joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c7ea0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x120000]
push edi
or ebp, 0xffffffff
jmp 0x5c7ec2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c7ec9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c7eb8
mov eax, 1
add ebx, ebx
jne 0x5c7edb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c7ed0
jne 0x5c7eec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c7ed0
xor ecx, ecx
sub eax, 3
jb 0x5c7f00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c7f72
mov ebp, eax
add ebx, ebx
jne 0x5c7f0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x5c7f18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x5c7f3c
inc ecx
add ebx, ebx
jne 0x5c7f28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c7f1d
jne 0x5c7f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c7f1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c7f5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c7f4d
jmp 0x5c7ebe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c7f5c
add edi, ecx
jmp 0x5c7ebe
pop esi
mov edi, esi
mov ecx, 0x6988
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c7f7a
cmp byte [edi], 0x2d
jne 0x5c7f7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c7f7f
lea edi, [esi + 0x1c4000]
mov eax, dword [edi]
or eax, eax
je 0x5c7ff7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d4008]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d415c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c7fac
mov ecx, edi
jns 0x5c7fdb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d4160]
or eax, eax
je 0x5c7ff1
mov dword [ebx], eax
add ebx, 4
jmp 0x5c7fc9
call dword [esi + 0x1d4168]
mov ebp, dword [esi + 0x1d4164]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5c802b
sub esp, 0xffffff80
jmp 0x4e3bdd
Function at 0xccc2bf
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0xccc2d6
mov eax, dword [ebp + 8]
movzx edx, byte [eax]

Function at 0xcdc39a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp]
not eax
lea esp, [esp + 2]
jmp 0xcdc3b4
pop cx
jmp 0xcdc384
mov cx, dx
jmp 0xcdc3c3
not edi
rdtsc
setp dl
mov dl, byte [esp]
mov dx, cx
jmp 0xcdc39e
not edi
mov cx, bp
rdtsc
lea ecx, [eax + edx]
lea edx, [esp + edx]
jmp 0xcdc42e
jmp 0xcdc3f9
lea eax, [edi*4]
not edi
lea edx, reloc.kernel32.dll_LoadLibraryA
bsf ecx, ebp
ja 0xcdc40f
lea edx, [edi + edi]
mov ecx, edi
sub esp, 0xf
lea esp, [esp + 3]
jmp 0xcdc415

Function at 0xcdecae
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xcded06
rol esi, 0
jl 0xcded48
bswap edx
xchg dh, al
bsf ebx, ebx
inc bx
jmp 0xcded79
xchg edx, eax
rdtsc
setbe bh
setg bh
mov dh, byte [esp]
bsr eax, esi
jmp 0xcded5f
xchg dh, al
bsf ebx, ebx
inc bx
jmp 0xcded95
bswap edx
jmp 0xcded32
xchg edi, eax
jmp 0xcdedb6
jle 0xcdecf0
jg 0xcdecf0
jmp 0xcded7e
aas
stc
stosb byte es:[edi], al
mov ah, 0xd3
call 0xaf99494d
pop ebp
in al, dx
or dword ds:[edx + reloc.kernel32.dll_LoadLibraryA], ecx
mov bh, byte [esp]
jmp 0xcded98
dec dh
jo 0xcdee12
jno 0xcdee12
mov eax, 0x2adfb82a
pushfd
retf
mov bh, byte [esp]
neg ax
xor esi, 0x5f3d99b6
mov dx, word [esp]
mov bx, word [esp]
call 0xcded63
std
outsb dx, byte [esi]
cld
wait
jbe 0xcded69
in eax, dx
adc dword [ebx], 0x76
test dword [esi], esi
aad 0x44
adc esi, dword [esi - 0x7b]
aad 0x44
fidivr dword [ebp + 0x7071fa4c]
jae 0xcded51
and al, 3
sbb edx, 0xf5a7cbb5
jmp 0xcdedf3
jmp 0xcdeddb
lea esp, [esp + 4]
sub esi, 0x784191fc
pushfd
bswap ebx
lea ebx, [esp + edx]
jmp 0xcdee53
rol esi, 0
sub esp, 0
jbe 0xcdedf1
sbb edx, 0xf5a7cbb5
jmp 0xcdedf3
not dh
sub esp, 0x15
pop eax
call fcn.00cdee3a
add ebx, dword [edi + reloc.kernel32.dll_LoadLibraryA]
jb 0xcdeea2
jl 0xcdee86
salc
jmp 0xcdee22
rdtsc
mov dword [esp], ecx
mov dword [esp], esp
ror esi, 0
jo 0xcdee38
not dh
sub esp, 0x15
pop eax
jmp 0xcdee28
dec esi
aad 0x45
sub al, 0xdf
imul eax, esp, 0x3e6d8d77

Function at 0xce978a
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0xcce083
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0xcce09d
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0xcce08c
pop esi
jmp 0xcce0a8
ret 4
push edi
lea esp, [esp + 4]
jmp 0xce97ed
pushal
popal
pushal
mov byte [esp + 2], bh
mov byte [esp + 8], ah
pop word [esp]
call fcn.00ce97c4
lea ebp, reloc.kernel32.dll_LoadLibraryA
mov ebp, 0xff60121
mov bp, word [esp]
jmp 0xceab24
pop edx
mov ebp, dword [esp]
mov ebp, 0x9768782d
mov ebp, eax
pop ebp
jmp 0xcce076
not dh
mov edx, esp
not dl
mov dl, byte [esp]
not edx
mov dx, word [esp]
jmp 0xce99c4
lea edx, [edi + ebp]
mov dl, 0x95
setp dl
xchg dx, bp
pop esi
mov bp, word [esp]
jmp 0xce9aa6
lea edx, [esi + ebp]
mov dh, 0xa7
mov ebp, ecx
mov bp, 0x83df
push esi
lea esi, [ebx*4]
jmp 0xce9af9
lea ebp, [edx*4]
not ebp
push edx
mov ebp, dword [esp]
setb dh
mov dl, 0x18
jmp 0xce9c24
Function at 0xd7f4b0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00dffa13
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00dffa13
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.00dffa13
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0xe03474
call fcn.00dffa0d
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0xd7f569
mov eax, 0
jmp 0xd7f6d5
cmp dword [ebp + 0xc], 0
jne 0xd7f59f
mov dword [ebp - 0x18], esp
mov eax, 0
call fcn.00dffa1f
cmp dword [ebp - 0x18], esp
je 0xd7f59c
push 0xa0
push 0x4057cf1
push 6
call fcn.00dffa19
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0xd7f5c7
mov eax, 0xf0f4fc
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0xd7f5c1
push ebx
call fcn.00dffa07
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 1
call fcn.00dffa1f
cmp dword [ebp - 0x18], esp
je 0xd7f5fc
push 0x104
push 0x4057cf1
push 6
call fcn.00dffa19
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0xf0f50d
mov eax, 2
call fcn.00dffa1f
cmp dword [ebp - 0x18], esp
je 0xd7f632
push 0x12e
push 0x4057cf1
push 6
call fcn.00dffa19
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 3
call fcn.00dffa1f
cmp dword [ebp - 0x18], esp
je 0xd7f6d0
push 0x225
push 0x4057cf1
push 6
call fcn.00dffa19
add esp, 0xc
jmp 0xd7f6d5
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00dffa07
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00dffa07
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00dffa07
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0xd7f701
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, 0xf0f4fc
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
call fcn.00d7f743
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0xd7f735
push ebx
call fcn.00dffa07
add esp, 4
mov eax, dword [ebp - 8]
jmp 0xd7f73d
mov esp, ebp
pop ebp
ret 8
Function at 0xd82ec8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0xd82f00
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0xd82eee
mov al, 1
jmp 0xd82f5f
cmp dword [ebx + 0x54], ecx
jne 0xd82ef7
mov al, 2
jmp 0xd82f5f
cmp dword [ebx + 0x7c], ecx
jne 0xd82f5f
mov al, 3
jmp 0xd82f5f
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0xd82f15
mov al, 4
jmp 0xd82f5f
cmp ecx, 5
jne 0xd82f35
cmp ebx, 0
jne 0xd82f23
mov al, 5
jmp 0xd82f5f
cmp ebx, 1
jne 0xd82f2c
mov al, 6
jmp 0xd82f5f
cmp ebx, 2
jne 0xd82f35
mov al, 7
jmp 0xd82f5f
cmp ecx, 6
jne 0xd82f5d
cmp ebx, 0
jne 0xd82f43
mov al, 8
jmp 0xd82f5f
cmp ebx, 1
jne 0xd82f4a
mov al, 9
cmp ebx, 2
jne 0xd82f51
mov al, 0xa
cmp ebx, 3
jne 0xd82f58
mov al, 0xb
cmp ebx, 4
jne 0xd82f5f
mov al, 0xc
pop ebx
leave
ret
Function at 0xdc19b0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0xdc19e7
mov esp, ebp
pop ebp
ret
Function at 0xe1ba64
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xfa458c]
xor edx, edx
cmp eax, edx
jne 0xe1ba8a
xor eax, eax
mov byte [eax + 0xfa448c], al
inc eax
cmp eax, 0x100
jl 0xe1ba72
mov dword [0xfa458c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xfa448c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0xe1bb1b
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0xe1baee
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0xe1babc
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0xe1bb24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0xe1bb77
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0xe1bb5e
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe31c54
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xf0729c
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0xe31c8d
inc eax
mov dword [esi + 0x10], eax
jmp 0xe31da0
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0xe31ca1
mov eax, 0xffffffc7
jmp 0xe31da2
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0xe31cb2
cmp dword [esi + 8], eax
jne 0xe31ca1
cmp dword [esi + 8], eax
jne 0xe31ccb
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0xe31ccb
mov eax, 0xffffffc7
jmp 0xe31da2
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0xe31cdf
push eax
mov ecx, ebx
call fcn.00e31484
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00e05d44
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0xe31d10
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00e05d64
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00e30bf4
test eax, eax
mov dword [esp + 0x38], eax
je 0xe31d43
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.kernel32.dll_LoadLibraryA
mov dword [esp + 0x10], 0xf5dc84
call fcn.00e05f44
mov eax, dword [esp + 0x38]
jmp 0xe31da2
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00e31ab4
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0xe31d87
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00e31ad4
mov esi, eax
test esi, esi
jne 0xe31db7
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00e31ab4
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0xe31d59
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.kernel32.dll_LoadLibraryA
mov dword [esp + 0x10], 0xf5dc84
call fcn.00e05f44
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], reloc.kernel32.dll_LoadLibraryA
mov dword [esp + 0x10], 0xf5dc84
call fcn.00e05f44
mov eax, esi
jmp 0xe31da2
Function at 0xe44f44
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0xe44f77
push esi
call fcn.00e532f4
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0xe44f70
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0xe44ffd
mov eax, dword [esi + reloc.kernel32.dll_LoadLibraryA]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0xe44fe6
mov eax, dword [esi + 8]
test eax, eax
je 0xe44f9b
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + reloc.kernel32.dll_LoadLibraryA]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0xe44fe2
cmp eax, 2
je 0xe44fe6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0xe44f8e
cmp eax, 3
je 0xe44fc1
cmp eax, 1
jne 0xe44f8e
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0xe44f8e
mov edx, dword [esi + reloc.kernel32.dll_LoadLibraryA]
add edx, ecx
mov dword [eax + 8], edx
jmp 0xe44f8e
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00e45024
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0xe4500c
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00e45024
add esp, 4
pop esi
ret

Function at 0xe88ef4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0xe88f20
mov ecx, dword [esp + 8]
push ebx
xor edx, edx
xor ebx, ebx
mov dl, byte [ecx]
mov bl, byte [edx + 0xf622e8]
lea edx, [eax*8]
xor ebx, edx
xor eax, ebx
inc ecx
dec esi
jne 0xe88f04
pop ebx
pop esi
ret
Function at 0xeb6854
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf65aa4
push 0xee9528
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], reloc.kernel32.dll_LoadLibraryA
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00ee65e4
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xed16b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0xed1707
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0xed16ee
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xed80b4
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xf086b2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00ed89d4
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xf66328
call fcn.00ef9c6b
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0xed8147
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00ef9c6b
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0xed8140
push 0
mov ecx, eax
call fcn.00ecf1c4
mov dword [esi + 0xc], eax
jmp 0xed8149
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0xed8149
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0xf56295
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 3
pop ecx
cdq
idiv ecx
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
lea ebx, [esi + 1]
mov dword [ebp - 8], ebx
test ebx, ebx
jle 0xf56338
mov ecx, dword [ebp + 8]
lea esi, [edi + 2]
add ecx, 2
mov edi, ecx
mov al, byte [edi - 2]
shr al, 2
movzx eax, al
push eax
call fcn.00f5624b
mov byte [esi - 2], al
mov cl, byte [edi - 2]
mov al, byte [edi - 1]
and cl, 3
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
push eax
call fcn.00f5624b
mov byte [esi - 1], al
mov cl, byte [edi - 1]
mov al, byte [edi]
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
push eax
call fcn.00f5624b
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
movzx eax, al
push eax
call fcn.00f5624b
mov byte [esi + 1], al
lea edi, [edi + 3]
lea esi, [esi + 4]
dec ebx
jne 0xf562c9
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, 1
jne 0xf56346
mov word [edi + esi*4 + 2], 0x3d3d
jmp 0xf56350
cmp ecx, 2
jne 0xf56352
mov byte [edi + esi*4 + 3], 0x3d
mov esi, ebx
mov eax, esi
shl eax, 2
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xfdd625
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 4]
push 0
jmp 0xfdd695
pushfd
call 0xfdd67f

Function at 0xfdd69b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], edx
xchg cx, dx
not dx
mov dx, cx
jmp 0xfdd6bd
push eax
not ax
rdtsc
rdtsc
mov dh, bl
xchg ah, al
jmp 0xfdd78b
mov dx, 0xd7ba
lea ecx, reloc.kernel32.dll_LoadLibraryA
lea ecx, [eax - 0x84]
pop edx
lea ecx, [edi*4]
mov ecx, 0xffa58faa
call fcn.00fdd6f3
xchg al, dl
mov cx, 0x4dd2
mov dx, 0xbccf
lea edx, reloc.kernel32.dll_LoadLibraryA
pop eax
bswap ecx
jmp 0xfdd70d

Function at 0x10251ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, 0x4ba46793
pop ecx
sete bh
bsr ecx, ebx
cpuid
adc esi, 0x90f50900
jmp 0x1025057
rdtsc
xchg word [esp + 3], dx
mov al, 0x4c
xchg dl, bl
bswap edi
xchg word [esp + 4], bp
jmp 0x1025079
xchg ebx, edi
pop word [esp + 3]
push word [esp]
mov dword [esp + 3], esp
mov ax, word [esp + 2]
jmp 0x10250eb
Function at 0x1025374
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
popal
sete bh
clc
pop cx
mov bx, 0x339e
jmp 0x1025335
dec bx
cld
mov ebx, 0x6cb193e9
xchg cl, ah
sub esp, 0xd
mov bp, dx
jmp 0x10252f7
lea ecx, [esi*4]
add esp, 6
xchg bp, bx
xchg cl, dl
jmp 0x102535b
pop word [esp + 3]
mov edi, ebx
bt di, di
std
stc
clc
jmp 0x102531f
std
mov dh, ah
xchg di, cx
mov eax, dword [esp]
xchg byte [esp], bl
mov dx, word [esp]
jmp 0x1025394
mov ecx, 0x1dfd3b23
sub esp, 3
lea ebx, [ebx*4]
lea esp, [esp + 5]
jmp 0x1025345
jmp 0x102530d
mov ebx, edx
add esp, 0
rdtsc
cpuid
mov di, 0xe23a
lea esp, [esp]
jmp 0x10253a5
stc
mov eax, esi
mov ax, word [esp]
mov ch, dh
mov ebx, dword [esp]
lea esi, [esi + ebp]
jmp 0x1025376
mov byte [esp], al
lea esp, [esp]
mov bh, dl
mov ebp, 0x42433a88
bts eax, ebx
rdtsc
jmp 0x10253fa
not si
call fcn.010253e4
mov al, 0x30
cmpsb byte [esi], byte es:[edi]
sal dword [eax], 0xd1
scasb al, byte es:[edi]
sub eax, 0xd737c4bd
mov esp, 0xeb81168f
jmp 0x10253c9
mov word [esp + 2], bp
mov si, bx
add esp, 7
mov bh, byte [esp + 3]
lea esp, [esp + 3]
lea esi, [edi*4]
jmp 0x102548f
mov al, byte [esp + 1]
xchg edi, esi
call fcn.01025448
mov byte [esp + 2], bl
push eax
lea esp, [esp + 0xc]
push dword [esp + 1]
mov edx, ebp
push ebx
jmp 0x10254b0
dec eax
stc
push ebx
push ebp
shr cl, 1
mov ax, bp
jmp 0x1025463
neg cx
or ch, ch
push word [esp + 0xb]
bswap esi
dec ecx
sub esp, 4
jmp 0x10254f9
lea ebx, reloc.kernel32.dll_LoadLibraryA
mov bp, word [esp + 6]
mov ch, byte [esp + 0xc]
mov ch, byte [esp + 4]
mov dword [esp + 8], eax
jmp 0x102549a
cpuid
push dword [esp + 4]
lea edi, [eax + ebp]
mov dword [esp + 5], esp
clc
jmp 0x1025532
xchg edx, esi
pop word [esp + 1]
mov cl, ch
mov ebp, 0x3799f44e
lea esp, [esp + 1]
pop bx
jmp 0x10254e3
lea ebx, [edx + edi]
xchg dx, bx
std
lea ebp, [eax*4]
mov ebp, edi
call fcn.0102550f
inc edx
lea eax, [edx*4]
pop word [esp + 0xb]
pop dword [esp + 4]
cpuid
jmp 0x10255e8
xchg dword [esp + 1], edi
not ax
lea ebp, [ebx + edi]
mov edx, dword [esp + 5]

Function at 0x1025f8a
Capabilities:
Access peb ldr_data

Disassembly:
push dword [esp + 3]
pop word [esp]
lea esp, [esp + 2]
mov dword [esp], eax
call fcn.01025f42
push word [esp + 3]
mov byte [esp + 3], al
lea esp, [esp + 2]
mov dword [esp], edx
call 0x1025f8a
into
mov dword [esp], ecx
call 0x1025f6c
lea esp, [esp + 3]
jmp 0x1025f94
pushal
pop dword [esp + 8]
lea esp, [esp + 1]
mov dword [esp + 0x18], ebx
push si
mov byte [esp], dh
jmp 0x1025fd0
mov dword [esp + 0x2c], ebp
pushfd
pushfd
lea esp, [esp + 4]
mov dword [esp + 0x2c], esi
push ax
jmp 0x1025fe7
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp + 0x14], esp
pushal
mov byte [esp + 5], al
pop dword [esp + 0xa]
jmp 0x1025fba
push word [esp + 1]
mov word [esp], di
mov byte [esp + 1], ch
mov dword [esp + 0x2c], edi
jmp 0x1026028
lea esp, [esp + 0x2c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x1026012