joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046e3e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10046e66
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10046e61
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10046fba
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10016b9d
cmp dword [eax], 0
je 0x10046f3d
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10016b9d
mov eax, dword [ebp - 0x50]
cmp dword [eax], 0xb11f
jle 0x10046eff
mov dword [ebp - 8], 1
jmp 0x10046f03
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
cmp dword [ebp - 8], 0
jne 0x10046f26
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10016b9d
cmp dword [eax], 0
jne 0x10046f26
and dword [ebp - 0x18], 0
jmp 0x10046f2d
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
neg eax
je 0x10046f3d
mov dword [ebp - 0x1c], 1
jmp 0x10046f41
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0x6b379904
jle 0x10046f53
mov dword [ebp - 0x20], 1
jmp 0x10046f57
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.10016b9d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x20]
sub esi, dword [edx]
mov edx, dword [ebp - 0x5c]
sub esi, dword [edx]
add ecx, esi
cmp dword [eax], ecx
jne 0x10046f85
mov dword [ebp - 0x28], 1
jmp 0x10046f89
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.10016b9d
mov eax, dword [eax]
cmp eax, dword [ebp - 0x28]
jle 0x10046fa6
mov dword [ebp - 0x14], 1
jmp 0x10046faa
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100472a9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100472d4
push 0x53a
push 0
push 0x25af
push 0x1a38
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1004731f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10047302
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1004731f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10016b9d
mov dword [eax], 0x5d3c
jmp 0x100472f7
mov esp, ebp
pop ebp
ret
Function at 0x10048347
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x100484df
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jbe 0x100483ca
mov dword [ebp - 0x14], 1
jmp 0x100483ce
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x58]
jle 0x100483fd
mov dword [ebp - 0x5c], 1
jmp 0x10048401
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
push 1
mov ecx, dword [ebp - 0x10]
call fcn.10016b9d
cmp dword [eax], 0xb14151c8
je 0x10048424
mov dword [ebp - 0xc], 1
jmp 0x10048428
and dword [ebp - 0xc], 0
push 1
mov ecx, dword [ebp - 0x10]
call fcn.10016b9d
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
cmp dword [ebp - 0xc], 0
jne 0x10048447
push 1
mov ecx, dword [ebp - 0x10]
call fcn.10016b9d
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
cmp dword [eax], ecx
je 0x1004845c
mov dword [ebp - 0x18], 1
jmp 0x10048460
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0x69cd
jne 0x10048477
or eax, 0xffffffff
je 0x10048477
mov dword [ebp - 0x1c], 1
jmp 0x1004847b
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jg 0x1004848e
mov dword [ebp - 0x64], 1
jmp 0x10048492
and dword [ebp - 0x64], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x100484b2
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x100484b2
and dword [ebp - 0x24], 0
jmp 0x100484b9
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
cmp eax, dword [ecx]
jge 0x100484d1
mov dword [ebp - 0x30], 1
jmp 0x100484d5
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x100484f0
push 0
push 0x208e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret
Function at 0x10048f31
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10048f5f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10048f5d
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10048faa
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10048f8d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10048faa
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.10016b9d
mov dword [eax], 4
jmp 0x10048f82
mov esp, ebp
pop ebp
ret
Function at 0x10080cae
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008b60c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007040a
mov dword [ebp - 0x14], eax
cmp dword [0x11efb2f4], esi
jne 0x10080da1
push 0x800
push esi
push 0x10007d0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10080d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10080e81
push esi
push esi
push 0x10007d0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10080e81
push 0x10007d24
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10080e81
push eax
call ebx
push 0x10007d30
push edi
mov dword [0x11efb2f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007d40
push edi
mov dword [0x11efb2f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007d54
push edi
mov dword [0x11efb2fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11efb304], eax
test eax, eax
je 0x10080d9e
push 0x10007d70
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x11efb300], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10080dc6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10080db9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10080ddb
push 4
pop eax
jmp 0x10080e83
cmp dword [ebp - 0x14], esi
je 0x10080ddb
push dword [0x11efb2f4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10080dc0
mov eax, dword [0x11efb300]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10080e39
cmp dword [0x11efb304], edi
je 0x10080e39
push eax
call ebx
push dword [0x11efb304]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10080e39
test eax, eax
je 0x10080e39
call ecx
test eax, eax
je 0x10080e2e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10080e2e
test byte [ebp - 8], 1
jne 0x10080e39
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10080e69
mov eax, dword [0x11efb2f8]
cmp eax, edi
je 0x10080e66
push eax
call ebx
test eax, eax
je 0x10080e66
call eax
mov esi, eax
test esi, esi
je 0x10080e66
mov eax, dword [0x11efb2fc]
cmp eax, edi
je 0x10080e66
push eax
call ebx
test eax, eax
je 0x10080e66
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x11efb2f4]
call ebx
test eax, eax
je 0x10080e81
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10080e83
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006d135
mov esp, ebp
pop ebp
ret
Function at 0x104949d1
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp + 4], 0x80894e95
xor dword [esp + 4], 0xa88b3b9
mov ecx, dword [edi + 2]
dec eax
adc edi, 6
mov dword [esp], eax
xchg byte [esp + 6], al
xor ecx, ebx
jmp 0x10a70e3e
lea edx, [esp + 0xc]
sbb ax, 0x16b0
movzx cx, byte [edx]
mov word [ebp - 2], cx
sar dword [esp], 0x26
movsx ecx, al
neg byte [esp + ecx - 0x3d]
lea ebp, [ecx + ebp - 0x4a]
and dword [esp + ecx*4 - 0x119], 0x9cb032a8
pop edx
pop edx
pop ecx
jl fcn.10ad726f
call fcn.10a52e9a
xadd al, ah
dec eax
lea ecx, [ecx + eax + 0x28a2debd]
push eax
bswap ecx
adc al, al
sub ecx, 0x853a4a89
sal dword [esp + 7], 0x4c
mov edx, eax
neg ecx
jmp 0x10aded49
xor ebx, ecx
not dl
add esi, ecx
sar dword [esp + 2], 0xab
ror ax, 0x8d
js 0x1095adef

Function at 0x104a7263
Capabilities:
Encode data using base64

Disassembly:
push ebp
inc ecx
inc ebp
inc eax
inc ch
dec eax
not dword [esp + 0x10]
dec eax
mov dword [esp + 0x18], ecx
inc ecx
bswap ebp
dec eax
mov dword [esp + 8], ebp
inc ecx
neg ebp
xadd word [esp + 6], bp
inc esp
movzx eax, cx
dec esi
mov dword [esp + eax*2 - 0x5e84], esp
dec edx
xchg dword [esp + eax*4 - 0xbd2f], ebp
inc esi
xor dword [esp + eax*8 - 0x17a58], ebp
inc edx
movzx edi, byte [esp + eax*8 - 0x17a61]
call fcn.1091a2b3

Function at 0x104aba27
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc ebp
xor bl, ah
inc ecx
dec bl
inc ecx
rol bl, 1
rol byte [esp + edi - 2], 0x24
inc ecx
push ebp
inc ecx
xor bl, 9
dec eax
mov dword [esp + edi - 7], 0x1eb6bb14
dec ecx
xadd ebp, ebx
jns 0x108c94f8
inc ecx
dec bl
movzx edx, bx
dec eax
xadd ebx, edx
inc ebp
xor ah, bl
dec eax
sal dword [esp + edi*4 - 0x2d], 0x3f
setne byte [esp + edi*2 - 0xa]
dec esi
lea ebx, [esp + ebx + 0x38]
jns 0x10971908
add ecx, esp
sal edx, 0x5c
xadd dl, ah
mov eax, dword [ecx + edx - 0x500000ff]
and edx, edx
mov edx, eax
lea ecx, [esp + 0xc]
mov eax, 0x821d2605
sub al, 7
mov dword [ecx], edx
movsx edx, al
mov edx, dword [edi]
mov ecx, dword [edi + 4]
add edi, 8
sub al, 0x95
mov dword ss:[edx], ecx
mov ecx, eax
lea edx, [eax + eax*4 - 0xbcbe3e6]
mov ecx, dword [ebp + edx - 0x7ec5dc26]
lea ebp, [ebp + edx - 0x7ec5dc22]
push edx
rol dl, 0xc7
xor ecx, ebx
ror dword [esp + edx - 0x7ec5dc93], 0x82
xchg dword [esp + edx - 0x7ec5dc93], eax
sal eax, 0x1d
lea ecx, [ecx + edx - 0x6c873d93]
sub eax, eax
or dl, byte [esp + eax + 1]
xor ecx, 0xc30bbfbd
not ecx
xor ecx, 0x99b8ef9d
add edx, dword [esp + eax*4]
xor ebx, ecx
not dl
call fcn.10948c06

Function at 0x104d556f
Capabilities:
Encode data using xor

Disassembly:
dec esi
lea edi, [esp + edi + 8]
sub bp, bp
inc ecx
mov dword [edi + ebx - 0x3a], ecx
inc edi
mov ecx, dword [eax + esi - 0x570e0226]
dec esi
lea esi, [ebx + esi - 0x35]
xor ecx, ebx
inc ebp
xor ecx, esp
inc ecx
rol ecx, 3
inc ecx
dec ecx
call fcn.109d4618
aam 0x53
mov al, 0x2d
mov al, 0xfc
sbb al, 0x2c
loopne 0x104d5587
movsb byte es:[edi], byte [esi]
rcr al, cl
sub al, 0xe0
lodsb al, byte [esi]
lodsb al, byte [esi]
fcmovu st(0), st(0)
sub al, 0xe0
mov al, 0xd4
ljmp 0x28c0
Function at 0x104d5b38
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc eax
add byte [esp + edx*2 + 0xc], ch
inc ebp
mov ebp, dword [esi + ebx*2 - 0x5b5f]
dec ebp
lea esi, [esi + ebx*4 - 0xb6bb]
dec eax
mov dword [esp + ebx - 0x2db0], edx
dec eax
xor edx, ebp
inc ebp
xor ebp, esp
inc ecx
neg ebp
inc ecx
xor ebp, 0x86298996
inc ecx
ror bl, 0xc3
movzx ecx, di
call fcn.108bb749
leave
xor eax, 0x9ff0159e
or eax, 0x8522ec16
aad 0x4f
ror dword [edi], 0x3f
in eax, 0xd1
cmp eax, ecx
invalid

Function at 0x104e0634
Capabilities:
Manually build aes constants

Disassembly:
dec edx
mov dword [esp + ecx*4 - 0x50], eax
neg edi
inc cx
dec ecx
dec esi
mov dword [esp + ecx*2 - 0x1e], esp
pop ebp
dec eax
sar ebx, 0x6f
inc ecx
push eax
inc edx
xor dword [esp + ecx - 0xb], edi
dec esp
xadd ebp, edi
dec esi
mov esp, dword [esp + ecx - 0xb]
dec edx
mov dword [esp + eax - 0x6a040f35], 0xc897d084
inc ebp
mov ebp, ecx
inc ecx
shl ebx, 0xd0
dec eax
arpl di, di
dec edx
lea ebp, [ecx*4 + 0x731eb229]
dec esp
adc edx, edi
dec ebp
mov eax, dword [ecx + esi - 0x19]
rol ebx, cl
inc bx
movzx edi, byte [eax + ecx*4 - 0x4c]
inc cx
jno 0x1090d146
mov eax, dword [edi]
mov edx, dword [edi + 4]
and eax, edx
jmp 0x105906d6
mov ecx, 0xb5b01d94
not eax
mov edx, ecx
or cl, dl
adc ecx, edx
mov dword [edi + ecx - 0x6b603b24], eax
mov eax, edx
shr dl, 0x67
call fcn.1055021a
adc edx, edx
not ecx
and eax, ecx
call fcn.1057d545
add bx, di
movzx bx, bl
inc esi
mov ch, byte [esi + ecx - 0x11]
call fcn.109416fc
pop ebp
jp 0x1090d1b2
das
invalid
or bl, cl

Function at 0x105059d5
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ecx
rol ebx, cl
dec esi
mov dword [esp + ebp - 0x3683], ebx
xor bl, cl
movzx edx, ax
inc esp
xor bh, cl
jmp 0x10949af3
inc esp
mov eax, ecx
inc ecx
xor edx, esp
ror edx, 1
call fcn.1059a80d
inc ebp
mov bh, byte [ebp + esi - 0x3685]
jge 0x10492082
shr di, 0xa6
inc eax
neg bh
inc ecx
or bl, bh
inc esp
add ebx, edx
inc cx
sal ebx, 0xa3
mov word [eax + esi - 0x66602d98], bx
dec eax
lea edx, [ecx + 0x3186e206]
inc cl
dec edx
lea esi, [esi + ebp*2 - 0x6d08]
dec esp
sub dword [esp + eax - 0x66602d92], ebx
inc edx
mov edx, dword [eax + esi - 0x66602d94]
dec esi
lea esi, [eax + esi - 0x66602d90]
shl di, 0xae
jbe 0x104a2ce6
lea edx, [edi + edx*8 - 0x7effc]
or cl, 0x29
or byte [esp + 0x10], 0x8a
mov dword [edi], edx
movzx edx, cx
mov dword [esp + edx*4 - 0x3f8a4], ecx
call fcn.10ab0cb3
inc ecx
push ecx
mov ax, word [esi]
call fcn.10a4e1a1

Function at 0x10511fc2
Capabilities:
Encode data using xor

Disassembly:
inc ecx
movsx edi, cl
inc edx
shl dword [esp + edi*2 - 0x3439d768], 0xe2
dec ebp
arpl ax, ax
call fcn.104bb30c
dec eax
jl 0x10a3c985
ror edx, 3
lea eax, [eax + eax*8 + 0x331768ba]
push ecx
sar dword [esp + ecx - 0x3b1b1268], 0xc7
inc edx
lea eax, [eax + eax*2 - 0x27591153]
xor dword [esp + ecx - 0x3b1b1268], ecx
xor ebx, edx
add esi, edx
movzx dx, byte [ebp + ecx - 0x3b1b1268]
dec dword [esp + ecx - 0x3b1b1268]
mov cl, byte [ecx + ebp - 0x3b1b1266]
not ax
sub al, 0xa2
sub ax, ax
lea ebp, [ebp + eax - 0x71ecfffe]
jno 0x10a6bd49
Function at 0x105304d8
Capabilities:
Encode data using base64

Disassembly:
mov edx, 0xe2067f30
mov eax, edx
xor ecx, ebx
xor ecx, 0x3bbaa097
push edx
mov dword [esp + 4], 0x4e1f183b
jmp 0x10ae61ba
rol dword [esp], 0x5f
bswap ecx
add al, 0xb9
rol ecx, 1
xor ebx, ecx
add esi, ecx
and byte [esp + 5], 0xbd
pop eax
pop ecx
jmp esi
dec ecx
dec eax
js 0x1056380b

Function at 0x10554f06
Capabilities:
Encode data using xor

Disassembly:
dec eax
mov dword [esp], 0x3520beac
call fcn.10ad703e
not eax
lea edx, [ecx*2 + 0x268c2eb0]
inc ecx
lea eax, [eax + edx + 0x23696f12]
js 0x1096b7af
mov bh, byte [ecx + eax*4 - 0x6f]
jb 0x10554fac
in eax, dx
int 0x30
nop
and esi, eax
sbb eax, 0xf39030cd
cwde
xchg ebp, eax
int 0x30
nop
fisttp dword [eax]
mov dl, 0x95
fild qword [edi - 0x6a]
test eax, 0x6ed062f6
pop es
shr byte [esi + 7], 1
outsd dx, dword [esi]
jnp 0x10554f83
iretd
inc ebp
cmpsb byte [esi], byte es:[edi]
fcmovnu st(0), st(5)
in eax, 0xb3
inc edx
fist dword [edi + 0x13]
invalid
sbb byte [ebp - 0x389b7075], ch
jne 0x10554f31
mov ecx, dword [edi - 0x598a389c]
invalid
jns 0x10554f71
add eax, 0x7930c9bc
cmp eax, 0x30c974c4
jns 0x10554f85
leave
xor byte [ecx - 0x2b], bh
cmp al, 0xbc
leave
xor byte [ecx - 0x13], bh
cld
xor al, 0xc9
xor byte [ecx - 0x5b], bh
and al, 0x3c
mov eax, dword [0x3b9c23af]
jge 0x10554fb2
xchg bl, bh
jl 0x10554f4b
xchg ecx, eax
popfd
jne 0x10555007
int 0x30
nop
xchg ebp, eax
in al, dx
jno 0x10554fa2
xor byte [eax - 0x32cea862], dl
xor byte [eax - 0x320ef084], dl
xor byte [eax - 0x329e93c1], dl
xor byte [eax - 0x323e9292], dl
xor byte [eax - 0x322ee0f2], dl
xor byte [eax - 0x328edb82], dl
xor byte [eax - 0x3007c204], dl
iretd
in al, 0xd7
push ds
aaa
sbb ah, byte [edx]
mov ah, 0xc1
jecxz 0x10555019
inc esp
inc dword [ebx + 0x53]
push esi
les ebp, [ecx + 2]
adc bl, byte [ebx + 0x56]
add dl, byte [edx]
pop ebx
push esi
les ebp, [ecx + 0xb]
push 0xffffffffffffffab
push esi
les ebp, [ecx + 0x3a]
sbb cl, byte [ebx + 0x4b69c456]
mov dl, 0x13
push esi
les ebp, [ecx - 0x4e]
cmp ch, byte [ebx + 0x56]
les ebp, [ecx + 0x2b]
xor esp, dword [ebx]
push esi
les ebp, [ecx - 0x2d]
xchg edx, eax
jmp 0x10555097
xchg esi, eax
shl dword [esi - 1], 0x84
or al, 4
sub al, 0x34
mov eax, dword [ebx]
and ecx, 0x683c3892
ror eax, 1
xor ebx, eax
xor dword [esp + ecx*2 - 0x77ed], edx
sal dl, 0xe2
js 0x10a192ac
bswap eax
shr ecx, 0x72
or cl, 0xa5
ja 0x1090fc0c
Function at 0x1055b64d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol edx, 3
shl ax, 0x66
xor edx, 0x7db28820
inc eax
lea edx, [ecx + edx + 0x48e8d8bc]
neg cl
lea ecx, [eax*8 - 0x24fd2772]
xchg cx, ax
neg edx
xor ebx, edx
jmp 0x10a56c91
xor bl, al
and edx, edx
mov dword [esp + edx - 0x7ffffffc], edx
rol dword [esp + ecx - 0xfb], cl
lea eax, [esp + eax + 0xc]
mov edx, dword [eax + ecx - 0xff]
mov dword [ecx + esi - 0x103], edx
je 0x108d9fac
lea eax, [ecx + ecx*2 + 0x1d840823]
mov eax, dword [ebp + ecx - 0x104]
shr byte [esp + ecx*4 - 0x3f8], 0x26
ja 0x105b15cf
movzx edx, byte [esp + ecx*2 - 0x1fa]
xor eax, ebx
xor dword [esp + ecx - 0xfb], 0xa9d973d
rol word [esp + ecx - 0xfb], 0xed
ror eax, 1
add word [esp + edx*2 + 4], 0xab15
lea ecx, [ecx + edx*8 + 0x5d0f17b8]
and edx, ecx
inc eax
ror dx, 0x2f
push edx
neg eax
rol eax, 3
or dl, ch
shr dx, 0x82
not eax
xchg dword [esp + 0xc], ecx
adc ecx, 0xfff42e9a
jmp ecx
jae 0x10ae0d23
mov edx, 0xf39e889a
movzx eax, dx
mov ecx, eax
lea edi, [edi + eax*4 - 0x2226c]
shl eax, 0x73
mov edx, dword [eax + edi - 0x44d00000]
xor edx, ebx
sal cx, 0xe6
dec cx
not edx
rol edx, 2
sar ecx, cl
lea ecx, [ecx*2 + 0x4698c49c]
neg al
sbb edx, 0xda1b0a86
add ecx, 0x159ff231
xadd eax, ecx
shr cl, 0x61
neg edx
and al, ah
rol edx, 3
xor eax, ecx
inc cl
xor edx, 0x4c37ebbe
and eax, eax
jl 0x104b29bd
sal al, 0xa5
pop edx
ror cl, 1
inc ax
jge 0x1096ff19
xor cl, 0x2b
rol eax, 0x53
push edx
setae byte [esp + eax*8 - 0x720000]
adc cl, 0x21
jmp 0x10559185
add esi, edx
movzx dx, byte [ebp + ecx - 0x9c7a101]
ror ax, cl
shl eax, cl
call fcn.109d68d9
jmp 0x10a077f9
sub dl, al
add esi, ecx
mov ecx, eax
and ecx, 0xb400a800
add cl, byte [edx + ebp - 0x562d04db]
bswap edx
xor cl, bl
not ax
sal eax, 0x3b
rol cl, 1
sal dx, 0xf
shl al, 0x25
sub al, al
adc cl, 0xf
jmp 0x1096492e
sal ecx, 0x6e
xor eax, ebx
call fcn.10a65e5d
or al, 0x86
dec ecx
xor ebx, ecx
jmp 0x10ac110a
Function at 0x1055e0a1
Capabilities:
Encode data using base64

Disassembly:
adc cl, dl
inc eax
xadd ecx, edx
shr ecx, cl
xor ebx, eax
inc ecx
shr cl, 0xc4
jae 0x10ad3f43
add ebp, ecx
and eax, eax
sal ax, 0x8e
mov edx, dword [edi]
mov ecx, eax
mov ecx, dword [edi + 4]
jns 0x109dcc36
mov eax, 0x58fe595
inc ecx
mov eax, dword [esi + eax*2 - 0xb1fcb2a]
dec ecx
add esi, 4
inc ecx
mov ebx, 0xac2abd17
inc ecx
mov edx, ebx
inc ecx
xor eax, esp
ror eax, 1
xor eax, 0xd1a9ba3c
shl dl, 3
inc esp
mov ebp, edx
dec esp
lea ebx, [edx + 0x4233093a]
dec eax
inc ecx
mov edi, ebx
inc ebp
mov ecx, ebp
inc esp
mov eax, edi
neg eax
dec ecx
neg eax
inc ecx
push esp
inc ecx
dec eax
inc edx
xor dword [esp + eax*4 - 0x4688e434], eax
inc ecx
pop esp
dec eax
arpl ax, ax
dec esp
add edx, eax
inc ecx
mov ebx, ecx
inc cx
movzx ebx, byte [eax + esi - 0x11a2390d]
dec ebx
lea ebp, [ecx + ebx*8 - 0x1de33ce9]
inc ebp
mov ch, byte [eax + esi - 0x11a2390b]
inc ecx
inc bl
inc eax
shr bh, 0x84
push ebp
dec ecx
lea esi, [eax + esi - 0x11a2390b]
push ebp
inc ecx
and bl, ch
inc esp
movsx edi, di
push edi
inc esi
sub al, byte [esp + eax - 0x11a23908]
not bl
inc eax
and bh, 0x16
inc ecx
mov ecx, eax
dec edx
ror dword [esp + eax - 0x11a238fd], 0xf4
inc cx
mov dword [eax + esi - 0x11a2390d], ebx
dec esp
mov dword [esp + ecx - 0x11a2390d], edx
ret 0x10
inc edx
movzx ebp, byte [eax + esi - 0x5636b3c4]
dec esp
lea ecx, [eax*4 + 0x2539be3b]
dec edi
lea esi, [esi + edi - 7]
call fcn.108fdd98
neg edx
not ecx
sar dx, 0x8c
sar edx, 0x6c
ja 0x10b09284
mov ecx, 0x228ba399
mov eax, dword [edi + ecx*2 - 0x45174732]
lea edi, [edi + ecx*2 - 0x4517472e]
xor eax, ebx
movzx edx, cx
sal ecx, 0xbc
lea eax, [eax + ecx + 0x2a3908af]
ror eax, 1
lea eax, [edx + eax + 0x7d3c90a0]
sub dl, ch
dec ecx
not eax
setg cl
jle 0x105434f0
movsx eax, dl
pop edx
pop eax
pop ecx
pop eax
pop eax
jmp edi
jmp ebp
push ecx
add cx, word [ebp + ecx*2 + 4]
xor dx, 0x160a
js 0x10ac089e
xchg dh, cl
jmp 0x10ae0cff
add edi, 4
sal ax, 0x6f
rol al, 0x84
or edx, ecx
not edx
neg byte [esp + 2]
adc eax, dword [esp]
mov ecx, 0x3c001497
mov dword [edi + ecx - 0x3c001497], edx
lea eax, [eax + 0x252427ad]
xor ecx, ecx
mov dword [esp + ecx], ebp
ret
xor ecx, ecx
mov eax, dword [ebp + ecx*2]
shr edx, 0xe3
jns 0x10903628
sub ebp, 4
lea edx, [eax + 0x531ee4bf]
neg eax
or dl, 0xb
mov eax, dword [ebp + eax - 0x69c8e34a]
jns 0x109e67b2
lea ebp, [edx + ebp - 0x133fe9f5]
jo 0x108b3232
sar edx, 0x3d
mov word [eax + edx*2], cx
sub dword [esp + edx*2], 0xb9a63e9a
mov dword [esp + edx*4], esi
ret
adc esi, eax
bswap edx
jmp 0x10aa5327
neg eax
xor ebx, eax
add esi, eax
dec edx
neg dl
setno cl
mov ax, word [ebp]
mov dx, word [ebp + 2]
jg fcn.10a14217
push ecx
mov cl, byte [ebp + 4]
call fcn.104aa12c