joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ac80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xab
xor eax, eax
nop
mov dl, byte [edi + eax + 0x39ca4980]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001acad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001ac90
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001af60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x31
xor eax, eax
nop
mov dl, byte [edi + eax - 0x30357a82]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001af8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x14
jl 0x1001af70
pop edi
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001b150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xab
xor eax, eax
nop
mov dl, byte [edi + eax - 0x78ca5e5b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001b17d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001b160
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001b190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xbf
xor eax, eax
nop
mov dl, byte [edi + eax + 0x47773c32]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001b1bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001b1a0
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001b560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x3d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x304eca3]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001b58d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001b570
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001b5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xc4
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1c1c37e0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001b5cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001b5b0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001bb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x38
xor eax, eax
nop
mov dl, byte [edi + eax - 0x20b64c60]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001bb6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x1001bb50
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001bde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x3c
xor eax, eax
nop
mov dl, byte [edi + eax + 0x508dd01d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001be0d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x1001bdf0
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xe
xor eax, eax
nop
mov dl, byte [edi + eax - 0xaeef186]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001c0ad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x1001c090
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x35
xor eax, eax
nop
mov dl, byte [edi + eax - 0x6282fd3f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001c0ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x12
jl 0x1001c0d0
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2b
xor eax, eax
nop
mov dl, byte [edi + eax - 0x7125becb]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001c3bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001c3a0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xe5
xor eax, eax
nop
mov dl, byte [edi + eax + 0x6acb51ce]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001c6bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x1001c6a0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001cb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x67
xor eax, eax
nop
mov dl, byte [edi + eax + 0x6b32a658]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001cb6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x1001cb50
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001cc10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xd2
xor eax, eax
nop
mov dl, byte [edi + eax - 0x57d4a2c6]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001cc3d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001cc20
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001cc50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 1
xor eax, eax
nop
mov dl, byte [edi + eax - 0x239182a4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001cc7d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001cc60
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ce10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xc6
xor eax, eax
nop
mov dl, byte [edi + eax + 0x6575ec95]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001ce3d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x1001ce20
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xf4
xor eax, eax
nop
mov dl, byte [edi + eax - 0x612e2ee1]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001d3bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001d3a0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x80
xor eax, eax
nop
mov dl, byte [edi + eax + 0x51d3556]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001d3fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001d3e0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x1c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x43362d13]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001d5bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x1001d5a0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
nop
mov dl, byte [edi + eax - 0x7632c59d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001d67d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x1001d660
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 7
xor eax, eax
nop
mov dl, byte [edi + eax - 0x631a8993]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001d6bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x1001d6a0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001d840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x1b
xor eax, eax
nop
mov dl, byte [edi + eax - 0x22048303]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001d86d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x1001d850
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xaa
xor eax, eax
nop
mov dl, byte [edi + eax - 0x5cb0fbbd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001d93d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001d920
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xd
xor eax, eax
nop
mov dl, byte [edi + eax + 0x758d2da1]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001d97d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001d960
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001de70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x96
xor eax, eax
nop
mov dl, byte [edi + eax - 0x6a30ca19]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001de9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x1001de80
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001dfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x42
xor eax, eax
nop
mov dl, byte [edi + eax + 0x3ec9ae8c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001e00d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001dff0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x52
xor eax, eax
nop
mov dl, byte [edi + eax - 0x5b1bf00c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001e04d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x16
jl 0x1001e030
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x3d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x760f49be]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001e08d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x1001e070
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001e1b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xb2
xor eax, eax
nop
mov dl, byte [edi + eax - 0x6a3aa13e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001e1dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x1001e1c0
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e1f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x81
xor eax, eax
nop
mov dl, byte [edi + eax + 0x2f1421fd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001e21d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x18
jl 0x1001e200
pop edi
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001fcb0
Capabilities:
Contain obfuscated stackstrings
Create thread
Set console window title

Disassembly:
sub esp, 0x24
mov eax, dword [0x1003b008]
xor eax, esp
mov dword [esp + 0x20], eax
cmp dword [esp + 0x2c], 1
push esi
mov esi, dword [esp + 0x2c]
jne 0x1001fe3e
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x1001fd33
push 1
mov word [esp + 8], 0x7477
mov byte [esp + 0xa], 0
mov dword [esp + 0xc], 0x4f4e4f43
mov dword [esp + 0x10], 0x245455
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
add esp, 0x10
push 0x10034d0e
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 7
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xa4
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + 0x10036cf8]
xor al, cl
inc ecx
mov byte [esp + edx + 0x14], al
and ecx, 0x800000ff
jns 0x1001fd5d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1001fd40
push 0x1001fb80
lea eax, [esp + 0x18]
mov byte [esp + 0x24], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x72657375
push eax
mov dword [esp + 0x18], 0x642e3233
mov word [esp + 0x1c], 0x6c6c
mov byte [esp + 0x1e], 0
call fcn.10001750
push eax
call fcn.100010f0
mov dword [0x1003bcf4], eax
mov ecx, 0x10
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + str.WtfPagexjIuh]
xor al, cl
inc ecx
mov byte [esp + edx + 0x14], al
and ecx, 0x800000ff
jns 0x1001fdcd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1001fdb0
push 0x1001fbd0
lea eax, [esp + 0x18]
mov byte [esp + 0x24], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x72657375
push eax
mov dword [esp + 0x18], 0x642e3233
mov word [esp + 0x1c], 0x6c6c
mov byte [esp + 0x1e], 0
call fcn.10001750
push eax
call fcn.100010f0
push 0x104
push 0x1003bcf8
push esi
mov dword [0x1003bcf0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push esi
push 0x1001ec90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1003b698], esi
mov ecx, dword [esp + 0x24]
mov eax, 1
pop esi
xor ecx, esp
call fcn.1002dd4e
add esp, 0x24
ret 0xc
Function at 0x10026940
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov dword [edi + 0xd60], 0
mov dword [0x2438ff74], 0xffffffff
mov dword [0x243b2ef8], 0
cmp byte [0x1004c400], 0
je 0x10026985
push 0x45
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10026985
cmp byte [0x1004c400], 0
jne 0x100269b5
mov ecx, dword [esi + 8]
cmp ecx, dword [esi]
jne 0x100269a8
mov eax, dword [esi + 4]
inc eax
add ecx, eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
mov dword [esi + 4], 0
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
Function at 0x10029040
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x1003b008]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x100290e2
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.100289a0
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x100290f1
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.100289a0
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
pop esi
xor ecx, esp
call fcn.1002dd4e
mov esp, ebp
pop ebp
ret
Function at 0x3585cc
Capabilities:
Check http status code

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xc], ebx
cmp dword [ebp + 0x14], ebx
je 0x358604
mov eax, dword [ebp + 0x14]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x3585f9
sub eax, edx
jmp 0x358606
xor eax, eax
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0035812d
mov esi, eax
cmp esi, ebx
jl 0x358725
push ebx
push dword [ebp - 4]
call dword [0x3215c0]
test eax, eax
jne 0x35865a
call dword [0x321414]
cmp eax, ebx
jle 0x358650
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x358725
push ebx
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x1c]
mov dword [ebp + 0x14], 4
push ebx
push 0x20000013
push dword [ebp - 4]
call dword [0x3215bc]
test eax, eax
jne 0x35869a
call dword [0x321414]
cmp eax, ebx
jle 0x358690
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x358725
mov ebx, 0x1000
push ebx
push 0
call dword [fcn.003214a0]
push eax
call dword [fcn.0032149c]
mov dword [ebp - 8], eax
test eax, eax
jne 0x3586bd
mov esi, 0x8007000e
jmp 0x358723
mov edi, dword [ebp + 0x18]
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [0x3215c8]
test eax, eax
jne 0x3586ef
call dword [0x321414]
test eax, eax
jle 0x3586e9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x358723
cmp dword [ebp + 0x14], 0
jbe 0x358711
mov eax, dword [edi]
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0x14]
push dword [ebp - 8]
push edi
call dword [eax + 0x10]
mov esi, eax
test esi, esi
jl 0x358723
cmp dword [ebp + 0x14], 0
ja 0x3586c0
mov eax, dword [edi]
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [eax + 0x14]
mov esi, eax
xor ebx, ebx
mov edi, dword [0x3215b8]
cmp dword [ebp - 0xc], ebx
je 0x358735
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x10], ebx
je 0x35873f
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 4], ebx
je 0x358749
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x35875f
push dword [ebp - 8]
push ebx
call dword [fcn.003214a0]
push eax
call dword [fcn.003214a4]
cmp esi, ebx
jl 0x358773
mov eax, dword [ebp + 0x1c]
cmp dword [eax], 0xc8
je 0x358773
xor eax, eax
inc eax
jmp 0x358775
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x35ea79
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x35eaba
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x35ea93
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x35ead8
dec esi
je 0x35eacf
dec esi
jne 0x35eadd
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x35ffcd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
and dword [ebx + 0x28], 0
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], 0
mov word [ebx + 0xc], ax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x24], ecx
mov esi, 0x8000
jne 0x36001d
push esi
push eax
add eax, esi
push eax
call fcn.00356642
add esp, 0xc
xor eax, eax
and dword [ebx + 0x30], eax
mov word [ebx + 0x2c], ax
call fcn.0035fa04
and dword [ebx + 0x20], 0
mov eax, esi
push 2
mov word [ebx + 0x3c], ax
mov eax, dword [ebx + 0x14]
pop ecx
mov dword [ebx + 0x34], esi
add eax, esi
push edi
movzx edi, byte [eax]
mov edx, dword [ebx + 0x20]
shl edx, 5
xor edx, edi
and edx, 0x7fff
inc eax
dec ecx
mov dword [ebx + 0x20], edx
jne 0x360041
cmp byte [ebp + 0x24], cl
je 0x360067
mov edi, ebx
call fcn.0035f845
jmp 0x360079
xor eax, eax
mov ecx, esi
mov edx, dword [ebx + 0x18]
xor edi, edi
mov word [eax + edx], di
inc eax
inc eax
dec ecx
jne 0x36006b
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.0035ec05
push 0x4b
pop edx
call fcn.0035ec05
call fcn.0035fd4a
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
pop edi
je 0x3600b8
mov eax, dword [ebx + 0x14]
push esi
lea ecx, [eax + 0x8000]
push ecx
push eax
call fcn.00356642
add esp, 0xc
mov eax, dword [ebx + 0x28]
neg eax
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24