joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x42901690
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..reloc
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x181e12a4
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, reloc.kernel32.dll_SleepEx
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x1012dd0c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.1012dd8b
jae 0x1012dd18
xor ecx, ecx
call fcn.1012dd8b
jae 0x1012dd42
xor eax, eax
call fcn.1012dd8b
jae 0x1012dd53
mov al, 0x10
call fcn.1012dd8b
adc al, al
jae 0x1012dd34
jne 0x1012dd80
stosb byte es:[edi], al
jmp 0x1012dd19
call fcn.1012dd97
dec ecx
loop 0x1012dd5f
mov eax, ebp
call fcn.1012dd95
jmp 0x1012dd81
lodsb al, byte [esi]
shr eax, 1
je 0x1012dda7
adc ecx, 2
mov ebp, eax
jmp 0x1012dd81
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.1012dd95
cmp eax, 0x7d00
jae 0x1012dd7f
cmp eax, 0x500
jae 0x1012dd80
cmp eax, 0x7f
ja 0x1012dd81
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1012dd19
pop ebp
ret 8

Function at 0x10191cf3
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.10191d72
jae 0x10191cff
xor ecx, ecx
call fcn.10191d72
jae 0x10191d29
xor eax, eax
call fcn.10191d72
jae 0x10191d3a
mov al, 0x10
call fcn.10191d72
adc al, al
jae 0x10191d1b
jne 0x10191d67
stosb byte es:[edi], al
jmp 0x10191d00
call fcn.10191d7e
dec ecx
loop 0x10191d46
mov eax, ebp
call fcn.10191d7c
jmp 0x10191d68
lodsb al, byte [esi]
shr eax, 1
je 0x10191d8e
adc ecx, 2
mov ebp, eax
jmp 0x10191d68
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.10191d7c
cmp eax, 0x7d00
jae 0x10191d66
cmp eax, 0x500
jae 0x10191d67
cmp eax, 0x7f
ja 0x10191d68
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10191d00
pop ebp
ret 8
Function at 0x4a334c
Capabilities:
Encode data using xor

Disassembly:
fadd qword [eax + 0x75]
jo 0x4a33a5
inc edx
ror byte [edi - 0x35], cl
aad 6
sal cl, 1
int 0x14
mov gs, word [ecx]
mov ch, byte [ebx + 0x1cc413bc]
inc eax
adc byte [edx - 0x1669a3f6], dh
xor ah, bl
invalid
sub dl, byte ds:[eax]
cmp al, 0xcd
cmp eax, 0xb2af799c
aad 0x49
sub bh, byte [eax - 0xe21e1ff]
push ds
fdivrp st(1)
or word [edi], ax
sbb al, 0x63
add al, 0xb9
xor eax, 0xdfc69022
popfd
arpl sp, si
jl 0x4a3396
adc ebx, 0xffffffb0
xor byte [eax - 0x603d6ae7], al
add bh, byte [ebx + 0x4b3d9c6e]
cld
test dword [esi], 0xf4829170
and dword [edi + 0x201e03af], eax
sbb bl, byte [ebp - 0x3754d510]
je 0x4a33ce
hlt
sbb ch, byte ds:[0x9d522ea7]
lds eax, [edi + ebx + 0x6f851370]
cmpsd dword [esi], dword es:[edi]
sbb dh, byte [0xc8442b00]
xchg edx, eax
rol edx, 1
loop 0x4a33fa
cmpsb byte [esi], byte es:[edi]
retf
invalid
Function at 0x10005d60
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100606b3
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x1007a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp dword [esi], 0
jne 0x10005ece
cmp dword [esi + 4], 0
jne 0x10005ece
push 0
push 0
push 0
push 0
push 0x1006b2c4
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], eax
test eax, eax
je 0x10005ece
push 0x1b7740
push 0x1b7740
push 0xea60
push 0xea60
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x80e]
push edx
mov word [ebp - 0x810], cx
call fcn.1004acc0
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x1c], 0x10
jae 0x10005e07
lea eax, [ebp + 8]
push 0x400
lea ecx, [ebp - 0x810]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10005e3d
mov edx, dword [esi]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
lea ecx, [ebp + 8]
call fcn.10002a50
jmp 0x10005ee0
xor eax, eax
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], 0
mov word [ebp - 0x82c], ax
push eax
push edi
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 1
mov edx, dword [esi]
push ecx
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [esi + 4], eax
test eax, eax
jne 0x10005e95
mov eax, dword [esi]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
lea ecx, [ebp - 0x82c]
call fcn.10007650
lea ecx, [ebp + 8]
call fcn.10002a50
jmp 0x10005ee0
push 0xffffffffffffffff
push 0
lea ecx, [ebp + 8]
push ecx
lea ecx, [esi + 0x13a0]
call fcn.100034c0
mov dl, byte [ebp + 0x24]
lea ecx, [ebp - 0x82c]
mov dword [esi + 0x13bc], edi
mov byte [esi + 0x13c0], dl
call fcn.10007650
lea ecx, [ebp + 8]
call fcn.10002a50
mov al, 1
jmp 0x10005ee2
cmp dword [ebp + 0x1c], 0x10
jb 0x10005ee0
mov eax, dword [ebp + 8]
push eax
call fcn.10046e92
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004677e
mov esp, ebp
pop ebp
ret 0x20
Function at 0x10007220
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060c49
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1007a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea eax, [esi + 0x18]
mov dword [ebp - 4], ebx
call fcn.100077d0
lea ecx, [esi + 0x13a0]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
mov byte [ecx], bl
push ebx
mov byte [ebp - 4], 1
push 0x1006b2c6
mov dword [esi + 4], ebx
mov dword [esi], ebx
call fcn.100035b0
mov dword [esi + 0x13bc], ebx
mov byte [esi + 0x13c0], bl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1c], eax
lea ecx, [ebx + 1]
lea edx, [esi + 0x20]
nop
mov ebx, eax
shr ebx, 0x1e
xor eax, ebx
imul eax, eax, 0x6c078965
add eax, ecx
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0x270
jl 0x100072a0
mov dword [esi + 0x18], 0x270
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10007430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1007a010]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [edi + 0x14], 0x10
push ebx
push esi
mov dword [edi + 0x10], 0
jb 0x10007457
mov eax, dword [edi]
jmp 0x10007459
mov eax, edi
lea ebx, [ecx + 0x18]
mov esi, 0xa
push ebx
lea ecx, [esi - 4]
mov byte [eax], 0
call fcn.100098a0
mov dword [esp + 0x10], 0x64636261
mov dword [esp + 0x14], 0x68676665
mov dword [esp + 0x18], 0x6c6b6a69
mov dword [esp + 0x1c], 0x706f6e6d
mov dword [esp + 0x20], 0x74737271
mov dword [esp + 0x24], 0x78777675
mov word [esp + 0x28], 0x7a79
test eax, eax
je 0x100074d9
mov dword [esp + 8], eax
lea esp, [esp]
push ebx
mov esi, 0x19
xor ecx, ecx
call fcn.100098a0
mov al, byte [esp + eax + 0x10]
mov byte [esp + 0xc], al
mov ecx, dword [esp + 0xc]
push ecx
push 1
mov ecx, edi
call fcn.10008080
dec dword [esp + 8]
jne 0x100074b0
mov ecx, dword [esp + 0x2c]
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.1004677e
mov esp, ebp
pop ebp
ret

Function at 0x100077d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov ecx, 0x1571
push edi
mov dword [eax + 0x1384], 0xffffffff
mov dword [eax + 4], ecx
mov edx, 1
lea esi, [eax + 8]
lea esp, [esp]
mov edi, ecx
shr edi, 0x1e
xor ecx, edi
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x270
jl 0x100077f0
pop edi
mov dword [eax], 0x270
pop esi
ret
Function at 0x100099d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
lea ecx, [esi + 0x9c4]
mov edi, 0xe3
lea esp, [esp]
mov eax, dword [ecx + 4]
xor eax, dword [ecx]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [ecx + 0x634]
shr eax, 1
xor edx, eax
mov dword [ecx - 0x9c0], edx
add ecx, 4
dec edi
jne 0x100099e0
lea ecx, [esi + 0xd50]
mov edi, 0x18c
nop
mov eax, dword [ecx]
xor eax, dword [ecx + 4]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [ecx - 0xd4c]
shr eax, 1
xor edx, eax
mov dword [ecx - 0x9c0], edx
add ecx, 4
dec edi
jne 0x10009a20
mov eax, dword [esi + 0x1380]
xor eax, dword [esi + 4]
and eax, 0x7fffffff
xor eax, dword [esi + 0x1380]
mov ecx, eax
and cl, 1
movzx edx, cl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [esi + 0x634]
shr eax, 1
xor edx, eax
mov dword [esi + 0x9c0], edx
mov dword [esi], edi
pop edi
ret

Function at 0x10009a90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
add eax, 0x638
mov edx, 0x68
push edi
lea ecx, [ecx]
mov esi, dword [eax - 0x630]
mov ecx, dword [eax - 0x634]
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, dword [eax - 0x634]
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
shr ecx, 1
and edi, 0x9908b0df
xor edi, ecx
xor edi, dword [eax]
mov dword [eax + 0x38c], edi
mov edi, dword [eax - 0x62c]
mov ecx, edi
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
shr ecx, 1
and esi, 0x9908b0df
xor esi, dword [eax + 4]
xor esi, ecx
mov dword [eax + 0x390], esi
mov esi, dword [eax - 0x628]
mov ecx, esi
xor ecx, edi
and ecx, 0x7fffffff
xor ecx, edi
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
shr ecx, 1
and edi, 0x9908b0df
xor edi, dword [eax + 8]
xor edi, ecx
mov dword [eax + 0x394], edi
mov edi, dword [eax - 0x624]
mov ecx, edi
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
shr ecx, 1
and esi, 0x9908b0df
xor esi, dword [eax + 0xc]
xor esi, ecx
mov dword [eax + 0x398], esi
mov esi, dword [eax - 0x620]
mov ecx, esi
xor ecx, edi
and ecx, 0x7fffffff
xor ecx, edi
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
and edi, 0x9908b0df
xor edi, dword [eax + 0x10]
shr ecx, 1
xor edi, ecx
mov ecx, dword [eax - 0x61c]
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
mov dword [eax + 0x39c], edi
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x14]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x3a0], esi
add eax, 0x18
dec edx
jne 0x10009aa0
pop edi
pop esi
pop ebx
ret
Function at 0x10009be0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x1007a010]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, edx
mov edx, dword [eax]
mov dword [ebx], edx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov edx, dword [eax]
mov dword [ebx + 8], edx
mov eax, dword [eax + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x18], ebx
cmp eax, 1
jae 0x10009c42
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0x1006e2d8
call fcn.10046815
push 0x100738f8
lea edx, [esp + 0x20]
push edx
call fcn.1004a731
cmp eax, 0x38
jbe 0x10009c51
mov dword [ebp + 8], 0x38
mov eax, dword [ebp + 8]
push eax
push ecx
lea eax, [esp + 0x34]
push eax
call fcn.1004a3d0
lea edi, [ebx + 0x10]
push 0x1000
add ebx, 0x58
push 0x1006d2d8
mov ecx, 0x12
mov esi, 0x1006d290
mov dword [esp + 0x24], edi
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x40], ebx
call fcn.1004a3d0
mov edi, dword [esp + 0x28]
add esp, 0x18
lea ecx, [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x14], 0x12
lea esp, [esp]
xor edx, edx
mov esi, 4
movzx ebx, byte [ecx]
shl edx, 8
inc eax
dec esi
or edx, ebx
inc ecx
cmp eax, dword [ebp + 8]
jne 0x10009cbd
xor eax, eax
lea ecx, [esp + 0x2c]
test esi, esi
jne 0x10009ca7
xor dword [edi], edx
add edi, 4
dec dword [esp + 0x14]
jne 0x10009ca0
mov edi, dword [esp + 0x18]
xor ebx, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
add edi, 0x10
lea ecx, [ecx]
mov eax, dword [esp + 0x18]
lea esi, [esp + 0x1c]
call fcn.10009d70
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [edi + 4], edx
add ebx, 2
add edi, 8
cmp ebx, 0x12
jb 0x10009ce0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 4
mov edi, dword [esp + 0x14]
xor ebx, ebx
jmp 0x10009d20
mov eax, dword [esp + 0x18]
lea esi, [esp + 0x1c]
call fcn.10009d70
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [edi + 4], edx
add ebx, 2
add edi, 8
cmp ebx, 0x100
jl 0x10009d20
add dword [esp + 0x14], 0x400
dec dword [esp + 0x10]
jne 0x10009d15
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004677e
mov esp, ebp
pop ebp
ret 8
Function at 0x10010310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100611f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1007a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x10010431
cmp byte [edi + 0x49], bl
je 0x10010431
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x10010425
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10010385
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x1001039d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x100103c6
dec eax
je 0x100103ca
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x10010420
jmp 0x1001042c
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x100103da
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x10010403
cmp ebx, 0x10
jae 0x100103e9
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.100484c9
add esp, 0x10
cmp esi, eax
jne 0x1001041d
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x10010429
test esi, esi
jne 0x10010391
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10008080
jmp 0x1001038b
lea ecx, [ebp - 0x2c]
call fcn.10002a50
xor al, al
jmp 0x10010433
lea ecx, [ebp - 0x2c]
call fcn.10002a50
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004677e
mov esp, ebp
pop ebp
ret
Function at 0x10010770
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006051b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1007a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10035919
push 4
mov dword [ebp - 4], 0
call fcn.10046eee
mov edi, eax
add esp, 4
test edi, edi
je 0x100107f0
call fcn.10032509
mov dword [edi], eax
call fcn.10032384
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.100325f2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x100107e6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1003261a
jmp 0x100107f2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret