joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c02f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 4], ebx
cmp byte [ebp + 0x18], bl
mov dword [edi], ebx
jne 0x40c04a
cmp dword [ebp - 4], ebx
jle 0x40c062
push 1
push dword [ebp + 0x14]
push dword [ebp + 8]
push 0xffffffffffffffff
call fcn.0040675b
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x40c0d7
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
cmp eax, ebx
je 0x40c130
jge 0x40c1b2
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x40c165
inc dword [ebp - 4]
cmp dword [0x414530], 3
jl 0x40c03e
call fcn.00405210
push dword [ebp + 0x10]
mov dword [0x415054], 3
push dword [ebp - 4]
push 0x418600
push dword [0x4307f8]
call fcn.004050e0
add esp, 0x10
mov dword [0x415054], 2
call fcn.00405240
jmp 0x40c03e
push 0xfffffffffffffffb
pop eax
cmp esi, eax
je 0x40c1b6
cmp dword [0x414530], ebx
je 0x40c1ae
call fcn.00405210
push 0x2b5
push 0x4185a8
call fcn.0040bb8f
pop ecx
push eax
push 0x4185b0
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.NiPRead:_NiIPeek
push dword [0x4307f8]
call fcn.00405160
pop ecx
pop ecx
call fcn.00405240
jmp 0x40c1ae
push ebx
push 0x4185d0
push 0x4185d8
push 0xfffffffffffffffa
push 0xfffffffffffffffa
call fcn.0040a304
pop ecx
push eax
push ebx
push 0x2c2
push 0x4185e0
push 0x1f
push str.NI__network_interface_
call fcn.00401266
add esp, 0x28
push 0xfffffffffffffffa
pop eax
jmp 0x40c1b6
cmp eax, 0x2746
je 0x40c17c
cmp eax, 0x2745
je 0x40c17c
cmp eax, ebx
je 0x40c17c
or esi, 0xffffffff
jmp 0x40c17f
push 0xfffffffffffffffa
pop esi
push eax
push str.recv
push str.NiPRead
push esi
push esi
call fcn.0040a304
pop ecx
push eax
push 1
push 0x2d5
push 0x41862c
push 0x1f
push 0x411010
call fcn.00401266
add esp, 0x28
mov eax, esi
jmp 0x40c1b6
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c1bb
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
movzx esi, byte [esp + 8]
mov eax, esi
dec eax
je 0x40c267
dec eax
je 0x40c221
cmp dword [0x414530], 0
je 0x40c318
call fcn.00405210
push 0x32b
push 0x418670
call fcn.0040bb8f
pop ecx
push eax
push 0x418678
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push esi
push str.NiPSocket:_invalid_socktype___d_
push dword [0x4307f8]
call fcn.00405160
add esp, 0xc
call fcn.00405240
jmp 0x40c318
push 0
push 2
push 2
call sub.WSOCK32.dll_socket
test eax, eax
mov esi, dword [esp + 0xc]
mov dword [esi], eax
jge 0x40c25f
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.socket
push str.NiPSocket
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0040a304
pop ecx
push eax
push 1
push 0x31b
push 0x418668
jmp 0x40c2a3
push eax
call fcn.0040bd64
jmp 0x40c2bd
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
test eax, eax
mov esi, dword [esp + 0xc]
mov dword [esi], eax
jge 0x40c2b7
call sub.WSOCK32.dll_WSAGetLastError
push eax
push 0x418638
push 0x418640
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0040a304
pop ecx
push eax
push 1
push 0x308
push 0x41864c
push 0x1f
push 0x411010
call fcn.00401266
add esp, 0x28
or eax, 0xffffffff
pop esi
ret
push eax
call fcn.0040bbb7
mov eax, dword [esi]
test eax, eax
pop ecx
jge 0x40c31d
cmp dword [0x414530], 0
je 0x40c310
call fcn.00405210
push 0x338
push 0x4186a8
call fcn.0040bb8f
pop ecx
push eax
push 0x4186b0
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push dword [esi]
push str.NiPSocket:_socket_invalid___d_
push dword [0x4307f8]
call fcn.00405160
add esp, 0xc
call fcn.00405240
push dword [esi]
call fcn.0040bad2
pop ecx
push 0xfffffffffffffff8
pop eax
pop esi
ret
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
pop esi
ret

Function at 0x40c32c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
xor esi, esi
xor ecx, ecx
cmp edx, esi
je 0x40c342
cmp dword [edx], esi
je 0x40c342
push 1
pop ecx
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x40c350
cmp dword [eax], esi
je 0x40c350
push 1
pop ecx
cmp ecx, esi
jne 0x40c377
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
imul ecx, ecx, 0x3e8
cdq
mov esi, 0x3e8
idiv esi
add ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x40c3c2
push dword [ebp + 0x14]
push esi
push eax
push edx
push dword [ebp + 8]
call sub.WSOCK32.dll_select
cmp eax, esi
jge 0x40c3c2
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.select
push str.NiPSelect
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0040a304
pop ecx
push eax
push 1
push 0x37c
push 0x4186f4
push 0x1f
push 0x411010
call fcn.00401266
add esp, 0x28
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x40c433
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x10
push dword [ebp + 8]
call sub.WSOCK32.dll_getsockname
test eax, eax
jge 0x40c48c
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.getsockname
push str.NiPGetPort
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.0040a304
pop ecx
push eax
push 1
push 0x41a
push 0x418738
push 0x1f
push 0x411010
call fcn.00401266
add esp, 0x28
or eax, 0xffffffff
leave
ret
xor eax, eax
leave
ret

Function at 0x410029
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp dword [0x430460], 0
jne 0x410071
lea eax, [ebp - 0x190]
push eax
push 2
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x410067
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x410067
or eax, 0xffffffff
leave
ret
mov dword [0x430460], 1
xor eax, eax
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x77cf7a18
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6311554f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0xf010f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xf0115c
jmp 0xf01142
rdtsc
jmp 0xf0112c
rdtsc
or al, bl
xchg dx, ax
mov ch, cl
jmp 0xf011f4
or al, bl
xchg dx, ax
mov ch, cl
jmp 0xf011f4
ror ebp, 0
mov eax, dword [esp]
sbb ax, 0x1428
js 0xf010f4
jns 0xf010fc
xchg ecx, eax
or eax, 0xa017e49d
sbb al, 0x6f
jbe 0xf011bb
mov al, byte [0xd1f766e3]
not cx
not ax
xchg dword [esp], ecx
xchg byte [esp + 1], al
sub esp, 0
je 0xf010f2
jne 0xf01142
mov ax, word [esp]
mov ch, 0x99
stc
js 0xf011a3
btc dx, cx
jmp 0xf011a9
push cs
imul ebx, dword [eax + reloc.MSVCRT.dll_strncpy], 0xebddf724
jecxz 0xf0111b
mov edx, dword [esp]
neg ebp
jmp 0xf01170
lea ecx, [edi*4]
or al, 0xbd
add byte [eax], al
add byte [eax], al
call fcn.00f0125d
jp 0xf01181
je 0xf011b0
out dx, al
sub edx, dword [edi + reloc.MSVCRT.dll_strncpy]
btc edx, ecx
btc dx, cx
jmp 0xf0118d
lea ecx, [edi*4]
jmp 0xf011cf
push ecx
mov al, byte [0xbfac5d27]
xchg byte [ecx], dh
xor byte [esi + 0xf], ah
mov ebp, 0x8bbc78c9
adc al, 0x24
bsr cx, cx
js 0xf01186
mov edx, dword [esp]
jmp 0xf01189
rol ebp, 0
bswap ecx
mov ax, 0x7a7b
mov dx, word [esp]
mov ax, 0x7b2f
jmp 0xf0127f
lea esp, [esp + 4]
neg ebp
xchg ecx, eax
bswap ecx
lea edx, [eax + edx]
jmp 0xf011c4
lea ecx, [ecx + 0x36]
xchg ah, al
ror ax, cl
shr eax, cl
rdtsc
xchg dl, ah
jmp 0xf01244
push ebx
push word [esp + 3]
bts dx, bx
lea esp, [esp + 2]
jmp 0xf01202
push dword [esp + 4]
ret 8
xchg dword [esp + 4], ecx
lea ecx, [esp + 0xeb]
dec eax
mov cx, word [esp]
shl eax, 0xb
jmp 0xf0122e
rcl dl, cl
not dl
jmp 0xf012a4
cmp ax, sp
jp 0xf01269
rcl dl, cl
not dl
inc edx
jmp 0xf012a5
bsr ecx, edi
js 0xf012c5
jns 0xf012c5
sti
jge 0xf01282
je 0xf0121e
xor eax, 0xbbdc4ecb
push esi
out 0x5f, eax
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
inc edx
rol ebp, 0
mov cx, bp
rdtsc
jmp 0xf0128b
cmc
jp 0xf012e5
mov cx, 0xf3a0
jmp 0xf012cf
add ebp, dword [esi]
mov cl, 0x9f
mov dx, 0x3426
jmp 0xf012af
mov cx, 0xf3a0
jmp 0xf012cf

Function at 0xf0bea2
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0xef0727
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0xef0741
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0xef0730
pop esi
jmp 0xef074c
ret 4
jmp 0xef071a

Function at 0xf0c8f2
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp], eax
mov di, word [esp]
mov edi, dword [esp + 0x44]
lea esp, [esp + 0x48]
jmp fcn.00eee963
Function at 0xf9a556
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00fc90f8
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00fc90f8
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.00fc90f8
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.00fca040
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0xf9a60f
mov eax, 0
jmp 0xf9a77b
cmp dword [ebp + 0xc], 0
jne 0xf9a645
mov dword [ebp - 0x18], esp
xor eax, eax
call fcn.00ee60d2
push 0xffffffffffffff90
nop
cmp dword [ebp - 0x18], esp
je 0xf9a642
push 0xa0
push 0x4045b1f
push 6
call fcn.00fc90ec
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0xf9a66d
mov eax, 0x1003b3f
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0xf9a667
push ebx
call fcn.00fc9104
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
xor eax, eax
call fcn.00ee7686
popal
nop
nop
cmp dword [ebp - 0x18], esp
je 0xf9a6a2
push 0x104
push 0x4045b1f
push 6
call fcn.00fc90ec
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x1003b50
xor eax, eax
call fcn.00eebbb9
retf 0x9090
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00fc9104
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00fc9104
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.00fc9104
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0xf9a7a7
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
mov eax, 0x1003b3f
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp + 8]
call fcn.00f9a7e9
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0xf9a7db
push ebx
call fcn.00fc9104
add esp, 4
mov eax, dword [ebp - 8]
jmp 0xf9a7e3
mov esp, ebp
pop ebp
ret 8
Function at 0xfce460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0xfce481
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0xfce4db
inc edi
cmp edi, esi
jl 0xfce475
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0xfce510
mov edx, dword [eax]
xor edx, esi
lea ebp, reloc.MSVCRT.dll_strncpy
not edx
and ebp, edx
test ebp, 0x80808080
je 0xfce4ca
cmp byte [eax], bl
je 0xfce4e5
cmp byte [eax + 1], bl
je 0xfce4ee
cmp byte [eax + 2], bl
je 0xfce4f8
cmp byte [eax + 3], bl
je 0xfce504
add eax, 4
cmp eax, edi
jb 0xfce4a1
pop edi
pop esi
pop ebp
or eax, reloc.MSVCRT.dll_strncpy
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, reloc.MSVCRT.dll_strncpy
pop ebx
ret 4

Function at 0xfce9e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + reloc.MSVCRT.dll_strncpy]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + reloc.MSVCRT.dll_strncpy]
mov eax, dword [esp + reloc.MSVCRT.dll_strncpy]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0xfcea12
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], pe_nt_image_headers32
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0xfcea72
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0xfcea49
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0xfceb20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x14]
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
xor esi, esi
mov byte [esp + 0x18], cl
test edi, edi
mov byte [esp + 8], dl
jle 0xfcebbc
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov cl, byte [esp + 0x20]
mov bl, byte [esp + 0x10]
inc cl
mov byte [esp + 0x20], cl
mov ecx, dword [esp + 0x20]
and ecx, 0xff
lea edi, [ecx + eax]
mov cl, byte [ecx + eax]
add bl, cl
mov byte [esp + 0x10], bl
mov ebx, dword [esp + 0x10]
and ebx, 0xff
lea ebp, [ebx + eax]
mov bl, byte [ebx + eax]
mov byte [edi], bl
mov byte [ebp], cl
mov bl, byte [edi]
add bl, cl
and ebx, 0xff
mov cl, byte [ebx + eax]
mov bl, byte [esi + edx]
xor bl, cl
mov ecx, dword [esp + 0x1c]
mov byte [esi + edx], bl
inc esi
cmp esi, ecx
jl 0xfceb4b
mov dl, byte [esp + 0x20]
mov cl, byte [esp + 0x10]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], dl
mov byte [eax + 0x101], cl
pop esi
pop ecx
ret
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
pop ecx
ret

Function at 0xfd9660
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xff9a38
push 0xfe1c0c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], reloc.MSVCRT.dll_strncpy
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00fe1da0
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100760e
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 3
pop ecx
cdq
idiv ecx
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], esi
lea ebx, [esi + 1]
mov dword [ebp - 8], ebx
test ebx, ebx
jle 0x10076b1
mov ecx, dword [ebp + 8]
lea esi, [edi + 2]
add ecx, 2
mov edi, ecx
mov al, byte [edi - 2]
shr al, 2
movzx eax, al
push eax
call fcn.010075c4
mov byte [esi - 2], al
mov cl, byte [edi - 2]
mov al, byte [edi - 1]
and cl, 3
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
push eax
call fcn.010075c4
mov byte [esi - 1], al
mov cl, byte [edi - 1]
mov al, byte [edi]
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
push eax
call fcn.010075c4
mov byte [esi], al
mov al, byte [edi]
and al, 0x3f
movzx eax, al
push eax
call fcn.010075c4
mov byte [esi + 1], al
lea edi, [edi + 3]
lea esi, [esi + 4]
dec ebx
jne 0x1007642
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cmp ecx, 1
jne 0x10076bf
mov word [edi + esi*4 + 2], 0x3d3d
jmp 0x10076c9
cmp ecx, 2
jne 0x10076cb
mov byte [edi + esi*4 + 3], 0x3d
mov esi, ebx
mov eax, esi
shl eax, 2
mov byte [eax + edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10409fd
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x24], eax
jmp 0x10408d9
call 0x103f8ed
jmp 0x1040a1d
mov dword [esp + 0x24], eax
jmp 0x10409f2
call 0x103f913
jmp 0x1040a7e
call 0x103fffe
jmp 0x1042172
popal
jmp 0x10408f5
inc dword [esp + 8]
push edx
pop word [esp]
lea esp, [esp + 2]
push ebx
jmp 0x104095b
call 0x1040914
inc edi
inc esp
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
jnp 0x104092f
add byte [eax], al
jnp 0x1040974
sub ecx, fcn.0103f88b
mov dword [ecx + 0x104085b], eax
jmp 0x1040966
sbb al, 0x85
add byte [eax], al
add byte [eax], al
mov ebx, dword [esp + 0x24]
lea esp, [esp + 0x28]
jmp 0x104097c
mov bx, bp
mov bh, byte [esp]
call fcn.01040943
movzx ebx, byte [eax]
jmp 0x1040994
scasb al, byte es:[edi]
pop ebp
fdivr qword [esi]
or dword [eax - reloc.MSVCRT.dll_strncpy], ebp
popfd
ret
cmp ebx, 0x30c277f3
jmp 0x1040a15
add ebx, 0x30c27727
jmp 0x104097e
pop esp
mov esi, 0x3051c145
ret
jmp 0x1040a68
popfd
ret
popal
inc dword [esp + 8]
call 0x10409fd
ja 0x1040a64
mov dword [esp], esi
pop word [esp]
jmp 0x1040ab9
je 0x10409e2
jne 0x103f890
pop eax
jmp 0x1040a3b
jne 0x10409ee
pushal
jmp 0x103f8e8
sub eax, 0x301703b5
jmp 0x1040a9d
push eax
call fcn.00ef14d8
jmp 0x103f90e
add al, 0
jmp 0x1040a33
inc dword [esp + 8]
jmp 0x10409f0
pop ecx
sub ecx, 0x103f913
mov dword [ecx + 0x10409c2], eax
jmp 0x1040ad8
call 0x1040aaf
dec edi
dec esp
inc ebp
inc ecx
push ebp
push esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
and al, 0x6e
add dword [eax], esi
push 0x14
xor byte [edx + 0x14], ch
jmp 0x1040a42
mov byte [esp], dh
lea esp, [esp + 2]
push eax
call fcn.01040be3
xchg ebp, eax
sbb byte [esi - 0x1a04e717], cl
jne 0x1040ab4
invalid
movzx ebx, byte [eax]
jmp 0x1040b07
pop eax
popfd
ret
add ebx, 0x8916edc9
cmp ebx, 0x8916ee95
je 0x1040b71
jne 0x103f8f2
wait
or al, 0x82
in eax, 0x14
mov ebp, 0x6809990f
wait
sub bh, byte [eax + 0x5b]
not ax
pop ecx
mov eax, 0x3275caf7
mov eax, dword [esp]
mov ax, 0x7f11
mov ax, di
jmp 0x1040aee
mov cx, bx
lea ecx, reloc.MSVCRT.dll_strncpy
jmp 0x1040b29
jmp 0x10421c6
pop eax
jmp 0x10421aa
jne 0x104228b
pushal
jmp 0x103fff9
sub eax, 0xd5eddf4b
jmp 0x1040905
push 0
pushfd
cmp dword [esp + 4], 0
jmp 0x1042188
popfd
ret
inc dword [esp + 8]
jmp 0x10421d3
jmp 0x10421e9
Function at 0x105e04b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esp]
mov ebx, 0x932ec046
mov byte [esp], ch
xchg byte [esp + 2], dh
jmp 0x105e076
push si
xchg ecx, edx
mov ax, 0xec0e
pop bp
mov dl, dh
jmp 0x105e035
pop word [esp]
mov si, ax
mov edi, dword [esp]
mov byte [esp], bh
mov ebx, dword [esp]
mov ecx, 0xa963b80a
jmp 0x105e0af
stc
lea edi, [esp - 0x31]
xchg byte [esp + 1], ch
dec ax
std
mov ax, word [esp + 3]
jmp 0x105e059
rdtsc
clc
mov cx, word [esp]
mov bp, 0x3614
xchg al, bh
btr bp, bx
jmp 0x105e0bd
mov bl, 0x25
std
mov word [esp], ax
std
cld
add esp, 1
jmp 0x105e089
bswap ebp
mov bp, 0x605a
clc
mov bl, byte [esp]
not bx
xchg si, bp
jmp 0x105e32e
sub edi, esp
mov si, word [esp + 2]
rdtsc
mov dh, byte [esp + 1]
lea esp, [esp + 2]
bswap ebp
call fcn.0105e145
mov edi, 0x3bc8a939
xlatb
cwde
sti
ror byte [ebp + 0x66], cl
mov ecx, ebp
mov cx, bp
not bx
mov ebp, dword [esp]
push word [esp]
mov bp, 0xcb07
inc edx
jmp 0x105e0f9
not ebx
sub esp, 1
mov ebx, esi
mov ch, ah
not bh
dec bl
jmp 0x105e11b
lea eax, [edi + ebp]
std
setp ah
xchg cx, ax
inc si
add esp, 0
jmp 0x105e16d
lea ecx, [edx - 0x36]
xchg bp, bx
lea eax, [ecx*4]
bsr bx, si
xchg edi, esi
std
jmp 0x105e25a

Function at 0x105e279
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov bh, 0x12
jmp 0x105e2be
bsf edi, ebx
std
mov bh, 1
mov ebp, dword [esp + 0x14]
push di
jmp 0x105e30c
mov si, bp
lea edi, [eax*4]
sub esp, 0x1c
mov ebx, ebp
mov edi, 0xdab8ade3
mov bh, bl
jmp 0x105e2a8
pop word [esp + 0x14]
rdtsc
mov bx, 0xa96e
mov ch, ah
lea ebx, [ecx*4]
stc
jmp 0x105e2f6

Function at 0x105ea1d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 2]
mov ah, byte [esp + 2]
setne bl
neg bp
lea ebp, [eax*4]
ror cx, cl
jmp 0x105e9df
lea esp, [esp + 8]
jmp 0x105e9f5

Function at 0x105ed21
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ebp, edi
mov ebp, ecx
pop word [esp]
btr edi, edx
cmc
lea ebp, reloc.MSVCRT.dll_strncpy
jmp 0x105ecea
sub esp, 0xf
bswap ecx
mov byte [esp + 6], dh
rdtsc
std
sete dl
jmp 0x105ec93
push word [esp + 6]
xchg dword [esp], edi
neg dx
lea ebp, reloc.MSVCRT.dll_strncpy
push word [esp + 2]
mov bx, bp
jmp 0x105ecff
push sp
pop word [esp]
bsr eax, eax
bswap ebp
bsr bp, bx
lea esp, [esp + 8]
jmp 0x105ecbf
sub esp, 0x1d
xor bp, bp
mov byte [esp + 0xa], dh
popal
push dword [esp + 1]
mov dword [esp + 7], edi
jmp 0x105ed51
mov byte [esp], cl
mov ebp, 0xb93652f1
xchg dword [esp], eax
add esp, 3
lea eax, [ebp*4]
jmp 0x105ecae
pop dword [esp + 6]
mov al, cl
lea edx, [edx + ebp]
neg bx
jmp 0x105ed64
push esi
rdtsc
xchg dword [esp + 8], eax
mov al, 0xa6
bt edx, edi
push word [esp + 0xd]
jmp 0x105ed3b
mov word [esp + 3], dx
xchg word [esp + 2], ax
mov byte [esp + 7], ch
sub esp, 0x18
popal
jmp 0x105ed99
lea ebx, reloc.MSVCRT.dll_strncpy
neg dx
mov edx, dword [esp + 5]
sub ax, bx
jmp 0x105eddd
mov dl, 0xc4
xchg al, bh
shl dx, 1
mov ebx, dword [esp + 2]
pop ebp
bswap ecx
jmp 0x105edc2
Function at 0x105f036
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x105eff3
pop word [esp]
mov byte [esp], dl
lea esp, [esp + 1]
lea esp, [esp + 1]
jmp 0x105f009