joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c9d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6c9d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x6c9d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x6c9d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6c9d94
push eax
push esi
call fcn.006cc20b
add esp, 8
pop esi
ret 0x10

Function at 0x6c9da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6c9e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x6c9e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x6e2320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006cbdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x6c9dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x6c9e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6c9ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x6c9eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x6e2320
push ecx
mov dword [esp + 0x1c], 4
call fcn.006cbdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x6c9eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x6c9e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x6ca000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x6ca131
push esi
call fcn.006cd145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.006bc080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x6ca131
push 0
push ebp
call fcn.006bc3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.006bc260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x6ca08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006bc2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x6ca121
push 0x6e2918
push edi
call fcn.006cb3f0
push eax
push ebx
push esi
call fcn.006c9f60
push 0x6e28f8
push edi
call fcn.006cb3f0
push eax
push ebx
push esi
call fcn.006c9f60
push 0x6e28d8
push edi
call fcn.006cb3f0
push eax
push ebx
push esi
call fcn.006c9f60
push 0x6e28c0
push edi
call fcn.006cb3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.006c9f60
push 0x6e28a0
push edi
call fcn.006cb3f0
push eax
push ebx
push esi
call fcn.006c9f60
push 0x6e2888
push edi
call fcn.006cb3f0
push eax
push ebx
push esi
call fcn.006c9f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6cb1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006cb140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006cb140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006cb140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006cb140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6cbbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6cbc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6dd87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6cbc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6cbc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x401005
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x401b30
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov eax, dword [edi + 0x3c]
mov esi, dword [eax + edi + 0x78]
mov eax, dword [esi + edi + 0x20]
add esi, edi
add eax, edi
mov ecx, dword [esi + 0x1c]
add ecx, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x24]
add ecx, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x18]
test ecx, ecx
jbe 0x401b86
mov ebp, eax
mov eax, dword [ebp]
add eax, edi
push eax
call fcn.004010aa
mov ecx, dword [esp + 0x20]
add esp, 4
cmp eax, ecx
je 0x401b8e
mov eax, dword [esi + 0x18]
inc ebx
add ebp, 4
cmp ebx, eax
jb 0x401b65
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cx, word [edx + ebx*2]
mov eax, dword [eax + ecx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x401055
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
jmp 0x401870
sub esp, 8
mov eax, dword [esp + 0x14]
push esi
push edi
xor edi, edi
xor esi, esi
cmp eax, edi
mov dword [esp + 8], edi
jbe 0x4019b1
mov ecx, dword [esp + 0x14]
push ebx
push ebp
mov ebx, dword [0x47e72c]
lea eax, [esi + 1]
xor edx, edx
div ebx
xor eax, eax
mov esi, edx
xor edx, edx
mov al, byte [esi + ecx]
add eax, edi
div ebx
mov eax, dword [0x47e738]
mov ebx, dword [0x47e748]
mov ebp, ebx
mov edi, edx
mov edx, eax
imul edx, eax
sub ebp, edx
mov edx, dword [0x47e73c]
sub ebp, edx
sub ebp, 3
imul ebp, ebx
mov ebx, dword [0x47e744]
imul ebx, edx
inc ebx
imul ebx, dword [0x47e740]
add ebx, 2
imul ebx, edx
mov edx, 2
add ebx, esi
sub edx, eax
add ebx, ebp
imul edx, dword [0x47e744]
add edx, ebx
mov ebx, 1
mov al, byte [edx + ecx]
mov dl, byte [edi + ecx]
mov byte [esi + ecx], dl
mov byte [esp + 0x14], al
mov byte [edi + ecx], al
mov eax, dword [0x47e73c]
lea edx, [eax + eax]
mov eax, dword [0x47e738]
mov dword [esp + 0x1c], edx
mov edx, eax
imul edx, eax
sub ebx, edx
mov edx, dword [0x47e748]
imul ebx, eax
dec edx
mov ebp, dword [esp + 0x1c]
imul edx, dword [0x47e740]
add ebx, edx
mov edx, dword [0x47e744]
sub ebx, edx
add edx, eax
add ebx, ebp
mov ebp, dword [esp + 0x10]
lea eax, [edx + eax*2]
mov edx, dword [0x47e748]
add ebx, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edx*4]
mov edx, dword [esp + 0x14]
shl eax, 1
add ebx, ebp
mov ebp, eax
xor eax, eax
and edx, 0xff
mov al, byte [esi + ecx]
add eax, edx
xor edx, edx
div dword [0x47e72c]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffffe
imul eax, dword [0x47e740]
sub edx, ebp
mov ebp, ecx
add ebp, edx
mov dl, byte [eax + ebp]
mov al, byte [ebx]
xor al, dl
mov edx, dword [esp + 0x24]
mov byte [ebx], al
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
jb 0x40188f
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
Function at 0x408b39
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x48b1c8
cmp edx, dword [eax]
je 0x408b5b
add eax, 8
inc ecx
cmp eax, 0x48b258
jl 0x408b4c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x48b1c8]
jne 0x408c89
mov eax, dword [0x48ed08]
cmp eax, 1
je 0x408c63
test eax, eax
jne 0x408b8c
cmp dword [0x48acd8], 1
je 0x408c63
cmp edx, 0xfc
je 0x408c89
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x408bc3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408d50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408e40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408c06
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408e40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43d40c
push edi
call fcn.0040b990
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408d50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408d60
lea eax, [ebp - 0xa0]
push 0x43d3ec
push eax
call fcn.00408d60
push dword [esi + 0x48b1cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408d60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040b8fa
add esp, 0x2c
pop edi
jmp 0x408c89
lea eax, [ebp + 8]
lea esi, [esi + 0x48b1cc]
push 0
push eax
push dword [esi]
call fcn.00408e40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x413660
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.004044b0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41372b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41372b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4136de
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4136e9
or bh, 8
and edi, 0x8000000
je 0x413704
mov eax, dword [0x490b1c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41372b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b6fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
dec eax
mov byte [esp + 8], 0xcc
pushfd
cmp ecx, esp
sub edx, edx
pushfd
cmp bl, 0x2c
add dl, byte [0x473b44]
jmp 0x47e633

Function at 0x47be53
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x30]
jne 0x4809d1
rdtsc
bswap cx
cwde
movsx eax, al
mov byte [0x47107f], 0xb5
rdtsc
lea ecx, [0x4710e5]
rdtsc
mov eax, 0xe9324f2c
push ecx
mov dword [ecx + 0x12], 0xdb
movzx dx, dl
lea edx, [ebp + 8]
not eax
bswap ax
mov byte [esp], ch
mov al, dl
mov dword [esp], edx
mov ax, bp
push eax
setae al
mov eax, dword [ebp + 0x1c]
pushal
jmp 0x48289f
call fcn.0047d28b

Function at 0x47c095
Capabilities:
Check http status code

Disassembly:
lea esp, [esp + 0x50]
call fcn.0046d6e0
cmc
sub edx, esi
jmp 0x482af6
push eax
push esi
lea esp, [esp + 4]
call fcn.00402484
sal ch, 2
rcl cl, 7
mov dword [0x471064], edx
movsx cx, al
sub dword [0x4710a9], esi
movzx cx, bl
lea ecx, [0x4710b2]
bt dx, 0xf
bt si, bx
pushal
add dword [ecx + 4], 0x60
jmp fcn.0047efc2

Function at 0x47c10f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
push edx
mov dword [esp + 0x34], eax
mov byte [esp], 0x4e
lea esp, [esp + 0x34]
call fcn.0046ddd4
cmc
test eax, eax
push 0x4023be21
jmp 0x481832
lea esp, [esp + 4]
jne 0x484353
not bx
call fcn.00480bdd
call fcn.0047c610
pushfd
mov byte [esp], 0xdc
lea esp, [esp + 4]
call fcn.0046dfe4
jmp 0x484ba3

Function at 0x47c3f7
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0xc]
js 0x483f0a
call fcn.0046ddd4
stc
test eax, eax
jmp 0x483900
call fcn.0046ddd4
call fcn.004814ae
push edx
jmp 0x484317
jmp 0x47e4a1
lea esp, [esp + 4]
jne 0x484353
mov bl, dh
setae bh
call fcn.0048126f
movsx ebx, dl
mov bl, cl
mov bl, dl
mov word [0x471105], 0x699a
jmp 0x48065c

Function at 0x47cce2
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
cwde
pushal
mov byte [ebp - 1], 1
bswap bx
mov eax, 0x7f
bswap bx
pushfd
lea ebx, [ecx*8 + 0x225e9357]
push esi
mov word [0x47109a], 0x4c55
call fcn.0047b568

Function at 0x47db8b
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], 0xf66e
lea esp, [esp + 0x28]
jne loc.0046c1b8
call fcn.0047e492

Function at 0x47dd77
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [0x4710b6], esi
pushfd
mov dword [0x471025], ecx
pushfd
mov word [esp], bx
push 0xb6228d13
mov dword [0x471044], edi
mov dword [esp], 0xb949f531
call fcn.0047e39b
mov dword [0x4710d5], edi
pushfd
jmp 0x47e5a1
mov dword [0x471071], esi
push dword [esp]
lea esp, [esp + 0x14]
call fcn.0046d0b0
push ecx
cmp dword [0x473b70], 1
pushfd
mov dword [esp], 0xc98a380e
lea esp, [esp + 8]
jne loc.0046c1b8
pushfd
mov byte [esp], 0x3b
jmp 0x47a986

Function at 0x47e19c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [0x471067], 0x93
lea esp, [esp + 4]

Function at 0x47ee23
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
shl dl, 4
jmp 0x47ff32
Function at 0x47f873
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
xor byte [eax], cl
cmc
cmp byte [0x473b88], 0
mov byte [esp + 0x10], 0x68
lea esp, [esp + 0x3c]
jg 0x47c594
jbe 0x47de39
shl al, 1
mov eax, 0x7f
clc
xor bh, 0xed
dec bx
mov word [0x47109a], 0x4c55
pushal
bt cx, bx
pushal
mov ebx, 0x146
bt bx, 0xb
bt sp, 0xc
call fcn.0047e4b5

Function at 0x480269
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [0x471098], 0x11eff
mov byte [esp + 4], dl
call fcn.004851b9
lea esp, [esp + 0xc]
jne 0x484353
call fcn.00480b6e
push dword [esp]
pushfd
call fcn.0047f322
mov byte [esp + 8], ch
jmp 0x47e30b

Function at 0x4814ae
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
test eax, eax
push ebp
mov byte [esp], al
jmp 0x484a32
push 0x2ec1f3b0
jmp 0x47f42d
jmp 0x47e31e

Function at 0x4817f8
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xc]
call fcn.0046d6e0
cmp cl, dl
cmp si, 0x14c
sub eax, eax
jmp 0x484a56
btc ax, 2
shrd ax, dx, cl
mov eax, dword [ebp - 4]
push 0xa5d6c025
push esp
jmp fcn.00484d9d

Function at 0x4818e4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [0x471097], edx
push ebx
and dword [0x47106d], esi
mov byte [esp + 0x10], 0x3d
call fcn.00484898
pushal
clc
mov dword [esp + 8], esi
mov byte [esp + 0x10], 0xae
pushfd
stc
mov dword [0x471017], eax
pushal
mov byte [esp + 4], bh
cmc
add dword [0x471076], ebx
clc
stc
cmp dl, 0xd6
jmp 0x47c5f9
mov dword [esp], eax
pushfd
lea esp, [esp + 4]
call fcn.0046ddd4
cmc
cmc
test eax, eax
pushfd
mov byte [esp], 0x43
pushfd
lea esp, [esp + 8]
jne 0x47e62e
je 0x485296
lea ebx, [esi*2 + 0x78a887d0]
push 0xef7abddc
mov dword [0x4710dc], 0x10581
movsx ebx, bl
not bx
pop ebx
lea ebx, [eax*8 - 0x74edbc32]
mov word [0x471105], 0x699a
not bh
lea ebx, [edx + 0x4b9007fb]
lea ebx, [ebp - 0x77d3e20d]
mov dword [0x471054], eax
lea ebx, [edi + 0x42c9889c]
movsx bx, dl
call fcn.0047b840
cmp bl, dl
jmp fcn.00484bca
call fcn.0047d0f9
cmp ah, bl
sub ebx, ebx
pushfd
cmp edi, 0x977ee6f
test eax, 0xa93dac14
add bl, byte [eax - 1]
jmp 0x47db24
call fcn.00480ce9
push ecx
mov dword [0x471054], eax
lea eax, [edx*2 + 0x4959120f]
not bh
setno al
mov ebx, dword [0x4710c4]
setnp ah
not ah
movzx ax, cl
setge ah
mov dword [0x47403c], 0x12956
movsx ax, al
lahf
mov eax, dword [0x47403c]
jmp 0x482276
mov byte [esp], 0xe4
pushfd
lea esp, [esp + 0xc]
jne 0x4808be
bts si, bp
rcr esi, 5
inc si
mov esi, 0xdf
stc
cmc
cmp ecx, dword [ebp + 0x1c]
pushfd
push eax
lea esp, [esp + 8]
je 0x484d19
cmc
jns 0x47c6f0
stc
clc
mov dword [esp - 0x18], esi
push ecx
push 0x50ccf519
mov dword [0x471017], eax
test cx, 0xdf07
test dx, bp
call fcn.00484d10
jmp 0x47c80b

Function at 0x481f1c
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
lea esp, [esp + 0x4c]
jbe 0x47ca88
movzx bx, dl
lea ebx, [edi*2 + 0x1d99c8b2]
mov ah, 0xca
mov byte [ebp - 1], 1
push 0xc83ea264
call fcn.004840db
Function at 0x4820c4
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
bt dx, 0xe
or al, al
mov byte [esp], 0x4f
lea esp, [esp + 4]
jne 0x47bf1d
adc bx, 0x53c6
setnp bl
xor eax, eax
not bh
movzx ebx, dl
movzx ebx, bl
mov dword [0x473b58], 0xa872
lea ebx, [ebp - 0x50d34716]
mov ebx, eax
push ebx
pushal
mov byte [esp + 8], cl
lea esp, [esp + 0x24]
jmp loc.0046c1b8

Function at 0x482dcc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], eax
jmp 0x484a8e
test bl, 0xd9
mov al, byte [eax + 1]
jmp 0x47f521

Function at 0x482f5a
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
pushfd
jmp 0x4813c3
mov dword [0x47403c], 0x12956
cwde
bswap ax
mov eax, dword [0x47403c]
push esi
push edx
mov dword [esp + 0x48], eax
pushfd
lea esp, [esp + 0x4c]
call fcn.0046ddd4
pushal
push dword [esp + 0xc]
mov byte [esp + 4], dh
test ebx, 0xe3431eb8
test eax, eax
pushal
mov byte [esp + 4], al
jmp 0x484bd4
lea esp, [esp + 0x44]
jb 0x47acde
jne 0x484353
jp 0x47d1e0
mov bx, dx
mov dword [0x4710dc], 0x10581
pushal
call fcn.0047ecb1

Function at 0x4830e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [0x4710c4]
cwde
mov dword [0x47403c], 0x12956
push 0x4e97cf8d
lahf
not ah
mov eax, dword [0x47403c]
mov byte [esp], 0x2f
mov dword [esp], 0x47b66e26
pushfd
pushfd
mov dword [esp + 0x38], eax
jmp 0x47d052

Function at 0x483cae
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt ax, 0xc
stc
mov al, byte [eax + 0x473b7f]
cmp dh, dh
bt bp, bp
clc
pushfd
sub edx, edx
mov dl, dl
mov dl, byte [0x473b88]
cmc
add byte [edx + 0x473b80], al
mov word [esp], si
mov byte [esp], dh
mov byte [esp + 4], 0xb8
lea esp, [esp + 0x50]
jmp 0x4845d1

Function at 0x48428a
Capabilities:
Check http status code
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x50]
jg 0x485073
mov dword [0x47401c], eax
push ecx
lea esp, [esp + 4]
call fcn.00401008
pushal
push dword [esp + 4]
lea esp, [esp + 0x24]
jmp loc.004014ec
sub eax, eax
push esp
mov dword [esp], ecx
jmp 0x47ae20
pushfd
clc
mov byte [esp + 8], 0xa6
mov dword [0x471071], esi
bt bp, cx
clc
jmp 0x4830d8
pushfd
mov word [esp], ax
call fcn.0047bb59

Function at 0x484345
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx bx, bl
mov ebx, dword [0x4710c4]
lea esp, [esp + 0x44]

Function at 0x484445
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 4], di
pushal
pushfd
lea esp, [esp + 0x30]
jae 0x48445e
movzx bx, cl
mov byte [ebp - 1], 1
push 0x36840a23
bswap bx
mov ebx, 0x6a
lea esp, [esp + 4]
js 0x47aa4c
pushal
pushfd
mov byte [esp + 0xc], ch
mov dword [0x4710a9], edx
pushal
jmp 0x480272
Function at 0x49c31d
Capabilities:
Encode data using xor

Disassembly:
pushal
add edi, eax
push dword [esp + 4]
pushfd
mov byte [esp], 0x96
mov edi, dword [edi + ecx*4]
stc
bt di, 0xd
test edi, edi
push 0x2234975e
push dword [esp]
lea esp, [esp + 0x34]
je 0x49794c
stc
pushal
add eax, edi
clc
lea esp, [esp + 0x20]
jae 0x49c596
test bl, al
cmc
cmp eax, edx
pushfd
lea esp, [esp + 4]
jb 0x497951
push 0xd442b3b6
jmp 0x4944ac
push 0x74395a7f
inc edi
push eax
mov byte [esp + 8], 0xe7
mov byte [esp + 4], al
lea esp, [esp + 0x50]
jmp 0x495617
stc
cmp eax, dword [ebp - 0x10]
mov byte [esp], 0xb8
push edi
lea esp, [esp + 8]
jae 0x497951
sar cx, cl
rcr bx, cl
mov ebx, eax
bts di, sp
not ch
dec edi
btc edi, 0x1a
mov edi, eax
bsr cx, sp
mov ecx, 0x104
call fcn.004894c8
add byte [eax], al
push ebx
je 0x494538
jb 0x494559
arpl word [ebp + 0x73], sp
jae 0x494546
outsd dx, dword [esi]
jb 0x49455d
imul ebp, dword [esi + 0x67], 0x53746553
imul edi, dword [edx + 0x65], 0x6c000000
imul esi, dword [ebx + 0x74], 0x6e65
add byte [edi + 0x65], al
je 0x49455c
jb 0x49457d
imul bp, word [ebp + 0x49], 0x746e
inc ecx
add cl, dh
outsb dx, byte [esi]
sub eax, 0x89f86707
xor al, 8
push ss
mov bl, 0x57
fdiv dword [eax + 0x48]
mov ecx, 0x89a11ec1
pop ecx
and byte [eax + 0x5a], ah
stosb byte es:[edi], al
add al, 0x2b
mov bh, ch
push edi
or bh, bh
push ebp
sbb dword [edx + 0x889409f], esp
mov byte [0x889409f], al
sub byte [esi], ah
sahf
cmpsd dword [esi], dword es:[edi]
xor al, 0xc9
jg 0x494539
and ebx, dword [0x2658fa02]
mov eax, dword [0xfab43f4d]
test dword es:[edx - 0x27], 0x462918a2
push ecx
cmp bh, dh
jle 0x494564
push es
sal dword [ebx - 0x39], 0x53
push ds
das
inc ecx
mov ebx, 0xb747db34
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
cmp byte [eax + 0x202282f8], dh
int3
int1
push 0x75
invalid
pushal
push esi
pushal
inc esi
push edx
jmp 0x4909a8
shrd edi, esp, cl
rcl edi, cl
mov edi, dword [edx + 0x1c]
jmp 0x489fe8
cmp dh, cl
bt edx, 0xb
cmp eax, edx
pushfd
mov byte [esp], 0xa2
pushfd
lea esp, [esp + 8]
jb 0x497951
clc
stc
cmp eax, dword [ebp - 0x10]
pushfd
pushfd
call fcn.0048a94f
lea esp, [esp + 0x24]
jne 0x4909e3
jmp 0x494cf8

Function at 0x49dc3b
Capabilities:
Encode data using xor

Disassembly:
cmc
add edi, 1
pushfd
pushfd
lea esp, [esp + 0x10]
jmp 0x4969ce