joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbd9554
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0xbd95ca
test eax, eax
je 0xbd9596
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.00bb22bb
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0xbd9596
push 0x3b
push 0x101a775c
push 0x66
push 0x10a
push 0x10
call fcn.00b7bc5b
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0xbd95c6
cmp edi, 0x40a
je 0xbd95bd
cmp edi, 0x43f
je 0xbd95bd
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0xbd95c2
mov eax, 0x20
cmp esi, eax
je 0xbd95ca
push 0x41
jmp 0xbd957b
push ebx
push 0x46
push 0x101a775c
push 0x40
call fcn.00b8591b
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0xbd9600
push 0x48
push 0x101a775c
push 0x41
push 0x10a
push 0x10
call fcn.00b7bc5b
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0xbd9618
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call fcn.00c4a61b
add esp, 0xc
jmp 0xbd9775
cmp edi, 0x40a
je 0xbd9638
cmp edi, 0x43f
je 0xbd9638
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0xbd963d
mov eax, 0x20
push 0x50
push 0x101a775c
push eax
call fcn.00b8883b
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0xbd9670
push 0x52
push 0x101a775c
push 0x41
push 0x10a
push 0x10
call fcn.00b7bc5b
add esp, 0x14
jmp 0xbd96c3
cmp ebp, 2
jne 0xbd9703
cmp edi, 0x40a
je 0xbd9699
cmp edi, 0x43f
je 0xbd9699
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0xbd969e
mov eax, 0x20
push eax
push esi
call fcn.00b8ecdb
add esp, 8
test eax, eax
jg 0xbd96d9
push 0x57
push 0x101a775c
push esi
call fcn.00b8885b
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push 0x101a775c
push ebx
call fcn.00b8598b
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0xbd96f2
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0xbd9737
cmp edi, 0x40b
jne 0xbd9737
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0xbd9737
cmp edi, 0x40a
je 0xbd9723
cmp edi, 0x43f
je 0xbd9723
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0xbd9728
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.00c4a61b
add esp, 0xc
lea eax, reloc.MSVCRT.dll_strncpy
cmp eax, 0x36
ja 0xbd9775
movzx ecx, byte [eax + 0x100e7358]
jmp dword [ecx*4 + 0x100e7344]
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.00b7cf8b
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0xbe11fb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.00c4a98b
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.00b9c58b
add esp, 8
test eax, eax
jne 0xbe1236
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0xbe1298
xor ebx, ebx
test ebp, ebp
jle 0xbe13fb
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0xbe127a
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0xbe1253
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0xbe124b
jmp 0xbe13fb
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x40], eax
jle 0xbe13fb
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
mov dword [esp + 0x20], esi
cmp edi, esi
jle 0xbe13d7
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0xbe136b
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [esp + 0x40]
jl 0xbe133b
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0xbed07a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00c4a98b
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
lea ecx, [esi + 2]
mov dword [esp + 0xc], 0x10
mov eax, ebp
sub esi, ebp
mov edi, 4
jmp 0xbed09b
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec edi
jne 0xbed09b
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push 0x10
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push edx
call fcn.00b8adfb
add esp, 0x14
pop edi
pop esi
pop ebp
test eax, eax
je 0xbed0eb
cmp dword [esp], 0x10
jne 0xbed0eb
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0xc36c02
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.00c4a98b
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0xc36d65
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.00bc9cdb
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.00bc9d5b
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00bc682b
push ebp
call fcn.00bc9cdb
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.00bc9d5b
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00bc682b
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0xc36c1e
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.00c4686f
add esp, 0xa0
ret
Function at 0xf41c32
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + reloc.MSVCRT.dll_strncpy], 0x8088405
inc edx
mov dword [ebx + reloc.MSVCRT.dll_strncpy], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xf44676
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
and eax, 0xff
add dword [reloc.MSVCRT.dll_strncpy], eax
imul eax, dword [reloc.MSVCRT.dll_strncpy], 0x8088405
inc eax
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
movzx ebx, al
xor bl, byte [0x5000f743]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
ret

Function at 0xf446e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
pushal
mov byte [ebp - 1], 0
mov dword [reloc.MSVCRT.dll_strncpy], 0x12345678
mov dword [reloc.MSVCRT.dll_strncpy], 0x23456789
mov dword [reloc.MSVCRT.dll_strncpy], 0x34567890
movzx ecx, byte [0x5000f748]
test ecx, ecx
je 0xf44773
xor esi, esi
mov dl, byte [esi + 0x5000f749]
call fcn.00f44676
inc esi
cmp esi, ecx
jb 0xf4471a
xor esi, esi
call fcn.00f446ce
xor byte [esi + 0x5000f724], al
mov dl, byte [esi + 0x5000f724]
call fcn.00f44676
inc esi
cmp esi, 0xc
jb 0xf4472c
mov al, byte [0x5000f72f]
test word [0x5000f90e], 8
jne 0xf44767
cmp al, byte [0x5000f919]
jne 0xf44773
mov byte [ebp - 1], 1
jmp 0xf44773
cmp al, byte [0x5000f913]
jne 0xf44773
mov byte [ebp - 1], 1
popal
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0xf44806
Capabilities:
Encode data using xor

Disassembly:
pushal
mov edi, dword [reloc.MSVCRT.dll_strncpy]
cmp dword [reloc.MSVCRT.dll_strncpy], edi
jae 0xf4481b
mov edi, dword [reloc.MSVCRT.dll_strncpy]
test edi, edi
je 0xf44846
sub dword [reloc.MSVCRT.dll_strncpy], edi
lea esi, reloc.MSVCRT.dll_strncpy
add esi, dword [reloc.MSVCRT.dll_strncpy]
add edi, esi
call fcn.00f446ce
xor byte [esi], al
mov dl, byte [esi]
call fcn.00f44676
inc esi
cmp esi, edi
jb 0xf44833
popal
ret

Function at 0xf4484a
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esi, reloc.MSVCRT.dll_strncpy
mov edi, esi
add edi, dword [reloc.MSVCRT.dll_strncpy]
call fcn.00f446ce
mov dl, byte [esi]
xor byte [esi], al
call fcn.00f44676
inc esi
cmp esi, edi
jb 0xf44859
popal
ret
Function at 0xf45056
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
cmp byte [0x5000f840], 0
jne 0xf450bc
cmp dword [reloc.MSVCRT.dll_strncpy], 0
jle 0xf450bc
mov eax, dword [reloc.MSVCRT.dll_strncpy]
lea edx, reloc.MSVCRT.dll_strncpy
mov ecx, dword [reloc.MSVCRT.dll_strncpy]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
call fcn.00f4384e
test eax, eax
jge 0xf450bc
mov dword [reloc.MSVCRT.dll_strncpy], 5
push 0x50005b6c
push dword [0x5000f854]
push 0x50005b8c
mov eax, 0x5000f838
mov edx, 3
call fcn.00f427c6
ret
mov eax, dword [reloc.MSVCRT.dll_strncpy]
test eax, eax
je 0xf450f8
add dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov esi, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
inc esi
cmp esi, dword [reloc.MSVCRT.dll_strncpy]
jb 0xf450d8
mov dword [reloc.MSVCRT.dll_strncpy], eax
cmp dword [reloc.MSVCRT.dll_strncpy], 0x10000
jb 0xf45129
mov esi, 0x5002a800
mov edi, esi
add esi, dword [reloc.MSVCRT.dll_strncpy]
sub esi, 0x8000
mov ecx, 0x8000
cld
rep movsb byte es:[edi], byte [esi]
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov dword [reloc.MSVCRT.dll_strncpy], 0
ret
Function at 0xf47ed2
Capabilities:
Encode data using xor

Disassembly:
cmp dword [reloc.MSVCRT.dll_strncpy], 0x8000
jle 0xf47f37
pushal
mov edx, dword [reloc.MSVCRT.dll_strncpy]
sub edx, 0x8000
mov esi, 0x5002a800
mov edi, esi
add esi, edx
mov ecx, 0x2000
cld
rep movsd dword es:[edi], dword [esi]
mov ebx, 0xffff
sub dword [ebx*4 + reloc.MSVCRT.dll_strncpy], edx
dec ebx
jns 0xf47f01
mov esi, edx
shl esi, 2
add esi, 0x50082b44
mov ebx, esi
add ebx, 0x20000
mov edi, 0x50082b44
cld
lodsd eax, dword [esi]
sub eax, edx
stosd dword es:[edi], eax
cmp esi, ebx
jb 0xf47f24
popal
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
sub eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
cmp dword [reloc.MSVCRT.dll_strncpy], 0x8000
jle 0xf47f67
mov dword [reloc.MSVCRT.dll_strncpy], 0x8000
mov eax, dword [reloc.MSVCRT.dll_strncpy]
lea edx, reloc.MSVCRT.dll_strncpy
mov ecx, dword [reloc.MSVCRT.dll_strncpy]
mov eax, dword [reloc.MSVCRT.dll_strncpy]
call fcn.00f4387a
cmp eax, dword [reloc.MSVCRT.dll_strncpy]
je 0xf47fb4
mov dword [reloc.MSVCRT.dll_strncpy], 3
push 0x50008a38
push dword [0x5000f854]
push 0x50008a5c
mov eax, 0x5000f838
mov edx, 3
call fcn.00f427c6
ret
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add eax, dword [reloc.MSVCRT.dll_strncpy]
mov dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
mov eax, dword [reloc.MSVCRT.dll_strncpy]
add dword [reloc.MSVCRT.dll_strncpy], eax
pushal
mov eax, dword [reloc.MSVCRT.dll_strncpy]
mov esi, dword [reloc.MSVCRT.dll_strncpy]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + reloc.MSVCRT.dll_strncpy]
inc esi
cmp esi, dword [reloc.MSVCRT.dll_strncpy]
jb 0xf47fe8
mov dword [reloc.MSVCRT.dll_strncpy], eax
popal
ret
Function at 0x1004d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
call fcn.01004d30
lea esi, [eax + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x1004d66
pop esi
ret

Function at 0x1008980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, 0x100
push edi
or esi, ebx
nop
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp + 0x10], eax
mov ecx, esi
shr ecx, 7
mov edx, ebx
and edx, eax
and ecx, 1
mov eax, esi
shr eax, 8
add edx, ebx
push ecx
mov ecx, dword [ebp + 0xc]
add eax, edx
lea edi, [ecx + eax*2]
mov eax, dword [ebp + 8]
call fcn.010088e0
add esi, esi
mov edx, esi
xor edx, dword [ebp + 0x10]
not edx
and ebx, edx
cmp esi, 0x10000
jb 0x1008990
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1008a30
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x1008a40
pop edi
pop ebx
ret

Function at 0x1008a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
push edi
or ecx, edx
add esi, esi
mov edi, edx
and edi, esi
add edi, edx
mov ebx, ecx
shr ebx, 8
add ebx, edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
shr edi, 4
sar ebx, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add ecx, ecx
mov edi, ecx
xor edi, esi
not edi
and edx, edi
cmp ecx, 0x10000
jb 0x1008a81
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1008b60
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, 1
shl ebx, cl
xor eax, eax
or edx, ebx
cmp edx, 1
je 0x1008b93
mov ecx, edx
and edx, 1
shr ecx, 1
movzx ebx, word [edi + ecx*2]
neg edx
sar edx, 4
and edx, 0x7f
shr ebx, 4
xor ebx, edx
add eax, dword [esi + ebx*4]
mov edx, ecx
cmp edx, 1
jne 0x1008b71
pop ebx
ret
Function at 0x1008ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
xor eax, eax
lea edx, [eax + 1]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x1008be3
push ebx
push edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + edx*2]
mov ecx, esi
and ecx, 1
mov ebx, ecx
neg ebx
sar ebx, 4
and ebx, 0x7f
shr edi, 4
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add edx, edx
shr esi, 1
or edx, ecx
dec dword [ebp - 4]
jne 0x1008bb5
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100b730
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [ebp + 8]
push ecx
push edx
push 0
push 0
call fcn.0100c1e4
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.0100b6e0
pop esi
pop ebp
ret 4
Function at 0x13d04f9
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp], edx
pop word [esp]
lea esp, [esp + 2]
jmp 0x13d0563
movzx eax, byte [esi - 1]
mov ebx, esi
mov bx, dx
clc
je 0x13d053a
bts dx, dx
jmp 0x13d053c
jmp 0x13d0522
jmp 0x13d0590
mov ebx, 0x9ebc2ee0
mov bl, cl
shr dh, cl
jmp 0x13d054b
dec dl
jmp 0x13d059f
add esi, dword [edi]
mov bl, byte [esp]
lea eax, [edi*4]
mov dl, byte [esp]
not ah
jmp 0x13d0538
mov bx, sp
cmp bx, 0xafb2
jle 0x13d05d9
jg 0x13d05d9
add eax, 0x98690e98
pop ecx
jne 0x13d05f2
xchg edi, eax
invalid
bts dx, dx
mov ebx, 0x9ebc2ee0
mov bl, cl
shr dh, cl
dec dl
lea ebx, [eax + edi]
add al, cl
mov dx, 0x8b5f
mov bl, byte [esp]
jmp 0x13d057a
mov dl, al
bt bx, si
jmp 0x13d1583
sal dword [esi + reloc.MSVCRT.dll_strncpy], cl
xor byte [ebx], dl
mov esp, 0xbafd1b5a
pop edx
jg 0x13d05d9
mov eax, 0xb8bb425a
pop edx
push ss
sub edi, dword [edx - reloc.MSVCRT.dll_strncpy]
pop edx
enter 0xffffffffffffbb77, 0x5a
invalid
neg bx
jmp 0x13d1835
jae 0x13d182c
bswap ebx
bt bx, si
jmp 0x13d0d17
bswap ebx
bt bx, si
neg bx
call fcn.013d0c05

Function at 0x13e04bc
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x13c4a73
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x13c4a8d
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x13c4a7c
pop esi
jmp 0x13c4a98
ret 4
jmp 0x13c4a66

Function at 0x14c2b9b
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x14c2a5d
lea esp, [esp + 2]
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
mov eax, dword fs:[0x30]
jmp 0x14c2a27
mov eax, dword [eax + 8]
push eax
jmp 0x14c206b
push word [esp + 1]
push dword [esp + 1]
mov dword [esp + 0x30], esi
push dx
mov byte [esp], cl
pushfd
jmp 0x14c2a49
mov dword [esp + 0x2c], ebp
push sp
jmp 0x14c2a88
Function at 0x5850dc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x40a666
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x14], esp
mov dword [ebp - 0x10], 0x407fb8
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], esi
push 1
call sub.MSVBVM60.DLL___vbaOnError
mov edx, 0x462f70
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrCopy
cmp dword [0x60e5b8], esi
jne 0x585141
push 0x60e5b8
push 0x44b77c
call sub.MSVBVM60.DLL___vbaNew2
mov esi, dword [0x60e5b8]
mov ebx, 0x80020004
mov dword [ebp - 0x2c], ebx
push 0xa
pop edi
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeVarg
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
push ecx
push dword [ebp - 0x20]
push esi
call dword [eax + 0x40]
fnclex
test eax, eax
jge 0x585184
push 0x40
push 0x44c708
push esi
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
lea ecx, [ebp - 0x24]
call sub.MSVBVM60.DLL___vbaFreeObj
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeVar
mov edx, 0x463168
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaStrCopy
cmp dword [0x60e5b8], 0
jne 0x5851b9
push 0x60e5b8
push 0x44b77c
call sub.MSVBVM60.DLL___vbaNew2
mov esi, dword [0x60e5b8]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], edi
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeVarg
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
push ecx
push dword [ebp - 0x20]
push esi
call dword [eax + 0x40]
fnclex
test eax, eax
jge 0x5851f4
push 0x40
push 0x44c708
push esi
push eax
call sub.MSVBVM60.DLL___vbaHresultCheckObj
lea ecx, [ebp - 0x24]
call sub.MSVBVM60.DLL___vbaFreeObj
lea ecx, [ebp - 0x34]
call sub.MSVBVM60.DLL___vbaFreeVar
jmp 0x585206
call sub.MSVBVM60.DLL___vbaExitProc
push 0x58522c
jmp 0x585223
lea ecx, [ebp - 0x20]
call sub.MSVBVM60.DLL___vbaFreeStr
ret
Function at 0x1000aad7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000aae6
pop dword [ebp - 0x4c]
mov eax, 0x9af91028
add eax, 0x75079abe
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x637db448
add dword [ebp - 0x5c], 0xead49103
mov dword [ebp - 0x58], 0x742affa0
add dword [ebp - 0x58], 0xbe084ca5
mov dword [ebp - 0x54], 0x93c8a246
sub dword [ebp - 0x54], 0x477c5e18
mov dword [ebp - 0x50], 0xf11b4ccc
add dword [ebp - 0x50], 0xee4b334
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x5373dbb2
sub eax, 0x43718b62
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x9eda3f98
add dword [ebp - 0x5c], 0xd59829be
mov dword [ebp - 0x58], 0x1f19507a
sub dword [ebp - 0x58], 0xddacef05
mov dword [ebp - 0x54], 0x64f4c044
add dword [ebp - 0x54], 0xfe7aac28
mov dword [ebp - 0x50], 0x9a3c9877
sub dword [ebp - 0x50], 0x9a3c9877
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x78d3c79b
sub eax, 0x68d17747
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x40fde
push 0
call eax
mov ecx, 0x7dcf44e
add ecx, 0xf8235d7f
mov esi, eax
mov edx, 0x10035a00
add edx, dword [ebp - 0x4c]
mov ebx, 0x93170c5b
sub ebx, 0xb3e13e50
xor dword [ebp - 0x48], eax
mov edi, dword [edx]
add dword [ebp - 4], esi
add edi, ebx
add dword [ebp - 0x28], 0xdad7bcd5
mov dword [esi], edi
xor dword [ebp - 0x40], 0xcf065af5
add esi, 4
add edx, 0x51a539af
add edx, 0xae5ac655
loop 0x1000ac02
add eax, 0x8bc6f249
add eax, 0x743a47be
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xb8a846e4
sub ecx, 0xa8a846e4
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret