joyce8/EMBER2024-capa huggingface dataset:
Function at 0x17a51dd
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
pushfd
mov dword [esp], 0x2c5ac97
call int.0186ca82
mov eax, 0x68c9fdcc
and byte [edi], cl
loopne 0x17159cf
jbe 0x1715998
in eax, dx
adc dl, ah
dec esp
retf
scasd eax, dword es:[edi]
cmp eax, 0xe7e5dbbd
sbb ebx, dword [ebx - 0x79ff98ff]
push cs
scasd eax, dword es:[edi]
sub al, 0x82
push edx
shl byte [edi + 0x65c33d2b], cl
and eax, 0x4c7f4d15
dec edx
jbe 0x17159f5
mov bh, 0x36
outsb dx, byte [esi]
or al, 0x68
pop eax
pop es
lea ebx, [edi]
inc ebp
jbe 0x17159ee
outsd dx, dword [esi]
in eax, dx
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
and ecx, eax
fnsave dword [ecx + 0x25e4f645]
push eax
aam 0xd5
cld
sbb byte [bp + di], bl
sbb edx, dword [esi - 0xb]
adc dword [ebx + 0x359d4bca], ecx
salc
inc eax
or al, 0x52
jne 0x1715a20
fild word [esi - 0x79965469]
xlatb
mov cl, 0x5a
pop edx
and al, 6
jmp 0xdda39c3c
fdivr qword [edi - 0x4e]
invalid
xchg esi, eax
dec ebx
xchg ecx, eax
mov ah, 0x5c
loopne 0x1715a6e
ljmp 0x8d45:0x541e131a
push ds
push esp
inc ebp
lea esp, [eax + 0x7c]
push ss
mov esi, 0xe674d603
mov edx, dword [ebx - 0x6db0f663]
std
and eax, 0x71e76022
inc eax
sti
add byte [edi + 0x6e], 0xc3
je 0x1715a2b
stosd dword es:[edi], eax
lodsd eax, dword [esi]
invalid
push edx
jl 0x1715ac2
test byte [edx], ch
sub dword ss:[0x80704968], esp
aam 0xdf
adc eax, 0x131aeab8
push ds
ja 0x1715a2b
cmc
popal
test al, 0xb5
jl 0x1715a9f
or eax, 0x31eec882
int 0xd6
adc al, 0x94
push esi
mov al, byte [0x46920407]
ljmp 0x3fb8
mov eax, 0x7e789f3f
test dword [edi - 0x34], ecx
shr eax, cl
cmovo ebx, dword [ebx - 0x1a]
cld
lds ebx, [edx]
test dword [edi], edx
push ds
mov ebp, 0x50175e64
sub al, byte [ebx]
xor byte [edx], dh
or byte [edx], 0xba
in al, 0x6d
les edi, [edx - 0x11]
jp 0x1715ab3
add edi, ebp
out dx, eax
in al, 0xaf
add dh, byte [ebp + edi*4 - 0x293e55a3]
nop
dec ebp
push 0x7a
lodsd eax, dword [esi]
popfd
add byte [edx - 0x6c], dl
xchg ecx, eax
cmp byte [esi - 0x3458b036], cl
xor al, 0xaa
push esp
mov ch, 0x49
sti
invalid
add esi, edx
lea esp, [esp + 0x24]
jmp 0x1715973
Function at 0x17a8e68
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sbb edx, 0xe08f9d3d
btr cx, ax
dec cl
or ecx, 0xfb0d4f18
not edx
xor ebx, edx
rol al, 0x85
call fcn.01968b6a
mov eax, 0x305dcad
bswap eax
mov ecx, dword [ebp]
btc eax, eax
lea edx, [eax*2 - 0x3bfcae64]
lea ebp, [edx + ebp - 0x1fbb5bae]
adc dx, dx
btc ax, dx
push eax
xor ecx, ebx
shl word [esp + edx - 0x1fbbb762], 0xe1
sal edx, 0xe8
ror ecx, 1
cwd
sar byte [esp + 2], 0x67
dec ecx
neg ax
call fcn.01702844
mov ecx, dword [edi]
mov eax, 0x522f6a8a
lea edx, [eax*2 + 0x280d8983]
xor dl, 0xaf
mov edx, dword [edi + eax - 0x522f6a86]
btr eax, eax
bswap eax
call fcn.017e60f0
mov dword [esp + edx - 0x763ee336], ecx
mov eax, dword [edx + esi - 0x763ee33a]
xor eax, ebx
sar cx, 0xc7
not edx
inc dl
sbb eax, 0xcc98fb30
call fcn.01516469
mov edx, dword [edi]
mov eax, 0x44b9bb33
mov ecx, eax
lea edi, [eax + edi - 0x44b9bb2f]
xor edx, ebx
jmp 0x1a08920
ror edx, 1
or cl, 0xbc
xor edx, 0x4500d588
bts eax, 0x95
rol ax, 0x44
jae 0xd32ab0
mov eax, dword [ebp]
mov edx, 0xa600b3a2
mov ecx, edx
shl dx, cl
adc ebp, 4
xor eax, ebx
and ecx, 0x6d03c387
not edx
ror eax, 1
shl ecx, 0x6a
lea eax, [ecx + eax - 0x6895e239]
adc cx, dx
rol ecx, 0xa2
sbb ecx, edx
ror eax, 1
shr ecx, 0x89
lea eax, [eax + edx + 0x1b1eeead]
xor ebx, eax
sal dl, 0xa7
add esi, eax
mov edx, dword [edi + ecx*4 - 0x15c7368]
mov eax, 0x8bacb7a0
xadd eax, ecx
btr cx, 0xb7
mov ecx, dword [edi + 4]
xchg ah, al
sub eax, eax
lea edi, [edi + eax*4 + 8]
mov dword es:[edx + eax*2], ecx
lea ecx, [eax*8 + 0x44bfa00e]
adc eax, esi
jmp eax
sar eax, 0xa6
ror edx, 1
shl al, 0x44
adc ecx, eax
xor edx, 0xaea27224
add ecx, eax
sal ax, 7
rol eax, 0x9a
not edx
jns 0x19335c3
imul ecx, dword [edx + 0x2e], 0x49
mov eax, dword [esi - 0x47]
adc eax, 0xd66fa794
jbe 0x1a0897e
div dh
dec ebp
nop
push 0x1f112498
test dword [esi + 0x34edf308], esi
mov ah, 0x33
jmp 0x1a089a3
cmp ebp, edx
jl 0x1a089d1
dec eax
push esp
mov edi, edi
div dword [esi + 0x6a]
adc dl, byte [edi - 0x1f6cfce8]
xor eax, 0x12712f06
in al, 0x9c
pushfd
call 0x8c515f68
xor eax, 0x6999b4fd
not dword [edx + 0x3e]
add byte [esi - 0x25cb65d5], 0xed
add byte ds:[esi - 0x25cb65d5], 0xed
lodsd eax, dword [esi]
cmp eax, 0x49c7be92
push cs
aas
mov bl, 0x44
jo 0x1a08a00
mov dword [ebp + 0x7c383fe9], ebp
mov dword [ebp + 0x7c383fe9], ebp
jo 0x1a089b8
inc edx
mov esi, 0x2ffa4a92
push ecx
jns 0x1a089f7
xchg esp, eax
ljmp 0xab8d
xor bl, byte [edx + 0x5d]
cmp byte [edi + 0x46], bl
out 0x16, eax
out dx, eax
jb 0x1a08980
invalid
mov byte [0x3e86cb33], al
lodsd eax, dword [esi]
imul esp, dword [edx + 0x22], 0x44b33f0f
jo 0x1a0899c
invalid
popfd
int3
Function at 0x17c7ba0
Capabilities:
Authenticate hmac

Disassembly:
inc eax
xor ebx, eax
add esi, eax
mov eax, edx
imul eax
call fcn.00d4805d

Function at 0x17c7bae
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ecx*2 - 0x7f100000], ecx
bswap eax
push ecx
sal ecx, 0xc9
xor ebx, eax
sub ecx, ecx
adc esi, eax
movsx eax, dl
xor ax, 0x6c8b
imul ecx, edx
mov ax, word [edi + ecx*2]
sbb edx, dword [esp + ecx*2 + 4]
adc dword [esp + ecx*8 + 4], ecx
or cl, byte [ecx + edi + 2]
sar dl, 0x43
shr edx, 0x5c
lea edi, [edi + edx*2 - 0x14]
cmovb edx, dword [esp + edx*8 - 0x56]
jne 0x1817492
shl ax, cl
mov word [edi + edx - 0x3f88], ax
mov dword [esp + edx*8 - 0x1fc40], esi
ret 4

Function at 0x17d5329
Capabilities:
Execute syscall

Disassembly:
mov ecx, 0x468e3602
mov ecx, dword [ebp + ecx - 0x468e3602]
mov eax, 0x9a0acba8
add ebp, 4
movsx edx, ax
mov dword [esp], 0x9a8bfa3e
sub edx, 0xe3b27b26
xor ecx, ebx
neg edx
xor eax, 0x90981e07
inc ecx
not ecx
mov dword [esp + eax*4 - 0x2a4b56bc], edx
bt eax, edx
rol ecx, 3
xor ecx, 0x1f1e6815
not byte [esp + eax - 0xa92d5af]
xor ebx, ecx
lea edi, [edi + eax*4 - 0x2a4b56c0]
xchg dword [esp + eax - 0xa92d5ad], edx
not eax
ror edx, 0x14
mov dword [edi], ecx
xchg byte [esp + 1], al
inc dword [esp + 4]
lea ecx, [edx*4 - 0x1bd389ca]
mov eax, dword [ebp]
adc ebp, 3
xor edx, 0xfe16169d
xor eax, ebx
xadd dx, cx
not eax
xor edx, 0xb90f6108
dec eax
xor cx, word [esp + 6]
rol eax, 2
pop edx
bswap eax
inc eax
add cl, 8
ror eax, 2
xor ebx, eax
mov word [esp], cx
shr word [esp], 0x6c
add esi, eax
rol dl, 0x81
or cx, word [esp + 2]
pop eax
jp fcn.0153753f
sysenter
call fcn.0154f630
mov dword [edi], edx
pop ecx
mov dword [edi + ecx*2 + 0x60fa04dc], eax
mov dword [esp + ecx*2 + 0x60fa04d8], esi
ret 8
Function at 0x17dae50
Capabilities:
Encode data using base64

Disassembly:
inc ecx
pop ebx
not ecx
inc ecx
movzx edi, dh
inc esp
movsx eax, dx
btr edi, edx
inc ecx
mov dword [edi + edx], ecx
call fcn.016ebe37
inc ebp
mov esp, dword [edx]
mov ecx, 0x9eac1583
dec ecx
add edx, 4
call fcn.01913ab2
sub ebp, 4
mov edx, dword [ebp]
mov ecx, 0xb0bf1aac
xor edx, ebx
or ecx, ecx
lea ecx, [ecx*8 + 0x43b3d9aa]
lea ecx, [ecx + ecx*8 + 0x602fa791]
sbb edx, 0xdbb00eaf
lea eax, [ecx - 0x27d05063]
rol cl, 0xa1
bswap edx
sbb edx, 0x602e6516
bts cx, ax
ror edx, 1
xor ebx, edx
shr al, 0xe1
adc esi, edx
mov edx, dword [edi + eax - 0x4f717e44]
btc ecx, eax
jb 0x1809ab6
inc dl
xor bl, dl
sar word [esp + 6], 0x26
movsx ecx, ax
add dword [esp + ecx + 3], ecx
lea edx, [esp + edx + 0xc]
rol eax, 0x38
adc dword [esp + eax*2 - 0x1fffe00], 0x3eb7f5ad
and byte [esp + eax - 0xffff00], cl
mov eax, dword [edx + eax*2 - 0x1fffe00]
lea edi, [ecx + edi - 4]
dec cx
xchg word [esp + ecx - 0xfff9], cx
mov dword [ecx + edi - 2], eax
mov edx, dword [ebp + ecx*2 - 4]
movzx eax, cx
sbb cx, 0xd794
lea ebp, [ecx + ebp - 0x286a]
xor edx, ebx
call fcn.017cebc6
inc ebp
mov ecx, dword [edx]
inc ecx
mov esp, 0x4021e987
dec ebp
and esp, esp
jne 0x181a72f
sub cl, ch
mov eax, dword [edi + eax - 0x4f717e40]
ror ecx, 0xf3
neg ecx
mov ecx, dword [edi + 8]
call fcn.00d4b1bf
dec edi
lea edx, [edx - 0x4021e983]
inc ebp
movsx esi, sp
inc ecx
movsx ecx, sp
inc esp
xor ecx, ebx
inc ecx
ror ecx, 3
dec ecx
lea edx, [esp + ecx + 0xd268088]
inc ecx
dec esi
inc ecx
dec ecx
movsx eax, cx
inc ecx
neg ecx
inc ebp
movzx eax, si
inc ecx
inc ecx
dec esp
imul eax, edx
sub al, cl
inc ecx
neg ecx
not cx
inc esp
movsx ebx, dl
inc ecx
bswap ecx
dec eax
not eax
push ebx
inc ecx
movzx edi, dh
inc esp
xor dword [esp + edi - 0x86], ecx
pop ebx
dec ecx
shr esp, 0x74
inc ecx
mov esi, esp
inc ecx
bswap ebx
dec ebp
arpl cx, cx
dec eax
shl edi, 0x9e
inc cx
sub edi, eax
inc cx
and ecx, esi
dec ecx
adc ebp, ecx
inc ebx
mov edx, dword [esp + edi]
inc esp
movsx ecx, di
inc edi
mov ebx, dword [edi + 4]
dec edi
lea edi, [edi + 4]
inc esp
and esp, eax
not edx
neg si
dec eax
shr eax, 0x83
call fcn.017d4e4d

Function at 0x1830a2f
Capabilities:
Encode data using xor

Disassembly:
add edi, 1
neg ax
mov dword [esp], eax
jo 0x17bd72e
xor dl, bl
pop eax
and ax, 0xac39
ror dl, 1
not dl
imul eax, eax
shr al, 0x21
shr ax, 0xa7
adc dl, 0x82
shr eax, 0xb
cbw
xor dl, al
and eax, eax
call fcn.017ae8de
mov edx, 0x823b528d
ror edx, 0xba
neg al
shr edx, 0x5e
xor edx, edx
sbb edx, edx
not al
shl edx, 0xe4
sar dx, 0x6b
neg dl
xor al, 0x10
xor bl, al
push ebp
shr edx, 0x6e
not edx
movzx ebp, dl
push esi
add dl, 0xbb
sar edx, 0x6a
btc ebp, 0x97
push ebx
mov ebp, edi
jb 0x196546f
mov ebx, eax
mov eax, edx
mov edx, ebx
shr al, 0x26
sal al, 0xe1
add al, 0x23
shl edx, 2
bswap eax
mov eax, ebp
push 0x98a38b1c
add eax, edx
and dword [esp], 0x5f223a3b
xor byte [esp + 3], 0x84
mov dword [ebp - 4], eax
call fcn.017f4d29
Function at 0x1840b1c
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp], ecx
mov edx, dword [esi]
add ecx, ecx
lea esi, [ecx + esi - 0x6125d648]
ror byte [esp + ecx - 0x6125d649], 0x65
xor edx, ebx
movzx eax, cx
lea ecx, [ecx + eax*2 + 0x468a992b]
push ecx
inc edx
cwde
not edx
sub dword [esp + 4], 0xe395098c
sbb dword [esp + 4], 0x79ae9999
shr eax, 0xe8
lea edx, [edx + ecx + 0x2352c597]
bswap edx
adc word [esp + eax*2 - 0x1ffffa6], ax
jb 0x17373a9
mov eax, 0x781f3dbc
mov edx, dword [edi + eax - 0x781f3dbc]
mov ecx, 0xa828a893
shr eax, cl
shl al, 0xe7
movzx cx, byte [edx + eax - 0xf80]
mov edx, eax
adc al, dh
lea edi, [eax + edi - 0xf8e]
lea edx, [eax*2 + 0x5da1f42f]
mov word [edi + eax - 0xf90], cx
and dl, ah
jge 0x1947a33

Function at 0x188626c
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
jne 0x14eea4a
mov ecx, 0x519b2ba6
jmp 0x18e37c3
pop esi

Function at 0x18b3ef3
Capabilities:
Encode data using xor

Disassembly:
ror edx, 0x6b
not al
call fcn.015cca08
dec al
mov dword [esp + edx*2 - 0x1959dc], edx
not al
sub edx, 0xd48c98af
and byte [esp + edx*2 - 0x5700287c], dl
sal edx, 0x79
adc al, 0x80
bswap edx
xor al, 0xd
not dword [esp + edx*2 - 0xfc]
jmp 0xce6935

Function at 0x18bb06c
Capabilities:
Encode data using xor

Disassembly:
push 0x582707b2
mov dword [edi + 4], ecx
mov ebx, dword [esp]
btc bx, 5
sub byte [esp + ebx - 0x58270791], bl
mov dword [ebx + edi - 0x58270792], edx
jg 0x19d2060
mov eax, 0x48b0f706
movzx ecx, al
lea edx, [eax - 0x4bea59d1]
mov edx, dword [edi + ecx*8 - 0x30]
lea edi, [edi + eax - 0x48b0f702]
jmp 0x19ca780
xor edx, ebx
rol cx, 0x6b
not edx
shl dword [esi - 0x3f], cl
shr dword [ebx - 9], 0xd2
imul esi, edi, 0xffffffd2
bswap edx
btr eax, eax
not eax
xadd eax, ecx
xor edx, 0xd386a529
call fcn.01804c62
movsb byte es:[edi], byte [esi]
xor dl, byte [eax]
leave
je 0x19ca781
loop 0x19ca785
popal
push edx
add byte [edx], dl
call 0xb3ae1fa0
dec esi
cmp dword [edx + 0x29af4a3d], ecx
sub dword [0x6766e708], esp
dec dword [edx + 0x42f07a00]
sub al, 0xc7
inc esi
inc esi
pop ecx
invalid
mov edx, 0x4f19ca22
mov ebx, dword [esp + edx - 0x4f19ca12]
movzx eax, dx
lea ecx, [edx + eax*2 + 0x6c256233]
mov eax, dword [ebp + eax - 0xca22]
lea ebp, [ebp + edx - 0x4f19ca1e]
xor eax, ebx
bts ecx, ecx
not byte [esp + edx - 0x4f19ca16]
pop ecx
bswap eax
sbb eax, 0xe98f1610
mov dword [esp + edx - 0x4f19ca16], 0x4806b59b
add dx, 0xdb1d
xor eax, 0xe23a2b1
mov dword [esp + ecx - 0x582775ae], 0x9ba3653b
not ecx
not dx
not eax
not cl
xor ebx, eax
push ecx
not byte [esp + edx - 0x4f195ab4]
bts ecx, edx
adc esi, eax
mov eax, 0x6f8a2881
btc cx, dx
sub byte [esp + edx - 0x4f195ab8], ah
pop edx
pop eax
pop edx
pop edx
pop eax
ja fcn.0157d7ff
mov eax, 0x721f91d
lea ecx, [eax + eax*4 + 0x78821c39]
sar ecx, 0xd0
movzx eax, byte [edi + eax*2 - 0xe43f23a]
call fcn.00d66c6c
Function at 0x18bc64b
Capabilities:
Authenticate hmac

Disassembly:
inc edi
mov edi, dword [ebp + edi*4]
jns 0x1691aab
mov eax, 0x32abf23b
mov eax, dword [ebp + eax*2 - 0x6557e476]
mov ecx, 0xecbdd706
add ebp, 4
dec cx
bt ecx, 0x13
and ecx, ecx
xor eax, ebx
xor eax, 0x4c923432
movsx edx, cx
btc ecx, ecx
neg eax
ror cx, 0xcc
sal dl, 0xa5
sub ecx, edx
rol eax, 2
bt dx, dx
jae 0x190af5a
mov eax, dword [ebp]
mov edx, 0xf515482b
movsx ecx, dx
mov ecx, dword [ebp + ecx - 0x4827]
add edx, edx
sal dx, 0xa6
adc ebp, 4
shr edx, 0x62
neg edx
not eax
ja 0x14e7212
neg dl
setne dl
not ecx
or eax, ecx
sal dx, 0xef
mov dword [ebp], eax
movzx eax, dx
lea ecx, [eax + eax*4 - 0x14c99250]
dec dl
lea edi, [eax + edi - 0x8004]
cmovge eax, edx
add ecx, 0x29108120
mov eax, dword [eax + edi - 0x8000]
not edx
xor eax, ebx
call fcn.016de61f
shr eax, 8
rol dword [esp + 0x16], 0xc6
inc ecx
xor eax, edi
call fcn.00d441de
inc ecx
and edi, 0xff
sal dword [esp + 0x16], 0xef
jbe 0x16703b6
lea eax, [eax + edx + 0x3d2ec19a]
not eax
bts ecx, 0x86
btc edx, edx
rol dx, cl
xor ebx, eax
shl cx, cl
adc esi, eax
push edx
not dword [esp]
sar edx, 0x73
movzx ecx, word [ebp]
pop edx
lea ebp, [edx + ebp - 0x4a7247ae]
lea eax, [edx + edx*4 + 0x4d0979a4]
ror edx, 0xf7
xor cx, bx
and eax, edx
dec eax
dec cx
not cx
dec cx
bt dx, ax
and edx, edx
not cx
sub eax, 0x7e853d93
bswap edx
and ax, 0x6b22
xor bx, cx
cwde
lea edi, [eax + edi - 0x2204]
xor dx, ax
mov dword [edi + eax*8 - 0x11000], ecx
mov ecx, edx
jne fcn.0153753f
neg eax
and ecx, edx
ror edx, 0x24
xor ebx, eax
add esi, eax
jmp 0x19e8793
mov dword [ecx + edx - 0x45bd2318], eax
movzx eax, dl
mov ecx, 0x321a1ad
and dx, dx
mov eax, dword [ebp + eax - 0x18]
lea ebp, [ebp + edx - 0x45bd2314]
imul ecx, ecx
xadd edx, ecx
sbb ecx, edx
xor eax, ebx
call fcn.01544d5f
jmp 0x160aec6
xor bx, ax
inc cl
neg cx
adc dx, dx
sbb edi, 1
dec dx
sar dl, 0x25
mov word [edi], ax
btr dx, dx
imul edx, ecx
mov eax, ecx
jo fcn.0186d441
stosd dword es:[edi], eax
mov ch, 0x1e
leave
jnp 0x19220f1
in al, dx
loopne 0x192205a
or eax, 0xa7120e75
scasb al, byte es:[edi]
sub byte [esi + 0x15264ebc], dl
mov edx, 0x607af44
mov byte [0x7879e706], al
js 0x1922037
add byte [ebp + 0x77], ah
dec esp
sub al, 0x61
push eax
push ecx
fmulp st(0)
cmp eax, 0x15c61c40
out dx, al
fdiv qword [0x15c576a9]
adc eax, 0x7b68ef17
jle 0x192213e
pop ds
lahf
sub eax, 0xf7ed8c52
invalid
push ecx
pop ebx
xor al, 0xf1
invalid
out dx, eax
jmp 0x1922199
mov ch, 0xb7
sbb byte [0xff356f3c], bh
mov bh, 0x18
cmp eax, 0xff356f3c
and dword [eax - 3], esp
rol dword [ebp + ecx*2 - 0x3d863633], cl
fmul qword [ebx]
ja 0x1922198
pop edx
push 0x19891822
nop
adc dword [eax], eax
pop esi
xchg edi, eax
jg 0x1922224
fnstsw ax
mov bl, 1
inc esp
stc
or byte [edi + 0x5c7031c8], ah
jo 0x1922223
jns 0x1922198
mov ebx, 0x55a9e422
inc eax
jge 0x19221ae
cli
loope 0x19221c5
invalid
test eax, ecx
test eax, ecx
retf
movzx eax, word [ebp + edx - 0xffffd7a]
sar cx, 5
and edx, ecx
lea ebp, [edx + ebp - 0xcbdfc0e]
seto cl
xor ax, bx
inc ecx
not ax
neg edx
or edx, ecx
add edx, ecx
neg ax
add ax, 0xc108
neg ax
add ax, 0xbe09
sar edx, 0x84
not ax
ror dl, 0x82
or cx, dx
jae 0x1922068
Function at 0x18fff72
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [edi]
pop ecx
mov ecx, dword [edi + 4]
mov dword [esp], 0xc4a8ec08
mov edx, 0xff0f8f16
bswap edx
lea edi, [edx + edi - 0x168f0ffb]
push edx
lea edx, [edx + edx*4 + 0x6a5b107]
add dword [esp + edx - 0x777100fe], edx
not eax
jne 0x153db52
mov eax, 0xa4a34b2a
lea ecx, [eax*2 + 0x92f769d]
lea edi, [edi + ecx - 0x52760cf5]
mov edx, dword [edi + ecx - 0x52760cf1]
shl cx, 0x47
sar ax, 8
xor edx, ebx
shl ecx, 0x2c
sbb ecx, eax
sar ax, 0x41
rol edx, 1
shl cl, 0xa3
add eax, eax
inc edx
push eax
ror al, 0x61
jae 0x17aeb52

Function at 0x198ee6a
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp]
add ebp, 4
call fcn.017634d0
test ebx, ebx
aam 0x49
xlatb
inc ebx
adc eax, 0x2cfec1f3
jbe 0x15a184d
add dword [eax - 0x11979524], eax
mov ch, 0xeb
pop ds
mov edi, dword [eax]
cdq
or ebp, ebp
ret 0x9592
lea edx, [eax + edx*4 + 0x7999613d]
xor ebx, ecx
btr eax, 0x83
cbw
call fcn.0168c424
mov ecx, 0x2d211f80
movzx eax, byte [ebp + ecx*2 - 0x5a423f00]
rol cx, 0x2a
or cx, 0x2ba1
jp 0xd4cd52
mov eax, 0x149eb80f
sal eax, 0xe6
lea ecx, [eax + eax*4 - 0x21f2ad50]
mov ecx, dword [edi + eax - 0x27ae03c0]
lea edi, [edi + eax - 0x27ae03bc]
call fcn.016c5371
mov ecx, dword ss:[eax + edx*2 - 0x4930]
mov eax, 0xdf9e28b8
ror eax, 0xe2
mov dword [ebp + edx - 0x2498], ecx
movzx ecx, dl
or ecx, eax
lea edi, [edi + edx*2 - 0x4934]
mov eax, dword [edi + eax - 0x37e78a2e]
ror edx, 0x94
xor cl, dh
xor eax, ebx
push edx
inc eax
rol eax, 1
shl ecx, 0x91
rol ecx, 0xd0
xor eax, 0x7527aba6
rol eax, 1
not cx
push ecx
not eax
xor eax, 0x3a8b820f
add word [esp + edx*2 - 0x492fffc], cx
ror eax, 1
neg dword [esp + edx - 0x2497ffe]
or dx, 0x649c
bts edx, edx
xor ebx, eax
call fcn.017f885c
mov ecx, 0xcca470b8
bt ecx, 0xb7
sbb edi, 3
not cl
movzx edx, cx
sub dx, 0x16a6
mov edx, dword [edi + edx - 0x59a1]
jge 0x179c598
jmp 0x15a18a0

Function at 0x1991cf1
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1944159
dec edx
xor ebx, edx
xadd al, cl
adc esi, edx
shr eax, 0xc5
jns 0x19d95fd
sub edx, 0x891190aa
mov eax, ecx
rol edx, 1
not eax
xor edx, 0x87af5d8a
jmp 0x1685f40
call fcn.016ab94f
mov eax, 0x88bc4faf
movsx esi, al
inc esp
movsx ebx, ax
inc ecx
not ecx
dec ecx
inc ebx
inc edi
mov dword [edi + ebx - 0x4fb0], ecx
movsx ecx, si
push esi
inc ebx
mov edi, dword [edx + ebx*8 - 0x27d80]
inc esi
movsx ebp, byte [esp + ebx - 0x4fac]
dec esp
lea esi, [eax + ecx*8 - 0x5e7d54df]
mul cl
dec edi
lea edx, [edx + ebx*4 - 0x13ebc]
ror cx, cl
inc edx
sal dword [esp + ebx - 0x4faf], cl
xor edi, ebx
inc esp
xor bl, al
dec eax
mul esi
call fcn.01a04958
shl dword [esp], 0x5a
push 0x77bd981c
adc ebp, 5
jmp 0x157a363
shrd edx, eax, cl
mov dword [ebp], edx
sub edi, 4
mov ecx, 0x3a3da505
mov byte [esp + ecx - 0x3a3da504], 0xa3
mov edx, dword [edi + ecx*2 - 0x747b4a0a]
sal word [esp + ecx - 0x3a3da4ff], 0xe2
xor edx, ebx
pop ecx
jmp 0x179bc63
dec eax
lea esp, [esp + 0x28]
je 0x191c002
mov esi, 0x6206b13a
dec eax
lea esi, [0xffd5d160]
inc ecx
mov ebp, 0xa81f2b34
inc ebp
movzx ebp, byte [esi]
inc ebp
xor ebp, ecx
jmp 0x189f3ed
mov dword [esp + eax - 0x44212e7], esi
ret
Function at 0x1a05e7f
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xb88df2c
lea edi, [ecx + edi + 3]
xor edx, ebx
shr eax, cl
btc eax, ecx
dec cl
add cl, ch
sbb ebp, 4
mov edx, dword [ebp]
ror cx, 0xe1
mov eax, 0x823b8b05
xor edx, ebx
xadd cl, ah
sal ecx, cl
xor edx, 0x2c09868c
neg cx
sar cx, 0x62
btc ecx, ecx
sbb edx, 0x28bce7a0
xadd cl, ch
setnp cl
xor edx, 0xccb0c9b2
neg ecx
call fcn.017a558f
mov ecx, 0xfc1c14a0
jmp 0x165bba9
xor edx, ebx
sar eax, cl
not edx
neg eax
sbb edx, 0x84b2f22f
jmp 0x194b91b
dec word [esp + 8]
jle 0x16b26ed
shrd dx, ax, cl
mov dword [esp], 0xc90c7aa0
push 0x4b96eead
mov word [edi], dx
push 0xe29d0905
mov edx, dword [esp + 8]
xor dword [esp + 0xd], edx
mov eax, dword [ebp]
mov ecx, 0x30be2dac
neg edx
sal word [esp + ecx*2 - 0x617c5b54], 0x62
lea ebp, [ebp + edx*2 - 0x6de70abc]
shl cl, 0xc2
bts cx, cx
add dword [esp + edx*2 - 0x6de70ab2], ecx
xor eax, ebx
mov word [esp + edx - 0x36f3855d], cx
rol eax, 1
or dl, 0xb3
and edx, 0x10bb5619
not eax
jo 0x1591f9b
call fcn.016ccf29
mov eax, dword [esi]
mov ecx, 0xf40886b0
movzx edx, cx
or ecx, ecx
mov edx, dword [edx + esi - 0x86ac]
neg cl
shl ecx, cl
adc esi, 4
xchg ch, cl
rol cl, 0x43
add cx, cx
adc eax, edx
lea edx, [ecx + 0x66b60408]
sar ecx, 0xdc
mov dword [esi], eax
mov edx, dword [edi]
movzx eax, cx
lea edi, [edi + eax*2 - 0x1ffec]
js 0x19d009c
Function at 0x4010c7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
mov ebx, 0x104
call fcn.0040aa20
add esp, 4
mov dword [ebp - 4], eax
push str.conf.inf_loc
push dword [ebp - 4]
mov ecx, 2
call fcn.0040106b
add esp, 8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40110d
push ebx
call fcn.0040a5d3
add esp, 4
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x42b7d0]
test ebx, ebx
je 0x401124
push ebx
call fcn.0040a5d3
add esp, 4
pop eax
mov dword [0x42b7d0], eax
mov dword [ebp - 4], esp
push 0
push 0
push 0
push 0x40991b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x401167
push 6
call fcn.0040a5bb
add esp, 4
cmp dword [0x42b7d4], 1
jne 0x401179
jmp 0x401199
push 0x80000301
push 0
push 0x400
push 1
mov ebx, 0x67c
call fcn.0040aac0
add esp, 0x10
jmp 0x401167
mov eax, 0
jmp 0x4011a3
mov esp, ebp
pop ebp
ret
Function at 0x4053d3
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0x80000301
push 0
push 0x400
push 1
mov ebx, 0x1bc
call fcn.0040cac0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x405434
push ebx
call fcn.0040a5d3
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push 1
push 0x4292ce
call dword [sym.imp.WININET.dll_InternetOpenA]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x405470
push 6
call fcn.0040a5bb
add esp, 4
mov dword [ebp - 8], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0040c4e0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esp
push 0
push SysReAllocString
push 0
push dword [ebp - 0x18]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x4054cd
push 6
call fcn.0040a5bb
add esp, 4
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4054e0
push ebx
call fcn.0040a5d3
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
push 0
mov ebx, 0x350
call fcn.0040caf0
add esp, 4
mov dword [ebp - 0x18], esp
lea eax, [ebp - 0x10]
push eax
push 0x3e8
mov eax, dword [ebp - 4]
test eax, eax
je 0x40550e
add eax, 8
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40552e
push 6
call fcn.0040a5bb
add esp, 4
push 0x80000301
push 0
push dword [ebp - 0x10]
push OleUIBusyA
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40554b
mov eax, 0x4293e8
push eax
push 2
mov ebx, 0x1a0
call fcn.0040cb60
add esp, 0x1c
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
mov ecx, 2
call fcn.0040537c
add esp, 8
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x405587
push ebx
call fcn.0040a5d3
add esp, 4
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40559b
push ebx
call fcn.0040a5d3
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
jne 0x4054e6
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4055cb
push 6
call fcn.0040a5bb
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4055ed
push 6
call fcn.0040a5bb
add esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x405607
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0040a5cd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40560c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40561d
push ebx
call fcn.0040a5d3
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40562d
push ebx
call fcn.0040a5d3
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4