joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099ec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409abf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ad8
push ebx
push 0x409ae4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a6c
mov al, 0x6a
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.004099c0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a75
call fcn.004099c0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ac6
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b78
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
jmp 0x409c21
cmp dword [esi + 0x10], 0x1000
jne 0x409c0d
test byte [esi + 0x15], 1
jne 0x409c0d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409bcc
cmp eax, 2
je 0x409bcc
cmp eax, 0x10
je 0x409bcc
cmp eax, 0x20
jne 0x409be1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409be1
mov bl, 1
xor ebp, ebp
jmp 0x409bf2
mov eax, dword [esi]
add eax, ebp
call fcn.00409b70
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409be5
test bl, bl
je 0x409c0d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409c2c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409ba4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x7c00fcd4
Capabilities:
Enumerate files on windows

Disassembly:
cmp dword [esp + 4], 0
je 0x7c00fd32
cmp dword [0x7c04f3f0], 0
jne 0x7c00fcf8
push 0x244
call sym.MSVCR70.dll_malloc
test eax, eax
pop ecx
mov dword [0x7c04f3f0], eax
je 0x7c00fd5b
mov eax, dword [0x7c04f3f4]
test eax, eax
je 0x7c00fd0f
push eax
call dword [sym.imp.kernel32.dll_FindClose]
and dword [0x7c04f3f4], 0
push dword [0x7c04f3f0]
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [0x7c04f3f4], eax
je 0x7c00fd5b
mov eax, dword [0x7c04f3f0]
add eax, 0x2c
ret
push dword [0x7c04f3f0]
push dword [0x7c04f3f4]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x7c00fd29
push dword [0x7c04f3f4]
call dword [sym.imp.kernel32.dll_FindClose]
and dword [0x7c04f3f4], 0
xor eax, eax
ret

Function at 0x7c00ffc3
Capabilities:
Enumerate files on windows

Disassembly:
cmp dword [esp + 4], 0
je 0x7c010021
cmp dword [0x7c04f404], 0
jne 0x7c00ffe7
push 0x354
call sym.MSVCR70.dll_malloc
test eax, eax
pop ecx
mov dword [0x7c04f404], eax
je 0x7c01004a
mov eax, dword [0x7c04f400]
test eax, eax
je 0x7c00fffe
push eax
call dword [sym.imp.kernel32.dll_FindClose]
and dword [0x7c04f400], 0
push dword [0x7c04f404]
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [0x7c04f400], eax
je 0x7c01004a
mov eax, dword [0x7c04f404]
add eax, 0x2c
ret
push dword [0x7c04f404]
push dword [0x7c04f400]
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x7c010018
push dword [0x7c04f400]
call dword [sym.imp.kernel32.dll_FindClose]
and dword [0x7c04f400], 0
xor eax, eax
ret

Function at 0x7c011a09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x7c011a18
pop dword [ebp - 0xc]
mov eax, 0x5bfb79d5
add eax, 0x2005a043
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x4076e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x557a
xor edi, edi
add edi, eax
mov ebx, 0x712d1a66
sub ebx, 0xf527da66
add ebx, dword [ebp - 0xc]
mov edx, 0x4a01fa35
xor dword [ebp - 4], 0x9af502a9
mov esi, dword [ebx]
add dword [ebp - 8], ebx
sub esi, edx
sub dword [ebp - 8], 0x40a98684
mov dword [edi], esi
mov dword [ebp - 8], 0xb5efe11c
add edi, 0x1d677b69
add edi, 0xe298849b
add ebx, 0x417871d8
sub ebx, 0x417871d4
loop 0x7c011a68
add eax, 0x148bb
mov ebx, eax
add eax, 0xca57e8c4
add eax, 0x35a81741
mov ecx, 0xa463c905
add ecx, 0xd79c36fb
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x125c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x125c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x125c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x125c06a
add dl, dl
jne 0x125c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x125c0dc
xor eax, eax
add dl, dl
jne 0x125c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x125c17d
add dl, dl
jne 0x125c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x125c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x125c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x125c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x125c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x125c075
mov eax, 1
add dl, dl
jne 0x125c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x125c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x125c0e1
sub eax, ebx
mov ebx, 1
jne 0x125c128
mov ecx, 1
add dl, dl
jne 0x125c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x125c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x125c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x125c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x125c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x125c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x125c136
cmp eax, 0x7d00
jae 0x125c16d
cmp eax, 0x500
jb 0x125c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x125c075
cmp eax, 0x7f
ja 0x125c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x125c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x125c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x125c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5b795f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], dx
mov dword [esp], edi
jmp 0x5b79d9
mov dword [esp], ebx
mov dword [esp + 8], edi
lea esp, [esp + 8]
pushfd
jmp 0x5b792a
Function at 0x5b89a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0x5b89fe
clc
jg 0x5b89e8
pop dx
lea esp, [esp + 2]
jmp 0x5b8a23

Function at 0x5b8aca
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl eax, 0xe
jmp 0x5b893c
lea edx, [esi + 0x50]
lea eax, [ecx*4]
clc
jmp 0x5b8956
xchg ebx, eax
mov bx, word [esp]
lea ebx, [eax + ecx]
cmp edi, edx
jle 0x5b89a6
bswap eax
jmp 0x5b9075
jb 0x5b8917
shl eax, 0xe
jmp 0x5b893c
bswap eax
jmp 0x5b9075
jmp 0x5b8973
dec bh
ja 0x5b892f
jbe 0x5b892f
pop dx
lea esp, [esp + 2]
jmp 0x5b8a23
mov dl, bl
pushfd
lea eax, [edx + ebx]
sub esp, 0x10
jb 0x5b8ab2
jae 0x5b8a48
cmp eax, 0xc43552bc
jae 0x5b8a2a
test al, 0xcb
sub bl, cl
mov ax, cx
mov ah, byte [esp]
xchg edx, eax
jmp 0x5b8a09
and al, 0x87
ret 0xdaeb
mov bl, 0x30
bswap edx
jmp 0x5b89da
mov eax, 0xc183d299
pop ax
jmp 0x5b8a65
mov eax, 0xc183d299
pop ax
call 0x5b8a81
lea esp, [esp + 0x14]
neg dl
stc
jae 0x5b8a8b
jb 0x5b8a8b
jp 0x5b8a6e
add dh, cl
push 0xffffffffffffff85
xor al, 0x27
dec esi
fldenv [esi - 0x48]
jge 0x5b8ac2
lea esp, [esp + 2]
jmp 0x5b8a6a
call 0x5b8aca
call fcn.005b8ab4
pop dword [esp]
lea esp, [esp + 4]
xor dl, 0x73
mov eax, 0x2e29e95c
mov eax, ebx
jmp 0x5b8ad1
jmp 0x5b8a5e
dec esp
rcl dword [ecx + 0x30], 0xc3
add al, bl
jp 0x5b8ada
mov bl, 0xf8
jg 0x5b8a90
jle 0x5b8a90
adc eax, ebx
jno 0x5b8b1f
dec ax
dec al
sub esp, 0xb
lea esp, [esp + 1]
lea esp, [esp + 2]
in al, dx
or ecx, dword [ebp - reloc.WINMM.dll_midiStreamOut]
and al, 2
jmp 0x5b8b4a
sub esp, 0xb
lea esp, [esp + 1]
lea esp, [esp + 2]
jmp 0x5b8b4a
mov al, byte [esp]
call fcn.005b8b25
out dx, eax
jg 0x5b8b2c
jmp 0x965c184c
dec ax
dec al
jmp 0x5b8af9
mov ax, 0xe20a
mov ax, word [esp]
jmp 0x5b8b71
lea esp, [esp + 8]
inc dl
mov eax, 0x7f241375
mov al, 0xdd
mov eax, esp
jmp 0x5b8b06
lea esp, [esp + 4]
dec dl
mov eax, ecx
bswap eax
xchg al, ah
jmp 0x5b9720
mov ax, word [esp]
jmp 0x5b8b5b
ja fcn.005b895d
mov al, 1
btr dx, ax
jl 0x5b90cb
jge 0x5b90a1
lahf
or bl, byte [eax + 0x33c90aff]
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0xd3f64271
clc
jmp 0x5b90cc
lea eax, [esi + 0x40]
mov bx, 0x5ff3
mov bl, dl
sub eax, edx
jmp 0x5b90b5
setl bl
mov bl, dh
jmp 0x5b90d7
clc
mov edx, esi
mov eax, dword [esp]
mov bl, byte [esp]
pushal
jmp 0x5b90a4
lea ebx, [edi - 0x80]
and bl, 0xfc
sub ebx, eax
jmp 0x5b90e5
cmc
jle 0x5b931a
jg 0x5b931a
add ebx, dword [edx + reloc.WINMM.dll_midiStreamOut]
jmp [bx + 0xa]
pop ecx
jmp 0x5b9148
mov ecx, eax
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x5b9115
popfd
call fcn.005b9601
and dword [ecx], reloc.WINMM.dll_midiStreamOut
loopne 0x5b91a2
invalid
pop edi
lea esi, reloc.WINMM.dll_midiStreamOut
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0x5b9132
push ecx
mov esi, edx
mov edi, ebx
jmp 0x5b912b
lea esi, [eax + ebx - 0x40]
push esi
push edi
jmp 0x5b916e
mov esp, ebx
pushfd
jmp 0x5b91ac
neg ax
jp 0x5b93c7
mov ah, 0x79
xchg al, ah
mov ax, word [esp]
mov ax, si
jmp 0x5b8c71
Function at 0x5b9634
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xa
call 0x5b9634
jne 0x5b9620
sub esp, dword [esi - 0x71]
add al, 0x24
sub esp, 7
mov word [esp + 6], bp
lea esp, [esp + 1]
jmp 0x5b96b4
xchg dword [esp + 0x18], eax
sub esp, 0xa
cmc
lea esp, [esp + 2]
push dword [esp + 0x20]
ret 0x24

Function at 0x5b9822
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc eax
jge 0x5b97b2
jl 0x5b97b2
lea esp, [esp + 8]
xor bl, 0x6f
lea eax, [eax*4]
rdtsc
mov al, ch
mov dl, 0xdd
jmp 0x5b97c8
lea esp, [esp]
jmp 0x5b97f5

Function at 0x5b998b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, 0x3fab
sub esp, 3
lea esp, [esp + 3]
jmp 0x5b99a8
mov dh, byte [esp + 7]
dec ax
ja 0x5b996f
jbe 0x5b9971
inc edx
fimul word [ebx + ebp - 0x1a]
and al, 0xaf
mov dh, 0x66
mov eax, 0xec833fab
add ecx, dword [ebp - reloc.WINMM.dll_midiStreamOut]
push esi

Function at 0x5b9a1e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
jmp 0x5b9a51
ror al, 0
mov edx, dword [esp]
neg dx
jb 0x5b9a55
add edx, ebx
mov dh, al
jmp 0x5b9aa4
jbe 0x5b9a28
ja 0x5b9a28
jmp 0x5b9aa0
add edx, ebx
mov dh, al
call 0x5b9a57

Function at 0x5bdec7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x10], esp
call fcn.005bded1
and dword [esi - 0x77], esp
mov word [esp + 1], sp

Function at 0x5bded1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], sp
push dword [esp + 3]
jp 0x5bdf0f
jnp 0x5bdef9
invalid
pushal
mov dword [esp + 0x34], ebp

Function at 0x5bdf94
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
lea esp, [esp + 2]
mov dword [esp + 0x38], esi
push ebp
mov dword [esp], eax
push word [esp]
jbe 0x5bdf4b
ja 0x5bdf35

Function at 0x5be208
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf dx, di
jno 0x5be16c
xchg word [esp], ax
xchg ah, dh
jmp 0x5be1ca
Function at 0x656fff
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, byte [esp + 0x13]
ror ah, 0
mov byte [esp + 0x11], bl
push dword [esp + 0x13]
jmp 0x657031
bsr ecx, ebp
mov ebp, 0x3226b85
mov di, 0x3756
neg bx
jmp 0x657057

Function at 0x657255
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, esi
jmp 0x6572c3
mov ah, byte [esp + 0x12]
lea esp, [esp + 3]
mov ecx, dword [esp + 0xc]
rdtsc
rdtsc
jmp 0x657336
mov esi, 0xa21b89d2
xchg word [esp], si
neg ebp
bswap ebx
sub esp, 0x14
pop cx
jmp 0x6572ad
xchg word [esp + 8], dx
mov bh, byte [esp + 6]
call fcn.006572ec
mov byte [esp + 2], dl
shr si, cl
pop eax
bts esi, esi
add esp, 3
lea ebx, [ecx + ebx]
jmp 0x657302

Function at 0x65755a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 7]
lea ebp, [ecx + esi]
lea esp, [esp + 0xb]
jmp 0x657544
Function at 0x657c0b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0xcb665f9f
push word [esp + 0x17]
mov dword [esp + 0x21], esi
xchg bx, dx
mov byte [esp + 0x13], cl
jmp 0x657bf5

Function at 0xe34118
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe34122
pushal
call 0xe34128
pop ebp
sub ebp, 0x10
sub ebp, 0xa34118
jmp 0xe3413e
mov eax, 0xa34118
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d9
mov edx, 0x21fb05fd
add eax, 0xfdba0000
add eax, 0x103021fb
xor byte [eax], dl
inc eax
dec ecx
jne 0xe34155
jmp 0xe34168
jbe 0xe3419a
jbe 0xe341e0
sar ebp, 0xfd
std
jl 0xe341ae
add eax, 0xfefdfdfd
xor byte [ebp - 5], al
std
std
std
inc edi
aad 0xfd
std
std
or bl, byte [edi]
invalid
std
std
std
invalid
fst dword [ebp - 0x2224d97]
std
xchg ebp, eax
jns 0xe341aa
or al, 0x7f
std
jg 0xe3419d
cld
rcr ecx, 1
xchg ebp, eax
push eax
jne 0xe3421a
call dword [0xfdfdfdf8]
std
std
std
adc al, 0xc9
leave
std
std
std
jo 0xe3414d
fld dword [ecx]
je 0xe34189
fldcw word [ecx - 0xa878960]
std
std
std
jbe 0xe3422b
int1
std
std
std
jbe 0xe34239
in eax, dx
std
std
std
cmp al, 0x14
dec esp
invalid
cdq
fyl2xp1
aas
int1
std
jbe 0xe34259
fyl2xp1
std
std
std
xchg ebp, eax
imul esi, dword [edx + 0x7995fddd], 0xfcfd7f0c
mov dl, 0xdd
std
xchg ebp, eax
jns 0xe34201
or al, 0x7f
std
jg 0xe341f4
cld
rcr ecx, 1
jo 0xe34195
fld dword [ecx]
je 0xe341f1
fst dword [0xfdfdfdf8]
adc eax, 0xfdfdfdf8
adc al, 0xb6
invalid
adc eax, 0xfdfdfd85
jbe 0xe34261
cmc
std
std
std
into
xor al, 0x7c
movups xmmword [eax + edx], xmm2
adc dword [eax + edx], edx
adc byte [eax + 0x7c], bl
movups xmmword [eax + edx], xmm2
pop eax
jl 0xe3423e
adc dword [eax + edx], edx
pop eax
into
das
jle 0xe3424c
adc eax, 0x79f2b5f8
mov bl, 0xfd
clc
mov ch, 0xf2
jns 0xe341ef
bnd jns 0xe341ef
std
std
std
bnd jne 0xe341f7
std
std
std
wait
jbe 0xe34229
les edi, [ebp + 6]
adc eax, 0xfde779f2
bnd jns 0xe34236
std
std
std
jge 0xe3425a
adc al, 0xf2
jns 0xe34244
std
std
std
wait
jl 0xe34264
add bl, al
bnd jns 0xe3424b
jns 0xe3424b
std
std
std
mov esp, 0x2023114
add dl, ah
mov cl, 0xc4
cld
jle 0xe342ae
clc
jle 0xe3428a
stc
adc al, 0x40
add al, byte [edx]
add dl, ah
test eax, 0x3c7effc4
sti
jle 0xe3429b
stc
jle 0xe3429c
clc
adc al, 0x56
add al, byte [edx]
add dh, byte [esi - 0x2f]
fnstenv [eax - 0x67]
fyl2xp1
aas
int1
std
test al, 0x76
adc dword [ebx - 0x77895756], ebp
int1
stosb byte es:[edi], al
test al, 0x76
mov cl, dh
jbe 0xe34222
cmc
add dword [edi + 0x7d], ecx
ja 0xe342a3
jl 0xe342e5
cmp edi, esp
cld
std
std
std
jne 0xe342aa
jl 0xe342ec
cld
std
std
std
inc esi
invalid
mov ebx, 0x7ef22fef
xchg edi, eax
std
std
std
into
cmp eax, 0x78f22fff
clc
bnd js 0xe342e0
std
std
std
ja 0xe342d8
jmp 0xe342a9
mov ebx, 0x7ef22fef
xlatb
cld
std
std
jmp [edi]
Function at 0x4125aa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
xor ebx, 0x4eef
and ebx, 0x13f32
or ebx, 0xb5df
pop ebx
push edx
jmp 0x412580
sub edx, 0x161d1
pop edx
cmp dword [ebp - 0x3e8], 0
je 0x412599
cmp dword [ebp - 0xab8], 0
jne 0x4125df
push esi
call 0x4125aa
add byte [ecx + 0x3f], al
dec esi
inc ebp
dec edi
dec edx
inc eax
xor cl, byte [edx + 0x3b]
add esp, 4
pop esi
push eax
push eax
add esp, 4
jmp 0x4125b8
add eax, 0x6898
xor eax, 0x5d10
add eax, 0xd2aa
pop eax
mov edx, dword [ebp - 0x79c]
mov dword [ebp - 0x1990], edx
push 0
call dword [ebp - 0x1990]
mov dword [ebp - 0x20a8], 0xa
push ecx
push ebx
add esp, 4
and ecx, 0x6d85
add ecx, 0x15278
jmp 0x412602
pop ecx
push ebx
push ebx
add esp, 4
sub ebx, 0x268f
xor ebx, 0x1491d
add ebx, 0x2f80
pop ebx
mov eax, dword [ebp - 0x3e8]
mov cl, byte [eax + 0xa]
mov byte [ebp - 0x3ae], cl
mov edx, dword [ebp - 0xab8]
sub edx, dword [ebp - 0x3e8]
mov dword [ebp - 0x1694], edx
mov dword [ebp - 0xce8], 0
push edx
xor edx, 0x34ad
xor edx, 0x17ad8
pop edx
push edx
push ecx
add esp, 4
or edx, 0x8c41
add edx, 0xdede
pop edx
push ebx
push edi
add esp, 4
or ebx, 0x15d09
add ebx, 0x8329
pop ebx
mov byte [ebp - 0x9d4], 0x56
mov byte [ebp - 0x9d3], 0x69
mov byte [ebp - 0x9d2], 0x72
mov byte [ebp - 0x9d1], 0x74
mov byte [ebp - 0x9d0], 0x75
mov byte [ebp - 0x9cf], 0x61
mov byte [ebp - 0x9ce], 0x6c
mov byte [ebp - 0x9cd], 0x50
Function at 0x10022190
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015f596
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x101c2db4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 8], 0xa
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea eax, [edi + 0x18]
mov dword [ebp - 4], 0
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100253e0
push 0
push 0
push edi
push 0x10022ae0
push 0
mov dword [esi], eax
push 0
mov byte [edi], 1
call fcn.101388b2
mov dword [edi + 4], eax
add esp, 0x18
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10025100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015f9c6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101c2db4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.10114dbf
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10032d09
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10027460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015fcba
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101c2db4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.100330d0
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10027520
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.1013481e
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x101bd060
push eax
call fcn.10134c1c
push edi
push esi
call fcn.10032e0c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011480c
mov esp, ebp
pop ebp
ret 4

Function at 0x1002a880
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push str._____Delete_HttpRequestTask_n
mov dword [esi], vtable.HttpRequestTask.0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esi + 0xb8]
call fcn.1002a6d0
lea ecx, [esi + 4]
call fcn.1002a3d0
test byte [ebp + 8], 1
je 0x1002a8be
push 0x18c
push esi
call fcn.10114822
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1002a900
Capabilities:
Write file on windows

Disassembly:
cmp dword [ecx + 0x14], 8
push esi
push edi
mov esi, edx
jb 0x1002a90c
mov ecx, dword [ecx]
push 0x40
push 0x101b4950
push ecx
call fcn.10138ade
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1002a958
push edi
push 1
push dword [esi + 4]
push dword [esi]
call fcn.10138d38
push edi
call fcn.10138e06
push 0
mov dword [esi], 0
call fcn.101384d1
add esp, 0x18
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov al, 1
pop edi
pop esi
ret
pop edi
xor al, al
pop esi
ret