joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411986
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x10]
push 0
push dword [eax + 4]
lea ecx, [ebp - 0xc]
call fcn.00410fa1
lea edi, [esi + 0x30]
lea ebx, [esi + 0x14]
push edi
mov ecx, ebx
call fcn.0040a70a
test al, al
jne 0x411ac9
cmp byte [ebp - 8], al
je 0x411ac9
mov ecx, dword [ebx + 4]
mov eax, 0x403944
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x1c], ecx
push edi
mov ecx, ebx
mov dword [ebp - 0x10], eax
call fcn.004112e4
test al, al
je 0x411a07
mov eax, dword [edi + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00415e9a
mov edi, eax
call fcn.0040b94e
test al, al
je 0x411a5b
lea eax, [edi + edi + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ecx, dword [esi + 4]
push eax
call fcn.00415f00
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x411abe
lea ebx, [edi + edi*2 + 3]
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 4], eax
lea eax, [edi + edi + 2]
push eax
call fcn.0040bf80
pop ecx
mov ecx, dword [esi + 4]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.00415f00
xor esi, esi
push esi
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push eax
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [0x41a4b0]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [ebp - 4]
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
call fcn.0040bf93
pop ecx
mov eax, 0x403944
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xc]
call fcn.00410fdf
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413cac
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
test edx, edx
je 0x413cd4
push edi
mov edi, edx
xor edx, edx
mov dl, byte [esi]
and edx, 0xdf
shl edx, cl
add ecx, 0xfffffffd
and ecx, 7
xor eax, edx
inc esi
inc esi
dec edi
jne 0x413cba
pop edi
and eax, 0xfff
pop esi
ret

Function at 0x4180c5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push dword [ebp + 8]
and byte [ebp - 0x800], 0
lea eax, [ebp - 0x800]
push eax
call fcn.00418118
lea eax, [ebp - 0x800]
push str._nThe_application_will_terminate_now.
push eax
call fcn.00418118
add esp, 0x10
lea eax, [ebp - 0x800]
push 0x10
push str.Fatal_error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x41832a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x78]
mov eax, dword [esi + edi + 0x20]
add esi, edi
add eax, edi
mov ebx, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
add ebx, edi
add ecx, edi
cmp dword [esi + 0x18], 0
mov dword [ebp - 8], ecx
jbe 0x418382
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
je 0x418389
inc dword [ebp + 8]
add dword [ebp - 4], 4
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x41835e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
movzx eax, word [ebx + eax*2]
mov eax, dword [ecx + eax*4]
add eax, edi
jmp 0x418384

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403a69
nop
nop
sub eax, 0x403a0f
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x414838
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x425798], 1
jae 0x4148be
mov byte [0x4215f0], 2
mov dword [0x4251e8], 0x4205bc
mov dword [0x4251ec], 0x4205d4
mov byte [0x425226], 2
mov dword [0x4251d4], 0x413954
call fcn.004120f8
test al, al
je 0x41487b
call fcn.00412128
call fcn.004121ec
mov word [0x42522c], 0xd7b0
mov word [0x4253f8], 0xd7b0
mov word [0x4255c4], 0xd7b0
call fcn.00413848
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x425218], eax
call fcn.00410164
mov dword [0x425214], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x42520c], eax
ret

Function at 0x41a750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x41a7b2
call fcn.0041a700
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004154e4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004154e4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x41a830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4233c4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x41a90a
cmp dword [0x4233c0], 0
jne 0x41a90a
cmp dword [0x4235a4], 0
je 0x41a8c4
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0041a600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41a8aa
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0041a600
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41a8aa
lea ebx, [ebp - 0x84]
jmp 0x41a8ab
inc ebx
call fcn.0041a7ec
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x41a945
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4233c8
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004154e4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4233cb
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x41a945
cmp dword [0x4233c0], 0
je 0x41a924
cmp dword [0x4233c0], 0xffffffff
je 0x41a945
push esi
call dword [0x4233c0]
pop ecx
mov eax, dword [0x4233c4]
test eax, eax
je 0x41a945
cmp dword [0x4233c4], 0xffffffff
je 0x41a945
cmp byte [eax], 0
je 0x41a945
push esi
push eax
call fcn.0041a750
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x438c87
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
sub ecx, 0xf8052df9
call fcn.00438cc1
sub ebx, ecx
xor dword [esi], edx
add ecx, 0x34b8c983
push 0x1c7ac6c5
pop ebx
inc esi
add ecx, 1
dec ebx
inc ebx
cmp esi, eax
jne fcn.00438c87
or ecx, ebx
or ecx, ebx
ret
Function at 0x10009237
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.1021f525
lahf

Function at 0x1000951a
Capabilities:
Authenticate hmac
Encode data using base64
Encrypt data using chaskey
Execute anti-debugging instructions

Disassembly:
push ebx
pushfd
mov ebx, 0x6ab51580
mov dword [esp + 8], 0xb495b710
mov ebx, dword [esp + ebx - 0x6ab5157c]
call fcn.1007e170

Function at 0x1000bc90
Capabilities:
Hash data using fnv

Disassembly:
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
ret
mov edx, ecx
jmp 0x1000bc70

Function at 0x1000bce0
Capabilities:
Hash data using fnv

Disassembly:
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
ret
mov edx, ecx
jmp 0x1000bca0
Function at 0x1000e6b0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x24f8
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100cbc5e
mov dword [ebp - 0x2354], ecx
jmp 0x1008e2cf
lea esp, [esp + 4]
or dx, ax
rol ah, cl
mov edx, dword [0x1011710c]
sub edi, edi
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x2348], edi
clc
cmc
lea eax, [eax + edx*4]
mov dword [ebp - 0x2404], eax
cmc
nop word [eax + eax]
cmp esp, 0xdbae789e
stc
test edi, edi
jmp loc.1017ad19

Function at 0x1000efd0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100cbc5e
jmp loc.10287ff4

Function at 0x1000f070
Capabilities:
Encode data using base64

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4820
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0xc
mov eax, 0x24b4
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x2058], edi
mov dword [ebp - 0x206c], edi
push 0x100cbc5e
mov esi, dword [0x10073659]
jmp 0x1004f461
call esi
mov eax, dword [0x1011d5a8]
mov eax, dword [eax + 0x58c]
jmp 0x1007bfac
push edi
call eax
push 0
jmp loc.101c3c35

Function at 0x100102a0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
mov eax, ebx
cdq
and edx, 3
push esi
push edi
lea esi, [edx + eax]
mov edx, 0x2a
sar esi, 2
lea edi, [ecx + esi*4]
neg esi
je 0x100102e3
imul eax, dword [edi + esi*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
rol edx, 0xd
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
add esi, 1
jne 0x100102c0
mov eax, ebx
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x10010309
sub eax, 1
je 0x10010300
sub eax, 1
jne 0x1001031f
movzx ecx, byte [edi + 2]
shl ecx, 0x10
movzx eax, byte [edi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, ebx
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
pop ebp
ret

Function at 0x10010420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
push esi
push edi
mov esi, ecx
push 0x100cbc5e
mov dword [esp + 0x2c], esi
jmp 0x1001c3e1
lea esp, [esp + 4]
cbw
xchg ah, ah
mov eax, dword [0x1011d5a8]
jmp loc.102454f0
Function at 0x100108f0
Capabilities:
Contain obfuscated stackstrings
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1550
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x150c], ecx
push 0x100cbc5e
jmp loc.1027371e

Function at 0x10016608
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 0xc], 0x99e7b790
lea esp, [esp + 0xc]
call fcn.1021f525
call esi
sub esi, esi
cmc
cmp si, 0x3397

Function at 0x10018205
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x10], 0xb136a910
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.1021f525

Function at 0x1001b1df
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
not dword [esp + 4]
push 0xe71d5d3e
lea esp, [esp + 0xc]
ja 0x101e300a
push 0x8cb60c99
mov eax, dword [esp]
lea edx, [esp + 4]
and dword [esp], 0xaf0e203d
js 0x102655d0
setns cl
mov ecx, 0x68
add al, 0xbe
inc dword [esp]
setbe al
lea eax, [edi - 0x80]
sbb word [esp + 1], 0x3c19
push 0x2e2517b2
push 0xeb9fea9c
and eax, 0xfffffffc
sub eax, ecx
call fcn.1009572a

Function at 0x1001c580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jl 0x1001c82a
mov eax, dword [esp + 0x18]
stc
cmc
test ah, al
sub ecx, ecx
jmp 0x1005df00
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x278
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0x274], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [0x1011d5a8]
push 0x100cbc5e
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], edi
jmp 0x10034c44
lea esp, [esp + 4]
cmp dword [ebp + 0x10], 3
jmp 0x1000fed8
push esi
jmp 0x10084efb

Function at 0x1001d250
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x2468
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0x2464], eax
push esi
push edi
mov edi, ecx
push 0x100cbc5e
mov dword [esp + 0xa0], edi
jmp loc.1018d753

Function at 0x10025770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp loc.101aa2ef
push 0
push eax
jmp loc.10258ddb
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc48
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0xc44], eax
push esi
push edi
push 0x100cbc5e
jmp 0x10035a72
lea esp, [esp + 4]
stc
test edi, 0x78809797
cmp dword [0x10117830], 0
jmp 0x1008ed44
jne fcn.100a052f
push 0xc8
lea eax, [esp + 0x224]
jmp 0x1001fce4
jle 0x10012963
sub eax, eax
xadd di, di
clc
mov dword [esp + 0x14], 0
btr di, 0x10
sub ecx, ecx
mov dword [esp + 0x10], 0
mov edi, 0x10117855
xor esi, esi
cmp edi, 0x520fc82
nop word [eax + eax]
stc
cmp byte [edi - 1], 0
jmp 0x100382b5
mov dword [esp + 0x18], 0
jmp 0x1004afc8
Function at 0x10026110
Capabilities:
Check for software breakpoints
Check http status code
Contain obfuscated stackstrings
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using chaskey
Encrypt data using speck
Execute anti-debugging instructions
Hash data using murmur3
Parse credit card information
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1d510
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xde50], ecx
push 0x100cbc5e
jmp loc.1025ab3d

Function at 0x1004f5a0
Capabilities:
Parse pe header

Disassembly:
mov dword [edi + 0x10e4], 0xc2a34c1a
jmp loc.10184496
lea esp, [esp + 4]
mov ebx, dword [edi + 0x134]
jmp 0x1000f88a
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp byte [edi + 0x12f], 0
jne 0x1004f6a7
push ebx
push 0x100cbc5e
jmp 0x1001a330

Function at 0x1004f6b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 8], edi
cmp byte [edi + 0x131], 0
jne 0x1004f9f3
push ebx
push 0x100cbc5e
jmp loc.102415db

Function at 0x1004fbe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc88
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0xc84], eax
push esi
push edi
push 0x100cbc5e
jmp loc.1016d3bd

Function at 0x10050360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x111c
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0x1118], eax
push esi
push 0x100cbc5e
jmp loc.101c566d

Function at 0x1005126c
Capabilities:
Encode data using base64

Disassembly:
pushfd
mov edi, 0xcb065a00
push esi
call fcn.1007a39b

Function at 0x10051300
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [0x1011d5ac]
push 0x100cbc5e
jmp loc.1023e2d9

Function at 0x100513d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
push ebx
mov ebx, dword [0x1011d5ac]
not eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x10051404
nop
movzx ecx, byte [edi + edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ebx + ecx*4]
cmp edx, esi
jb 0x100513f0
pop edi
pop esi
not eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100555b3
Capabilities:
Authenticate hmac
Encode data using base64
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x10]
call fcn.1021f525

Function at 0x10057a90
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov dword [ebp - 0xa4], ecx
push 0x100cbc5e
jmp loc.1016b72a
Function at 0x10058140
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
push 0x100cbc5e
jmp loc.10155715

Function at 0x10058fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xe8
push esi
push edi
push 0x100cbc5e
jmp loc.102783b4

Function at 0x1005b67a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], 0x93103190
lea esp, [esp + 4]
call fcn.1021f525
movaps xmm0, xmmword [ebp - 0xb2c0]
call fcn.101b8cc0
movaps xmm0, xmmword [ebp - 0x15920]
call fcn.10216fae
mov dword [esp + 0x1d8], 0x96714868
jmp loc.10241dd0

Function at 0x1005c1f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x3548
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100cbc5e
mov edi, ecx
push edx
mov edx, 0x282c54b5
pushfd
shr dl, 0x13
sub dx, 0xc6b6
mov dx, 0xf933
and dl, 0xa3
xor dl, 2
mov edx, dword [esp + edx*2 - 0x5059f23e]
mov dword [esp + 4], 0x9f1e3610
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.1021f525
jge 0x1005c1f9
sahf
cli
in al, dx
jp 0x1005c25a
salc
mov dl, 0x20
salc
inc esi
sti
salc
mov dl, 0x3c
les ecx, [esi - 5]
salc
mov dl, 0xfc
mov dh, 0x6d
mov dword [esi], ecx
pop edx
adc edi, dword [0x3d622f00]
and dword [ecx - 0x2121e4ff], edx
pop edx
arpl word [eax], sp
fbstp tbyte [ebx + 0x21ba18fe]
invalid

Function at 0x1005e500
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1ca8
call fcn.100c2ae0
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x100cbc5e
jmp fcn.101f6e9a

Function at 0x1005fd20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x100cbc5e
mov edi, edx
mov esi, ecx
call int.101d9d1f
push 0xffffffffffffffa1
cli
in al, dx
insd dword es:[edi], dx
invalid

Function at 0x10060060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push 0x100cbc5e
mov esi, edx
mov edi, ecx
call fcn.10092222

Function at 0x100601c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x568
mov eax, dword [0x100cf040]
xor eax, esp
mov dword [esp + 0x564], eax
push esi
push edi
push 0x100cbc5e
jmp loc.101a5d15
Function at 0x10061810
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c49af
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xe10
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100cbc5e
push ecx
pushfd
mov ecx, 0xa88a0d88
push 0xd2168326
and cl, byte [esp + ecx + 0x5775f27a]
not byte [esp + ecx + 0x5775f300]
sete cl
mov ecx, dword [esp + ecx + 0x5775f307]
mov dword [esp + 8], 0x4f69b690
push dword [esp + 4]
popfd
lea esp, [esp + 8]
call fcn.1021f525

Function at 0x10062f60
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x1011d5b0]
push 0x100cbc5e
push ebx
pushfd
mov ebx, 0xb023c422
push 0x960e50ad
test byte [esp + ebx + 0x4fdc3bdf], bl
jo 0x10062f8c
or ebx, ebx
push esi
mov ebx, dword [esp + ebx + 0x4fdc3bea]
mov dword [esp + 0xc], 0xbd063990
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.1021f525

Function at 0x10063d20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x100cbc5e
mov esi, ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1009d737
lea esp, [esp + 4]
mov ecx, 0xf91a625
bswap di
mov byte [esi], 0
jmp loc.101b2199

Function at 0x10064050
Capabilities:
Encode data using base64
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x100cbc5e
mov esi, ecx
mov dword [ebp - 0x18], ebx
jmp loc.1020cd86

Function at 0x10064370
Capabilities:
Hash data with md5

Disassembly:
lea esp, [esp + 4]
inc cl
mov byte [ebx], 0
setg al
bswap cx
lea ecx, [esi + 1]
mov dword [ebx + 0x44], 0
jmp 0x1006eb91
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100cf040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x100cbc5e
mov dword [ebp - 0x14], esi
jmp 0x10030535
mov dword [ebx + 0x48], 0
not al
mov dword [ebx + 0x4c], 0x67452301
dec al
inc al
mov dword [ebx + 0x50], 0xefcdab89
dec al
mov dword [ebx + 0x54], 0x98badcfe
dec al
mov dword [ebx + 0x58], 0x10325476

Function at 0x100655f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x100cbc5e
mov edi, ecx
jmp loc.10248d53