x670323
invalid
aam 0xa7
out 0xf8, eax
lahf
xchg edx, eax
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
outsb dx, byte [esi]
sbb dword [ecx + ebx*8], 0x50b0aa05
mov eax, edi
mov ebx, 0x1dcb39e7
test eax, 0xb267d32a
pop ss
sbb eax, esi
xor al, 0xe5
fmulp st(3)
fld qword [eax]
rcr byte [edi], cl
sahf
scasb al, byte es:[edi]
cmp ebx, ecx
cdq
sbb dl, byte [esi + 0x4e2382a9]
jae 0x670376
ror dword [ebp - 0x66], 1
mov edx, 0xcc397e22
fst dword [edi - 0x120e919b]
and byte [edx - 0x23], dl
mov ebx, 0x8f50d975
cmc
push ecx
arpl word [esi], cx
arpl word [esi + 0x1b], dx
shl dword [ecx - 0x42], cl
dec esi
lea ecx, [ecx + 0x34f6fe2b]
jle 0x670351
dec ebp
fidiv word [esi]
loope 0x67035e
inc ebx
push cs
add bh, byte [ecx]
retf

Function at 0x679bd5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
test edx, edx
jmp 0x6863bd
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp ecx, eax
cmp ah, 0x90
lea esp, [esp - 0x114]
cmc
cmp cx, 0x5e2b
push esi
cmp ecx, ebp
test ah, bh
jmp 0x676de6
je 0x76273d
mov esi, dword [ebp + 0xc]

Function at 0x691376
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esi + 4]
add esi, 4
xor edx, edx
test ecx, ecx
lea esp, [esp + 4]
je 0x6913ce
push esi
movzx esi, byte [eax]
push 0xd58fab95
xor esi, edx
and esi, 0xff
mov esi, dword [esi*4 + 0x676494]
not dword [esp]
shr edx, 8
xor edx, esi
mov dword [esp], 0xed191892
inc eax
xor edx, 0x35134f2e
dec ecx
lea esp, [esp + 4]
jne 0x69138e
mov esi, 0x74b89e0c
not esi
pop esi
push 0x683b220e
not edx
call fcn.008b6ffc
mov word [esi], dx
lea esp, [esp + 0xc]
jmp fcn.0079c77c
Function at 0x6c7510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jno 0x7a9384
mov edx, 0xe6a6bb05
sub dl, dl
rdtsc
push 0xdd0773a9
call fcn.00761740
inc esp
xor al, al
dec eax
lea eax, [esp + eax + 0x10]
inc esi
mov ebp, dword [eax + ebp - 0x6145b403]
dec eax
sub ebp, 4
inc esp
mov dword [ebp], ebp
call fcn.00943baf
mov edx, 0x9ab15933
jmp 0x78848b
add eax, 0xfc3cb48d
jns 0x6ade32
call fcn.006a0123
test eax, 0xb3bf8d95
adc dword [ebp - 0x727a4041], 0x99ad9fb7
stosd dword es:[edi], eax
xchg dword [ebp + 0x408bbbb1], esi
xchg ecx, eax
mov dword [0x30bd7797], eax
push 0x7e
movsd dword es:[edi], dword [esi]
adc dword [edi], eax
pushfd
and al, 0xff
xor al, 0xbc
salc
sbb eax, 0xdf00ceb2
mov eax, 0x1e995230
xchg edx, eax
test al, 0xe7
and al, 0x6c
out dx, al
adc eax, 0x96feb98e
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
xchg esi, eax
stosb byte es:[edi], al
and byte [eax - 0x7b7f4d66], 0xbe
cmpsb byte [esi], byte es:[edi]
lodsb al, byte [esi]
pushfd
scasb al, byte es:[edi]
mov dh, byte [eax - 0x63294578]
mov word [esi + edx*8], cs
jnp 0x788527
jl 0x788480
jmp [ecx - 0x4c40726b]
jge 0x78848d
adc edx, dword [edi - 0x3c03e064]
wait
add eax, 0xcbe559ee
push edi
setns byte [edx - 0x1798820f]
retf
sub bl, byte [ebx]
nop
bound esp, qword [esi]
shr byte fs:[esi + esi*4 - 0x1acca0cd], 0x6f
sbb dword [esi], eax
adc dword [esp + ebx], esi
test byte [edx - 0x1f], al
das
in al, dx
enter 0x73ee, 0x4a
sbb cl, ah
retf 0xe3e2

Function at 0x7920ac
Capabilities:
Encode data using xor

Disassembly:
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x7920e1
mov eax, dword [ebp + ebx*4]
push 0x151ed1ba
mov dword [esp], eax
push 0x3814f6a8
xor dword [esp], 0xc3111a06
dec ebx
lea esp, [esp + 4]
jne 0x7920be
mov eax, dword [ebp]
jmp 0x7b9ac0
jmp 0x7aacbd

Function at 0x7a4a1e
Capabilities:
Encode data using xor

Disassembly:
add ebp, 2
call fcn.00765665
shr byte [ecx - 0x6c7ca632], 1