joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002c08
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000e0cc]
jne 0x10002c12
repz ret
jmp fcn.10004fac

Function at 0x10006106
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10006141
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10006128
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10006139
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x10006143
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1000611e
xor eax, eax
pop edi
pop esi
ret

Function at 0x100063b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
invalid
inc ebp

Function at 0x10006632
Capabilities:
Inspect section memory permissions

Disassembly:
push ecx
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
jae 0x10006564
inc ebp
invalid
push edi
mov byte [ebp - 0x70], 0x16
call fcn.100060c6
test byte [esi], 0x83
xchg edx, eax
lea eax, [ebp - 0x84]
push eax
call fcn.100060d6
push eax
push esi
push dword [ebp + 8]
call fcn.1000608b
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x100068bf
jae 0x10006564
inc ebp
invalid
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.10006037
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x10006636
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.10006037
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
inc edi
push es
jb 0x10006603
call fcn.100060c6
or byte [edi], ch
add cl, ch
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x100068b5
add eax, esi
mov dword [ebp - 0x44], eax
Function at 0x100066d4
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x1000666b
cmp dword [eax + 0xc], ebx
je 0x1000670e
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.100060c6
cmove edi, dword [ecx + 0xc5d3966]
jne 0x1000669a
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x100068b5
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x100066ae
mov dword [ebp + 0x10], edi
jmp 0x100066b3
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.100060c6
sbb dword [ebp + edi + 0xf], ebp
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x100066fc
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x100066d7
and eax, 0xffff
push eax
jmp 0x100066db
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000608b
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x100068b5
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x100066bc
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x1000665d
call fcn.100060c6
nop
push ss
outsb dx, byte [esi]
popal
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x1000677a
add eax, esi
cmp dword [eax], ebx
je 0x1000677a
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10006775
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000675f
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10006767
cmp edx, ebx
jne 0x100068b5
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10006736
add eax, dword [eax + 4]
jmp 0x10006723
mov dword [ebp + 0xc], ebx
jmp 0x10006785
Function at 0x100067ae
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000679d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100067bb
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10006819
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
add byte [eax - 0x77], al
jge 0x100067f8
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10006800
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10006809
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10006813
add ecx, eax
or byte [ecx], 4
invalid
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100067f5
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000677f
dec dword [ecx - 0xccf78b]
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10006866
dec eax
je 0x1000685d
sub eax, 3
je 0x10006854
mov dword [ebp - 4], 0x40
jmp 0x10006883
mov dword [ebp - 4], 4
jmp 0x10006869
mov dword [ebp - 4], 0x20
jmp 0x10006869
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100068b5
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10006835
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100060c6
scasb al, byte es:[edi]
inc ebp
je 0x1000682f
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x100068c1
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100067e1
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000679d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100067bb
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10006819
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
add byte [eax - 0x77], al
jge 0x100067f8
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10006800
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10006809
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10006813
add ecx, eax
or byte [ecx], 4
invalid
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100067f5
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000677f
dec dword [ecx - 0xccf78b]
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10006866
dec eax
je 0x1000685d
sub eax, 3
je 0x10006854
mov dword [ebp - 4], 0x40
jmp 0x10006883
mov dword [ebp - 4], 4
jmp 0x10006869
mov dword [ebp - 4], 0x20
jmp 0x10006869
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100068b5
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10006835
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100060c6
scasb al, byte es:[edi]
inc ebp
je 0x1000682f
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x100068c1
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10006811
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000679d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x100067bb
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
add dword [eax], eax
add byte [ebp + 0xf8c784], cl
add byte [eax], al
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10006819
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
add byte [eax - 0x77], al
jge 0x100067f8
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10006800
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10006809
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10006813
add ecx, eax
or byte [ecx], 4
invalid
invalid
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x100067f5
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000677f
dec dword [ecx - 0xccf78b]
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10006866
dec eax
je 0x1000685d
sub eax, 3
je 0x10006854
mov dword [ebp - 4], 0x40
jmp 0x10006883
mov dword [ebp - 4], 4
jmp 0x10006869
mov dword [ebp - 4], 0x20
jmp 0x10006869
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x100068b5
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10006835
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100060c6
scasb al, byte es:[edi]
inc ebp
je 0x1000682f
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x100068c1
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xed0110
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0xe8fc54]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00eebd80
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0xed01df
mov eax, 0xe885c4
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0xed0155
sub eax, edx
sar eax, 1
je 0xed01df
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.00e83238]
push 0xe885c4
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00eea2c8
push 0xe885bc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00ee9d6f
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0xed01df
push eax
push 1
push 0x200
push esi
call fcn.00eea5e5
mov eax, dword [esp + 0x14]
push eax
call fcn.00eea01d
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00ee9af3
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00ee9af3
add esp, 0x214
ret

Function at 0xed03c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x3e8
mov dword [esp + 0x10], 0
call dword [0xe83250]
push 0xe885bc
lea eax, [esp + 0x10]
push 0xeb4960
push eax
call fcn.00ee9d6f
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0xed04f1
push 2
push 0
push eax
call fcn.00eeaa5f
mov ecx, dword [esp + 0x18]
add esp, 0xc
push ecx
call fcn.00eeac81
mov esi, eax
add esp, 4
push esi
call fcn.00edf788
mov edx, dword [esp + 0x10]
add esp, 4
push 0
push 0
push edx
mov edi, eax
call fcn.00eeaa5f
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
push esi
push 1
push edi
call fcn.00eea5e5
add esp, 0x10
cmp esi, eax
jne 0xed04d3
call dword [0xe8323c]
push eax
call fcn.00eea9a1
add esp, 4
call fcn.00eea9b3
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0xe8a7a8]
fmul qword [0xe8a7a0]
fadd qword [0xe8a798]
call fcn.00eec620
cmp esi, eax
jl 0xed04d3
mov ebx, edi
sub ebx, eax
add ebx, esi
call fcn.00ed0370
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00eea01d
add esp, 4
push 0xeb4960
call dword [0xe83230]
push 0xe882cc
lea edx, [esp + 0x10]
push 0xeb4960
push edx
call fcn.00ee9d6f
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0xed04f1
push eax
push esi
push 1
push edi
call fcn.00ee9f24
add esp, 0x10
mov eax, dword [esp + 0xc]
test eax, eax
je 0xed04e4
push eax
call fcn.00eea01d
add esp, 4
test edi, edi
je 0xed04f1
push edi
call fcn.00edf77d
add esp, 4
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0xed23b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebp, ebp
push esi
mov ebx, ecx
push edi
mov edi, eax
mov dword [esp + 0x10], ebp
cmp ebx, ebp
je 0xed24a1
cmp edi, 0xa
jb 0xed24a1
lea eax, [edi*4]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.00ee9b51
add esp, 4
mov esi, eax
push esi
push ebx
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.00ed2230
add esp, 8
test eax, eax
je 0xed249a
mov eax, dword [esp + 0x1c]
push 0xe882cc
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00ee9d6f
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
jne 0xed2425
lea ebp, [eax - 2]
jmp 0xed2450
mov edi, dword [esp + 0x14]
push eax
push edi
push 1
push esi
call fcn.00ee9f24
add esp, 0x10
cmp eax, edi
je 0xed2467
mov ebp, 0xfffffffe
mov eax, dword [esp + 0x10]
test eax, eax
je 0xed2450
push eax
call fcn.00eea01d
add esp, 4
test esi, esi
je 0xed245d
push esi
call fcn.00ee9c1b
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [0xe8323c]
call edi
xor edx, edx
mov ecx, 0x1f4
div ecx
mov ebx, edx
call edi
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [esp + 0x10]
push eax
push ebx
push 1
add edx, esi
push edx
call fcn.00ee9f24
add esp, 0x10
jmp 0xed243f
mov ebp, 0xfffffffd
jmp 0xed243f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret

Function at 0xed4220
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0xed4227
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0xed4304
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xe8a138]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xe8a138]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xe8a138]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xe8a138]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xe8a138]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xe8a138]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xe8a138]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xe8a138]
inc ecx
sub edx, 8
sub esi, 1
jne 0xed4240
pop edi
test edx, edx
je 0xed432b
jmp 0xed4310
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0xe8a138]
inc ecx
sub edx, 1
jne 0xed4310
not eax
pop esi
ret

Function at 0xed4330
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0xe8a138]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0xe8a138]
mov dword [edx + 8], ecx
ret
Function at 0xed4380
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0xe8a138]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0xe8a138]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0xed5770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0xed578e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0xed5782
cmp dword [edi + 0x7c], ebx
je 0xed579d
call fcn.00ed5b50
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00ed54e0
add esp, 0xc
test eax, eax
je 0xed57c4
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.00ee9b51
mov esi, eax
add esp, 4
cmp esi, ebx
je 0xed5802
push 0x4000
call fcn.00ee9b51
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0xed580f
push esi
call fcn.00ee9c1b
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0xed5857
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00ed4630
test eax, eax
jne 0xed5857
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0xed587e
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0xed5884
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0xed58c1
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0xed58c1
call fcn.00ed4330
add ebp, 1
jne 0xed58b0
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x8a8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008a81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8a807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a806a
add dl, dl
jne 0x8a8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a80dc
xor eax, eax
add dl, dl
jne 0x8a8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8a817d
add dl, dl
jne 0x8a80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8a80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8a8075
mov eax, 1
add dl, dl
jne 0x8a80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8a80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a80e1
sub eax, ebx
mov ebx, 1
jne 0x8a8128
mov ecx, 1
add dl, dl
jne 0x8a810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8a8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8a813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8a814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8a8136
cmp eax, 0x7d00
jae 0x8a816d
cmp eax, 0x500
jb 0x8a8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a8075
cmp eax, 0x7f
ja 0x8a8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8a8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8a819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8a8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408e84
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2db69dd
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6a6c3964
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219