joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20001eb0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x20008ab0], eax
je 0x20002038
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x2000201d
mov edx, dword [0x20008ab0]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx]
mov cl, byte [ecx + edx - 1]
cmp cl, 0x5c
je 0x20001f0e
mov byte [eax], 0x5c
mov byte [eax + 1], 0
mov edx, dword [0x20008ab0]
mov edi, str.TempFolder
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..aaa
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x20008ab0]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x20008ab0]
or ecx, 0xffffffff
mov edi, edx
push edx
repne scasb al, byte es:[edi]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
not ecx
dec ecx
mov esi, ecx
call edi
test eax, eax
jne 0x20001fe2
mov bl, 0x61
mov ecx, dword [0x20008ab0]
movsx eax, byte [esi + ecx - 1]
cmp eax, 0x7a
jge 0x20001f9e
inc al
mov byte [esi + ecx - 1], al
jmp 0x20001fd4
mov byte [esi + ecx - 1], bl
mov ecx, dword [0x20008ab0]
movsx eax, byte [ecx + esi - 2]
cmp eax, 0x7a
jge 0x20001fba
inc al
mov byte [ecx + esi - 2], al
jmp 0x20001fd4
mov byte [ecx + esi - 2], bl
mov ecx, dword [0x20008ab0]
movsx eax, byte [ecx + esi - 3]
cmp eax, 0x7a
jge 0x20002023
inc al
mov byte [ecx + esi - 3], al
mov eax, dword [0x20008ab0]
push 0
push eax
call edi
test eax, eax
je 0x20001f86
mov edx, dword [0x20008ab0]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx]
mov cl, byte [ecx + edx - 1]
cmp cl, 0x5c
je 0x2000200d
mov byte [eax], 0x5c
mov byte [eax + 1], 0
mov edx, dword [0x20008ab0]
push edx
call fcn.20002040
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
mov ecx, dword [0x20008ab0]
test ecx, ecx
je 0x20002038
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [0x20008ab0], 0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x20002ec0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x248
or ecx, 0xffffffff
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x254]
push esi
push edi
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, 1
cmp byte [ecx + ebp - 1], 0x5c
je 0x20002ef2
mov byte [ecx + ebp], 0x5c
mov byte [ecx + ebp + 1], 0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x20008174
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x2000307e
mov esi, 0x2000815c
lea eax, [esp + 0x144]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x20002f93
test cl, cl
je 0x20002f8f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x20002f93
add eax, 2
add esi, 2
test cl, cl
jne 0x20002f6f
xor eax, eax
jmp 0x20002f98
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x20003050
mov esi, 0x20008170
lea eax, [esp + 0x144]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x20002fd0
test cl, cl
je 0x20002fcc
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x20002fd0
add eax, 2
add esi, 2
test cl, cl
jne 0x20002fac
xor eax, eax
jmp 0x20002fd5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x20003050
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x144]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x118]
mov ecx, ebx
and ecx, 3
test al, 0x10
rep movsb byte es:[edi], byte [esi]
je 0x20003043
lea eax, [esp + 0x14]
push eax
call fcn.20002ec0
jmp 0x2000304e
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test ebx, ebx
je 0x2000306f
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x118]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x20002f63
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x20003092
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x248
ret 4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x248
ret 4
Function at 0x20003210
Capabilities:
Terminate process

Disassembly:
push 1
call fcn.20003864
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x200037f1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x20003811
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.20003b25
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x20003834
test byte [esp + 8], 2
je 0x20003834
call fcn.20003b98
mov dword [eax], 0xd
call fcn.20003ba1
mov dword [eax], 5
jmp 0x2000380d
xor eax, eax
ret

Function at 0x20004b0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x20008708
cmp edx, dword [eax]
je 0x20004b2f
add eax, 8
inc ecx
cmp eax, 0x20008798
jl 0x20004b20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x20008708]
jne 0x20004c5d
mov eax, dword [0x20008b00]
cmp eax, 1
je 0x20004c37
test eax, eax
jne 0x20004b60
cmp dword [0x20008194], 1
je 0x20004c37
cmp edx, 0xfc
je 0x20004c5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x20004b97
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.20005ec0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.20005fb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x20004bda
lea eax, [ebp - 0x1a4]
push eax
call fcn.20005fb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x200074c0
push edi
call fcn.200063f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.20005ec0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.20005ed0
lea eax, [ebp - 0xa0]
push 0x200074a0
push eax
call fcn.20005ed0
push dword [esi + 0x2000870c]
lea eax, [ebp - 0xa0]
push eax
call fcn.20005ed0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.20006365
add esp, 0x2c
pop edi
jmp 0x20004c5d
lea eax, [ebp + 8]
lea esi, [esi + 0x2000870c]
push 0
push eax
push dword [esi]
call fcn.20005fb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x2008990c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x24]
push ebx
push ebp
add eax, 6
xor ebp, ebp
push esi
cmp eax, 6
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 6
jle 0x200899d5
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
lea ebx, [ecx + 0x120]
sub ecx, eax
lea edi, [eax + 0x128]
mov dword [esp + 0x18], ecx
mov eax, dword [edi]
test eax, eax
je 0x200899b7
cmp eax, dword [ecx + edi]
je 0x200899b7
mov eax, dword [esp + 0x38]
mov esi, ebx
test eax, eax
je 0x20089994
test ebp, ebp
jne 0x20089994
push 1
push 0xbca0
call fcn.200eb4a6
test eax, eax
mov dword [esp + 0x14], eax
je 0x200899d5
push eax
call fcn.200eb488
mov ebp, eax
test ebp, ebp
je 0x20089994
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push edx
push ebp
call fcn.2008973c
mov eax, edi
sub eax, ebx
lea ecx, [eax - 8]
mov eax, 0x18
mov dx, word [ecx + esi]
add esi, 2
xor dx, 0xff
dec eax
mov word [esi - 2], dx
jne 0x200899a0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
inc edx
add eax, 6
add edi, 0x30
add ebx, 0x30
cmp edx, eax
mov dword [esp + 0x10], edx
jl 0x2008994b
mov ecx, dword [esp + 0x34]
push ecx
call fcn.2008975c
push eax
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
call fcn.20089a2c
test ebp, ebp
mov esi, eax
je 0x20089a1e
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
push ebp
push edx
call fcn.2008973c
lea eax, [esp + 0x14]
push eax
call fcn.200eb4c4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x1c
Function at 0x2008e08c
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
neg ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
sbb ebx, ebx
xor edi, edi
and ebx, 0xfffffffe
inc ebx
cmp word [esi + 0x10], di
je 0x2008e0ae
push ebx
jmp 0x2008e0af
push edi
mov ebp, dword [esp + 0x20]
push ebp
call fcn.200e6fcc
mov ax, word [esi + 0x10]
mov word [ebp + 2], ax
cmp word [esi + 6], di
je 0x2008e0ce
lea ecx, [ebp + 4]
push ebx
push ecx
jmp 0x2008e0d3
lea edx, [ebp + 4]
push edi
push edx
call fcn.200e6fcc
mov ax, word [esi + 6]
mov word [ebp + 6], ax
cmp word [esi + 8], di
je 0x2008e0ed
lea ecx, [ebp + 8]
push ebx
push ecx
jmp 0x2008e0f2
lea edx, [ebp + 8]
push edi
push edx
call fcn.200e6fcc
mov ax, word [esi + 8]
mov word [ebp + 0xa], ax
mov cl, byte [esi + 5]
test cl, cl
je 0x2008e128
mov al, byte [esi + 2]
mov edx, eax
and al, 0x7f
and edx, 0xff
shr edx, 7
push edx
mov dl, byte [esi + 3]
push edx
push eax
push ecx
call fcn.2009761c
mov dword [esp + 0x10], eax
jmp 0x2008e132
mov word [esp + 0x10], di
mov word [esp + 0x12], di
mov eax, dword [esp + 0x10]
lea ecx, [ebp + 0xc]
push eax
push ecx
call fcn.200e6fcc
lea eax, [ebp + 0xe]
mov edx, dword [esp + 0x12]
push edx
push eax
call fcn.200e6fcc
mov cl, byte [esi + 4]
lea edi, [ebp + 0x18]
mov byte [ebp + 0x15], cl
mov dl, byte [esi + 0xd]
mov byte [ebp + 0x10], dl
mov al, byte [esi + 0xe]
mov byte [ebp + 0x11], al
mov cl, byte [esi + 0xf]
mov byte [ebp + 0x12], cl
mov dl, byte [esi + 0x12]
mov byte [ebp + 0x13], dl
mov al, byte [esi + 0x13]
mov byte [ebp + 0x14], al
cmp word [esi + 0x14], 0
je 0x2008e17f
push ebx
jmp 0x2008e181
push 0
push edi
call fcn.200e6fcc
mov cx, word [esi + 0x14]
mov word [edi + 2], cx
mov dl, byte [esi + 0x19]
mov byte [edi + 4], dl
mov al, byte [esi + 0x18]
mov byte [edi + 5], al
mov cl, byte [esi + 0x16]
mov byte [edi + 6], cl
mov dl, byte [esi + 0x17]
mov byte [edi + 7], dl
mov ax, word [esi + 0x1a]
mov word [edi + 8], ax
mov cx, word [esi + 0x1c]
mov word [edi + 0xa], cx
mov dl, byte [esi + 0x1e]
mov byte [edi + 0xc], dl
mov al, byte [esi + 0x1f]
mov byte [edi + 0xd], al
mov cl, byte [esi + 0x20]
mov byte [edi + 0xe], cl
lea edi, [esi + 0x38]
lea esi, [ebp + 0x32]
mov ebp, 0x30
cmp word [edi - 0xa], 0
je 0x2008e1de
push ebx
jmp 0x2008e1e0
push 0
push esi
call fcn.200e6fcc
mov dx, word [edi - 0xa]
mov word [esi + 2], dx
cmp word [edi], 0
je 0x2008e1fb
lea eax, [esi + 4]
push ebx
push eax
jmp 0x2008e201
lea ecx, [esi + 4]
push 0
push ecx
call fcn.200e6fcc
mov dx, word [edi]
add edi, 0x14
mov word [esi + 6], dx
mov al, byte [edi - 0x23]
mov byte [esi - 2], al
mov cl, byte [edi - 0x1f]
mov byte [esi - 1], cl
mov dl, byte [edi - 0x22]
mov byte [esi + 8], dl
mov al, byte [edi - 0x21]
mov byte [esi + 9], al
mov ecx, dword [edi - 0x1c]
mov dword [esi + 0xa], ecx
mov edx, dword [edi - 0x18]
mov dword [esi + 0xe], edx
mov al, byte [edi - 0x12]
mov byte [esi + 0x12], al
mov cl, byte [edi - 0x11]
mov byte [esi + 0x13], cl
mov dl, byte [edi - 0x20]
mov byte [esi + 0x14], dl
add esi, 0x18
dec ebp
jne 0x2008e1d4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x2010366c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov al, byte [ebx]
push edi
cmp al, 0xff
jae 0x20103680
and eax, 0xff
jmp 0x20103689
lea eax, [ebx + 1]
push eax
call fcn.200eb4dc
mov edi, dword [esp + 0x18]
movsx esi, ax
mov al, byte [edi]
cmp al, 0xff
jae 0x2010369d
and eax, 0xff
jmp 0x201036a6
lea ecx, [edi + 1]
push ecx
call fcn.200eb4dc
movsx edx, ax
cmp esi, edx
je 0x201036b5
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
test esi, esi
jle 0x201036d8
mov eax, dword [esp + 0x10]
dec esi
inc ebx
inc edi
xor ecx, ecx
mov cl, byte [ebx]
xor edx, edx
mov dl, byte [edi]
mov ecx, dword [eax + ecx*4 + 0x14]
xor ecx, dword [eax + edx*4 + 0x14]
test cl, cl
jne 0x201036ad
test esi, esi
jg 0x201036bd
pop edi
pop esi
mov eax, 1
pop ebx
ret 0xc
Function at 0x2010712c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov eax, dword [ebx + 0x3c]
lea edi, [ebx + 0x3c]
test eax, eax
jl 0x2010727d
mov esi, dword [ebx + 0x40]
push ebp
cmp esi, eax
jge 0x20107191
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx + esi]
cmp eax, 6
mov ecx, dword [ecx + esi + 4]
jne 0x20107175
mov eax, dword [ecx]
mov ebp, dword [eax + 4]
dec ebp
mov dword [eax + 4], ebp
mov eax, dword [ecx]
mov edx, dword [eax + 4]
test edx, edx
jg 0x20107188
mov edx, dword [eax]
push ecx
push ebx
call dword [edx + 0xc]
jmp 0x20107188
and eax, 0xf
mov dl, byte [eax + 0x68113200]
test dl, dl
je 0x20107188
push ecx
call fcn.2003842c
mov eax, dword [edi]
add esi, 8
cmp esi, eax
jl 0x20107149
mov eax, dword [ebx + 0x4c]
push eax
push ebx
call fcn.2010788c
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x201071af
test byte [ebx + 0x64], 0x20
je 0x201071af
push eax
push ebx
call fcn.2010651c
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x68]
mov dword [ebx + 0x14], ecx
mov esi, dword [edx]
mov ecx, dword [edi]
add esi, ecx
mov ecx, 0xd
cmp eax, 8
rep movsd dword es:[edi], dword [esi]
jge 0x201071e3
mov eax, dword [ebx + 0x78]
cmp eax, 4
jl 0x201071dd
cmp eax, 5
jle 0x201071e0
mov eax, dword [ebx + 0x60]
mov dword [ebx + 0x74], eax
mov eax, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x38]
cmp eax, ecx
je 0x201071f4
push eax
push ebx
call fcn.20107b1c
mov eax, dword [ebx + 0x18]
test ebp, ebp
pop ebp
jne 0x20107272
test eax, eax
je 0x20107251
mov eax, dword [ebx + 0xac]
mov ecx, dword [ebx + 0xb0]
cmp eax, 6
jne 0x2010722c
mov eax, dword [ecx]
mov esi, dword [eax + 4]
dec esi
mov dword [eax + 4], esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
test edx, edx
jg 0x2010723f
mov edx, dword [eax]
push ecx
push ebx
call dword [edx + 0xc]
jmp 0x2010723f
and eax, 0xf
mov dl, byte [eax + 0x68113200]
test dl, dl
je 0x2010723f
push ecx
call fcn.2003842c
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [ebx + 0xac], eax
mov dword [ebx + 0xb0], ecx
mov eax, dword [ebx + 0x14]
mov edx, dword [ebx + 0xc]
add eax, 0xfffffff8
pop edi
mov dword [ebx + 0x14], eax
mov ecx, dword [edx]
pop esi
mov edx, dword [ecx + eax]
mov dword [ebx + 0x18], edx
mov eax, dword [ecx + eax + 4]
mov dword [ebx + 0x1c], eax
pop ebx
ret 4
test eax, eax
jne 0x2010727d
mov dword [ebx + 0x18], 2
pop edi
pop esi
pop ebx
ret 4

Function at 0x2016813c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, dword [0x69088e1c]
mov ebx, ecx
and ebx, 3
push ebx
shr ecx, 2
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
or ecx, ecx
je 0x20168167
nop
lodsd eax, dword [esi]
not eax
xor dword [edi], eax
add edi, 4
dec ecx
jne 0x2016815c
pop ecx
or ecx, ecx
je 0x20168175
lodsb al, byte [esi]
not al
xor byte [edi], al
inc edi
dec ecx
jne 0x2016816c
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x201b4bfc
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x201b4c2e
push esi
call fcn.201b65bc
mov eax, dword [esi + 0x40]
test eax, eax
je 0x201b4c27
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret 4
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x201b4caf
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x201b4c99
mov eax, dword [esi + 8]
test eax, eax
je 0x201b4c4f
push esi
call dword [eax]
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
test eax, eax
je 0x201b4c93
cmp eax, 2
je 0x201b4c99
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x201b4c45
cmp eax, 3
je 0x201b4c72
cmp eax, 1
jne 0x201b4c45
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x201b4c45
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x201b4c45
xor eax, eax
pop esi
ret 4
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.201b4cdc
pop esi
ret 4
cmp eax, 0xcc
je 0x201b4ccc
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x12
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
push esi
call fcn.201b4cdc
pop esi
ret 4
Function at 0x20204c28
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x20204c41
test al, 0x40
jne 0x20204c41
test al, 2
je 0x20204c46
or al, 0x20
mov dword [esi + 0xc], eax
or eax, 0xffffffff
pop esi
ret
or al, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
jne 0x20204cdc
push esi
call fcn.201f47c2
pop ecx
push dword [esi + 0x18]
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.201fff41
add esp, 0xc
mov dword [esi + 4], eax
test eax, eax
je 0x20204ced
cmp eax, 0xffffffff
je 0x20204ced
mov edx, dword [esi + 0xc]
test dl, 0x82
jne 0x20204cb1
mov ecx, dword [esi + 0x10]
push edi
cmp ecx, 0xffffffff
je 0x20204ce6
mov edi, ecx
sar edi, 5
and ecx, 0x1f
mov edi, dword [edi*4 + 0x78037760]
lea ecx, [ecx + ecx*8]
lea edi, [edi + ecx*4]
mov cl, byte [edi + 4]
pop edi
and cl, 0x82
cmp cl, 0x82
jne 0x20204cb1
or dh, 0x20
mov dword [esi + 0xc], edx
cmp dword [esi + 0x18], 0x200
jne 0x20204cce
mov ecx, dword [esi + 0xc]
test cl, 8
je 0x20204cce
test ch, 4
jne 0x20204cce
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec eax
mov dword [esi + 4], eax
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
pop esi
ret
mov eax, dword [esi + 8]
mov dword [esi], eax
jmp 0x20204c5c
mov edi, 0x780394a8
jmp 0x20204c9f
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
and dword [esi + 4], 0
jmp 0x20204c41

Function at 0x202065a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, edi
test edi, edi
mov dword [ebp - 4], edi
mov dword [ebp + 8], ecx
jne 0x202065c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
je 0x20206614
mov eax, dword [esi + 0x18]
mov dword [ebp + 0x14], eax
test word [esi + 0xc], 0x10c
je 0x20206622
mov eax, dword [esi + 4]
test eax, eax
je 0x20206622
cmp ecx, eax
mov edi, ecx
jb 0x202065f0
mov edi, eax
push edi
push dword [esi]
push ebx
call fcn.201e5719
sub dword [ebp + 8], edi
sub dword [esi + 4], edi
add dword [esi], edi
add esp, 0xc
add ebx, edi
mov edi, dword [ebp - 4]
cmp dword [ebp + 8], 0
jne 0x2020661d
mov eax, dword [ebp + 0x10]
jmp 0x202065c3
mov dword [ebp + 0x14], 0x1000
jmp 0x202065d9
mov ecx, dword [ebp + 8]
jmp 0x202065d9
cmp ecx, dword [ebp + 0x14]
jb 0x20206655
cmp dword [ebp + 0x14], 0
mov eax, ecx
je 0x20206638
xor edx, edx
div dword [ebp + 0x14]
mov eax, ecx
sub eax, edx
push eax
push ebx
push dword [esi + 0x10]
call fcn.201fff41
add esp, 0xc
test eax, eax
je 0x2020666f
cmp eax, 0xffffffff
je 0x20206682
sub dword [ebp + 8], eax
add ebx, eax
jmp 0x20206609
push esi
call fcn.20204c28
cmp eax, 0xffffffff
pop ecx
je 0x20206673
mov byte [ebx], al
mov eax, dword [esi + 0x18]
inc ebx
dec dword [ebp + 8]
mov dword [ebp + 0x14], eax
jmp 0x20206609
or dword [esi + 0xc], 0x10
mov eax, edi
xor edx, edx
sub eax, dword [ebp + 8]
div dword [ebp + 0xc]
jmp 0x202065c3
or dword [esi + 0xc], 0x20
jmp 0x20206673
Function at 0x20207e5c
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x20207e75
test al, 0x40
jne 0x20207e75
test al, 2
je 0x20207e7c
or al, 0x20
mov dword [esi + 0xc], eax
mov eax, 0xffff
pop esi
ret
or al, 1
test ax, 0x10c
mov dword [esi + 0xc], eax
jne 0x20207f1f
push esi
call fcn.201f47c2
pop ecx
push dword [esi + 0x18]
push dword [esi + 8]
push dword [esi + 0x10]
call fcn.201fff41
add esp, 0xc
mov dword [esi + 4], eax
test eax, eax
je 0x20207f30
cmp eax, 1
je 0x20207f30
cmp eax, 0xffffffff
je 0x20207f30
mov edx, dword [esi + 0xc]
test dl, 0x82
jne 0x20207ef0
mov ecx, dword [esi + 0x10]
push edi
cmp ecx, 0xffffffff
je 0x20207f29
mov edi, ecx
sar edi, 5
and ecx, 0x1f
mov edi, dword [edi*4 + 0x78037760]
lea ecx, [ecx + ecx*8]
lea edi, [edi + ecx*4]
mov cl, byte [edi + 4]
pop edi
and cl, 0x82
cmp cl, 0x82
jne 0x20207ef0
or dh, 0x20
mov dword [esi + 0xc], edx
cmp dword [esi + 0x18], 0x200
jne 0x20207f0d
mov ecx, dword [esi + 0xc]
test cl, 8
je 0x20207f0d
test ch, 4
jne 0x20207f0d
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
add eax, 0xfffffffe
mov dword [esi + 4], eax
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
pop esi
ret
mov eax, dword [esi + 8]
mov dword [esi], eax
jmp 0x20207e92
mov edi, 0x780394a8
jmp 0x20207ede
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
and dword [esi + 4], 0
jmp 0x20207e75

Function at 0x2020f26c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
test eax, eax
jle 0x2020f2b9
push ebx
push edi
lea edi, [esi + 8]
mov ebx, eax
mov eax, dword [esi + 4]
push 3
shr eax, 0xb
and eax, 7
push eax
push edi
call fcn.2020f3c2
mov eax, dword [esi + 4]
add esp, 0xc
mov ecx, eax
and cx, 0xf800
add ecx, 0x800
xor ecx, eax
and ecx, 0x3800
xor ecx, eax
dec ebx
mov dword [esi + 4], ecx
jne 0x2020f280
pop edi
pop ebx
pop esi
ret
jge 0x2020f2e6
mov ecx, dword [esi + 4]
push 0
mov eax, ecx
add esi, 8
and ax, 0xf800
dec eax
xor eax, ecx
and eax, 0x3800
xor eax, ecx
mov dword [esi - 4], eax
shr eax, 0xb
and eax, 7
push eax
push esi
call fcn.2020f3c2
add esp, 0xc
pop esi
ret