joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100181b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100359f7
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x10048040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 7
mov word [edi + 0x18], ax
movups xmmword [edi + 0x30], xmm0
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 7
mov word [edi + 0x30], ax
mov byte [edi + 0x48], al
movups xmmword [edi + 0x4c], xmm0
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], 7
mov word [edi + 0x4c], ax
movups xmmword [edi + 0x64], xmm0
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], 7
mov word [edi + 0x64], ax
lea ecx, [edi + 0x7c]
mov byte [ebp - 4], 5
push str.Default
call fcn.10012720
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
push 0x1003c3d4
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 5
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
call fcn.10012720
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
push 2
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.10019140
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov esi, dword [ebp - 0x2c]
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov edi, 2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x50]
mov ecx, esi
push eax
call fcn.100186a0
add esi, 0x18
mov dword [ebp - 0x1c], esi
sub edi, 1
jne 0x10018328
push ecx
mov edx, esi
mov ecx, esi
call fcn.10012910
mov edi, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
add esp, 4
mov dword [ebp - 0x28], esi
cmp edi, eax
je 0x10018385
mov ecx, edi
call fcn.10012840
mov eax, dword [ebp - 0x2c]
mov dword [edi], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
call fcn.10012840
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x100183c3
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100183b9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100183e5
push ecx
push edx
call fcn.1001a858
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001a6fb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.10022409
int3
Function at 0x1001a9c7
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x1001a9fc
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x1001a9f9
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x1001aa05
add edx, 0x28
cmp edx, esi
jne 0x1001a9e7
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x1001aa02

Function at 0x10028a9c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10028adb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10028adb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10028adb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10028adb
cmp dword [ecx + 0x74], 0xe
jbe 0x10028adb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1002cff6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002d093
push ebx
push esi
call fcn.1002cfbe
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002cf54
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002d040
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002d092
push edi
push eax
call fcn.10029eb0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002d060
call fcn.10029e60
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002d091
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002cf54
add esp, 0x20
test eax, eax
jne 0x1002d07f
push edi
call fcn.10029e60
jmp 0x1002d087
push ebx
call fcn.10029e60
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100345c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100345ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100345ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x23191d00
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x543f2c62
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x14d0fa28
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], ebx
call dword [0x14d12300]
test eax, eax
je 0x14d0fb16
cmp dword [ebp - 0xc], 0xc8
jne 0x14d0fb16
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [0x14d12158]
mov esi, eax
cmp esi, 0xffffffff
je 0x14d0fb16
mov byte [ebp - 1], bl
push ebx
push dword [ebp + 0x10]
call dword [0x14d12150]
test eax, eax
je 0x14d0fabc
lea eax, [ebp - 8]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [0x14d122ec]
test eax, eax
jne 0x14d0fac0
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x14d0faf0
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [0x14d12190]
test eax, eax
je 0x14d0fae7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x14d0faeb
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x14d0fa91
push esi
call dword [0x14d121a0]
push esi
call dword [0x14d12140]
cmp byte [ebp - 1], bl
je 0x14d0fb0c
push dword [ebp + 0xc]
call fcn.14d0eab6
pop ecx
xor eax, eax
cmp byte [ebp - 1], bl
sete al
jmp 0x14d0fb18
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x482d349d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x76687282
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3cd92c33
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x74ec3501
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x535a6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.00550adc
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x575a32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.00550adc
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x575a32
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 4]
xor eax, 0x12476359
mov dword [ebp + 4], eax
push eax
mov eax, dword [ebp]
xor eax, 0x97815643
mov dword [ebp], eax
push eax
mov ebx, dword [ebp - 4]
call fcn.00535a4d
mov eax, 0
cmp eax, ecx
jl 0x535b05
push 0x20b
push 0x4011022
push 1
call fcn.00550af4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.00535a4d
mov eax, 0
cmp eax, ecx
jl 0x535b38
push 0x234
push 0x4011022
push 1
call fcn.00550af4
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x535b4e
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x535b76
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x535b70
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x535b8f
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.005519d0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x535beb
push ebx
call fcn.00550ad6
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x535c00
push eax
pushfd
mov eax, dword [esp + 8]
xor eax, 0x97815643
mov dword [ebp], eax
mov eax, dword [esp + 0xc]
xor eax, 0x12476359
mov dword [ebp + 4], eax
xchg dword [esp + 4], eax
popfd
pop eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.00550ad6
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.00550ad6
add esp, 4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x552450
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x55246e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x552463
pop esi
ret

Function at 0x555b0a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00555b89
jae 0x555b16
xor ecx, ecx
call fcn.00555b89
jae 0x555b40
xor eax, eax
call fcn.00555b89
jae 0x555b51
mov al, 0x10
call fcn.00555b89
adc al, al
jae 0x555b32
jne 0x555b7e
stosb byte es:[edi], al
jmp 0x555b17
call fcn.00555b95
dec ecx
loop 0x555b5d
mov eax, ebp
call fcn.00555b93
jmp 0x555b7f
lodsb al, byte [esi]
shr eax, 1
je 0x555ba5
adc ecx, 2
mov ebp, eax
jmp 0x555b7f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00555b93
cmp eax, 0x7d00
jae 0x555b7d
cmp eax, 0x500
jae 0x555b7e
cmp eax, 0x7f
ja 0x555b7f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x555b17
pop ebp
ret 8

Function at 0x593f49
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.006d47ba

Function at 0x5bc20f
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov eax, dword [eax + 4]
test edi, 0x66113c46
cmp eax, 0x42792bda
add eax, 8
push eax
call fcn.00550adc
pop ecx
pop esi
mov bx, dx
xchg bx, di
mov edi, eax
movsx ebx, cx
bswap bx
mov bx, 0x331a
rep movsb byte es:[edi], byte [esi]
not bl
sete bl
bswap esi
pop edi
pop esi
movzx cx, ah
stosd dword es:[edi], eax
bswap cx
movsx ebx, bp
cbw
mov ecx, 3
movsx ebx, cx
rep movsd dword es:[edi], dword [esi]
pop eax
sbb edi, edi
pop edi
mov dword [edi], eax
rcl bh, cl
shr ebx, cl
cmp ebp, eax
mov ebx, dword [ebp - 0x70]
clc
push ebx
cmp edi, 0x29803894
jmp 0x5baf80
add ebx, 4
stc
clc
push ebx
test sp, 0x440e
mov ebx, dword [ebx]
test ebx, ebx
je 0x5bafa0
push ebx
call fcn.00550ad6
add esp, 4
xchg bl, bl
pop ebx
call fcn.00550ad6
add esp, 4
cwde
not ax
push dword [esp + 0x30]
popfd
lea esp, [esp + 0x40]
call fcn.00597963
stosd dword es:[edi], eax
movzx ax, cl
lodsd eax, dword [esi]
push esi
clc
cmc
push edi
clc
test sp, bx
test eax, 0x3e303414
test eax, eax
je 0x5b1482
push eax
jmp 0x5b144e

Function at 0x60caac
Capabilities:
Authenticate hmac

Disassembly:
mov dword [ebp - 4], 0
jmp 0x69311b
stosd dword es:[edi], eax
lodsd eax, dword [esi]
jmp 0x66c5fa
push ebp
mov ebp, esp
sub esp, 0x98
jmp 0x5daaf7
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x5d924d
stosd dword es:[edi], eax
jmp 0x66e78d
mov dword [ebp - 0xc], 0
jmp 0x6222fb
push 8
call fcn.00550adc
add esp, 4
xchg di, si
movsx edi, cx
mov dword [ebp - 8], eax
movsx esi, bp
mov edi, eax
cbw
mov esi, 0x55523e
movsx ax, dh
lodsd eax, dword [esi]
jmp 0x60a869
Function at 0x6d59aa
Capabilities:
Authenticate hmac

Disassembly:
push esi
pushfd
mov esi, 0x149741e
call fcn.0066c3ea
Function at 0x6fe1b2
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
xor dword [esp + 0xc], 0x1b9e1148
push dword [esp + 8]
popfd
lea esp, [esp + 0x10]
call fcn.0066ca05
push esi
jne 0x610e59
cmc

Function at 0x708693
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x20]
call fcn.005d8b0b

Function at 0x70a071
Capabilities:
Check for software breakpoints
Check http status code
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp + 4], 0xfd091814
pushfd
call fcn.00536bf7
Function at 0x4a14f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a15cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a15e8
push ebx
push 0x4a15f8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004077c0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a494
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a1576
mov ax, 0x83
call fcn.004a1118
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a14c8
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a157f
call fcn.004a14c8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a15d4
lea eax, [ebp - 4]
call fcn.00409a3c
pop eax
jmp eax

Function at 0x4a16e8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
jmp 0x4a17a5
cmp dword [esi + 0x10], 0x1000
jne 0x4a1793
test byte [esi + 0x15], 1
jne 0x4a1793
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1744
cmp ebp, 2
je 0x4a1744
cmp ebp, 0x10
je 0x4a1744
cmp ebp, 0x20
jne 0x4a1760
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a1760
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a1771
mov eax, dword [esi]
add eax, ebx
call fcn.004a16e0
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a1764
cmp byte [esp + 4], 0
je 0x4a1793
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a1719
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40894a
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edx, 0x4085d8
and edi, esi
call fcn.00408969
xor dword [eax], edx
add eax, 1
sub esi, 1
cmp eax, ebx
jne fcn.0040894a
ret
Function at 0x4010e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x401940
push 0x401fc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x40302c], 0xffffffff
or dword [0x403030], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x403024]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x403020]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403028], eax
call fcn.004011d5
cmp dword [0x403014], 0
je 0x401f76
call fcn.004011d6
push 0x403010
push 0x40300c
call sub.MSVCRT.dll__initterm
mov eax, dword [0x40301c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x403018]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x403008
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00401275
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x401f87
push 0x401fcf
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
jmp 0x401163
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401b13
Capabilities:
Terminate process

Disassembly:
push 0x1fe8
push 0
push 6
push 0x401a18
call fcn.00401b31
add esp, 0x10
push 1
call dword [sym.imp.MSVCRT.dll_exit]

Function at 0x401e71
Capabilities:
Create process on windows
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 2
xor esi, esi
push 0x401a14
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.MSVCRT.dll__mbsnbcmp]
mov edi, eax
add esp, 0xc
neg edi
sbb edi, edi
mov dword [ebp - 0x58], 0x44
inc edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x28], si
mov word [ebp - 0x26], si
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
je 0x401eff
inc ebx
inc ebx
movsx eax, byte [ebx]
push eax
call dword [sym.imp.MSVCRT.dll__ismbcspace]
test eax, eax
pop ecx
je 0x401eff
push ebx
call dword [sym.imp.MSVCRT.dll__mbsinc]
mov ebx, eax
movsx eax, byte [ebx]
push eax
call dword [sym.imp.MSVCRT.dll__ismbcspace]
pop ecx
jmp 0x401ee4
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push 0x20
push 1
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401f33
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
cmp edi, esi
je 0x401f6c
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x401acc
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
call dword [sym.imp.MSVCRT.dll__getch]
push dword [ebp - 0x14]
call ebx
mov eax, dword [ebp - 4]
jmp 0x401f2c