joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9bef32
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf09ad3f0
jmp 0x9bef3a
jmp 0x9bef9a
pushfd
jmp 0x9be312
pushal
mov dword [esp + 0x13], esp
mov al, 0x8d
jmp 0x9bef71
lea esi, [esp + 0x20]
call fcn.009bef7d
loopne 0x9befc8
invalid
pushfd
and ah, byte [edi + 0x4da15237]
pop edx
cmpsd dword [esi], dword es:[edi]
aaa
push edx
mov eax, dword [reloc.RASAPI32.dll_RasHangUpA]
and al, 0x4c
mov edi, dword [esp + 0x4c]
xchg edx, eax
not dx
xchg dl, dh
jmp 0x9bef5b
pop word [esp]
mov word [esp], ax
lea esp, [esp + 2]
push esi
push edi
jmp 0x9bef34
jmp 0x9bf00e
ror al, 6
jle 0x9befaa
jg 0x9bf00e
in eax, dx
outsb dx, byte [esi]
cld
wait
jbe 0x9bef69
std
adc dword [ebx], 0x76
test dword [edi - 0x3a], esi
jno 0x9bef6b
lea esp, [esp + 3]
and al, 3
push ebx
ret
rdtsc
jmp 0x9bf031
rdtsc
mov edx, dword [esp]
lea ebx, reloc.RASAPI32.dll_RasHangUpA
mov bx, word [esp]
xchg dx, ax
jmp 0x9bf0c1
mov ecx, edi
xchg al, bh
xchg dl, bh
bt ebx, eax
jbe 0x9befe3
ja 0x9befeb
xchg dx, ax
jmp 0x9bf0c1
mov edx, dword [esp]
lea ebx, reloc.RASAPI32.dll_RasHangUpA
mov bx, word [esp]
call fcn.009bf153
jge 0x9bf043
insb byte es:[edi], dx
or eax, dword [esi]
in al, 0x4f
salc
jmp 0x9befdd
jmp 0x9bf0f6
btc bx, sp
lea esp, [esp + 1]
jmp 0x9bf103
xor edi, 0x11a0cef5
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov bx, word [esp]
sub esp, 0xd
jle 0x9bf0a5
neg dx
setb al
mov edx, 0x8f0ab993
btc bx, sp
lea esp, [esp + 1]
jmp 0x9bf103
neg dx
setb al
mov edx, 0x8f0ab993
jmp 0x9bf0a7
lea esp, [esp + 0xc]
neg edi
mov bx, 0xe988
bsr bx, di
jno 0x9bf127
mov dx, di
jmp 0x9bf180
jmp 0x9bf13d
mov dx, di
or ebx, 0x98494fd1
rdtsc
bt eax, ecx
jmp 0x9bf16a
add edi, 0x64cd7826
dec al
jl 0x9bf22a
jge 0x9bf1f8
pop ss
jle 0x9bf1c6
call 0xcc1d938d
ror dword [edi + 0x49], 1
cwde
or ebx, 0x98494fd1
rdtsc
bt eax, ecx
jmp 0x9bf16a
invalid
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov dl, byte [esp]
mov ax, 0x7f7d
call fcn.009bf18d
add dword [eax - 9], 0x24148bd0
mov ax, di
push dword [esp + 4]
ret 8
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov dl, byte [esp]
mov ax, 0x7f7d
bsf dx, sp
mov dl, byte [esp]
jmp 0x9bf25b
jmp 0x9bf28a
mov ah, 0x8b
dec edi
mov edx, ebx
neg ax
jmp 0x9bf290
sub edi, 0x2d03c035
not eax
not bx
inc dl
jno 0x9bf241
mov eax, ebp
inc edx
cmc
mov ah, 0x8b
jmp 0x9bf245
bsr edx, esp
jmp 0x9bf29b
mov eax, ebp
inc edx
cmc
jmp 0x9bf243
jle 0x9bf272
bsr edx, esp
jmp 0x9bf29b
add edi, dword [esi]
lea eax, [edx*4]
rdtsc
mov bx, cx
jmp fcn.009bf4d7

Function at 0x9bef7d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, 0x28c7
mov dword [esp], ecx
sub esp, 0x9c
jmp 0x9befc0
mov ebp, esp
lea ebx, [esp + edx]
setp ch

Function at 0x9c1033
Capabilities:
Execute anti-debugging instructions

Disassembly:
jl 0x9c0ff1
push word [esp]
jmp 0x9c0fd9
push word [esp]
jmp 0x9c0fd9
push cx
bsf dx, ax
jmp 0x9c0fcd

Function at 0x9c117b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
ja 0x9c108f
not eax
jmp 0x9c1091
Function at 0x9e7511
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [ecx + 0xc], edx
mov eax, dword [esp]
jmp 0x9e7529
lea ebp, [esp - 0x46]
shl edx, 8
xor edx, eax
jmp 0x9e74dc
jmp 0x9e74f2
bswap ebp
mov bl, 0x2a
jmp 0x9e7534
mov eax, edx
inc ebp
setne bl
shr eax, 0x10
jmp 0x9e7513
mov esi, 0xff
bt bp, bp
push edi
and eax, esi
jmp 0x9e757e
sub esp, 5
mov byte [esp], al
lea esp, [esp + 1]
mov eax, dword [eax*4 + reloc.RASAPI32.dll_RasHangUpA]
push ebx
jmp 0x9e7568

Function at 0x9e76a6
Capabilities:
Encrypt data using aes

Disassembly:
sub esp, 5
lea esp, [esp + 1]
and edi, esi
jmp 0x9e76f6
mov ebp, 0x9affa917
add ebp, 0x650155e9
call fcn.009e770a
inc esi
les ebx, [edx + 0x3d]
int3
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
sub esp, 0x18
push dword [esp + 2]
xchg dword [esp + 0x14], ebp
jmp 0x9e76d2

Function at 0x9e770a
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], ebx
lea esp, [esp + 4]
jmp 0x9e77ea
lea edi, [ebx + esi]
lea edi, [esp + ebp]
not di
jmp 0x9e7778
mov eax, edi
mov eax, dword [ecx + 8]
xor eax, ebx
stc
jmp 0x9e7740
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
jmp 0x9e7756
and edi, ebp
xor eax, edi
lea esp, [esp + 0x58]
xor eax, dword [ecx]
jmp 0x9e7716

Function at 0x9e7a6e
Capabilities:
Encrypt data using aes

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x10]
jmp 0x9e79ff
mov eax, dword [esp]
jmp 0x9e7a43
add edi, 0xc
mov edx, dword [edi]
pop edi
xor edx, ecx
push edi
jmp 0x9e79cc
cmp ebx, 0x9b9848
jne 0x9e71e6
push 0xa
lea edi, [eax*4]
jmp 0x9e79de
mov dword [eax + 0x18], ecx
push edi
mov edi, eax
jmp 0x9e79f4
pop edi
mov bl, byte [esp]
jmp 0x9e7a50
pop eax
mov bh, byte [esp]
mov si, word [esp]
mov bh, byte [esp]
jmp 0x9e7a2d
pop esi
bswap ebx
mov bx, word [esp]
pop ebp
jmp 0x9e7ac3
xor ecx, edx
mov edx, 0xf3b13736
jmp 0x9e7a25
sete bh
pop ebx
ret

Function at 0xadcc91
Capabilities:
Parse pe header

Disassembly:
call fcn.00adc113
push edi
jmp 0xadcc98
mov byte [esp + 6], al
mov dword [esp + 0x2c], esp
pushal
pop word [esp + 2]
push word [esp + 3]
jmp 0xadccc1
mov dword [esp + 0xe], eax
mov dword [esp + 0x48], ebp
pushal
pop word [esp + 0x10]
jmp 0xadccfe
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
jmp 0xadcd19
mov byte [esp + 0x1c], bh
mov dword [esp + 9], ebp
mov dword [esp + 0x17], edx
mov word [esp], sp
mov byte [esp + 7], cl
push word [esp + 0x15]
jmp 0xadcce8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xadcf00
lea edi, [edi + 8]
mov eax, dword [edi]
pop edi
push eax
jmp 0xadc10e
mov eax, dword [eax]
push edi
mov edi, eax
jmp 0xadcec4

Function at 0xadccb3
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x20], edx
call fcn.00adccd7
mov word [esp], bp
pop word [esp]
lea esp, [esp + 2]
jmp 0xadcc88

Function at 0xadccd7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp], esp
pushfd
push dword [esp + 4]
mov dword [esp + 0x28], ebx
call fcn.00adcc91
Function at 0x401900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
shr eax, 3
mov dword [ebp - 4], eax
test eax, eax
je 0x4019c3
lea edx, [ecx + eax*8 - 8]
push esi
mov dword [ebp - 8], edx
push edi
lea ecx, [ecx]
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov edx, dword [0x5700e0]
add edx, dword [0x5700e4]
mov esi, 0x20
add edx, dword [0x5700dc]
add edx, dword [0x5700d8]
mov dword [ebp - 0xc], edx
shl edx, 5
dec esi
mov dword [ebp - 0x10], esi
mov esi, ecx
shr esi, 5
add esi, dword [0x5700e4]
mov edi, ecx
shl edi, 4
add edi, dword [0x5700e0]
xor esi, edi
lea edi, [edx + ecx]
xor esi, edi
sub eax, esi
mov esi, eax
shr esi, 5
add esi, dword [0x5700dc]
mov edi, eax
shl edi, 4
add edi, dword [0x5700d8]
xor esi, edi
lea edi, [edx + eax]
sub edx, dword [ebp - 0xc]
xor esi, edi
sub ecx, esi
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x401948
mov esi, dword [0x5700dc]
mov edx, dword [ebp - 8]
xor esi, ecx
mov dword [edx], esi
mov ecx, dword [0x5700dc]
xor ecx, eax
mov eax, dword [ebp - 4]
dec eax
mov dword [edx + 4], ecx
sub edx, 8
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
test eax, eax
jne 0x401920
pop edi
pop esi
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40b92b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00410e97
call fcn.004032b8
cmp eax, esi
pop esi
jne 0x40b947
mov ecx, 0x571d88
jmp fcn.00415102
ret
Function at 0x403d40
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x834
cmp dword [0x61d538], 0x400
push ebx
push esi
push edi
jne 0x403df5
push 0
lea eax, [esp + 0x44]
push eax
push 0x403698
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
call fcn.00403ff9
add esp, 4
push 0
push 0
call fcn.004044fc
push 0
push 0
call fcn.00404033
push 0
push 0
call fcn.004042ac
push 0
call fcn.0040471c
add esp, 0x1c
push 0
push 0
push 0
call fcn.00404633
fldz
push ecx
fst qword [esp + 8]
fstp qword [esp]
call fcn.00403e90
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00403ed0
fstp st(0)
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.004041c0
fstp st(0)
push 0
call fcn.00404790
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor esi, esi
lea ecx, [ecx]
push 0
push 0
push 0
push 0
call edi
cmp esi, 0x4f45cc2
jg 0x403e1b
inc esi
cmp esi, 0x33cd5b9
jl 0x403e00
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
lea esp, [esp]
call edi
call ebx
cmp esi, 0x12e8236
jg 0x403e45
inc esi
cmp esi, 0x2ff8d
jl 0x403e30
mov ecx, dword [0x479c5c]
mov dword [0x61d538], ecx
call fcn.00403a30
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x2ec37
mov ebx, 0x51f
cmp dword [0x61d538], ebx
jne 0x403e77
lea edx, [esp + 0x40]
push edx
push 0
call esi
dec edi
jne 0x403e66
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x409366
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x476420]
jne 0x409370
repz ret
jmp fcn.0040df04
Function at 0x40d570
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x476420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407b0d
and dword [ebp - 0x14], 0
cmp dword [0x48e4c8], 0
mov dword [ebp - 0x18], eax
jne 0x40d623
push 0x4034fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d6cb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4034f0
push ebx
call edi
test eax, eax
je 0x40d6cb
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4034e0
push ebx
mov dword [0x48e4c8], eax
call edi
push eax
call esi
push 0x4034cc
push ebx
mov dword [0x48e4cc], eax
call edi
push eax
call esi
push 0x4034b0
push ebx
mov dword [0x48e4d0], eax
call edi
push eax
call esi
mov dword [0x48e4d8], eax
test eax, eax
je 0x40d623
push 0x403498
push ebx
call edi
push eax
call esi
mov dword [0x48e4d4], eax
mov eax, dword [0x48e4d4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40d67c
cmp dword [0x48e4d8], ecx
je 0x40d67c
push eax
call esi
push dword [0x48e4d8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40d67c
test ebx, ebx
je 0x40d67c
call edi
test eax, eax
je 0x40d673
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40d673
test byte [ebp - 8], 1
jne 0x40d67c
or dword [ebp + 0x10], 0x200000
jmp 0x40d6af
mov eax, dword [0x48e4cc]
cmp eax, dword [ebp - 0x18]
je 0x40d6af
push eax
call esi
test eax, eax
je 0x40d6af
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d6af
mov eax, dword [0x48e4d0]
cmp eax, dword [ebp - 0x18]
je 0x40d6af
push eax
call esi
test eax, eax
je 0x40d6af
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x48e4c8]
call esi
test eax, eax
je 0x40d6cb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d6cd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409366
leave
ret
Function at 0x1000d870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
jne 0x1000d8b0
test ebx, ebx
jne 0x1000d8b0
push 0
push 0
push 0
push 0
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0
call fcn.1000a210
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], esi
je 0x1000d889
lea eax, [ebp - 4]
push eax
push 0x1000dcf0
push 0x3c
call fcn.10009fa0
test eax, eax
jne 0x1000d89b
push edi
mov edi, dword [ebp - 4]
test edi, edi
jne 0x1000d8e4
push edi
push edi
push edi
push edi
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
jmp 0x1000d9a9
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xffffffff
push eax
call fcn.1000dc90
test eax, eax
jne 0x1000d9a9
mov eax, dword [edi + 0x18]
cmp eax, dword [ebp - 8]
je 0x1000d91b
push 0
push 0
push 0
push 0
push 0xfffffe6e
call sym.NBUidai.dll_NBErrorsSetLastA
jmp 0x1000d9a9
mov eax, dword [ebp + 8]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x30], eax
lea eax, [edi + 0x38]
push eax
push dword [ebp + 0x14]
mov dword [edi + 0x34], ebx
call fcn.1000a210
test eax, eax
jne 0x1000d9a9
push dword [ebp - 4]
call fcn.10009ea0
test eax, eax
jne 0x1000d9a9
push eax
push eax
mov dword [edi + 0x20], 0xffffffff
push dword [ebp - 4]
push 0x1000dfa0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x28], eax
test eax, eax
jne 0x1000d993
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100091d0
push dword [ebp - 4]
mov esi, eax
call fcn.1000a500
pop edi
lea eax, [ebp - 4]
push eax
push 0
call fcn.1000a210
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x18]
mov dword [edi + 0x24], 1
push dword [ebp - 4]
call fcn.1000a210
test eax, eax
je 0x1000d9ab
mov esi, eax
pop edi
lea eax, [ebp - 4]
push eax
push 0
call fcn.1000a210
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f820
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, 0xff
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
add ecx, esi
add eax, edi
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
test esi, esi
jne 0x1000f860
push 0
push 0
push 0
push 0
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
mov ebx, eax
pop esi
pop ebx
pop ebp
ret
test edi, edi
je 0x1000f847
cmp dword [ebp + 0x18], ebx
je 0x1000f847
cmp esi, ecx
jae 0x1000f8f9
movsx ecx, byte [esi]
inc esi
lea eax, [ecx - 0x41]
cmp eax, 0x19
ja 0x1000f881
mov ecx, eax
jmp 0x1000f8c1
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x1000f88e
sub ecx, 0x47
jmp 0x1000f8c1
lea eax, [ecx - 0x30]
cmp eax, 9
ja 0x1000f89b
add ecx, 4
jmp 0x1000f8c1
add ecx, 0xfffffff7
cmp ecx, 0x34
ja case.0x1000f8ae.11
movzx eax, byte [ecx + 0x1000fa08]
jmp dword [eax*4 + 0x1000f9f4]
mov ecx, 0x3e
jmp 0x1000f8c1
mov ecx, 0x3f
shl edx, 6
or edx, ecx
jge case.0x1000f8ae.9
mov ecx, dword [ebp + 0x14]
cmp ecx, 3
jl 0x1000f910
mov eax, edx
mov byte [edi + 2], dl
shr eax, 0x10
mov byte [edi], al
mov eax, edx
shr eax, 8
mov edx, 0xff
mov byte [edi + 1], al
add edi, 3
sub ecx, 3
mov dword [ebp + 0x14], ecx
cmp esi, dword [ebp + 8]
jb 0x1000f871
cmp edx, 0xff
jne 0x1000f92c
mov eax, dword [ebp + 0x18]
sub edi, dword [ebp + 0x10]
mov dword [eax], edi
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x18]
pop edi
pop esi
mov dword [eax], ebx
xor ebx, ebx
mov eax, ebx
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
cmp esi, eax
jne 0x1000f971
shl edx, 6
test edx, edx
js 0x1000f948
push 0
push 0
push 0
push str.Bad_Base64_length
push 0xffffff36
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
mov ebx, eax
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
sub eax, edi
cmp eax, 2
jl 0x1000f910
mov eax, edx
shr edx, 8
shr eax, 0x10
mov byte [edi], al
mov eax, dword [ebp + 0x18]
mov byte [edi + 1], dl
add edi, 2
sub edi, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
lea ecx, [eax - 1]
cmp esi, ecx
jae 0x1000f991
mov al, byte [esi]
cmp al, 0x20
je 0x1000f98a
cmp al, 0xa
je 0x1000f98a
cmp al, 0xd
je 0x1000f98a
cmp al, 9
jne 0x1000f98f
inc esi
cmp esi, ecx
jb 0x1000f978
cmp esi, ecx
jne 0x1000f9c2
cmp byte [esi], 0x3d
jne 0x1000f9c2
shl edx, 0xc
test edx, edx
jns 0x1000f92c
mov eax, dword [ebp + 0xc]
sub eax, edi
cmp eax, 1
jl 0x1000f910
mov eax, dword [ebp + 0x18]
shr edx, 0x10
mov byte [edi], dl
inc edi
sub edi, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push 0
push 0
push str.Bad_Base64_char
push 0xffffffffffffff9c
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
mov ebx, eax
pop esi
pop ebx
pop ebp
ret
push 0
push 0
push 0
push str.Invalid_char_found
push 0xffffffffffffff9c
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
mov ebx, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x1000fa40
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0xaaaaaaab
mul ebx
mov eax, dword [ebp + 8]
xor ecx, ecx
shr edx, 1
push edi
xor edi, edi
lea edx, [edx + edx*2]
sub ebx, edx
mov dword [ebp - 8], edx
mov dword [ebp + 0xc], ebx
test eax, eax
jne 0x1000fa7e
push eax
push eax
push eax
push eax
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1000fa8b
cmp dword [ebp + 0x18], ecx
jne 0x1000faa4
push 0
push 0
push 0
push 0
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x1000fb4f
lea ebx, [eax + 1]
dec edx
mov eax, 0xaaaaaaab
mul edx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 4], eax
nop
cmp dword [ebp + 0x14], 0
je 0x1000fad9
cmp edi, 0x4c
jne 0x1000fad6
mov word [ecx + esi], 0xa0d
add ecx, 2
xor edi, edi
add edi, 4
movzx eax, byte [ebx - 1]
shr eax, 2
movzx eax, byte [eax + 0x1010d460]
mov byte [ecx + esi], al
movzx edx, byte [ebx - 1]
movzx eax, byte [ebx]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + 0x1010d460]
mov byte [esi + ecx + 1], al
movzx edx, byte [ebx]
movzx eax, byte [ebx + 1]
and edx, 0xf
shr eax, 6
shl edx, 2
or edx, eax
movzx eax, byte [edx + 0x1010d460]
mov byte [esi + ecx + 2], al
movzx eax, byte [ebx + 1]
add ebx, 3
and eax, 0x3f
movzx eax, byte [eax + 0x1010d460]
mov byte [esi + ecx + 3], al
add ecx, 4
sub dword [ebp - 4], 1
jne 0x1000fac0
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x14], 0
je 0x1000fb67
test ebx, ebx
je 0x1000fb67
cmp edi, 0x4c
jne 0x1000fb67
mov word [ecx + esi], 0xa0d
add ecx, 2
sub ebx, 1
je 0x1000fbd5
sub ebx, 1
jne 0x1000fc06
movzx eax, byte [edx + eax]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 8]
shr eax, 2
movzx eax, byte [eax + 0x1010d460]
mov byte [ecx + esi], al
movzx edx, byte [edx + ebx]
movzx eax, byte [edi + ebx + 1]
and edx, 3
shr eax, 4
shl edx, 4
or edx, eax
movzx eax, byte [edx + 0x1010d460]
mov byte [ecx + esi + 1], al
movzx eax, byte [edi + ebx + 1]
and eax, 0xf
mov byte [ecx + esi + 3], 0x3d
movzx eax, byte [eax*4 + 0x1010d460]
mov byte [ecx + esi + 2], al
add ecx, 4
mov eax, dword [ebp + 0x18]
pop esi
pop edi
pop ebx
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
movzx eax, byte [edx + eax]
mov ebx, dword [ebp + 8]
shr eax, 2
mov al, byte [eax + 0x1010d460]
mov byte [ecx + esi], al
movzx edx, byte [edx + ebx]
and edx, 3
mov word [ecx + esi + 2], 0x3d3d
shl edx, 4
mov dl, byte [edx + 0x1010d460]
mov byte [ecx + esi + 1], dl
add ecx, 4
mov eax, dword [ebp + 0x18]
pop esi
mov dword [eax], ecx
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fc20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
or edx, 0xffffffff
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1000fc4e
test esi, esi
je 0x1000fc4e
push 0
push 0
push 0
push 0
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
pop esi
pop ebp
ret 0xc
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x1000fc6b
push ebx
push ebx
push ebx
push ebx
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
test esi, esi
je 0x1000fc8a
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
xor eax, edx
shr edx, 8
movzx ecx, al
xor edx, dword [ecx*4 + 0x1010d060]
sub esi, 1
jne 0x1000fc70
mov dword [ebx], edx
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10012bc0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x10012bdc
push esi
push esi
push esi
push esi
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop esi
pop ebp
ret
push edi
push 0x10
push 1
call fcn.1002ddf8
mov edi, eax
add esp, 8
test edi, edi
jne 0x10012c01
push eax
push eax
push eax
push eax
push 0xfffffe6f
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x10012c32
push 0
push 0
push 0
push 0
push 0xffffff36
call sym.NBUidai.dll_NBErrorsSetLastA
mov esi, eax
push edi
call fcn.1002d945
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [edi], eax
cmp dword [0x1018ca00], 0
je 0x10012c4b
push 0x10197980
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1018ca04]
test eax, eax
je 0x10012c5a
mov dword [eax + 8], edi
mov dword [edi + 0xc], eax
cmp dword [0x1018ca00], 0
mov dword [0x1018ca04], edi
je 0x10012c74
push 0x10197980
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esi], edi
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x10012c80
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10012c9c
push esi
push esi
push esi
push esi
push 0xffffff37
call sym.NBUidai.dll_NBErrorsSetLastA
pop esi
pop ebp
ret
push edi
push 0x10
push 1
call fcn.1002ddf8
mov edi, eax
add esp, 8
test edi, edi
jne 0x10012cc1
push eax
push eax
push eax
push eax
push 0xfffffe6f
call sym.NBUidai.dll_NBErrorsSetLastA
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x10012cf2
push 0
push 0
push 0
push 0
push 0xffffff36
call sym.NBUidai.dll_NBErrorsSetLastA
mov esi, eax
push edi
call fcn.1002d945
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret
mov dword [edi], 0x10012b70
cmp dword [0x1018ca00], 0
je 0x10012d0c
push 0x10197980
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1018ca04]
test eax, eax
je 0x10012d1b
mov dword [eax + 8], edi
mov dword [edi + 0xc], eax
cmp dword [0x1018ca00], 0
mov dword [0x1018ca04], edi
je 0x10012d35
push 0x10197980
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esi], edi
pop edi
xor eax, eax
pop esi
pop ebp
ret