joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac30
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x40ac43
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40ac3f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x40ac60
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40ac9f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40ac95
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40aca1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40ac85
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40ada2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x401674
push 0x80000000
call dword [entry0]
test eax, eax
jne 0x40ae79
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [0x401004]
test eax, eax
jne 0x40ae68
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x40ae52
push edi
push dword [ebp - 0x110]
push eax
call dword [0x401094]
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x40ae68
push eax
push edi
push dword [ebp - 0x110]
call fcn.0040ad3f
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [0x401008]
mov eax, esi
pop edi
jmp 0x40ae7b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409c0e
leave
ret 4
Function at 0x2000175d
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [eax], esi
lea eax, [ebp - 0x208]
push eax
push 0x100
mov dword [ebp - 4], esi
xor edi, edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x20001798
push 5
pop eax
jmp 0x200018af
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.20001d3c
test eax, eax
je 0x200017d6
lea eax, [ebp - 0x108]
push str.proj.dll
push eax
call fcn.200018b6
mov edi, eax
mov dword [ebx], 2
cmp edi, esi
jne 0x2000189a
mov dword [ebp - 4], 6
jmp 0x2000189a
lea eax, [ebp - 0x108]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
mov esi, str.proj.dll
je 0x2000184d
lea eax, [ebp - 0x108]
push eax
call fcn.200015d4
test al, al
je 0x2000184d
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.200018b6
mov edi, eax
test edi, edi
je 0x2000181d
mov dword [ebx], 1
jmp 0x2000189a
lea eax, [ebp - 0x108]
push str.Xtras
push eax
call fcn.200015ba
test al, al
je 0x2000184d
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.200018b6
mov edi, eax
test edi, edi
je 0x2000184d
mov dword [ebx], 3
jmp 0x2000189a
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x20001893
lea eax, [ebp - 0x108]
push str.MacromedShockwave_10
push eax
call fcn.200015ba
test al, al
je 0x20001893
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.200018b6
mov edi, eax
test edi, edi
je 0x20001893
mov dword [ebx], 4
jmp 0x2000189a
mov dword [ebp - 4], 3
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x200019ad
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
lea eax, [ebp - 4]
push edi
push eax
push 0x20019
push 0
push str..htm
push 0x80000000
call ebx
test eax, eax
jne 0x20001b1d
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 8], 0x208
call esi
push dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], eax
call edi
cmp dword [ebp - 0xc], 0
jne 0x20001b1d
lea eax, [ebp - 0x214]
push str._shellopencommand
push eax
call fcn.20003280
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push 0x20019
lea eax, [ebp - 0x214]
push 0
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x20001b1d
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov esi, eax
call edi
test esi, esi
jne 0x20001b1d
xor edi, edi
mov al, byte [ebp + edi - 0x214]
cmp al, 0x20
je 0x20001a82
cmp al, 9
jne 0x20001a85
inc edi
jmp 0x20001a73
mov al, byte [ebp + edi - 0x214]
test al, al
je 0x20001b1d
cmp al, 0x22
lea esi, [edi + 1]
jne 0x20001aaf
mov edi, esi
mov al, byte [ebp + esi - 0x214]
test al, al
je 0x20001ac1
cmp al, 0x22
je 0x20001ac1
inc esi
jmp 0x20001a9d
mov al, byte [ebp + esi - 0x214]
test al, al
je 0x20001ac1
cmp al, 0x20
je 0x20001ac1
inc esi
jmp 0x20001aaf
test edi, edi
je 0x20001ae1
mov eax, esi
sub eax, edi
push eax
lea eax, [ebp + edi - 0x214]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.20002f30
add esp, 0xc
sub esi, edi
lea eax, [ebp - 0x214]
push 0x2000a0a8
push eax
and byte [ebp + esi - 0x214], 0
call fcn.20003280
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
call fcn.20003280
add esp, 0x10
lea eax, [ebp - 0x214]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x20001b9d
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
mov esi, str.msvcrt.dll
push edi
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
jne 0x20001c77
lea eax, [ebp - 0x204]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x20001bdf
push 5
pop ebx
jmp 0x20001c77
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.20001d3c
test eax, eax
je 0x20001c04
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.200018b6
mov edi, eax
test edi, edi
jne 0x20001c6a
lea eax, [ebp - 0x104]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x20001c3f
lea eax, [ebp - 0x104]
push eax
call fcn.200015d4
test al, al
je 0x20001c3f
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.200018b6
mov edi, eax
test edi, edi
jne 0x20001c6a
lea eax, [ebp - 0x104]
push str.Xtras
push eax
call fcn.200015ba
test al, al
je 0x20001c67
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.200018b6
mov edi, eax
test edi, edi
jne 0x20001c6a
push 2
pop ebx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 4

Function at 0x20001c85
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
xor eax, eax
cmp dword [ebp + 8], esi
push edi
setne al
inc eax
mov edi, eax
or edi, 4
call fcn.20001d0e
test eax, eax
je 0x20001cfa
lea eax, [ebp + 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x20001cc1
xor eax, eax
jmp 0x20001d08
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x10]
push esi
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x20001cbd
push esi
push edi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
leave
ret 4
Function at 0x20001d81
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
push esi
mov esi, 0x104
push edi
xor ebx, ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [0x2000ce28], eax
je 0x20001e83
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x20001e6c
push dword [0x2000ce28]
call fcn.20001e89
push str.TempFolder
push dword [0x2000ce28]
call fcn.20003280
push str..aaa
push dword [0x2000ce28]
call fcn.20003280
push dword [0x2000ce28]
call fcn.20003360
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x14
mov esi, eax
push ebx
push dword [0x2000ce28]
call edi
test eax, eax
jne 0x20001e51
mov eax, dword [0x2000ce28]
movsx ecx, byte [esi + eax - 1]
lea eax, [esi + eax - 1]
cmp ecx, 0x7a
jl 0x20001e27
mov byte [eax], 0x61
mov eax, dword [0x2000ce28]
movsx ecx, byte [eax + esi - 2]
lea eax, [eax + esi - 2]
cmp ecx, 0x7a
jge 0x20001e2d
inc cl
mov byte [eax], cl
jmp 0x20001e48
mov byte [eax], 0x61
mov edx, dword [0x2000ce28]
movsx eax, byte [edx + esi - 3]
lea ecx, [edx + esi - 3]
cmp eax, 0x7a
jge 0x20001e72
inc al
mov byte [ecx], al
push ebx
push dword [0x2000ce28]
jmp 0x20001df8
push dword [0x2000ce28]
call fcn.20001e89
push dword [0x2000ce28]
call fcn.20001ea8
push 1
pop ebx
jmp 0x20001e83
mov edx, dword [0x2000ce28]
cmp edx, ebx
je 0x20001e83
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [0x2000ce28], ebx
pop edi
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x200026ff
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
lea eax, [ebp - 0x208]
push edi
push eax
push 0x104
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x20002831
lea eax, [ebp - 0x208]
push eax
call fcn.20001e89
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.20003270
lea eax, [ebp - 0x104]
push str.TempFolder.
push eax
call fcn.20003280
add esp, 0x10
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x20002831
mov eax, dword [ebp - 0x348]
and eax, 0x10
cmp al, 0x10
jne 0x2000281b
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.20003270
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.20003280
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call fcn.20001e89
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x44c]
push eax
call fcn.20003270
lea eax, [ebp - 0x44c]
push str.Macromedia.lok
push eax
call fcn.20003280
add esp, 0x10
lea eax, [ebp - 0x44c]
push 0
push 1
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x2000281b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x104]
push eax
call fcn.20002837
or ebx, eax
lea eax, [ebp - 0x348]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x20002778
mov eax, ebx
pop edi
pop ebx
leave
ret
Function at 0x20002837
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
pop esi
push ebx
call fcn.20001e89
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.20003270
lea eax, [ebp - 0x104]
push 0x2000a18c
push eax
call fcn.20003280
add esp, 0x10
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x20002924
lea eax, [ebp - 0x218]
push 0x2000a174
push eax
call fcn.20003450
pop ecx
test eax, eax
pop ecx
je 0x200028ff
lea eax, [ebp - 0x218]
push 0x2000a188
push eax
call fcn.20003450
pop ecx
test eax, eax
pop ecx
je 0x200028ff
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.20003270
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.20003280
add esp, 0x10
lea eax, [ebp - 0x104]
test byte [ebp - 0x244], 0x10
push eax
je 0x200028f7
call fcn.20002837
jmp 0x200028fd
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
test esi, esi
je 0x20002919
lea eax, [ebp - 0x244]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x2000288f
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
je 0x2000292d
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x20003405
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x20003425
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.20003856
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x20003448
test byte [esp + 8], 2
je 0x20003448
call fcn.200038c9
mov dword [eax], 0xd
call fcn.200038d2
mov dword [eax], 5
jmp 0x20003421
xor eax, eax
ret
Function at 0x20004a75
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x2000a718
cmp edx, dword [eax]
je 0x20004a97
add eax, 8
inc ecx
cmp eax, 0x2000a7a8
jl 0x20004a88
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x2000a718]
jne 0x20004bc5
mov eax, dword [0x2000ce78]
cmp eax, 1
je 0x20004b9f
test eax, eax
jne 0x20004ac8
cmp dword [0x2000a1a4], 1
je 0x20004b9f
cmp edx, 0xfc
je 0x20004bc5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x20004aff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.20003270
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.20003360
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x20004b42
lea eax, [ebp - 0x1a4]
push eax
call fcn.20003360
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x2000852c
push edi
call fcn.20006d60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.20003270
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.20003280
lea eax, [ebp - 0xa0]
push 0x2000850c
push eax
call fcn.20003280
push dword [esi + 0x2000a71c]
lea eax, [ebp - 0xa0]
push eax
call fcn.20003280
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.20006ccf
add esp, 0x2c
pop edi
jmp 0x20004bc5
lea eax, [ebp + 8]
lea esi, [esi + 0x2000a71c]
push 0
push eax
push dword [esi]
call fcn.20003360
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x2008dd23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 6
add eax, 6
pop ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
jle 0x2008ddd7
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
sub dword [ebp - 8], ecx
lea ebx, [eax + 0x120]
lea esi, [ecx + 0x128]
mov eax, dword [esi]
test eax, eax
je 0x2008ddc3
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx + esi]
je 0x2008ddc3
cmp dword [ebp + 0x20], 0
mov edi, ebx
je 0x2008dda8
cmp dword [ebp - 4], 0
jne 0x2008dda8
push 1
push 0xbca0
call fcn.200e4a40
test eax, eax
mov dword [ebp - 0x10], eax
je 0x2008ddd7
push eax
call fcn.200e4a22
test eax, eax
mov dword [ebp - 4], eax
je 0x2008dda8
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
call fcn.2008db91
mov eax, esi
push 0x18
sub eax, ebx
pop ecx
add eax, 0xfffffff8
mov dx, word [eax + edi]
xor dx, 0xff
mov word [edi], dx
inc edi
inc edi
dec ecx
jne 0x2008ddb2
mov eax, dword [ebp + 0x1c]
inc dword [ebp - 0xc]
add eax, 6
add esi, 0x30
add ebx, 0x30
cmp dword [ebp - 0xc], eax
jl 0x2008dd60
push dword [ebp + 0x1c]
call fcn.2008dbab
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.2008de1c
cmp dword [ebp - 4], 0
mov esi, eax
je 0x2008de13
push dword [ebp + 0x1c]
push dword [ebp - 4]
push dword [ebp + 0x18]
call fcn.2008db91
lea eax, [ebp - 0x10]
push eax
call fcn.200e4a5e
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x200918ee
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
neg ebx
sbb ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
and ebx, 0xfffffffe
inc ebx
push edi
cmp word [esi + 0x10], 0
mov dword [ebp + 0x10], ebx
je 0x20091911
push ebx
jmp 0x20091913
push 0
mov edi, dword [ebp + 8]
push edi
call fcn.200e0f36
mov ax, word [esi + 0x10]
mov word [edi + 2], ax
cmp word [esi + 6], 0
je 0x2009192e
push ebx
jmp 0x20091930
push 0
lea eax, [edi + 4]
push eax
call fcn.200e0f36
mov ax, word [esi + 6]
mov word [edi + 6], ax
cmp word [esi + 8], 0
je 0x2009194b
push ebx
jmp 0x2009194d
push 0
lea eax, [edi + 8]
push eax
call fcn.200e0f36
mov ax, word [esi + 8]
mov word [edi + 0xa], ax
mov cl, byte [esi + 5]
test cl, cl
je 0x20091981
mov al, byte [esi + 2]
movzx edx, al
shr edx, 7
push edx
mov dl, byte [esi + 3]
and al, 0x7f
push edx
push eax
push ecx
call fcn.200998e3
mov dword [ebp - 8], eax
jmp 0x2009198b
and word [ebp - 8], 0
and word [ebp - 6], 0
push dword [ebp - 8]
lea eax, [edi + 0xc]
push eax
call fcn.200e0f36
push dword [ebp - 6]
lea eax, [edi + 0xe]
push eax
call fcn.200e0f36
mov al, byte [esi + 4]
lea ebx, [edi + 0x18]
mov byte [edi + 0x15], al
mov al, byte [esi + 0xd]
mov byte [edi + 0x10], al
mov al, byte [esi + 0xe]
mov byte [edi + 0x11], al
mov al, byte [esi + 0xf]
mov byte [edi + 0x12], al
mov al, byte [esi + 0x12]
mov byte [edi + 0x13], al
mov al, byte [esi + 0x13]
mov byte [edi + 0x14], al
cmp word [esi + 0x14], 0
je 0x200919d6
push dword [ebp + 0x10]
jmp 0x200919d8
push 0
push ebx
call fcn.200e0f36
mov ax, word [esi + 0x14]
mov dword [ebp + 8], 0x30
mov word [ebx + 2], ax
mov al, byte [esi + 0x19]
mov byte [ebx + 4], al
mov al, byte [esi + 0x18]
mov byte [ebx + 5], al
mov al, byte [esi + 0x16]
mov byte [ebx + 6], al
mov al, byte [esi + 0x17]
mov byte [ebx + 7], al
mov ax, word [esi + 0x1a]
mov word [ebx + 8], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0xa], ax
mov al, byte [esi + 0x1e]
mov byte [ebx + 0xc], al
mov al, byte [esi + 0x1f]
mov byte [ebx + 0xd], al
mov al, byte [esi + 0x20]
mov byte [ebx + 0xe], al
lea ebx, [esi + 0x38]
lea esi, [edi + 0x32]
xor edi, edi
cmp word [ebx - 0xa], di
je 0x20091a3a
push dword [ebp + 0x10]
jmp 0x20091a3b
push edi
push esi
call fcn.200e0f36
mov ax, word [ebx - 0xa]
mov word [esi + 2], ax
cmp word [ebx], di
je 0x20091a53
push dword [ebp + 0x10]
jmp 0x20091a54
push edi
lea eax, [esi + 4]
push eax
call fcn.200e0f36
mov ax, word [ebx]
add ebx, 0x14
mov word [esi + 6], ax
mov al, byte [ebx - 0x23]
mov byte [esi - 2], al
mov al, byte [ebx - 0x1f]
mov byte [esi - 1], al
mov al, byte [ebx - 0x22]
mov byte [esi + 8], al
mov al, byte [ebx - 0x21]
mov byte [esi + 9], al
mov eax, dword [ebx - 0x1c]
mov dword [esi + 0xa], eax
mov eax, dword [ebx - 0x18]
mov dword [esi + 0xe], eax
mov al, byte [ebx - 0x12]
mov byte [esi + 0x12], al
mov al, byte [ebx - 0x11]
mov byte [esi + 0x13], al
mov al, byte [ebx - 0x20]
mov byte [esi + 0x14], al
add esi, 0x18
dec dword [ebp + 8]
jne 0x20091a2d
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x200fbc09
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp word [edi + 6], 0
jg 0x200fbc29
mov eax, dword [esp + 0xc]
mov dword [eax], 4
mov ecx, dword [edi]
mov dword [eax + 4], ecx
jmp 0x200fbcbe
push ebx
push esi
mov esi, dword [esp + 0x10]
push 1
pop ebx
push esi
call fcn.20103a65
mov dword [esi + 0x1c], 4
movsx eax, word [edi + 4]
movzx ecx, word [edi + 6]
shl eax, 0x10
or eax, ecx
mov dword [esi + 0x20], eax
cmp word [edi + 0xa], 0
jle 0x200fbc76
push esi
call fcn.20103a65
mov dword [esi + 0x1c], 4
push 2
movsx eax, word [edi + 8]
movzx ecx, word [edi + 0xa]
shl eax, 0x10
or eax, ecx
pop ebx
mov dword [esi + 0x20], eax
push esi
call fcn.20103a65
or ebx, 0x80000000
push 0
push esi
mov dword [esi + 0x1c], 4
mov dword [esi + 0x20], ebx
call fcn.201109f0
mov ecx, dword [esi + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esi + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x10]
add dword [esi + 0x18], 0xfffffff8
mov eax, dword [esi + 0x18]
mov ecx, dword [ecx]
mov edx, dword [ecx + eax]
mov dword [esi + 0x1c], edx
mov eax, dword [ecx + eax + 4]
mov dword [esi + 0x20], eax
pop esi
pop ebx
pop edi
ret 0xc

Function at 0x20100b9f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov al, byte [ebx]
cmp al, 0xff
jae 0x20100bb1
movzx eax, al
jmp 0x20100bba
lea eax, [ebx + 1]
push eax
call fcn.200e4aa6
mov esi, dword [esp + 0x18]
movsx edi, ax
mov al, byte [esi]
cmp al, 0xff
jae 0x20100bcc
movzx eax, al
jmp 0x20100bd5
lea eax, [esi + 1]
push eax
call fcn.200e4aa6
movsx eax, ax
cmp edi, eax
jne 0x20100c08
test edi, edi
jle 0x20100bff
mov eax, dword [esp + 0x10]
movzx ecx, byte [ebx + 1]
movzx edx, byte [esi + 1]
dec edi
inc ebx
mov ecx, dword [eax + ecx*4 + 0x14]
inc esi
xor ecx, dword [eax + edx*4 + 0x14]
test cl, cl
jne 0x20100c08
test edi, edi
jg 0x20100be4
push 1
pop eax
pop edi
pop esi
pop ebx
ret 0xc
xor eax, eax
jmp 0x20100c02
Function at 0x201b71f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [0x69098108]
mov ebx, ecx
and ebx, 3
push ebx
shr ecx, 2
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
or ecx, ecx
je 0x201b721f
nop
lodsd eax, dword [esi]
not eax
xor dword [edi], eax
add edi, 4
dec ecx
jne 0x201b7214
pop ecx
or ecx, ecx
je 0x201b722d
lodsb al, byte [esi]
not al
xor byte [edi], al
inc edi
dec ecx
jne 0x201b7224
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x202069e4
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x1c], 0xca
jne 0x20206a1e
push esi
call fcn.20208394
test eax, eax
jl 0x20206a9d
mov eax, dword [esi + 0x48]
test eax, eax
je 0x20206a17
mov dword [esi + 0x1c], 0xcf
mov eax, 1
pop esi
ret 4
mov dword [esi + 0x1c], 0xcb
mov eax, dword [esi + 0x1c]
cmp eax, 0xcb
jne 0x20206aa1
mov eax, dword [esi + 0x1bc]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x20206a8b
mov eax, dword [esi + 8]
test eax, eax
je 0x20206a3f
push esi
call dword [eax]
mov ecx, dword [esi + 0x1bc]
push esi
call dword [ecx]
test eax, eax
jl 0x20206a9d
je 0x20206a85
cmp eax, 2
je 0x20206a8b
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x20206a35
cmp eax, 3
je 0x20206a64
cmp eax, 1
jne 0x20206a35
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x20206a35
mov edx, dword [esi + 0x148]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x20206a35
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0x98]
mov dword [esi + 0xa0], eax
push esi
call fcn.20206ac4
pop esi
ret 4
cmp eax, 0xcc
je 0x20206a97
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x1c]
pop esi
mov dword [edx + 0x18], eax
mov eax, 0xffffffec
ret 4