joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50bac0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d0c
xor eax, eax
push ebp
push 0x50bc30
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00408f54
mov edx, dword [ebp - 0x2c]
mov eax, 0x50bc4c
call fcn.00404e60
test eax, eax
jne 0x50bb19
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x50bc4c
call fcn.00404b68
mov byte [ebp - 9], 0
push 0
push 0
push 0
push 0
push 0x50bc54
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push 4
lea eax, [ebp - 8]
push eax
push 2
push ebx
call sub.wininet.dll_InternetSetOptionA
test ebx, ebx
je 0x50bc0d
mov edi, 1
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d1c
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
test esi, esi
jne 0x50bb91
inc edi
call sub.kernel32.dll_GetLastError_1
cmp edi, 5
jg 0x50bb91
cmp eax, 0x2ee2
jne 0x50bb91
cmp eax, 0x2f78
jne 0x50bb91
push 0xfa0
call sub.kernel32.dll_Sleep_1
jmp 0x50bb4c
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xa
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x13
push esi
call sub.wininet.dll_HttpQueryInfoA
lea edi, [ebp - 0x28]
lea eax, [ebp - 0x30]
mov edx, edi
call fcn.00404a54
mov eax, dword [ebp - 0x30]
mov edx, 0x194
call fcn.00409678
add eax, 0xfffffe70
sub eax, 3
jb 0x50bbdd
je 0x50bbe3
dec eax
sub eax, 0x2f
jae 0x50bbf9
mov byte [ebp - 9], 0
jmp 0x50bbfd
mov eax, dword [ebp - 4]
call fcn.00404b1c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x2f
sete byte [ebp - 9]
jmp 0x50bbfd
mov byte [ebp - 9], 1
test esi, esi
je 0x50bc07
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bc37
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00404880
lea eax, [ebp - 4]
call fcn.0040485c
ret
Function at 0x40ae3d
Capabilities:
Encode data using xor

Disassembly:
inc ecx
dec ebp
clc
sub eax, 0xd09c8f54
scasd eax, dword es:[edi]
stosb byte es:[edi], al
aam 0xe8
pop ecx
call 0x9a23d0d9
cdq
inc esp
clc
add cl, ah
mov dh, 0x48
aam 0x73
pop ebx
xor ch, byte [ebp + 0x4634820f]
jo 0x40ae4e
movsb byte es:[edi], byte [esi]
les ebp, [edx]
Function at 0x42e773
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xe58804ec
in al, 0x89
xchg byte [edi], dh
pop ebx
stosd dword es:[edi], eax
test al, 0xa7
pop ss
pop esi
adc edi, dword [eax]
sub dh, byte [ebp + 0x7a4c2bfd]
jb 0x42e6ff
xchg byte [edx - 0x5b], bh
movsd dword es:[edi], dword [esi]
push ebp
push ebp
out dx, eax
sub byte ds:[ebp - 0x33b12a03], dh
cmp dh, byte [esi]
dec esp
movsd dword es:[edi], dword ds:[esi]
in eax, dx
arpl word [esi + 0x7b297b9c], bx
jl 0x42e755
xchg ebx, eax
mov ch, byte [esi + 0x37]
pop edx
mov esi, 0x9b9ce523
lahf
mov ebp, 0xfd8a7cec
test byte [esi + 0x6d48fab8], bh
int1
pop edi
pop edx
mov edx, 0x29f5bd2a
dec ebp
outsd dx, dword [esi]
leave
jl 0x42e6e8
imul ebx, esp, 0x6c
sbb dword cs:[esi - 0x7a7daa85], ebx
xor byte [ebx], ch
leave
outsb dx, byte [esi]
mov dl, cl
test eax, 0x30a0e978
frstor dword [edx - 0x6da3ab85]
sti
loopne 0x42e70f
or esp, dword [eax]
adc ch, ah
push edi
push ebp
in eax, dx
cmp dword [eax], ebp
movsd dword es:[edi], dword [esi]
std
salc
adc dword [esi + 0x18], edi
mov esp, 0xa4202e0e
inc eax
Function at 0x444fb3
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xc805df51
xor bl, byte [ecx]
mov dl, 8
popal
imul ebp, dword [esi - 0x58], 0xffffffea
sbb al, 7
add ah, byte [edx + edx*2 + 0x5e3fb3f3]
push cs
mov ecx, es
dec eax
push ebx
invalid
mov ds, ebp
sub ebx, dword [esi + ebp - 0x27]
mov edx, 0xca24ca57
jb 0x444ea1
lds esp, [edx + 7]
or dl, byte [edx + 0x66]
mov byte [0x3bf4f41b], al
cmp al, 0x30
sub cl, byte [ebx + 0x25557e3b]
cwde
sal dword [ecx + 0x5298d298], 1
cwde
push edx
mov ecx, 0x82c05a55
mov dword [0x50d42fc3], eax
pop es
add dword [ebx - 4], ecx
jnp 0x444f0a
movsb byte es:[edi], byte ss:[esi]
rol dl, 0x8b
invalid
mov ebp, dword [ecx - 0x5fddfb29]
adc ecx, dword [eax - 0x2b63073c]
out 0x7b, eax
adc dl, dh
scasd eax, dword es:[edi]
popfd
imul esi, dword [edx + eax - 0x4f], 0xfffffff9
fild qword [eax - 0xc]
and cl, byte [eax + 0x5e]
add eax, 0x3eaa45c7
and cl, dh
and cl, dh
je 0x444f52
mov al, 0x10
js 0x444f2f
xchg ebx, ecx
fnsave dword [edi - 0x6781fee0]
cwde
cdq
jbe 0x444f83
push es
dec esp
loop 0x444f8f
xor al, byte fs:[esi + 0x1fb51360]
mov byte [ebp - 0x5804d876], dl
xchg ebp, eax
mov ah, byte [edi]
sti
cmpsd dword [esi], dword es:[edi]
adc esi, dword [ebp - 0x756a77e1]
daa
sti
cmpsd dword [esi], dword es:[edi]
push ecx
movsb byte es:[edi], byte [esi]
mov ebx, 0x88538ef9
push ds
mov byte [0x5b614ed2], al
dec esi
popal
pop ebx
add edi, dword [ebx - 0x61cda8c3]
or eax, 0xa6ac3eec
add byte [ebx + 0x7a2cd985], dh
fldcw word [edx + edi*2]
mov cl, 0xd2
outsb dx, byte [esi]
xor byte [edi - 0x6b], bl
nop
jl 0x444fa2
jne 0x445022
adc dword [edx + edx*2 - 0x54], edi
sahf
jb 0x444f8b
das
push esi
pop esp
push eax
jp 0x44500e
test byte [ecx + esi*4], bl
lds esp, [ebp - 0x47]
insb byte es:[edi], dx
salc
int1
psubsb mm1, qword [esi - 0x4dc5ab01]
jns 0x445096
nop
xchg edi, eax
les esi, [ebx + 0x6a775557]
test byte [eax + 0xc], bh
sub byte [ebp - 0x7d], 0x3f
xor ecx, dword [ebx + 0x7f]
Function at 0x447821
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00447a14
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00452569
xor ebx, ebx
cmp eax, ebx
jne 0x4479cf
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00447a14
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0044f248
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004a0b3d
add esp, 0x10
test eax, eax
jne 0x4478ea
push esi
call fcn.00444ed3
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4478ea
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4478d5
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4478ea
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4478e3
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call int.00453a7c
cmp byte [esp + 0x13], bl
je 0x44791a
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00447a51
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x44798a
push 0x14
call fcn.0049fdaa
cmp eax, ebx
pop ecx
je 0x447944
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x447946
xor edi, edi
cmp edi, ebx
je 0x44798a
push esi
push edi
call fcn.00446f77
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0044703f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00447168
add esp, 0x18
call fcn.00447a14
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00451c36
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4479a1
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4479b3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4479f6
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4479f6
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0044703f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00447168
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4683c5
Capabilities:
Encode data using xor

Disassembly:
invalid
xchg ecx, eax
scasb al, byte es:[edi]
ror dword [edi + 0x3b8994b0], 1
sub byte [edi + 0x37], dh
ja 0x4683cc
aaa
loop 0x46835d
dec edi
push ecx
lea ebp, [0xf5eaa751]
push ss
test eax, 0x278f4b4f
imul edi, eax, 0
ja 0x468369
lds esi, [esi - 0x7c]
mov eax, 0xc680dcb9
cmc
stc
sub ebp, dword [eax + 0x75]
or eax, 0xb850331
mov ebp, 0x5bc2a49a
pop eax
aaa
rcr dword es:[edx], cl
sbb cl, byte [edx]
invalid
ret 0x585b
sbb cl, byte [edx]
cmp dl, dh
xor dl, ch
xor dl, ch
mov al, byte [0x38c41f29]
sub dword [edi], ebx
les edi, [eax]
je 0x468393
push ss
push esi
loope 0x4683c8
add al, 0xf8
mov bh, 0xe5
wbinvd
mov ebp, dword [0xfd637ec1]
xchg edx, eax
mov ebx, dword [ebp + 0x7e78b5e5]
add byte [edi + 0x2a], dl
xor bl, bh
jbe 0x4683bf
rcr dword [eax + 1], 1
out 0x2c, eax
jno 0x468392
inc edx
enter 0xffffffffffff80ba, 0x78
pushfd
cmp byte [edx + ecx*4 + 0x46], ch
xchg ebx, eax
js 0x468394
fimul word [edi - 0x41f7d586]
xchg dword [esi + ebx + 0x31], esi
xchg ecx, eax
jnp 0x46842a
daa
xchg ebp, eax
aad 0xf8
dec ebp
pop ebx
sbb dword [ebx], 0x6540dd97
mov al, 0xe
outsb dx, byte [esi]
fild word [esi + 0x7e305c7a]
cmp al, 0xf6
int 0x47
inc edi
invalid
Function at 0x474c81
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00474e74
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0047f9c9
xor ebx, ebx
cmp eax, ebx
jne 0x474e2f
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00474e74
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0047c6a8
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4cdf9d
add esp, 0x10
test eax, eax
jne 0x474d4a
push esi
call fcn.00472333
mov esi, eax
cmp esi, ebx
pop ecx
je 0x474d4a
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x474d35
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x474d4a
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x474d43
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00480edc
cmp byte [esp + 0x13], bl
je 0x474d7a
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00474eb1
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x474dea
push 0x14
call 0x4cd20a
cmp eax, ebx
pop ecx
je 0x474da4
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x474da6
xor edi, edi
cmp edi, ebx
je 0x474dea
push esi
push edi
call fcn.004743d7
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0047449f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004745c8
add esp, 0x18
call fcn.00474e74
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0047f096
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x474e01
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x474e13
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x474e56
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x474e56
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0047449f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004745c8
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x493548
Capabilities:
Check http status code

Disassembly:
into
movsd dword es:[edi], dword [esi]
pushfd
mov byte [ecx + 0x24], al
mov eax, dword [0x5540a449]
outsb dx, byte [esi]
xor esp, edi
or edx, 0x7d
cld
push 0x79d6278c
push cs
and byte [ebx + 0x1f47ddad], bh
wait
mov al, 0x66
in eax, 0xbd
mov ebx, 0x19bb852d
loope 0x4935ab
sub byte [ebx + 0x2e], 0xad
push cs
adc edx, dword [ebp - 0x1f58c3c3]
mov ebp, dword [eax - 0x3bf45c28]
and dword [ebx], eax
mov dword [0x3dec4048], eax
jo 0x493509
jae 0x49350b
xchg esi, eax
mov edi, 0x1a985393
jmp 0x493585
dec ebx
fcomp dword [eax - 0x26a5c110]
inc ebx
jmp 0x8d2d21c8
invalid
Function at 0x4a27f1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a29e4
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004ad539
xor ebx, ebx
cmp eax, ebx
jne 0x4a299f
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a29e4
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004aa218
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4fbb0d
add esp, 0x10
test eax, eax
jne 0x4a28ba
push esi
call int.0049fea3
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a28ba
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a28a5
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a28ba
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a28b3
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004aea4c
cmp byte [esp + 0x13], bl
je 0x4a28ea
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a2a21
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a295a
push 0x14
call 0x4fad7a
cmp eax, ebx
pop ecx
je 0x4a2914
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a2916
xor edi, edi
cmp edi, ebx
je 0x4a295a
push esi
push edi
call fcn.004a1f47
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a200f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a2138
add esp, 0x18
call fcn.004a29e4
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004acc06
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a2971
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a2983
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a29c6
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4a29c6
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a200f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a2138
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4acac4
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
dec ebp
inc edx
mov ebx, 0x81840fca
sahf
fcom dword [edx + esi*8 - 0x1282f5ec]
inc eax
lea edx, [ecx - 0x58]
aad 0x1c
aaa
mov esp, 0xed05ee49
xor al, 0x3a
clc
mov ebp, 0x1c42d650
cld
lcall 0x9715, 0xd2b9c31
pushfd
sub ecx, dword [0x48649715]
inc edx
js 0x4acac0
lcall 0x185b, 0x31884da2
cmp bl, byte [ebx]
push esp
mov ebx, 0xf509985a
punpckhbw mm7, qword [edx - 0x14]
sbb cl, byte [esi - 0x6a]
cmp ch, byte [edx + 0x7a]
das
jp 0x4aca25
mov esp, 0x7d3d5488
sbb eax, 0x1e4428d7
lock or dword [esp + edi], ecx
invalid
scasb al, byte es:[edi]
push esp
mul byte [esi + edi - 0x46a96751]
scasd eax, dword es:[edi]
cwde
push esi
mov ecx, 0xa4868541
cmp bh, byte [ebp + 0x13]
scasd eax, dword es:[edi]
cwde
push esi
mov ecx, 0xa4868541
cmp bh, byte [ebp + 0x13]
outsd dx, dword [esi]
xchg ebp, eax
sbb al, 0xb
inc esp
pop esp
popfd
xor eax, 0x448342ba
mov ch, ch
jp 0x4acac5
popfd

Function at 0x4adbed
Capabilities:
Encode data using xor

Disassembly:
mov byte [ecx], 0x63
retf
pushal
sahf
test byte [eax - 0x61e2dfaa], bl
sbb dword [edi], esi
arpl cx, di
mov ah, 0x36
mov ch, 0x1b
arpl word [ecx], bx
sbb byte [edi - 0x79cebb81], dl
xor dword [esi + 0x63ba9cea], eax
jne 0x4adbf8
pop eax
mov eax, dword [0xe831fd74]
cmpsd dword [si], dword es:[di]
sahf
add al, 2
call dword [ebp - 0x6b]
pop esi
mov edi, 0xe21593c6
sbb dh, bh
inc esi
out 0x96, al
mov cl, 4
out 0xa0, eax
outsd dx, dword [esi]
movsb byte es:[edi], byte [esi]
jecxz 0x4adc75
jno 0x4adb98
sar byte [edi + 7], cl
xlatb
lahf
add dh, ah
jo 0x4adb89
xchg esi, eax
pushfd
jb 0x4adbd7
xchg esi, eax
inc edx
and cl, byte [eax + 0x126e7cc0]
mov dl, 0xcd
cmp byte [ebx - 0x70], bh
movsd dword es:[edi], dword [esi]
fisubr dword [eax - 0x39]
cdq
and byte [edx + ecx*4 + 0x59f30e36], dh
mov dh, byte [esi]
push cs
pop ecx
insb byte es:[edi], dx
add al, 0x61
arpl bx, cx
mov dh, 0x1a
xor dword [eax + 0x1d], ebp
mov esi, 0xabcd9b8b
push ebp
lcall 0xebf1, 0x8bc12fc1
in eax, 0x91
push esi
jno 0x4adc1b
jo 0x4adcba
invalid
pop ds
rcr dword [edi + 0x484197f6], 0x75
xchg ebp, eax
lahf
not byte [edi - 0x6a8ab7bf]
xor bh, cl
stc
xor dh, bh
mov dh, 0xc2
xor eax, 0xe6cbdb44
int1
invalid
nop
push 0x24
or byte [edx - 0x15360f7c], 3
and eax, 0x8bb9dffb
in eax, dx
sbb eax, ebp
sub byte [esi], dl
je 0x4adc73
xor al, ah
sub al, bl
aas
int 0x2f
retf
Function at 0x402ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
add eax, 0xa
push edi
mov ebx, 0x303a
mov ecx, 0x32c9
mov dword [ebp - 4], eax
mov esi, 0x69df
nop
mov eax, 0x2aaaaaab
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402ae0
mov eax, 0x8ca29c05
imul ebx
add edx, ebx
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402af3
jmp 0x402b10
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402b10
mov eax, dword [ebp + 8]
mov edi, 0x4403
inc byte [eax + 2]
mov cl, byte [eax + 2]
mov eax, 0x4bda12f7
imul edi
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402b33
mov edx, dword [ebp + 8]
movzx ebx, cl
add ebx, dword [ebp - 4]
movzx eax, byte [edx + 7]
movzx ecx, byte [ebx]
add ecx, eax
mov byte [edx + 7], cl
mov edi, 0x44fd
mov esi, 0x69cd
mov eax, 0x214d0215
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402b65
mov dl, byte [ebx]
movzx eax, cl
mov ecx, dword [ebp - 4]
add ecx, eax
mov byte [ebp + 0xb], dl
mov al, byte [ecx]
mov byte [ebx], al
mov byte [ecx], dl
mov esi, 0x5e9d
mov eax, 0xad602b59
imul edi
add edx, edi
sar edx, 7
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x402b90
mov al, byte [ebx]
add al, byte [ebp + 0xb]
mov ecx, dword [ebp - 4]
movzx eax, al
mov cl, byte [eax + ecx]
mov eax, 0x939a85c5
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x402bb3
movzx eax, cl
movzx ecx, byte [ebp + 0xc]
pop edi
pop esi
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452690
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x10325476
pop ebp
ret

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x543a7866
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4c1a2426
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x472670
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x402366
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x4022b8
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], ecx
xor ebx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
call dword [0x4010dc]
call fcn.0040db98
mov esi, dword [fcn.00401094]
mov dword [ebp - 0x48], eax
call esi
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x38]
push edx
push 0xf00ff
push eax
call fcn.0040dbe0
mov edi, eax
call esi
cmp edi, 1
jne 0x472766
mov edi, dword [0x4012a4]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x44]
push 0x40e4d4
push edx
call edi
push eax
lea eax, [ebp - 0x40]
push 0x405fbc
push eax
call edi
push eax
call fcn.0040dc30
mov dword [ebp - 0x48], eax
call esi
mov edi, dword [ebp - 0x48]
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x40]
push ecx
push edx
push 2
call dword [fcn.00401264]
add esp, 0xc
cmp edi, 1
jne 0x472766
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
push ecx
lea edx, [ebp - 0x24]
push 0x10
push edx
push ebx
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x48], 0x10
call fcn.0040dc80
call esi
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.0040d874
call esi
call dword [0x4010dc]
push 0x472793
jmp 0x472792
ret