joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100191b1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1001912d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10019320
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10019320
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100192d5
jg 0x1001920d
test eax, eax
je 0x100192cb
push 1
push 0x1000
call fcn.10012aa1
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10019230
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100192c2
push 0x8000
push ebx
call fcn.1001905e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10019259
jg 0x10019254
cmp ecx, 0x1000
jb 0x10019259
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100165d1
add esp, 0x10
cmp eax, 0xffffffff
je 0x1001929e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10019254
jl 0x10019285
test ecx, ecx
jne 0x10019246
push dword [ebp - 0xc]
push ebx
call fcn.1001905e
push esi
call fcn.10010614
add esp, 0xc
xor ebx, ebx
jmp 0x1001932e
cmp byte [edi + 0x24], 0
je 0x100192b5
cmp dword [edi + 0x20], 5
jne 0x100192b5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100192c0
mov ebx, dword [edi + 0x18]
jmp 0x100192c2
xor ebx, ebx
push esi
call fcn.10010614
pop ecx
jmp 0x1001932e
test ecx, ecx
jg 0x10019297
jl 0x100192d5
test eax, eax
jae 0x10019297
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1000ed6b
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100192f5
cmp byte [edi + 0x1c], 0
je 0x10019297
jmp 0x10019326
push ebx
call fcn.10014903
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10019297
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001932e
cmp byte [edi + 0x1c], 0
je 0x1001932b
mov ebx, dword [edi + 0x18]
jmp 0x1001932e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1000ed6b
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001bc90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001bcbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001bcbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1f94b47
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], di
xchg dword [esp + 4], ebp
sub esp, 0xa
jmp 0x1f94b98
sub esp, 1
xchg dh, cl
inc edx
add esp, 0
mov byte [esp], al
lea esp, [esp + 1]
jmp 0x1f94b7f
xchg dword [esp + 8], ebp
rdtsc
not bl
clc
push dword [esp + 8]
ret 0xc
rol cx, 3
push dword [esp + 5]
rdtsc
lea esp, [esp + 8]
lea esp, [esp + 2]
lea ebp, [ebp - 0x3b]
jmp 0x1f94b54

Function at 0x1f9a56e
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc eax
xchg dword [esp + 4], eax
jmp 0x1f9a608
xchg dword [esp], ebx
call fcn.01f9a5a5
mov cl, dl
jmp 0x1f9a646
lea ebx, [eax + ebp]
btr ebx, edi
setne bh
lea eax, [eax - 0x27]
not ebx
push ecx
jmp 0x1f9a5bb
mov dword [ebp], ebx
push sp
mov ebx, 0x2170be36
xchg ch, cl
lea esp, [esp + 2]
jmp 0x1f9a6fe
lea ecx, [edi + 0x50]
mov ebx, dword [esp]
stc
jns 0x1f9a689
js 0x1f9a693
pop ss
xchg esi, eax
add al, 0x63
sahf
pop ebp
xchg dword [esi], ebp
cmp dword [eax], ebx
jnp 0x1f9a6cc
dec eax
neg cx
jmp 0x1f9a66d
bsf bx, bp
jmp 0x1f9a6d2
bsf bx, bp
jmp 0x1f9a6d2
bsr ecx, ebp
jge 0x1f9a683
dec eax
neg cx
jmp 0x1f9a66d
call 0x1f9a6e3
setbe bh
lea esp, [esp + 1]
jmp 0x1f9ad28
sub eax, ebx
mov ch, 0xa4
xlatb
xchg bx, ax
cmp ebp, ecx
js 0x1f9a6b7
jns 0x1f9a6b7
mov esp, 0x77c43552
or dword [eax + reloc.kernel32.dll_DeleteCriticalSection], ebp
add dword [ebp - reloc.kernel32.dll_DeleteCriticalSection], ecx
into
ret 0xdf4f
jmp 0x1f9a6ac
ja 0x1f9a7b5
xchg ebx, eax
dec bx
jle 0x1f9ad58
jg 0x1f9ad42
test eax, 0x3acfa83a
mov ebx, dword [ebx + reloc.kernel32.dll_DeleteCriticalSection]
mov ah, 0x4a
setl al
jmp 0x1f9ad5d
mov ah, 0x4a
setl al
pushal
mov ax, cx
jmp 0x1f9adbf
mov dword [esp + 0x10], edi
call 0x1f9ada4
lea cx, [eax + ecx]
lea ecx, [ecx + 0xc0]
sub esp, 2
mov ecx, esi
sbb ax, 0xecf5
in al, dx
add cl, byte [ebx - 0xae29932]
in al, dx
jmp 0x1f9ae20
mov dx, word [esp]
mov al, 0xf7
clc
jp 0x1f9ad9a
mov dword [esp + 0x10], edi
jmp 0x1f9ae42
bsf ecx, ebx
neg ch
or ax, 0x2afd
mov ecx, 0xee2ba7bf
jmp 0x1f9adf5
adc bh, byte [edi + ecx*2]
mov ah, 0x85
stc
lea esi, [esi - 0x1f]
jmp 0x1f9add2
xchg dword [esp + 4], esi
lea ecx, reloc.kernel32.dll_DeleteCriticalSection
lea ecx, reloc.kernel32.dll_DeleteCriticalSection
cmc
push dword [esp + 4]
ret 8
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
adc dh, byte [ebp - 0xd]
arpl word [esi], ax
cmc
inc esp
jbe 0x1f9adae
lea esp, [esp + 2]
and al, 2
xchg dword [esp], esi
call 0x1f9ade8
pushal
call fcn.01f9ae4a
jp 0x1f9ae15
jno 0x1f9ae46
jecxz 0x1f9ae88
mov esp, 0x22d7b022
xchg edi, eax
jecxz 0x1f9ae5a
jne 0x1f9aea6
popal
lea eax, [esi + ebp]
bswap ecx
jmp 0x1f9ae2c
mov ebp, esi
sbb eax, 0x127ce0dd
jne 0x1f9ade7
xor edx, esi
dec ecx
fnstcw word [eax - 0x749774b5]
add ebp, ecx
xchg dword [0xa0020000], eax
push ecx
mov al, byte [0x4ddd5d27]
adc al, 0xe7
pop edx
lodsb al, byte [esi]
mov edi, 0x7800f86
invalid

Function at 0x1f9a973
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
lea esp, [esp + 5]
jmp 0x1f9a9d2
mov ax, 0xadbc
lea esp, [esp + 1]
jmp 0x1f9a99b
mov ax, 0xadbc
lea esp, [esp + 1]
jmp 0x1f9a99b
mov ah, byte [esp + 2]
setae ah
mov word [esp], bx
add esp, 2
jl 0x1f9a97a
jge 0x1f9a9b1
Function at 0x1fbd740
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
jne 0x1fbd790
push eax
jmp 0x1fbd74d
pop word [esp]
mov word [esp], sp
lea esp, [esp + 2]
jmp 0x1fbde5c
movzx edx, bl
call fcn.01fbd799
scasb al, byte es:[edi]

Function at 0x1fbd799
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1fbde91
ja 0x1fbd7f2
add edx, 4
jmp 0x1fbd77a
lea esp, [esp + 0x20]
cmp bl, 0x5a
jmp 0x1fbdec5
sub edx, 0x47
jmp 0x1fbd77a
pushal
jmp 0x1fbd7a5
lea esp, [esp + 4]
cmp bl, 0x39
jmp 0x1fbd79e
sub edx, 0x41
jmp 0x1fbd77a
ja 0x1fbd7d1
jbe 0x1fbdeaf
cdq
adc dword [ecx + reloc.kernel32.dll_DeleteCriticalSection], eax
xchg edx, eax
add byte [edi - 0x6e], ah
and bl, byte [ecx + 0x11e28717]
fimul dword [edx]

Function at 0x2038676
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, 0x207a7b8
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
call fcn.020386b8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x20386aa
push ebx
call fcn.0205168e
add esp, 4
mov eax, dword [ebp - 8]
jmp 0x20386b2
mov esp, ebp
pop ebp
ret 8
Function at 0x2046017
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x20460cb
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.02045fa7
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x20460a4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x20460d7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x20460f2
test ebp, ebp
je 0x20460f2
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x20460fa
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x204613a
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x2046196
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x2046191
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x204617c
test dl, dl
je 0x2046178
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x204617c
add ecx, 2
add eax, 2
test dl, dl
jne 0x204615c
xor eax, eax
jmp 0x2046181
sbb eax, eax
or eax, 1
test eax, eax
je 0x20461a0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x2046149
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x20461b7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.02046017
test eax, eax
jne 0x20461cf
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.020460d7
mov esi, eax
test esi, esi
jne 0x2046205
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x204621f
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret
Function at 0x2046317
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x44
push esi
push edi
mov dword [esp + 0x1c], edx
mov edi, ecx
call fcn.02046017
mov esi, eax
test esi, esi
jne 0x2046335
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x64616f4c
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x41797261
mov byte [esp + 0x44], 0
call fcn.020460d7
mov dword [esp + 0x18], eax
test eax, eax
je 0x204632d
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x65657246
mov dword [esp + 0x3c], 0x7262694c
mov dword [esp + 0x40], 0x797261
call fcn.020460d7
mov dword [esp + 0x34], eax
test eax, eax
je 0x204632d
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x50746547
mov dword [esp + 0x3c], 0x41636f72
mov dword [esp + 0x40], 0x65726464
mov word [esp + 0x44], 0x7373
mov byte [esp + 0x46], 0
call fcn.020460d7
mov dword [esp + 0x28], eax
test eax, eax
je 0x204632d
lea edx, [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x38], 0x4d746547
mov dword [esp + 0x3c], 0x6c75646f
mov dword [esp + 0x40], 0x6e614865
mov dword [esp + 0x44], 0x41656c64
mov byte [esp + 0x48], 0
call fcn.020460d7
mov dword [esp + 0x30], eax
test eax, eax
je 0x204632d
mov eax, dword [edi + 0x3c]
push ebx
cmp dword [eax + edi + 0x84], 0
push ebp
je 0x20464fc
mov ecx, dword [eax + edi + 0x80]
add ecx, edi
xor esi, esi
lea ebx, [ecx + 0xc]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], esi
cmp dword [ebx], esi
je 0x20464fc
mov eax, ebx
mov ebp, ecx
mov eax, dword [eax]
add eax, edi
push eax
mov dword [esp + 0x2c], eax
call dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x204645f
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
add eax, edi
mov dword [esp + 0x14], 0
cmp dword [eax], 0
je 0x20464e0
mov dword [esp + 0x18], 0
nop
mov eax, dword [eax]
test eax, eax
jns 0x2046482
movzx esi, ax
jmp 0x2046487
lea esi, [edi + 2]
add esi, eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x20464a6
push dword [esp + 0x58]
and eax, 0x80000000
push eax
push esi
push dword [esp + 0x34]
call ecx
mov ecx, eax
test ecx, ecx
jne 0x20464b5
push esi
push dword [esp + 0x30]
call dword [esp + 0x38]
mov ecx, eax
test ecx, ecx
je 0x2046509
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x18]
mov dword [eax + edi], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x14], ecx
shl ecx, 2
add eax, ecx
add eax, edi
mov dword [esp + 0x18], ecx
cmp dword [eax], 0
jne 0x2046477
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
inc esi
mov dword [esp + 0x10], esi
lea eax, [esi + esi*4]
lea ebp, [ecx + eax*4]
cmp dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
jne 0x204643c
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x44
ret
cmp dword [ebx], 0
je 0x2046532
mov esi, dword [esp + 0x10]
xor ebp, ebp
lea ecx, [ecx]
cmp ebp, esi
ja 0x2046532
mov eax, dword [ebx]
add eax, edi
push eax
call dword [esp + 0x3c]
push eax
call dword [esp + 0x40]
add ebx, 0x14
inc ebp
cmp dword [ebx], 0
jne 0x2046517
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x44
ret
Function at 0x2046547
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, ecx
call fcn.02046017
mov esi, eax
test esi, esi
je 0x2046603
push ebp
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x65657246
mov dword [esp + 0x14], 0x7262694c
mov dword [esp + 0x18], 0x797261
call fcn.020460d7
mov ebp, eax
test ebp, ebp
je 0x2046602
lea edx, [esp + 0x10]
mov ecx, esi
mov dword [esp + 0x10], 0x4d746547
mov dword [esp + 0x14], 0x6c75646f
mov dword [esp + 0x18], 0x6e614865
mov dword [esp + 0x1c], 0x41656c64
mov byte [esp + 0x20], 0
call fcn.020460d7
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x2046602
mov ecx, dword [edi + 0x3c]
cmp dword [ecx + edi + 0x84], 0
je 0x2046602
push ebx
mov ebx, dword [ecx + edi + 0x80]
add ebx, edi
xor esi, esi
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x2046601
lea ebx, [ebx]
add eax, edi
push eax
call edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea esi, [esi + 1]
lea eax, [esi + esi*4]
mov eax, dword [ebx + eax*4 + 0xc]
test eax, eax
jne 0x20465e7
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x18
ret

Function at 0x2046979
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x2046989
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 8], 0
jle 0x2046a97
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cwde
call fcn.02046aa7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5a4d
jne 0x2046a97
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [eax]
call fcn.02046aa7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4550
jne 0x2046a97
pop eax
push eax
mov eax, dword [eax + 0x7c]
call fcn.02046aa7
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x2046a97
pop eax
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
pop eax
mov eax, dword [eax + 0x18]
dec eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x2046a94
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.02046aba
test eax, eax
je 0x2046a83
push ecx
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop ecx
leave
ret 8
push dword [ebp - 8]
call fcn.02046aee
add dword [ebp - 0xc], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x2046a3e
add esp, 0xc
mov eax, 0
jmp 0x2046aa1
mov esp, ebp
pop ebp
ret 8
Function at 0x20543b8
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x20543d6
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x20543cb
pop esi
ret

Function at 0x2056548
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x2056569
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x20565c3
inc edi
cmp edi, esi
jl 0x205655d
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x20565f8
mov edx, dword [eax]
xor edx, esi
lea ebp, reloc.kernel32.dll_DeleteCriticalSection
not edx
and ebp, edx
test ebp, 0x80808080
je 0x20565b2
cmp byte [eax], bl
je 0x20565cd
cmp byte [eax + 1], bl
je 0x20565d6
cmp byte [eax + 2], bl
je 0x20565e0
cmp byte [eax + 3], bl
je 0x20565ec
add eax, 4
cmp eax, edi
jb 0x2056589
pop edi
pop esi
pop ebp
or eax, reloc.kernel32.dll_DeleteCriticalSection
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, reloc.kernel32.dll_DeleteCriticalSection
pop ebx
ret 4

Function at 0x2056988
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + reloc.kernel32.dll_DeleteCriticalSection]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + reloc.kernel32.dll_DeleteCriticalSection]
mov eax, dword [esp + reloc.kernel32.dll_DeleteCriticalSection]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x20569ba
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], pe_nt_image_headers32
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x2056a1a
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x20569f1
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x2056ac8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0x2056b64
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0x2056af3
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0x20f51a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 3
pop ecx
cdq
idiv ecx
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
lea ebx, [esi + 1]
mov dword [ebp - 8], ebx
test ebx, ebx
jle 0x20f5243
mov ecx, dword [ebp + 8]
lea esi, [edi + 2]
add ecx, 2
mov edi, ecx
mov al, byte [edi - 2]
shr al, 2
movzx eax, al
push eax
call fcn.020f5156
mov byte [esi - 2], al
mov cl, byte [edi - 2]
mov al, byte [edi - 1]
and cl, 3
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
push eax
call fcn.020f5156
mov byte [esi - 1], al
mov cl, byte [edi - 1]
mov al, byte [edi]
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
push eax
call fcn.020f5156
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
movzx eax, al
push eax
call fcn.020f5156
mov byte [esi + 1], al
lea edi, [edi + 3]
lea esi, [esi + 4]
dec ebx
jne 0x20f51d4
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, 1
jne 0x20f5251
mov word [edi + esi*4 + 2], 0x3d3d
jmp 0x20f525b
cmp ecx, 2
jne 0x20f525d
mov byte [edi + esi*4 + 3], 0x3d
mov esi, ebx
mov eax, esi
shl eax, 2
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x21886d8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ah
neg bp
mov eax, 0x419bb33a
lea ebp, [esp + 0xb1]
sub esp, 0xa
rdtsc
bswap ecx
rcr cx, 1
setae cl
pop dword [esp]
lea esp, [esp + 4]
inc esi
jmp 0x2188525
xchg bl, ch
mov edi, eax
mov edx, 0xa10e678b
mov cl, al
cpuid
dec eax
jmp 0x2188549
lea esp, [esp + 7]
rdtsc
bswap ebx
push word [esp + 8]
pop cx
mov di, bx
jmp 0x2188584
cld
xchg byte [esp + 8], bl
std
inc bl
jmp 0x2188612

Function at 0x2188c32
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dh, bl
jmp 0x2188c72
not ch
cpuid
neg ebx
xchg dword [esp], eax
rdtsc
mov al, ch
jmp 0x2188c5c
Function at 0x2188ceb
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
jmp 0x2188ec5
lea ecx, [edx*4]
xchg si, ax
mov word [esp + 3], bx
lea esp, [esp + 4]
xchg byte [esp], dl
mov dword [esp + 4], ebx
jmp 0x2188d1a
mov eax, dword [esp + 0xb]
rdtsc
xchg di, dx
bsf di, ax
clc
mov byte [esp + 2], al
jmp 0x2188d30
dec eax
push dword [esp + 6]
mov byte [esp + 9], al
xchg bp, ax
pop si
sets cl
jmp 0x2188d69

Function at 0x2188dad
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edi
cpuid
lea edi, reloc.kernel32.dll_DeleteCriticalSection
jmp 0x2188dcc

Function at 0x2188fe1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, cx
mov edi, 0x276340c1
mov byte [esp], bh
bswap ecx
jmp 0x2188ff4
add esp, 2
bswap edx
rdtsc
mov cl, byte [esp]
mov byte [esp], bl
mov edi, eax
jmp 0x218902d
pop bx
adc ah, ch
xchg bx, dx
lea edx, [ecx + esi]
clc
sub esp, 5
jmp 0x2189017

Function at 0x21890fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
not ecx
pop word [esp + 7]
jmp 0x2189140
xchg ecx, edx
mov word [esp + 7], dx
mov si, word [esp + 0xd]
dec si
mov cl, 0x28
xchg dword [esp + 0xa], ecx
jmp 0x218912a

Function at 0x218d76c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ecx
sub esp, 0xa
lea esp, [esp + 2]
lea esp, [esp + 0xc]