joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1cbe5c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2d0]
call fcn.0004dcfc
push eax
call fcn.00017bd4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1cbf1b
xor eax, eax
push ebp
push 0x1cbf14
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xcc0020
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x480]
mov eax, dword [esi + 0x12c]
call fcn.00091cfc
call fcn.0002d794
push eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
push eax
mov eax, dword [ebx + 8]
mov edi, dword [ebx]
sub eax, edi
push eax
mov eax, dword [ebp + 8]
mov eax, dword [esi + 0x34]
add eax, dword [ebx + 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [esi + 0x30]
add eax, edi
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0001768c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1cbf1b
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2d0]
call fcn.0004dcfc
push eax
call fcn.00017e64
ret
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40102e
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x822c4c], 0xee
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jne 0x401077
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
mov eax, dword [0x435c58]
mov dword [ebp - 0x24], eax
mov eax, dword [0x435c5c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.00401027
mov eax, dword [0x435c60]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [0x435c64]
add ebx, 0x7c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 4], 2
add dword [ebp - 4], 3
mov eax, dword [ebp - 8]
mov edx, dword [0x822c4c]
mov edi, eax
shl edi, 4
add edi, dword [ebp - 0x18]
cmp edx, 0xfa9
jne 0x4010dd
mov dword [0x822c48], 0xedeb2e40
cmp edx, 0x3eb
jne 0x4010eb
mov dword [0x437074], esi
lea ecx, [ebx + eax]
xor edi, ecx
mov ecx, dword [ebp - 4]
shr eax, cl
mov dword [0x822c44], 0x9150ce2e
add eax, dword [ebp - 0x20]
xor eax, edi
mov edi, eax
cmp edx, 0x27
jne 0x401137
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push esi
push esi
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
mov edx, dword [0x822c4c]
sub dword [ebp - 0xc], edi
cmp edx, 0xc
jne 0x401145
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0x5dc052bb
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 0x24]
lea edx, [ebx + ecx]
xor eax, edx
push eax
mov dword [ebp - 0x10], eax
mov eax, ecx
shr eax, 5
add eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
push ecx
call fcn.00401000
mov dword [0x437070], esi
mov eax, dword [ebp - 0x10]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
dec dword [ebp - 0x14]
jne 0x4010af
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4

Function at 0x40120a
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [0x822c4c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x822738], eax
ret
Function at 0x401225
Capabilities:
Get hostname
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x89c
push esi
xor esi, esi
cmp dword [0x822c4c], 0x20a
jne 0x40129a
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push str.Pufumaboyesimes
push str.Cazica
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
push esi
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryOption]
push esi
call fcn.0040146d
pop ecx
push edi
xor edi, edi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
cmp edi, 0x90ce655
jg 0x4012b8
inc edi
cmp edi, 0x7048dce2
jl 0x40129d
call fcn.004011f6
push 0x436be8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [0x822c4c]
mov dword [0x82273c], eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x822738], eax
call fcn.0040120a
mov eax, dword [0x435d34]
xor edi, edi
mov dword [0x82403c], eax
cmp dword [0x822c4c], esi
jbe 0x40132d
cmp dword [0x822c4c], 0x44
mov eax, dword [0x82403c]
mov al, byte [eax + edi + 0xb2d3b]
mov ecx, dword [0x822738]
mov byte [ecx + edi], al
jne 0x401324
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
inc edi
cmp edi, dword [0x822c4c]
jb 0x4012f8
xor edi, edi
mov eax, dword [0x822c4c]
add eax, edi
cmp eax, 0x5e
jne 0x40135d
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
push esi
lea eax, [ebp - 0x89c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapCompact]
inc edi
cmp edi, 0x40c893
jl 0x40132f
call fcn.0040119f
pop edi
cmp esi, 0xc06
jne 0x401379
call fcn.004011dc
inc esi
cmp esi, 0x246b35
jl 0x40136c
mov eax, dword [0x822738]
mov dword [0x822c40], eax
call eax
pop esi
leave
ret

Function at 0x401391
Capabilities:
Get geographical location

Disassembly:
cmp dword [0x822c4c], 0xc
jne 0x4013d1
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
call fcn.004013ea
push esi
call fcn.0040154d
push esi
call fcn.00401537
push esi
push esi
call fcn.0040166f
add esp, 0x14
call fcn.00401690
pop esi
mov eax, dword [0x435ed4]
add eax, 0xb2d3b
mov dword [0x822c4c], eax
call fcn.00401225
xor eax, eax
ret 0x10

Function at 0x40338c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435360]
jne 0x403396
repz ret
jmp fcn.00405f95
Function at 0x404b1a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040340d
and dword [ebp - 4], 0
cmp dword [0x4367ac], 0
mov ebx, eax
jne 0x404bcb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404c7c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404c7c
push eax
call fcn.0040339b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4367ac], eax
call esi
push eax
call fcn.0040339b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4367b0], eax
call esi
push eax
call fcn.0040339b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4367b4], eax
call esi
push eax
call fcn.0040339b
pop ecx
mov dword [0x4367bc], eax
test eax, eax
je 0x404bcb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040339b
pop ecx
mov dword [0x4367b8], eax
mov eax, dword [0x4367b8]
cmp eax, ebx
je 0x404c23
cmp dword [0x4367bc], ebx
je 0x404c23
push eax
call fcn.00403416
push dword [0x4367bc]
mov esi, eax
call fcn.00403416
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404c23
test edi, edi
je 0x404c23
call esi
test eax, eax
je 0x404c1a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404c1a
test byte [ebp - 0xc], 1
jne 0x404c23
or dword [ebp + 0x10], 0x200000
jmp 0x404c5c
mov eax, dword [0x4367b0]
cmp eax, ebx
je 0x404c5c
push eax
call fcn.00403416
pop ecx
test eax, eax
je 0x404c5c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404c5c
mov eax, dword [0x4367b4]
cmp eax, ebx
je 0x404c5c
push eax
call fcn.00403416
pop ecx
test eax, eax
je 0x404c5c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4367ac]
call fcn.00403416
pop ecx
test eax, eax
je 0x404c7c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404c7e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5ccb2fe2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x5a0f2271
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x545120
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x56c9d0]
jne 0x54512a
repz ret
jmp fcn.005463cc

Function at 0x54759b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00544768
and dword [ebp - 4], 0
cmp dword [0x56e914], 0
mov ebx, eax
jne 0x54764c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5476fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5476fd
push eax
call fcn.005446f6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x56e914], eax
call esi
push eax
call fcn.005446f6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x56e918], eax
call esi
push eax
call fcn.005446f6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x56e91c], eax
call esi
push eax
call fcn.005446f6
pop ecx
mov dword [0x56e924], eax
test eax, eax
je 0x54764c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.005446f6
pop ecx
mov dword [0x56e920], eax
mov eax, dword [0x56e920]
cmp eax, ebx
je 0x5476a4
cmp dword [0x56e924], ebx
je 0x5476a4
push eax
call fcn.00544771
push dword [0x56e924]
mov esi, eax
call fcn.00544771
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5476a4
test edi, edi
je 0x5476a4
call esi
test eax, eax
je 0x54769b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x54769b
test byte [ebp - 0xc], 1
jne 0x5476a4
or dword [ebp + 0x10], 0x200000
jmp 0x5476dd
mov eax, dword [0x56e918]
cmp eax, ebx
je 0x5476dd
push eax
call fcn.00544771
pop ecx
test eax, eax
je 0x5476dd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5476dd
mov eax, dword [0x56e91c]
cmp eax, ebx
je 0x5476dd
push eax
call fcn.00544771
pop ecx
test eax, eax
je 0x5476dd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x56e914]
call fcn.00544771
pop ecx
test eax, eax
je 0x5476fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5476ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x548bb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x56c384]
add eax, 0xfffffdcf
mov dword [0x56c384], eax
call fcn.004010a0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x548c81
jmp 0x548cbe
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x38]
mov dword [esp + 0x50], eax
mov dword [0x56c388], 0x2382
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x80], eax
mov dword [0x56c384], 0x17e8
mov eax, dword [esp + 0x30]
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00549b30
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x56c384]
add ecx, 0xfffff71a
mov dword [0x56c384], ecx
mov dword [esp + 0x18], eax
jmp 0x548d34
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
je 0x548be6
jmp 0x548caa
mov eax, dword [esp + 0x10]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
je 0x548c52
jmp 0x548caa
lea eax, [esp + 0x38]
mov dword [0x56c388], 0xcff
mov dword [esp + 0xc], eax
call fcn.00549260
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
je 0x548cc6
jmp 0x548d34
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x10], eax
jmp 0x548c70
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.00548750
lea ecx, [0x54a3f0]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x58], 0x13f400
mov edx, dword [0x56c370]
mov dword [esp + 0x68], edx
mov edx, dword [0x56c374]
mov dword [esp + 0x8c], edx
mov edx, dword [0x56c378]
mov dword [esp + 0x54], edx
mov edx, dword [0x56c37c]
mov dword [esp + 0x74], edx
mov edx, dword [0x56c380]
mov dword [esp + 0x7c], edx
mov dword [0x56c384], 0xfffff70e
mov dword [esp + 8], eax
mov dword [esp + 0x10], ecx
jmp 0x548c70
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
jmp 0x548cbe
Function at 0x549100
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x56c390], 0
mov byte [0x56c394], 0
mov dword [0x56c384], 0x2002
mov dword [0x56c388], 0xf6c
mov dword [0x56c38c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x54922a
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x56c398], 0
mov edi, dword [0x56c390]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x56c398], esi
mov dword [0x56c388], 0x232c
mov eax, esi
cdq
idiv ecx
mov dword [0x56c390], edx
mov dword [0x56c384], 0x347
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x56c394], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x56c394]
mov esi, dword [0x56c390]
mov byte [ebx + esi], cl
mov esi, dword [0x56c38c]
add esi, 1
mov dword [0x56c38c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x549154
mov eax, dword [0x56c388]
add eax, 0xffffeb75
mov dword [0x56c388], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x56c388], 0x1a2c
mov dword [0x56c38c], 0
mov dword [ebp - 0x20], eax
jmp 0x549154
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x56c384], 0x142c
mov eax, dword [0x56c38c]
add eax, 1
mov dword [0x56c38c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x54922a
jmp 0x54920c
Function at 0x549260
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x56c388]
mov edi, esi
add edi, 0xffffde83
mov dword [0x56c384], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
jmp 0x5492c7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
je 0x5493aa
jmp 0x5493ee
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
je 0x549382
jmp 0x549340
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x38]
cmp word [eax + ecx*2], 0x6f
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
je 0x54935d
jmp 0x5493ee
mov eax, dword [ebp - 0x20]
add eax, 0xffffdce0
mov dword [0x56c384], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x10], 0x6c
sete bl
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x3d], bl
mov al, byte [ebp - 0x3d]
test al, 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], ecx
jne 0x5493c5
jmp 0x5493ee
mov eax, dword [ebp - 0x30]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], eax
jl 0x5492c7
jmp 0x549382
mov dword [0x56c388], 0x1815
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
je 0x5492a9
jmp 0x5493ee
mov eax, dword [ebp - 0x34]
mov dword [0x56c388], 0x9f
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
je 0x5492e3
jmp 0x5493ee
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
je 0x549307
jmp 0x5493ee
mov eax, 1
mov ecx, 0xadf
mov dword [0x56c384], 0xadf
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x44], eax
je 0x549400
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
add eax, 0xfffff184
mov dword [0x56c388], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x549840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x56c38c], 0
mov dword [0x56c390], 0
mov dword [0x56c39c], 0
mov dword [0x56c388], 0x14e0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x549990
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x5498a5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x56c384], 0xb69
add eax, 1
mov edi, edx
add edi, 1
mov dword [ebp - 0x2c], edx
cdq
idiv esi
mov dword [0x56c38c], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x56c390], edx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x56c394], cl
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x56c384], 0x226c
mov cl, byte [0x56c394]
mov edx, dword [0x56c390]
mov byte [ebx + edx], cl
mov edx, dword [0x56c38c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x56c390]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x56c39c], ecx
mov dword [0x56c384], 0x11c5
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
mov dl, byte [edx + esi]
xor dl, byte [ebx + ecx]
mov ecx, dword [ebp - 0x18]
mov byte [ecx + esi], dl
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x34], edi
je 0x54998e
mov eax, dword [0x56c38c]
mov ecx, dword [0x56c390]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
jmp 0x5498a5
jmp 0x549990
mov dword [0x56c388], 0xe7d
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5d7ce1
Capabilities:
Check http status code

Disassembly:
sub edx, eax
inc eax
test al, 0x74
sub al, 0xd0
adc edi, dword [edi + 0x55]
pop edx
test al, 0x74
sub al, 0xd0
or edx, dword [esi + 0x7e224e79]
add ah, byte [edx]
push ss
invalid

Function at 0x5d7e90
Capabilities:
Check http status code

Disassembly:
mov ebp, 0x2ab6c6eb
jne 0x5d7ec2
dec esi
and bl, byte [edi]
stosb byte es:[edi], al
lea ebx, ds:[esi + 0x74a85c82]
popal
dec esi
and ecx, dword [eax]
inc esp
inc esi
pop ebp
jg 0x5d7ed6
dec esi
ret
sub al, 0xc4
and edi, dword [edi + 0x55]
sub dl, byte [eax + 0x2d]
dec esi
and ebx, dword [esi]
add ah, byte [edx]
push cs
jle 0x5d7f49
invalid
jecxz 0x5d7f03
fbld tbyte [ebx - 0x45]
fbld tbyte [ebx - 0x45]
and edi, eax
jmp 0x5d7f4e
dec ebx
jle 0x5d7f32
loopne 0x5d7eec
insd dword es:[edi], dx
cmpsd dword [esi], dword es:[edi]
jle 0x5d7f2f
jle 0x5d7f3a
sahf
push ecx
jmp 0x2fe6e599
fimul dword [esi + 0x79]
loop 0x5d7f33
invalid
mov ebp, 0xbab32b74
mov esi, dword [edi]
aaa
dec esi
and bh, byte [esi - 0x1d]
cmp dword [ebx], ebp
jle 0x5d7f6e
dec esi
popfd
insb byte es:[edi], dx
sub al, 0xf6
into
mov esp, 0x78295c82
sub ecx, dword [esi + 0x22]
xchg esi, eax
hlt
test al, 0xc8
pop ss
push esp
cmp al, 0xdf
jle 0x5d7ff3
sub ecx, dword [esi - 0x69]
pop es
cmp al, 0x25
or al, 0x44
sub ecx, dword [esi + 0x22]
mov bh, 0x66
dec edx
and bh, byte [esi + 0x2b]
dec esi
sub dword [ebx + 0x2b], ebx
dec esi
and dh, cl
mov edx, fs
add ch, byte [ebx]
cmp dword [ebp - 0x63], ecx
pop esp
sub al, 0xd0
jg 0x5d8018
push ebp
pop esi
and ecx, dword [eax]
inc eax
dec ebp
popfd
insb byte es:[edi], dx
sub al, 0x32
mov dword [edi], esi
das
lodsb al, byte [esi]
mov byte [edi], dh
das
and al, 0xe0
invalid
invalid

Function at 0x5d7eb1
Capabilities:
Check http status code

Disassembly:
sub edx, eax
inc eax
mov ebx, 0x224e2a8c
jle 0x5d7f07

Function at 0x5e357c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5e3597
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124a87bc]
pop edx
test eax, eax
je 0x5e3669
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5e3658
test dword [ebp - 0x2a8], 1
jne 0x5e3658
and dword [ebp - 0x2a8], 0x100
jne 0x5e3658
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2b9e]
pop edx
pop esi
test eax, eax
je 0x5e35fb
jmp 0x5e3658
cmp word [esi], 0x5a4d
jne 0x5e3658
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5e3658
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2b96]
pop edx
test eax, eax
je 0x5e3658
lea eax, [ebp - 0x28c]
push eax
call fcn.005e34d8
test eax, eax
jne 0x5e3651
jmp 0x5e3658
mov eax, esi
jmp 0x5e3669
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5e3597
pop esi
leave
ret 4