joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e03
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403cf9
and dword [ebp - 4], 0
cmp dword [0x43d700], 0
mov ebx, eax
jne 0x404eb4
push 0x401920
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404f65
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401914
push edi
call esi
test eax, eax
je 0x404f65
push eax
call fcn.00403c87
mov dword [esp], 0x401904
push edi
mov dword [0x43d700], eax
call esi
push eax
call fcn.00403c87
mov dword [esp], 0x4018f0
push edi
mov dword [0x43d704], eax
call esi
push eax
call fcn.00403c87
mov dword [esp], 0x4018d4
push edi
mov dword [0x43d708], eax
call esi
push eax
call fcn.00403c87
pop ecx
mov dword [0x43d710], eax
test eax, eax
je 0x404eb4
push 0x4018bc
push edi
call esi
push eax
call fcn.00403c87
pop ecx
mov dword [0x43d70c], eax
mov eax, dword [0x43d70c]
cmp eax, ebx
je 0x404f0c
cmp dword [0x43d710], ebx
je 0x404f0c
push eax
call fcn.00403d02
push dword [0x43d710]
mov esi, eax
call fcn.00403d02
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404f0c
test edi, edi
je 0x404f0c
call esi
test eax, eax
je 0x404f03
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404f03
test byte [ebp - 0xc], 1
jne 0x404f0c
or dword [ebp + 0x10], 0x200000
jmp 0x404f45
mov eax, dword [0x43d704]
cmp eax, ebx
je 0x404f45
push eax
call fcn.00403d02
pop ecx
test eax, eax
je 0x404f45
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404f45
mov eax, dword [0x43d708]
cmp eax, ebx
je 0x404f45
push eax
call fcn.00403d02
pop ecx
test eax, eax
je 0x404f45
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43d700]
call fcn.00403d02
pop ecx
test eax, eax
je 0x404f65
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404f67
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406c6e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c9f8]
jne 0x406c78
repz ret
jmp fcn.00408395

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40f719
Capabilities:
Encode data using xor

Disassembly:
add dword [esi - 0x6448014e], eax
shl dword [edi], cl
clc
sbb al, 0x31
push ss
salc
add byte [ecx + 0x70], dl
pop edx
jae 0x40f77f
dec ecx
mov ch, 0xc2
int3
out dx, eax
jns 0x40f751
invalid
jl 0x40f771
loope 0x40f77f
invalid
jg 0x40f6fa
mov al, 0xf9
mov ecx, 0x63046b11
fst dword [eax]
and al, 0x9c
sbb dword [ecx + edi*4 + 0xf], 0x90dd3f91
int1
adc dh, byte [edx - 0x61]
push 0x1e8a4202
lcall 0x68e6, 0x3a7f36f5
jg 0x40f7ae
out 0x68, al
mov ecx, 0x6cf17181
insb byte es:[edi], dx
retf
cmp byte [edx], cl
sub bl, byte [edi - 0x3a]
rol bh, cl
push 0xffffffffffffffd7
out dx, eax
mov ebp, dword [0x3ae8a3e3]
sub eax, 0xa399d663
xchg edi, eax
add cl, dl
cmp bh, ch
loopne 0x40f740
add al, 0x77
leave
dec esp
cmp byte [edx], ch
and eax, 0x6268b381
add edx, ebp
push ecx
invalid
jg 0x40f77a
loope 0x40f7f7
or bl, byte [ebp - 0x56]
or dh, 0x6d
sub al, 0xf2
retf 0xa999
push cs
mov eax, dword fs:[0xef39993b]
in al, 0x43
in eax, dx
ljmp 0x1137

Function at 0x460d32
Capabilities:
Encode data using xor

Disassembly:
shr byte [ecx], cl
pop ds
fmul dword [ebx]
or al, 0xd3
xor bh, dl
cli
cli
stosd dword es:[edi], eax
fsubr qword [ebx + 0x26763ebc]
xchg dh, cl
std
loopne 0x460d2a
invalid

Function at 0x4941b0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x850f48
mov dword [esp + 0x3c], 8
mov dword [esp + 0x40], 4
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea edx, [esp + 0xc]
mov dword [esp + 0x14], 0
push edx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x14
push 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test edi, edi
je 0x494250
mov eax, dword [0x650d78]
push 0x650aa8
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalPipeCRT40
push 0
lea ecx, [esp + 0x20]
push 1
push ecx
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [0x650d74], esi
mov eax, esi
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x51dbb4
Capabilities:
Encode data using xor

Disassembly:
fisub dword [esp + edi*8 - 0x3d6f1a48]
sal byte [edx - 0x1e], 1
inc edx
hlt
int1
popfd
inc edx
lodsb al, byte [esi]
popal
les esp, [edx + 0x547245e2]
mov byte [0x547245e2], al
neg dword [edx - 0x7e]
jle 0x51da73
or ebx, ebx
ja 0x51dadc
jg 0x51db16
movsb byte es:[edi], byte [esi]
rcl byte [ebx + 0xf418580], 0x88
invalid
leave
xchg byte [ecx], dl
invalid
jbe 0x51dac1
sti
push cs
stosd dword es:[edi], eax
in al, dx
dec edx
mov edi, 0x56945306
invalid
clc
lds esi, [edx - 0xf5b6b4a]
loop 0x51daba
mov al, 0x22
adc eax, 0x1b6740fe
and edi, dword [eax + 0x65]
ret
push edi
js 0x51db42
inc edi
pop esi
pop ebx
sub eax, dword [esi]
cmp dword [edx], ebx
invalid
rol byte [eax - 0x55a60f41], cl
aas
and al, 0xb4
je 0x51dafd
push ecx
push eax
mov bl, 0xf7
test dword [ecx + 0x10], ebx
or dword [esi - 0xf], ebx
xchg esp, eax
movsb byte es:[edi], byte [esi]
ljmp 0x5236
ja 0x51db94
add bh, dl
jbe 0x51db5d
jbe 0x51db48
mov esp, esp
mov edi, dword [0xf1e28cb0]
aam 0x63
imul dword [edx + 0x54]
xor al, 0x43
dec ecx
push 0x6ae3410
pop eax
daa
fisubr dword [edx + 0x74]
out 0xcb, al
jo 0x51db43
invalid
jmp 0x51db8c

Function at 0x54edc0
Capabilities:
Encode data using xor

Disassembly:
lea ebp, [edi - 0x297a26e7]
salc
push ebp
cvtdq2ps xmm7, xmmword [edi]
jo 0x54ee4b
xor al, 0xd0
sbb eax, 0x69c6d379
sbb eax, 0x17ccafd5
sub esi, esp
and word [edi], 0xffbf
lds esp, [ebp + 0x75]
adc byte ds:[eax + 0x5c], dh
outsb dx, byte [esi]
and ebx, eax
push ebx
js 0x54edc5
hlt
jnp 0x54ee5c
neg dword [esi + edx*8]
popfd
sub dword [edi - 0x4e1fba33], edi
jmp 0x54ee04
scasd eax, dword es:[edi]
xor al, 0xe6
pop ebx
jmp 0x54ee2c
jno 0x54ee21
cmp eax, 0x627cbb4d
add al, 0xb6
shr byte [ebx - 0x5c], 1
fdiv st(2), st(0)
xchg edx, eax
inc ebx
mov byte [esi - 0x7629aebf], dh
rol ecx, 0xb3
add bl, dh
dec edi
int1
stc
xchg ebp, eax
into
pop ecx
imul ebx, dword [eax], 0xb537b260
neg dword [ebx*8 - 0x5f23f027]
jae 0x54ee24
sbb al, 0xdd
invalid
pop ebx
mov edx, 0xcf3bf861
imul ecx
das
cmc
std
wait
cmp dword [esi + 0x67e06fb0], 0xffffffb4
ja 0x54edd9
dec ebx
mov byte [edi + 0x2038f927], al
out dx, al
cmp dword [edx + eax*4 - 0x19], eax
inc ebx
wait
rcr byte [edx - 0x3872130e], cl
sub esp, 0xdf35b03
inc ebp
aaa
mov ch, 0xfc
mov al, byte [0x414a50d2]
mov ecx, 0xbf870de5
xchg cl, bh
mov bh, 0xba
insd dword es:[edi], dx
movsb byte es:[edi], byte [esi]
jecxz 0x54edfd
invalid
and ebp, ebx
push dword [ebp - 0x3b]
mov eax, ecx
lahf
adc eax, 0xaa800353
wait
mov gs, esp
sbb dword [ebx], edx
in eax, 0x3f
sbb byte [ecx], ch
pop ss
cld
aam 0x57
shl dword [ecx - 0x4e4bda45], cl
adc dh, byte [esi + esi*8 + 0x3dd9aa5]
jae 0x54ef1a
and dword [ecx - 0x1984ee19], 0xffffffff
cdq
push ecx
arpl word [ebx - 0x4077214e], si
movsd dword es:[edi], dword [esi]
invalid
int3
shl ah, cl
into
pop ebx
xor dword [0x3b0f1e53], esp
and byte [edi - 0x49e25e0c], bh
push ecx
psrlq mm7, qword [edx]
in al, 0x2c
neg esi
movsd dword es:[edi], dword [esi]
enter 0xfffffffffffffba1, 0x13
out dx, eax
cld
xchg esi, eax
stosb byte es:[edi], al
out dx, eax
in eax, 0x51
jne 0x54eef0
invalid
Function at 0x5ba904
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xa8
movsd dword es:[edi], dword [esi]
std
lahf
push 0x566ad619
int3
cld
int 0x9a
and dword [ecx + 0x7434bb41], 0xe47e8d47
add edx, dword [ecx + 0x78]
cmp al, 0xe1
mov ebx, 0xa9f615df
pop eax
jb 0x5ba8c0
push ecx
js 0x5ba8ff
loope 0x5ba880
fist word [0x7258a9f6]
hlt
mov edx, 0xc2d2afd8
pushal
stosb byte es:[edi], al
push ecx
adc al, 0xb6
cmpsb byte [esi], byte es:[edi]
push 0x8a4bf433
sbb eax, 0x310f9eb0
setbe byte [eax]
push ds
fcomp st(4)
mov ah, 0xb
mov al, byte [0xf85b3689]
sahf
pop eax
xchg ebx, eax
push cs
cmp byte [0x53bf52f2], 0xab
xchg ebx, eax
cdq
out 0xfd, al
cmp esi, edi
wait
je 0x5ba928
or dword [esi + 9], esp
movsb byte es:[edi], byte [esi]
je 0x5ba8fd
dec edx
xchg ecx, eax
jnp 0x5ba961
inc ebx
xchg edx, eax
adc dword [esi], esp
aad 0x32
or ebx, dword [esi + 0x68]
pushfd
fucompp
fdiv qword [esp + eax]
shr byte [ecx + 8], 1
invalid
sbb edi, dword [eax]
jb 0x5ba8b2
ljmp 0xfa56:0x9e212838
jl 0x5ba997
loope 0x5ba967
or byte [edi + 0x57], dh
push edi
lcall 0xf5c6, 0x63e9ddf
cmc
pop eax
fld st(5)
imul esi, dword [ebx + 0x609d5f38], 0xffffffe1
sub al, 0xca
and eax, 0xc54b39ea
push es
lcall 0x547b, 0xbcc97562
or dl, byte [esi - 0x6d8be970]
fld dword [edi + 0x468ee197]
mov ebp, 0xe3a94f2c
add dl, bh
out 0xc2, al
xor eax, 0x9ef47cc6
dec edx
mov bl, 0x59
jecxz 0x5ba96e
test eax, 0xe6fa00e3
ret 0xc635
xchg byte [edi + eax*4 - 0x52], ah
scasb al, byte es:[edi]
mov eax, dword [0x940f3d95]
sti
and dword es:[ecx - 0x1a5ab184], ecx
test dword [ebx - 0x5ae52b21], esi
cmp eax, dword [ebp + 0x3a]
or bl, bl
out 0x10, al
push edx
imul esp, dword [ecx + ebx*2 + 0x4dca79dc], 0x79
mov al, 0x1b
fstp qword [eax - 0x560bac27]
dec edx
sbb dword [ecx + 0x38902a1e], eax
sub byte [ebp - 0x4b], ah
div byte cs:[esi]
aad 0xdf
dec edi
cdq
xchg dword [eax + 0x2e471875], edx
in al, 0xba
add esi, ecx
mov eax, 0x46cc16b3
mov edi, 0x39719bee
inc eax
inc eax
xor al, 0xd4
sbb byte [eax], bh
jae 0x5baa51
in eax, dx
lcall 0x668, 0x7abb6ac2
dec esp
mov dl, 0x81
invalid
invalid
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..wixburn
mov ebx, 0x40c7d0
nop
mov ecx, 0x73f7236e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..pdata
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3a4d695f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x7458b3
Capabilities:
Encode data using xor

Disassembly:
add edi, 2
not al
not dl
or al, dl
call fcn.005d2cb9
out dx, al
jns 0x7458fc
add dh, dh
sal dh, 1
ror byte [edx], cl
ret 0xf5e8
stc
pushfd
xchg edi, eax
jmp 0x7458f0
push es
push esi
invalid
test eax, 0x27d129d6
salc
and eax, 0x1d9bbfde
je 0x7458b8
sub al, 0x85
js 0x74596e
mov ebp, dword [eax]
stc
sbb eax, 0x169c6760
pushal
cli
cmc
inc edx
imul edi, dword [eax + 0x28cfc238], 0x28a6badf
lea edx, [edx]
or eax, 0xdf49de90
inc esi
add dword [edx], edi
inc esi
dec edx
str esi
test al, 0x8d
test dword [edx - 0x52], esp
xchg ebx, eax
cwde
pushfd
push ebx
xchg ebp, eax
fadd qword [ecx]
jecxz 0x7459a0
stc
clc
add dword [eax], 0x7ab5423d
xchg esp, eax
pushfd
adc ebx, esp
or bh, byte [ebx + 1]
pop edx
inc ebp
add byte [edx - 0x4a], cl
add dword [edx], ebp
cmp dword [edi + 0x40a92e74], esp
sbb ah, byte [0xa956302d]
and eax, 0xa956302d
salc
xor cl, byte [ecx]
not byte [ecx]
test byte [ecx + 0x60], dh
mov byte es:[esi], dh
mov byte [esi], dh
sub edi, esp
das
idiv byte [edx - 0x7c]
pushfd
popal
outsd dx, dword [esi]
sbb eax, 0xb578b59a
pushal
add ch, al
arpl word [edx + 0x7ffb3a21], si
cdq
mov byte [ebx + 0x15], bl
popal
scasd eax, dword es:[edi]
jl 0x745954
pop eax
pushal
cld
dec ebx
fnstenv ss:[edi + 0x19a7d8a8]
push esp
mov eax, 0xa6595174
cmpsb byte [esi], byte es:[edi]
stosb byte es:[edi], al
push eax
add dword [edx + 0x39], ebx
jbe 0x745960
hlt
Function at 0x75f760
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jae 0x8570d1
mov cl, byte [eax + edx]
add eax, edx
or si, 0x7526
clc
inc esi
mov esi, eax
cmc
cmp bh, 0xaf
test cl, cl
jmp 0x83f969
mov edi, dword [ecx + edx + 0x18]
test edi, edi
je 0x722503
mov eax, dword [ecx + edx + 0x20]
dec edi
lea eax, [eax + edx]
test ebx, 0x2b27b580
sub ebx, ebx
stc
clc
mov dword [ebp - 0xc], eax
test edi, edi
jmp 0x761d44
mov edx, dword [ebp - 4]
dec ecx
mov eax, dword [ebp + 8]
mov ecx, dword [edx + eax + 0x24]
bsf dx, di
btc dx, 0x82
rcr dl, cl
lea edx, [ecx + esi*2]
movzx eax, word [edx + eax]
mov ecx, dword [ebp - 4]
sar dl, cl
jmp 0x6c870d
ret
je 0x83baec
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x77ccaa
jae 0x736e3b
sub edi, edi
clc
cmc
test ecx, ecx
jbe 0x7953b9
lea ebx, [ebp - 0x114]
sal dl, cl
not dl
sub ebx, eax
adc dl, 0xab
je 0x83baec
mov eax, dword [eax + 0x7c]
test esp, esp
clc
push ebx
push edi
cmc
mov dword [ebp - 0x10], eax
cmc
test al, 0xa
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
jmp 0x728405
mov edx, dword [ebp + 8]
jmp 0x7224fa
jle 0x740ec0
mov ecx, dword [ebp - 4]
jmp 0x722503
mov eax, dword [eax + esi*4]
stc
jmp 0x7516bb
inc esi
test ecx, esp
stc
test cl, cl
jmp 0x736e35
jle 0x5a953c
lea ebx, [esi + 1]
cmp ebx, edi
movsx edx, sp
mov edx, dword [ebp + 8]
jmp 0x6ca1a5
mov dword [ebp - 8], eax
rcr eax, cl
bts ax, cx
mov eax, dword [ebp - 8]
cmp eax, dword [ecx + edx + 0x14]
jmp 0x722a08
jae 0x736e3b
mov esi, dword [ecx + edx + 0x1c]
cmp esi, 0x933ca589
lea eax, [esi + eax*4]
test bl, bh
cmp bp, ax
mov eax, dword [eax + edx]
stc
test ch, 0x91
test eax, eax
jmp 0x8589f8
ja 0x579e8e
mov eax, esi
stc
test ah, 0x1a
sub eax, dword [ecx + edx + 0x10]
jmp 0x7224fa
lea esi, [esi + ecx]
clc
test bp, 0x89e
test edi, ebx
cmp eax, esi
jmp 0x577a69
jne 0x83f96f
mov eax, dword [ebp - 0xc]
test sp, 0x3895
btc si, 0xe
mov esi, 0x9c3c9c08
mov ecx, dword [ebp + 0x10]
or esi, 0xef3a2f33
lea esi, [edi + ebx]
sar esi, 1
jmp 0x6d155a
mov ecx, dword [ebp + 0xc]
jmp 0x7ba992
jmp 0x6f7ddc
push ecx
movzx cx, al
jmp 0x746341
call 0x5b38db
add esp, 4
test bp, dx
stc
cmc
test eax, eax
jge 0x6f7dd3
lea edi, [esi - 1]
jmp 0x748d36
push ebp
mov ebp, esp
sar dh, cl
cmp esi, 0x539c17a2
mov edx, dword [ebp + 8]
stc
clc
lea esp, [esp - 0x114]
cmp ch, 6
test ecx, esp
push esi
cmc
test edx, edx
jmp 0x5bb4dc
jl 0x722503
jmp 0x740ed2
mov ecx, esi
cmp dx, ax
test bx, 0x4f98
cmp di, 0x3015
sub ecx, eax
stc
cmp ecx, 0x104
jmp 0x5c2b73
je 0x83baec
mov eax, 0x5a4d
test bp, di
cmp word [edx], ax
jmp 0x83bae6
jne 0x83baec
mov ecx, dword [eax + 0x78]
mov dword [ebp - 4], ecx
clc
test ecx, ecx
jmp 0x5cb8d9
je 0x7679e8
mov cl, byte [esi + 1]
jmp 0x6d73d1
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jmp 0x7ae650
add eax, edx
jmp 0x7540b0
je 0x7b3fbf
sub eax, eax
mov esi, 0xf41425af
not si
pop esi
mov esp, ebp
cmovne bp, cx
pop ebp
jmp 0x5b2a03
je 0x736e3b
cmp cl, 0x2e
jmp 0x7b2a51
pop edi
pop ebx
add eax, edx
bswap si
mov esi, ebp
pop esi
mov esp, ebp
movsx ebp, bx
pop ebp
ret
je 0x736e3b
cmp eax, ecx
jb 0x8570d1
mov esi, dword [ebp - 0x10]
test bp, 0xdb81
jmp 0x72a849
Function at 0x76f7d6
Capabilities:
Encode data using xor

Disassembly:
and bl, bh
test eax, 0x4ed81f4
add byte [eax], al
add dh, al
inc esp
and al, 3
and cl, byte [ecx - 0x72ffda8c]
and al, 4
call fcn.007319a8
fadd qword [esi]
xchg edi, eax
cwde
pop ecx
std
cmp eax, 0xc9870c96
leave
sahf
imul edi, edi, 0x37
pushfd
push cs
inc esi
sti
aam 0x25
jp 0x7022a2
cmpsb byte [esi], byte es:[edi]
je 0x70225d
push edi
jmp 0x7b3a858d
mov al, cl
cmp eax, 0xd90d80e5
and byte [ebp + edx + 0x33aaeb32], 0xe1
mov ah, 0xa4
sbb edx, dword [ebp - 0x77]
push 0
stc
and eax, 0xf8b03299
sbb eax, 0x9bf4ab42
xor byte [edx - 0x669bcc56], bh
add eax, 0x73e06ac1
sub ebx, edx
inc ebp
test byte [edx + 0x7df07c04], bh
pop ecx
imul dword [edi - 0x51908f2d]
test eax, 0xb4d5953e
push ss
ja 0x702288
add al, 0x7c
invalid
mov esi, 0x8ce3a82c
sub byte [0x44ccbfce], cl
cmpsd dword [esi], dword es:[edi]
adc dword [ecx - 0x44], ebx
stosd dword es:[edi], eax
outsb dx, byte [esi]
xor dword [esi - 0x33], ebx
adc ebx, dword [ebx - 0xa]
and cl, byte [esp + esi]
mul byte [edx]
or al, 0x34
mov bh, 0x82
mov bl, 0xb4
pop ecx
lea edi, [esi + 0x37c8c67]
imul ecx, dword [edx], 0xffffffb0
rol ch, 1
xchg ecx, eax
js 0x7022d5
out 0x22, eax
mov ebx, 0xd8b54b83
sbb al, 0xc2
add bh, byte [ebx]
fild qword [eax]
xchg ebx, eax
into
mov al, 0x4d
jl 0x7022fe
pop es
inc byte [ebp - 0x20]
test bh, ch
dec ebx
inc ebx
cmp dword [edi], 0x9c5d338b
pushal
into
sbb al, 0xb6
nop
xor ebx, dword [ebx + edx - 0xc899cf9]
mov bl, 0x47
insd dword es:[edi], dx
clc
invalid
push 0xfbba99ac
sub edi, 0xc
jmp 0x702279

Function at 0x78c463
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov edx, dword [esi]
and ecx, 0xca32fa84
mov cx, word [esi + 4]
jle 0x845b6b
adc esi, 6
mov word ss:[edx], cx
lea esp, [esp + 4]
jmp fcn.007bc0d9

Function at 0x7b6eaa
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x14]
jne fcn.006e1bd5
adc al, 0xf
test dword [ecx], esp
lodsd eax, dword [esi]
invalid
mov ecx, 0x9f3afa0b
sar ecx, 0xb7
mov dx, word [ebp]
mov ax, word [ebp + 2]
jae 0x83f0c7
je 0x7b6ead
in eax, 0xed
and ch, ch
sbb edx, dword [eax]
sbb al, 0xa1
aaa
nop
test bl, 0xc8
mov word [ecx], es
or byte ds:[esi], 6
cdq
push esi
call 0x66c6f6cb
insd dword es:[edi], dx
push ecx
sahf
jo 0x7b6f68
daa
jmp 0x7b6e86
and esp, esi
xor ah, byte [ebp + ecx + 0x1556c096]
adc ch, bh
mov ebp, 0xbe45d607
fbld tbyte [edi]
aad 0x14
mov bh, 0x9c
dec ebp
adc byte [edi + 0x6a], 0x99
dec ebx
and bh, cl
sti
mov esp, dword [ecx]
cmp dword [esi - 0x23], edx
jbe 0x7b6f8c
fnsave dword [esi - 3]
xchg edx, eax
push es
jmp 0x9fbbb7bb
sub ecx, ecx
xor cl, byte [ebp + ecx*4 + 4]
add ebp, 4
push 0x9e9b4d94
neg word [esp]
shrd dx, ax, cl
mov word [ebp], dx
not dword [esp]
lea esp, [esp + 4]
jmp fcn.006f8984
Function at 0x83e1ec
Capabilities:
Encode data using xor

Disassembly:
push 0x1c33ec1b
lea esp, [esp + 8]
jmp fcn.006f8984
shrd dx, ax, cl
mov word [ebp], dx
jmp 0x6c687a
call 0x5afeb2
mov ecx, 0x118e290a
inc ecx
mov eax, ecx
mov dx, word [ecx + ebp - 0x118e290b]
sal ecx, 0xb0
mov ax, word [ecx + ebp - 0x290afffe]
xor cl, byte [ecx + ebp - 0x290afffc]
push 0xc3a16b2f
add ebp, 4
jmp 0x70084f
xor eax, eax
test esi, esi
lea esp, [esp + 8]
je 0x83e233
mov ecx, 0xbda34883
movzx ecx, byte [edx]
xor ecx, eax
push 0x7988c0af
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5b0d04]
and dword [esp], 0x69afbe0c
shr eax, 8
xor eax, ecx
inc edx
xor eax, 0x81823213
dec esi
lea esp, [esp + 4]
jne 0x83e1fa
jmp 0x835b9c

Function at 0x8542d0
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xc166c80f
enter 0xffffffffffff8b41, 0xffffffffffffffda
xor eax, eax
movsx edx, al
call fcn.0078fad3
mov edx, dword fs:[edx + eax - 0x792cf11e]
push 0x22235689
mov dword [esi], edx
call fcn.0071484d
adc dword [edx + eax*4], 0xffffff89
in eax, dx
pop eax
sbb bh, byte [ecx + 0x1f]
jb 0x854369
int 1
sbb al, 0x14
jecxz 0x854324
jb 0x854370
sub eax, 0x53dcd4e1
out dx, al
sbb esi, ecx
dec esp
xor dword [edx], edi
jbe 0x8542bd
aaa
cmp al, 0x28
in al, 0xe1
ljmp 0x85f0
mov esi, 0x5e93bc4f
xchg ebx, eax
pop esi
inc edx
int3
jne 0x8542d8
pushfd
imul dh
jnp 0x85433b
and eax, 0x5c20e5f2
xchg edi, eax
dec eax
psubd mm3, qword [edx]
ror cl, 0x32
and dword [eax - 0x43e585b3], edi
sbb al, al
leave
xor ah, byte [ecx]
mov eax, 0xbc1a7a4d
sbb ch, byte [eax + 0x3a5c1bad]
push edi
pop edi
call 0xe68e4476
sub edi, edx
fmul st(0), st(0)
pop es
mov dword [eax], ecx
sbb ah, bh
pop ecx
pop ebp
xchg edx, eax
dec esp
inc edi
pop ebx
xchg edi, eax
ljmp 0xab04
loope 0x85432a
or dword [esp + eax], ecx
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [0xc7cc529d]
fcmovne st(0), st(2)
jnp 0x8543ed
mov esi, 0x391492
aam 0x2d
xor byte [esi - 0x57], dl
salc
jae 0x8543bc
mov eax, 0x108aaa0f
mov ebp, 0x34d0193a
xor edx, dword [eax - 0x6fe5f595]
xor eax, 0x6de855aa
jp 0x854321
and dword [ebx - 0x14b50ea6], esp
arpl word [ecx - 0x4e9bbc70], ax
imul edi, ebx, 0x1ad641d5
pop edi
push esp
js 0x854363
stc
int1
push esi
frstor dword ds:[eax]
push 0xffffffffffffff8e
imul ebp, dword [ebx], 0x61563052
popal
invalid
mov esp, 0xbe762cad
pop edx
pop ebx
mov edi, 0x630d1dd1
sbb byte [esi - 0x487607cc], bh
mov edi, 0x7e376cdc
push edi
daa
rol bh, cl
stosd dword es:[edi], eax
xchg esi, eax
invalid