joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bbf94
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, 0x3f
push ebx
mov ebx, dword [ebp + 0xc]
sar edx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [edx*4 + 0x10103cd0]
mov dword [ebp - 8], edx
mov edx, dword [eax + edi + 0x18]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100bbfd8
push 0xa
pop esi
cmp word [ebx], si
jne 0x100bbfd8
or byte [eax + edi + 0x28], 4
jmp 0x100bbfdd
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + edx*2]
mov eax, ebx
mov dword [ebp - 0x10], edx
mov esi, ebx
cmp ebx, edx
jae 0x100bc148
movzx edx, word [eax]
mov ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, cx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
cmp edx, 0x1a
je 0x100bc120
lea ebx, [eax + 2]
mov dword [ebp - 4], ebx
push 0xd
pop ebx
cmp dx, bx
mov ebx, dword [ebp + 0xc]
je 0x100bc02a
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 4]
movzx ebx, bx
mov dword [ebp - 4], ebx
jmp 0x100bc054
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x100bc073
push 0xa
pop ebx
cmp word [edx], bx
jne 0x100bc041
push ebx
add eax, 4
pop edx
jmp 0x100bc049
mov eax, edx
mov edx, dword [ebp - 0xc]
movzx edx, dx
movzx edx, dx
mov dword [ebp - 4], edx
mov edx, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
mov word [esi], cx
mov esi, dword [ebp - 0xc]
add esi, edx
cmp eax, dword [ebp - 0x10]
jb 0x100bbfef
jmp 0x100bc148
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100bc11b
cmp dword [ebp - 0x14], 0
je 0x100bc11b
mov eax, dword [ebp - 8]
push 0xa
mov eax, dword [eax*4 + 0x10103cd0]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x100bc0f7
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x100bc0bf
mov word [esi], ax
jmp 0x100bc145
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebp - 8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov eax, dword [eax*4 + 0x10103cd0]
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10103cd0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10103cd0]
pop ecx
mov byte [eax + edi + 0x2c], cl
jmp 0x100bc145
cmp word [ebp - 4], ax
jne 0x100bc101
cmp esi, ebx
je 0x100bc0b7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100b856f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x100bc148
push 0xd
pop eax
jmp 0x100bc0b7
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
mov edi, dword [eax*4 + 0x10103cd0]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x100bc142
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x100bc148
mov word [esi], dx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100beea0
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100b223d
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100b223d
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100bef17
cmp word [ecx], dx
je 0x100bef17
mov eax, dword [0x100df22c]
push edi
dec eax
push eax
push 0x100df118
call fcn.100bf090
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100bef8a
cmp word [eax], dx
je 0x100bef8a
mov eax, dword [edi]
test eax, eax
je 0x100bef3b
cmp word [eax], dx
je 0x100bef3b
lea eax, [ebp - 0x10]
push eax
call fcn.100bf0f7
jmp 0x100bef44
lea eax, [ebp - 0x10]
push eax
call fcn.100bf3e6
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100befb4
mov eax, dword [0x100df114]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100dee08
call fcn.100bf090
add esp, 0xc
test al, al
je 0x100befb4
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100bef7f
cmp word [eax], di
je 0x100bef7f
lea eax, [ebp - 0x10]
push eax
call fcn.100bf0f7
pop ecx
jmp 0x100befb6
lea eax, [ebp - 0x10]
push eax
call fcn.100bf3e6
jmp 0x100bef7c
mov eax, dword [edi]
test eax, eax
je 0x100befa1
cmp word [eax], dx
je 0x100befa1
lea eax, [ebp - 0x10]
push eax
call fcn.100bf516
pop ecx
jmp 0x100befb4
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100bf07f
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100bf604
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100bf07f
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100bf07f
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100bf07f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100bf00c
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100b439e
test ebx, ebx
je 0x100bf07a
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100b439e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100bf07f
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100bf07f
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100c3181
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100bf081
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005677
leave
ret
Function at 0x100bf70a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100b223d
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100bf779
cmp esi, dword [ebp - 4]
je 0x100bf774
cmp dword [ebp + 0xc], 0
je 0x100bf774
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100bf751
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100bf7d3
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100bf77b
xor eax, eax
inc eax
jmp 0x100bf77b
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x100c2784
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100ed440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x100c27c7
call fcn.100ac10f
mov dword [eax], 0xf
call fcn.100ac0d9
mov dword [eax], 0xd
call fcn.100acb04
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10005677
leave
ret
test eax, eax
jne 0x100c27ce
inc eax
jmp 0x100c27bb
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x100c27b9
xor eax, eax
cmp ecx, 1
setne al
jmp 0x100c27bb
Function at 0x100c39b6
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100c3b4d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100c3b25
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100c3b25
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100c3ada
jg 0x100c3a12
test eax, eax
je 0x100c3ad0
push 1
push 0x1000
call fcn.100b53d0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100c3a35
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100c3ac7
push 0x8000
push ebx
call fcn.100c38ae
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100c3a5e
jg 0x100c3a59
cmp ecx, 0x1000
jb 0x100c3a5e
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100ba8fd
add esp, 0x10
cmp eax, 0xffffffff
je 0x100c3aa3
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100c3a59
jl 0x100c3a8a
test ecx, ecx
jne 0x100c3a4b
push dword [ebp - 0xc]
push ebx
call fcn.100c38ae
push esi
call fcn.100b1f90
add esp, 0xc
xor ebx, ebx
jmp 0x100c3b33
cmp byte [edi + 0x24], 0
je 0x100c3aba
cmp dword [edi + 0x20], 5
jne 0x100c3aba
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100c3ac5
mov ebx, dword [edi + 0x18]
jmp 0x100c3ac7
xor ebx, ebx
push esi
call fcn.100b1f90
pop ecx
jmp 0x100c3b33
test ecx, ecx
jg 0x100c3a9c
jl 0x100c3ada
test eax, eax
jae 0x100c3a9c
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100b856f
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100c3afa
cmp byte [edi + 0x1c], 0
je 0x100c3a9c
jmp 0x100c3b2b
push ebx
call fcn.100b9f53
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100c3a9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100c3b33
cmp byte [edi + 0x1c], 0
je 0x100c3b30
mov ebx, dword [edi + 0x18]
jmp 0x100c3b33
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100b856f
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5ddb37
Capabilities:
Parse pe header

Disassembly:
xchg edx, eax
inc dword [ebx + 0x39427a9d]
and dword [ebp + 0x47189f4a], ebx
dec ecx
mov word [0x70d8fc5e], ax
inc ebp
cdq
sbb byte [edi + 0x78], al
sbb al, 0xb4
inc esi
dec ecx
cdq
in eax, 0x9d
jle 0x5ddbc0
mov al, byte [0x4d8fc5e]
cmp dword [edi + 0x122d0485], 0x32303031
jne 0x5ddb7f
cmp word [eax], 0x5a4d
je 0x5ddb7f
call fcn.005e3cb6
cmp word [eax], 0x5a4d
je 0x5ddb8f
call fcn.005e3cb6
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x5ddbb2
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx + 0x14]
add eax, ebx
push 0
push dword [ebp + 0xc]
push ebx
call eax
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 8
cmp dword [ebp + 0x18], 0
jne 0x5ddd0e
cmp dword [ebp + 0xc], 0
jne 0x5ddd0e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5ddc01
sub eax, dword [ebp + 0x10]
js 0x5ddd0e
je 0x5ddd0e
cmp eax, dword [ebp + 0x14]
jl 0x5ddd0e
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5ddd0e
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5ddd0e
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d30c5]
pop edi
test eax, eax
je 0x5ddd0e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124a1f71]
push eax
call fcn.005dcc22
pop edi
test eax, eax
je 0x5ddd0e
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124a1f75]
push eax
call fcn.005dcc22
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5ddd01
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5ddd0e
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5ddcee
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5ddcbc
push dword [ebp + 8]
call fcn.005deab0
jmp 0x5ddd15
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5de0a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5de18f
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5de18f
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5de13b
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5de18f
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124a20d1]
pop edi
pop ecx
test eax, eax
jne 0x5de0f4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5de141
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5de18f
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5de18f
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5de18f
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5de18f
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005ddfe9
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x10001640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 1
imul ecx, eax, 7
mov edx, dword [str.r_5FbGpKcP]
movsx eax, byte [edx + ecx]
cmp eax, 0x59
jne 0x1000166f
mov ecx, 1
shl ecx, 3
mov edx, dword [str.r_5FbGpKcP]
mov byte [edx + ecx], 0x58
mov eax, 1
imul ecx, eax, 0
mov edx, dword [str.80tNu_O__Xaqac.9S2_gHgfrg_]
movsx eax, byte [edx + ecx]
cmp eax, 0x48
jne 0x10001697
mov ecx, 1
imul edx, ecx, 5
mov eax, dword [str.80tNu_O__Xaqac.9S2_gHgfrg_]
mov byte [eax + edx], 0x2a
mov ecx, 2
imul edx, ecx, 6
mov eax, dword [str.fg65doJdqvyTT:Cj_CKnB_5Os6_]
movzx ecx, word [eax + edx]
cmp ecx, 0x5a
jne 0x100016c4
mov edx, 2
imul eax, edx, 0xf
mov ecx, 0x67
mov edx, dword [str.fg65doJdqvyTT:Cj_CKnB_5Os6_]
mov word [edx + eax], cx
movzx eax, word [0x1008b05c]
imul ecx, eax, 0x864e
mov word [0x1008b05c], cx
movzx edx, word [0x1008b05c]
or edx, 0x7732
mov word [0x1008b05c], dx
movzx eax, word [0x1008b05c]
imul ecx, eax, 0x3ec2
mov word [0x1008b05c], cx
mov byte [ebp - 1], 0
movzx edx, word [0x1008b05c]
xor edx, 0xa6ff
mov word [0x1008b05c], dx
movzx eax, word [0x1008b05c]
add eax, 0xb86e
mov word [0x1008b05c], ax
movzx ecx, word [0x1008b05c]
and ecx, 0x5d79
mov word [0x1008b05c], cx
movzx edx, word [0x1008b05c]
imul eax, edx, 0x6227
mov word [0x1008b05c], ax
movzx ecx, word [0x1008b05c]
or ecx, 0xc250
mov word [0x1008b05c], cx
movzx edx, word [0x1008b05c]
or edx, 0xfef4
mov word [0x1008b05c], dx
mov eax, dword [ebp + 8]
push eax
call fcn.10021f20
add esp, 4
movzx ecx, word [0x1008b05c]
imul edx, ecx, 0x4818
mov word [0x1008b05c], dx
movzx eax, word [0x1008b05c]
imul ecx, eax, 0x45ec
mov word [0x1008b05c], cx
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10021ee0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100017e6
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
cmp edx, dword [ebp + 0xc]
jne 0x100017e4
mov byte [ebp - 1], 1
jmp 0x100017e6
jmp 0x100017b4
movzx eax, word [0x1008b05c]
sub eax, 0xe77d
mov word [0x1008b05c], ax
movzx ecx, word [0x1008b05c]
or ecx, 0x4b47
mov word [0x1008b05c], cx
movzx edx, word [0x1008b05c]
xor edx, 0x5d57
mov word [0x1008b05c], dx
mov eax, dword [ebp + 8]
push eax
call fcn.10021f30
add esp, 4
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x10002000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 2
imul ecx, eax, 0x1b
mov edx, dword [str.f.qidav43p2_OQrarCn_UOezyMH]
movzx eax, word [edx + ecx]
cmp eax, 0x78
jne 0x10002034
mov ecx, 2
imul edx, ecx, 0x18
mov eax, 0x5e
mov ecx, dword [str.f.qidav43p2_OQrarCn_UOezyMH]
mov word [ecx + edx], ax
movzx edx, byte [0x1008afab]
add edx, 0xc78e
mov word [0x1008afa8], dx
movzx eax, word [0x1008afa8]
add eax, 0xc35f
mov word [0x1008afa8], ax
movzx ecx, word [0x1008afd0]
imul edx, ecx, 0x2576
mov word [0x1008afa8], dx
movzx eax, byte [0x1008afee]
sub eax, 0xa12d
mov word [0x1008afa8], ax
movzx ecx, byte [0x1008afee]
sub ecx, 0x1ba9
mov word [0x1008afa8], cx
mov edx, dword [ebp + 8]
push edx
call fcn.10021f20
add esp, 4
movzx eax, byte [0x1008afee]
or eax, 0x11
mov byte [0x1008afab], al
mov ecx, dword [0x1008afd0]
xor ecx, 0x8113c7c6
mov dword [0x1008afd0], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10021ee0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10002115
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
cmp edx, dword [ebp + 0xc]
je 0x100020f8
cmp dword [ebp + 0xc], 0
jne 0x10002113
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10001ba0
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x100020c8
movzx eax, byte [0x1008afab]
add eax, 0x6a
mov byte [0x1008afee], al
movzx ecx, byte [0x1008afab]
xor ecx, 0xa7
mov byte [0x1008afab], cl
mov edx, dword [ebp + 8]
push edx
call fcn.10021f30
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x10021d30
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [ebx + 1]
imul eax, dword [esp + 0x1c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10021d95
push edi
xor edx, edx
xor eax, eax
xor edi, edi
test ebx, ebx
je 0x10021d92
mov ebp, dword [esp + 0x14]
xor ecx, ecx
cmp eax, 0x40
cmovne ecx, eax
mov al, byte [ecx + 0x10078aa0]
xor al, byte [edi + ebp]
inc edi
xor al, byte [esp + 0x1c]
cmp dword [esp + 0x20], 2
mov byte [edx + esi], al
lea eax, [edx + 1]
cmovne eax, edx
lea edx, [eax + 1]
lea eax, [ecx + 1]
cmp edi, ebx
jb 0x10021d60
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10059c20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 2
imul ecx, eax, 0
mov edx, dword [str._K_vJ]
movzx eax, word [edx + ecx]
cmp eax, 0x7c
jne 0x10059c53
mov ecx, 2
shl ecx, 2
mov edx, 0x43
mov eax, dword [str._K_vJ]
mov word [eax + ecx], dx
movzx ecx, byte [0x1008a620]
and ecx, 0x32
mov byte [0x1008a5e6], cl
mov edx, dword [0x1008a620]
add edx, 0x4a69a750
mov dword [0x1008a61c], edx
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
je 0x10059db1
mov eax, dword [0x1008a61c]
xor ecx, ecx
add eax, 0xd03d8481
adc ecx, 0xce06c45f
mov dword [0x1008a620], eax
mov dword [0x1008a624], ecx
movzx edx, byte [0x1008a5e6]
add edx, 0xfc
mov byte [0x1008a5e7], dl
mov eax, dword [0x1008a61c]
xor ecx, ecx
push 0x86ff35c0
push 0x2679790e
push ecx
push eax
call fcn.100660e0
mov dword [0x1008a620], eax
mov dword [0x1008a624], edx
movzx edx, byte [0x1008a61c]
imul eax, edx, 0xbe
mov byte [0x1008a5e7], al
mov ecx, dword [0x1008a61c]
or ecx, 0x2f58a020
mov dword [0x1008a61c], ecx
mov edx, dword [0x1008a620]
xor edx, 0xf8c51539
mov dword [0x1008a61c], edx
movzx eax, byte [0x1008a5e7]
add eax, 0x90
mov byte [0x1008a5e7], al
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x10059db1
movzx eax, byte [0x1008a5e6]
and eax, 0x2d
mov byte [0x1008a5e6], al
movzx ecx, byte [0x1008a5e6]
xor ecx, 0x7768bebf
mov dword [0x1008a61c], ecx
movzx edx, byte [0x1008a5e7]
xor edx, 0x5b97392d
mov dword [0x1008a61c], edx
movzx eax, byte [0x1008a5e7]
and eax, 0x72
mov byte [0x1008a5e6], al
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp + 8]
cmp dword [eax + edx], 0x4550
jne 0x10059d8e
mov dword [ebp - 8], 1
jmp 0x10059d95
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
jne 0x10059da4
mov dword [ebp - 0xc], 0
jmp 0x10059dab
mov dword [ebp - 0xc], 1
mov cl, byte [ebp - 0xc]
mov byte [ebp - 1], cl
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x668a6396
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x6e466ef7
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x100326c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x1051008], 0x8088405
inc edx
mov dword [ebx + 0x1051008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x101f340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x101f42e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.010051d8
lea eax, [ebp - 8]
mov edx, edi
mov ecx, 0
call fcn.010051d8
mov eax, dword [ebp - 8]
test eax, eax
je 0x101f3a3
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x101f3a3
lea eax, [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.01004748
test eax, eax
je 0x101f3ac
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x101f3ce
mov edx, eax
sub edx, 0xa
cmp word [edx], 1
je 0x101f3ce
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.01004748
test eax, eax
je 0x101f3d7
sub eax, 4
mov eax, dword [eax]
mov esi, eax
test esi, esi
jle 0x101f408
mov ebx, 1
lea eax, [ebp - 4]
call fcn.01004b0c
lea eax, [eax + ebx - 1]
push eax
mov eax, ebx
dec eax
cdq
idiv dword [ebp - 0x10]
movzx eax, word [edi + edx*2]
mov edx, dword [ebp - 4]
xor al, byte [edx + ebx - 1]
pop edx
mov byte [edx], al
inc ebx
dec esi
jne 0x101f3e2
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.010051b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x101f435
lea eax, [ebp - 8]
mov edx, 2
call fcn.0100458c
ret