joyce8/EMBER2024-capa huggingface dataset:
Function at 0x536ff8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x537026
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x537044
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00536f5e
jmp 0x537044
mov eax, dword [esi + 0x14]
test eax, eax
je 0x537044
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00536f5e
test edi, edi
mov eax, edi
jne 0x53702e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xdcc958
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
mov dword [esp], ebp
push dword [esp + 2]
lea esp, [esp + 8]
jmp 0xdcc9ab
push 0
pushfd
call fcn.00dcc966

Function at 0xdcc9de
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xdcc933
mov dword [esp + 0x24], eax
jmp 0xdcc839
call 0xdc63f2
jmp 0xdcc994
popal
jmp 0xdcc8da
movzx ebx, byte [eax]
jmp 0xdcc912
add ebx, 0x571cd6e3
cmp ebx, 0x571cd7af
jmp 0xdcc97f
pop ecx
sub ecx, fcn.00dc639a
mov dword [ecx + 0xdcc86d], eax
jmp 0xdcc8f6
jmp 0xdcca4f
mov bh, 6
cmp al, 0x74
sti
je 0xdcc97c
jne 0xdc63ab
cmp dword [esp + 4], 0
jne 0xdcc942
pushal
jmp 0xdc63ed
pop eax
sub eax, 0x4e4dc2b8
jmp 0xdcc9cc
call 0xdcc9de
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
xor eax, 0xe94e4db1
rol dword [eax], cl
add byte [eax], al
add bl, byte [edx + esi + 0x6923a455]
mov byte [ebx], ch
inc edx
std
int3
inc dword [esp + 8]
popfd
ret

Function at 0xdccadd
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00dc6417
push eax
jmp 0xdcca2f
call fcn.00dd0aa0
jmp 0xdc6412
jmp 0xdcc9b6
Function at 0xdde8ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
stc
jmp 0xdde619
lea esp, [esp + 4]
stc
mov esp, edx
jmp 0xdde647
push edi
push ecx
mov esi, eax
jmp 0xdde665
cld
rep movsb byte es:[edi], byte [esi]
pop ecx
jmp 0xdde62d
pop edi
pop esi
popfd
call fcn.00dde64f
and ch, byte [ebx + 0x1ead5e3b]
dec eax
int3
pushfd
lea ebp, [ecx + edx - 0x40]
push esi
jmp 0xdde61d
mov edi, edx
mov ecx, ecx
jmp 0xdde623
jle 0xdde6ab
jg 0xdde6ab
pushfd
sub edx, ecx
jno 0xdde614
jo 0xdde5fe
jns 0xdde84b
js 0xdde84b
and dl, 0xfc
push eax
mov byte [esp + 1], ah
sub esp, 0x18
jmp 0xdde67d
push dword [esp + 2]
jmp 0xdde76d

Function at 0xddf092
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xddf0c6
mov dword [esp + 0x17], esi
lea esp, [esp + 2]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
Function at 0xddf0ab
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0dcc9bc
jmp 0xddf0b0
pushfd
jmp 0xddb6d9
call 0xddf062
lea ebx, [esi*4]
rdtsc
mov bx, si
neg ch
jmp 0xddf0dc
je 0xddf0f5
sub byte [ecx - 0x72dbdb84], cl
and al, 0x24
jmp 0xddf094
jns 0xddf0f2
js 0xddf0f2
clc
jle 0xddf0cf
mov eax, dword [esi - reloc.kernel32.dll_LoadLibraryA]
cmpsb byte [esi], byte es:[edi]
push ebp
out 0x56, al
rol dword [eax - reloc.kernel32.dll_LoadLibraryA], 0x6c
and al, 0x2c
mov ebp, dword [esp + 0x2c]
sub al, 0x8a
invalid
mov al, bh
bswap ecx
push sp
jmp 0xddf118
lea esi, [esp]
mov ecx, 0xf2b06941
neg bx
jo 0xddf15e
jno 0xddf148
inc edx
invalid
mov bx, word [esp + 1]
lea esp, [esp + 2]
jmp 0xddf0fe
cmp eax, 0x312fcbc2
mov cx, word [esp]
jmp 0xddf167
cmp eax, 0x312fcbc2
mov cx, word [esp]
sub esp, 0xc0
jmp 0xddf199
setl bl
jmp 0xddf178
push dword [esp + 2]
mov ecx, ebp
not dh
call 0xddf3d1
xchg dword [0xa317e49d], ecx
pop ss
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
arpl bx, si
arpl word [esi], ax
cmc
jbe 0xddf1fa
mov edi, esp
push edx
rol ecx, 4
jg 0xddf16f
setl bl
push dword [esp + 2]
jmp 0xddf17c
push edx
mov dword [esp + 0xe], esp
jmp 0xddf22d
inc ebx
sal dword [esi + reloc.kernel32.dll_LoadLibraryA], cl
lcall 0x3330, 0x31ba0cfd
neg eax
jns 0xddf1f2
push edx
mov dword [esp + 0xe], esp
lea esp, [esp + 1]
jmp 0xddf231
neg ah
jle 0xddf23c
lea ebx, [ebp - 0x48]
mov ebx, 0x47c8c1af
rol dh, cl
jmp 0xddf31c
lea esp, [esp + 1]
lea esp, [esp + 0x14]
not ebp
mov eax, dword [esp]
jmp 0xddf217
lea ebx, [ebp - 0x48]
mov ebx, 0x47c8c1af
jmp 0xddf38f
call fcn.00ddf270
rol al, 2
jmp 0xddf2dd
sub esp, 0x1e
jb 0xddf28d
jae 0xddf28d
bswap eax
xchg dx, ax
rcl ebx, cl
dec bl
jmp 0xddf359
lea esp, [esp + 0x34]
inc ebp
shl edx, 0xe
jle 0xddf2c6
jg 0xddf2f1
int 0x57
invalid
bswap eax
xchg dx, ax
rcl ebx, cl
jmp 0xddf2fd
dec bl
jmp 0xddf359
mov dh, 0xd5
add esp, 0
jp 0xddf33a
lea esp, [esp + 1]
jmp 0xddf33e
setne al
xchg bx, ax
jmp 0xddf397
inc ebp
dec ah
js 0xddf340
jns 0xddf340
pop esp
fimul word [ebx + ebp - 0x1a]
pop eax
scasb al, byte es:[edi]
xor esp, dword [ebx - reloc.kernel32.dll_LoadLibraryA]
mov eax, dword [reloc.kernel32.dll_LoadLibraryA]
add ebx, ebp
in al, 3
mov bl, byte cs:[esp]
lea esp, [esp + 1]
jmp 0xddf324
add ebp, dword [esi]
mov bl, byte [esp]
jmp 0xddf370
sub ebp, 0x3defa35b
lea ebx, [ebp*4]
push ax
not eax
lea esp, [esp + 1]
jmp 0xddf301
dec edx
jo 0xddf3b7
xchg ah, dl
lea ebx, reloc.kernel32.dll_LoadLibraryA
jmp 0xddf3a1
rol dh, cl
setne al
xchg bx, ax
not ebx
ror ebp, 0
jmp 0xddf2bf
xchg ah, dl
lea ebx, reloc.kernel32.dll_LoadLibraryA
jmp 0xddf3a1

Function at 0xddf270
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x12
jns 0xddf2a8
bswap edx
rol al, 2
jmp 0xddf2dd
bswap edx
jmp 0xddf292
Function at 0xddf510
Capabilities:
Execute anti-debugging instructions

Disassembly:
sbb eax, ebx
jmp 0xddf471
lea esp, [esp + 4]
neg dl
cmp ah, cl
jno 0xddf4ac
lea eax, reloc.kernel32.dll_LoadLibraryA
lea eax, [ecx*4]
rol al, cl
jmp 0xddf501
js 0xddf446
jns 0xddf446
mov ah, 0x3f
scasd eax, dword es:[edi]
retf 0xf039
lea eax, reloc.kernel32.dll_LoadLibraryA
lea eax, [ecx*4]
rol al, cl
jmp 0xddf501
jmp 0xddf490
mov eax, 0xd26535b1
cmc
mov ax, word [esp]
jmp 0xddf4ce
mov eax, 0xd26535b1
cmc
mov ax, word [esp]
jmp 0xddf4e4
inc dl
lea eax, [eax*4]
mov ax, word [esp]
mov al, 0x93
bswap eax
lea eax, [ecx - 8]
jmp 0xddf526
xor dl, 0x16
lea eax, [ecx*4]
inc eax
jle 0xddf4c4
jg 0xddf4ae
lea esp, [esp + 4]
xor dl, 0x56
mov ah, ch
jmp 0xddf5b8
lea eax, [edi*4]
mov eax, dword [esp]
call 0xddf510
insd dword es:[edi], dx
mul byte [ebx + eax - 2]
aas
mov cs, word [bx]
mov dh, 0x5d
add byte [ebp - 0x3c74ccec], cl
mov ax, word [esp]
mov ah, 0x70
lea eax, reloc.kernel32.dll_LoadLibraryA
mov ax, word [esp]
adc ax, bx
jne 0xddf567
je 0xddf551
not ah
mov eax, ebx
mov eax, dword [esp]
mov ah, ch
rol dl, 0
jmp 0xddf58c

Function at 0xde07e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebx - 0x50]
xor eax, 0x85a4aa9d
mov eax, 0xf6740987
rcr al, 4
jmp 0xde0914
setb ah
call 0xde082e
lea eax, [edx + esi]
neg ah
push ax
push word [esp]
clc
xchg dword [esp + 4], ebp
jmp 0xde0854
xchg dword [esp], ebp
rcr ax, cl
rol ax, cl
neg ax
bswap eax
lea ebp, [ebp + 0x54]
jmp 0xde0891

Function at 0xde08c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x12]
lea esp, [esp + 2]
jmp 0xde08f8
sub eax, ebx
pushfd
push sp
pushfd
lea esp, [esp + 2]
jmp 0xde08e2

Function at 0xde3e4b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x28], eax
jmp 0xde3bc5
call fcn.00de3b71
sub ecx, 0x10016c38
jmp 0xde3bb5
mov dword [ecx + reloc.kernel32.dll_LoadLibraryA], eax
jmp 0xde4040
popal
popfd
lea esp, [esp + 4]
ret
je 0xde40ad
jne 0xde35f9
call 0xde3e4b
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
xor ecx, ecx
int3
movzx ebx, byte [eax]
add ebx, 0xd0c8e1b0
cmp ebx, 0xd0c8e27c
jmp 0xde3e2f
and al, 4
ret

Function at 0xde97a0
Capabilities:
Check for trap flag exception

Disassembly:
pushal
call fcn.00de9d2d
push edi
mov esi, 0xb322889
jns 0xde97ce
mov esi, 0x1cc9589b
ret
inc dword [edx + 0x19]
shl byte [edi + 0x104fc5dd], cl
xchg ebx, eax
or ah, byte [ebp + 0x124648d]

Function at 0xdece15
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xdecef5
xchg byte [esp + 2], dh
btc dx, dx
setbe dl
btr dx, dx
jle 0xdece52
xchg byte [esp + 2], dh
jmp 0xdece33
Function at 0xdf0b3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esp + eax]
lea eax, [edx + edi]
lea eax, [esp - 0xbf]
xchg dword [esp], esi
jmp 0xdf0bbc
dec ax
ror edx, cl
call fcn.00df0b8d
mov dl, bl
sub esp, 5
jmp 0xdf0bf9
call fcn.00df0c31
lea esp, [esp + 4]
neg dl
bswap eax
jmp 0xdf0ce6
jbe 0xdf0bd0
ja 0xdf0bd0
bswap eax
pop word [esp + 2]
call fcn.00df0c7d
push 0xffffffffffffff8d
wait
fdiv st(7), st(0)
invalid
sub esp, 9
jge 0xdf0cab
bswap eax
pop word [esp + 2]
jmp 0xdf0d50
lea esp, [esp + 4]
xor dl, 0x16
mov eax, dword [esp]
mov eax, dword [esp]
mov eax, 0x3484ead5
jmp 0xdf0d95
dec eax
lea esp, [esp + 3]
jmp 0xdf0d34
xor dl, 0x56
neg ah
jno 0xdf0df2
mov ax, word [esp]
jmp 0xdf0dc4
mov al, byte [esp]
mov ax, 0x9854
not al
lea eax, [ecx*4]
mov eax, ebp
jmp 0xdf0d57
setge ah
mov ax, 0x697b
bswap eax
inc dl
mov ax, word [esp]
jmp 0xdf0d6d
mov ax, 0x6d4c
jmp 0xdf0e06
inc eax
js 0xdf0dd2
dec ah
lea eax, reloc.kernel32.dll_LoadLibraryA
bsf eax, ecx
jmp 0xdf0e8a
xchg ah, al
lea eax, [esi*4]
setbe al
jmp 0xdf0da6
dec ah
lea eax, reloc.kernel32.dll_LoadLibraryA
jmp 0xdf0e87
mov ax, word [esp]
xchg ah, al
lea eax, [esi*4]
setbe al
mov ax, 0x6d4c
rol dl, 0
mov ax, word [esp]
lea eax, reloc.kernel32.dll_LoadLibraryA
lea eax, [eax*4]
jmp 0xdf0dac
setl al
rol dh, cl
dec ax
jmp 0xdf0e59
setl al
rol dh, cl
dec ax
mov eax, edi
inc ebp
mov ax, dx
mov dl, byte [esp]
jmp 0xdf0eca
mov eax, edi
call 0xdf0e6f
int 0x5d
int 0x94
sar dword [di], cl
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x75
aas
push es
mov cl, 0x8a
hlt
bsf eax, ecx
sub cl, dl
js 0xdf0e34
jns 0xdf0e1c
btc dx, bx
xchg dword [esp], edx
jmp 0xdf0ef9
lea edx, reloc.kernel32.dll_LoadLibraryA
rdtsc
inc edx
jae 0xdf0f28
lea edx, [ecx + esi]
mov dh, al
jmp 0xdf0f2d
mov al, byte [esp]
dec al
push dword [esp + 8]
ret 0xc
xchg word [esp], dx
mov word [esp], si
xchg dword [esp + 8], eax
btr ax, si
mov dl, byte [esp]
mov dx, 0x2a13
jmp 0xdf0ee0
mov dh, al
setbe al
jmp 0xdf0fbf
lea edx, [ecx + esi]
jmp 0xdf0f12
setbe al
jmp 0xdf0fbf
bt ax, bp
jmp 0xdf0f3f
xchg dx, ax
mov ax, 0x4cb5
lea eax, reloc.kernel32.dll_LoadLibraryA
jmp 0xdf0f82
lea edx, [edi + ebp]
jmp 0xdf0fa5
inc bl
mov dh, 0xb5
rdtsc
mov edx, eax
mov ax, sp
jmp 0xdf0f6c
mov edx, ecx
call fcn.00df0fde
push ecx
int 0x5d
and al, 0xd7
pushal
rcr dword [esi - 0x34], 0xab
shr word [edi], 1
and dword ss:[eax - reloc.kernel32.dll_LoadLibraryA], eax
push ds
xor bl, 0x96
sub esp, 0x1e
jl 0xdf0f8f
mov edx, ecx
lea edx, [ecx + ebp]
jmp 0xdf1049
inc bl
bsr ax, di
jp 0xdf0f35
bt ax, bp
xchg dx, ax
mov ax, 0x4cb5
lea eax, reloc.kernel32.dll_LoadLibraryA
jmp 0xdf0f82
lea esp, [esp + 0xd]
mov dh, byte [esp + 9]
bt dx, cx
jmp 0xdf1171
mov ah, bl
mov edx, ebx
not eax
jmp fcn.00df106f
jmp 0xdf1085
lea esp, [esp + 1]
lea esp, [esp + 0x10]
dec bl
bsr eax, ebx
jne 0xdf10cc
mov ah, bl
mov edx, ebx
not eax
jmp fcn.00df106f

Function at 0xdf0bef
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 3]
bsr dx, cx
jmp 0xdf0c13
js 0xdf0bc5
jns 0xdf0bc5
Function at 0xe1b48d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 3
jnp 0xe1b4aa
lea eax, [eax - 0x52]
lea esp, [esp + 1]
jmp 0xddff6f

Function at 0xe80c48
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00ed810f
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00ed810f
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.00ed810f
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.00ed959c
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0xe80d01
mov eax, 0
jmp 0xe80e6d
cmp dword [ebp + 0xc], 0
jne 0xe80d37
mov dword [ebp - 0x18], esp
xor eax, eax
call fcn.00dc5e31
int 0x90
nop
cmp dword [ebp - 0x18], esp
je 0xe80d34
push 0xa0
push 0x4045b1f
push 6
call fcn.00ed811b
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0xe80d5f
mov eax, 0xf2c344
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0xe80d59
push ebx
call fcn.00ed8115
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
xor eax, eax
call fcn.00dcb927
add dl, byte [eax - 0x179ac670]
je 0xe80d94
push 0x104
push 0x4045b1f
push 6
call fcn.00ed811b
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0xf2c318
xor eax, eax
call fcn.00dcba28
adc byte [eax - 0x179ac670], dl
je 0xe80dca
push 0x12e
push 0x4045b1f
push 6
call fcn.00ed811b
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call fcn.00dcbc39
xchg ebp, eax
nop
nop
cmp dword [ebp - 0x18], esp
je 0xe80e68
push 0x225
push 0x4045b1f
push 6
call fcn.00ed811b
add esp, 0xc
jmp 0xe80e6d
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00ed8115
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00ed8115
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00ed8115
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0xe80e99
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, 0xf2c344
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
call fcn.00e80edb
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0xe80ecd
push ebx
call fcn.00ed8115
add esp, 4
mov eax, dword [ebp - 8]
jmp 0xe80ed5
mov esp, ebp
pop ebp
ret 8
Function at 0xe8312a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0xe83162
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0xe83150
mov al, 1
jmp 0xe831c1
cmp dword [ebx + 0x54], ecx
jne 0xe83159
mov al, 2
jmp 0xe831c1
cmp dword [ebx + 0x7c], ecx
jne 0xe831c1
mov al, 3
jmp 0xe831c1
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0xe83177
mov al, 4
jmp 0xe831c1
cmp ecx, 5
jne 0xe83197
cmp ebx, 0
jne 0xe83185
mov al, 5
jmp 0xe831c1
cmp ebx, 1
jne 0xe8318e
mov al, 6
jmp 0xe831c1
cmp ebx, 2
jne 0xe83197
mov al, 7
jmp 0xe831c1
cmp ecx, 6
jne 0xe831bf
cmp ebx, 0
jne 0xe831a5
mov al, 8
jmp 0xe831c1
cmp ebx, 1
jne 0xe831ac
mov al, 9
cmp ebx, 2
jne 0xe831b3
mov al, 0xa
cmp ebx, 3
jne 0xe831ba
mov al, 0xb
cmp ebx, 4
jne 0xe831c1
mov al, 0xc
pop ebx
leave
ret
Function at 0xeb64eb
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 4]
mov eax, dword [ebp - 4]
jmp 0xeb6522
mov esp, ebp
pop ebp
ret

Function at 0xedea7c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0xedea9a
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0xedea8f
pop esi
ret

Function at 0xedfc0c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0xedfc2d
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0xedfc87
inc edi
cmp edi, esi
jl 0xedfc21
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0xedfcbc
mov edx, dword [eax]
xor edx, esi
lea ebp, reloc.kernel32.dll_LoadLibraryA
not edx
and ebp, edx
test ebp, 0x80808080
je 0xedfc76
cmp byte [eax], bl
je 0xedfc91
cmp byte [eax + 1], bl
je 0xedfc9a
cmp byte [eax + 2], bl
je 0xedfca4
cmp byte [eax + 3], bl
je 0xedfcb0
add eax, 4
cmp eax, edi
jb 0xedfc4d
pop edi
pop esi
pop ebp
or eax, reloc.kernel32.dll_LoadLibraryA
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, reloc.kernel32.dll_LoadLibraryA
pop ebx
ret 4

Function at 0xee018c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + reloc.kernel32.dll_LoadLibraryA]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + reloc.kernel32.dll_LoadLibraryA]
mov eax, dword [esp + reloc.kernel32.dll_LoadLibraryA]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0xee01be
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], pe_nt_image_headers32
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0xee021e
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0xee01f5
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0xee02cc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0xee0368
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0xee02f7
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0xeec31c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf2134c
push 0xf06684
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], reloc.kernel32.dll_LoadLibraryA
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00f0680c
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf30960
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 3
pop ecx
cdq
idiv ecx
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
lea ebx, [esi + 1]
mov dword [ebp - 8], ebx
test ebx, ebx
jle 0xf30a03
mov ecx, dword [ebp + 8]
lea esi, [edi + 2]
add ecx, 2
mov edi, ecx
mov al, byte [edi - 2]
shr al, 2
movzx eax, al
push eax
call fcn.00f30916
mov byte [esi - 2], al
mov cl, byte [edi - 2]
mov al, byte [edi - 1]
and cl, 3
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
push eax
call fcn.00f30916
mov byte [esi - 1], al
mov cl, byte [edi - 1]
mov al, byte [edi]
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
push eax
call fcn.00f30916
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
movzx eax, al
push eax
call fcn.00f30916
mov byte [esi + 1], al
lea edi, [edi + 3]
lea esi, [esi + 4]
dec ebx
jne 0xf30994
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, 1
jne 0xf30a11
mov word [edi + esi*4 + 2], 0x3d3d
jmp 0xf30a1b
cmp ecx, 2
jne 0xf30a1d
mov byte [edi + esi*4 + 3], 0x3d
mov esi, ebx
mov eax, esi
shl eax, 2
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xf9379c
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x24], eax
jmp 0xf93608
call 0xf91fe7
jmp 0xf9364f
call 0xf92038
jmp 0xf937b6
call fcn.00f935f9
lea esp, [esp + 4]
push 0
jmp 0xf936e3
jmp 0xf936cc
popfd
ret
popal
inc dword [esp + 8]
pushal
setnp bl
jmp 0xf936b6
call 0xf93649
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
or al, 0x4c
fbld tbyte [esi]
push ecx
pop eax
sub eax, 0x84ea357c
jmp 0xf93639
pushal
jmp 0xf91fe2
xchg si, ax
bswap edx
popal
call fcn.00f93768
and eax, 0xbc4d2ab4
dec ebp
and dword [eax - 0x5d], esp
fidiv dword [reloc.kernel32.dll_LoadLibraryA]
inc dword [esp + 8]
jmp 0xf93606
pushfd
cmp dword [esp + 4], 0
jne 0xf93601
je 0xf93681
add ebx, 0x57b22cbe
cmp ebx, 0x57b22d8a
jmp 0xf93730
jne 0xf9374e
pushal
jmp 0xf92033
je 0xf9375b
jne 0xf91f12
cmp dword [esp + 4], 0
jmp 0xf93718
inc dword [esp + 8]
jmp 0xf93811
cmp bh, byte [ebp - 0x1570e065]
sbb ebx, esi
in eax, dx
cld
iretd
call 0xf9379c
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
jno 0xf93805
invalid
pop eax
sub eax, 0x8c0d333a
jmp 0xf9378c
insb byte es:[edi], dx
out dx, al
call fcn.00dd0aa0
jmp fcn.00f92066
popfd
ret