joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50fd40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
push 0x40
mov dword [ebp - 8], esi
lea edi, [esi + 0x6c]
call fcn.00511cd3
lea ebx, [esi + 0x70]
mov dword [edi], eax
push 0x40
mov dword [ebp - 4], ebx
call fcn.00511cd3
push 0x40
push 0
push dword [edi]
mov dword [ebx], eax
call fcn.004aeae0
push 0x40
push 0
push dword [ebx]
call fcn.004aeae0
mov eax, dword [ebp + 0xc]
add esp, 0x20
cmp eax, 0x40
jbe 0x50fdeb
mov eax, dword [esi + 4]
add esi, 4
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi]
push ecx
push dword [ebp + 8]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov esi, dword [edi]
mov ecx, eax
mov eax, dword [ebx]
mov edx, 0x40
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
cmp ecx, dword [eax + 4]
je 0x50fe06
mov eax, edx
dec edx
test eax, eax
jle 0x50fe06
movzx eax, byte [ecx]
mov ebx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
mov byte [ebx], al
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
cmp ecx, dword [eax + 4]
jne 0x50fdc5
jmp 0x50fe06
mov esi, dword [ebp + 8]
push eax
push esi
push dword [edi]
call fcn.004ae560
mov ecx, dword [ebp + 0xc]
push ecx
push esi
push dword [ebx]
call fcn.004ae560
add esp, 0x18
mov ecx, dword [edi]
xor eax, eax
mov edx, dword [ebx]
lea ebx, [ecx + 0x3f]
cmp edx, ebx
lea esi, [edx + 0x3f]
mov ebx, dword [ebp - 4]
ja 0x50fe1d
cmp esi, ecx
jae 0x50fe40
cmp edx, edi
ja 0x50fe25
cmp esi, edi
jae 0x50fe40
cmp edx, ebx
ja 0x50fe2d
cmp esi, ebx
jae 0x50fe40
lea esi, [ecx + 0x3f]
cmp ecx, edi
ja 0x50fe38
cmp esi, edi
jae 0x50fe40
cmp ecx, ebx
ja 0x50fe63
cmp esi, ebx
jb 0x50fe63
mov ecx, dword [edi]
xor byte [eax + ecx], 0x36
mov ecx, dword [ebx]
xor byte [ecx + eax], 0x5c
inc eax
cmp eax, 0x40
jl 0x50fe40
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movaps xmm2, xmmword [str.6666666666666666_security.dll]
movaps xmm3, xmmword [0x560100]
movups xmm0, xmmword [ecx + eax]
movaps xmm1, xmm3
pxor xmm0, xmm2
movups xmmword [ecx + eax], xmm0
movups xmm0, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [edx + eax], xmm1
movups xmm0, xmmword [ecx + eax + 0x10]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ecx + eax + 0x10], xmm1
movups xmm0, xmmword [edx + eax + 0x10]
pxor xmm0, xmm3
movups xmmword [edx + eax + 0x10], xmm0
add eax, 0x20
cmp eax, 0x40
jl 0x50fe71
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x514510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5418e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5be1ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.00414ac0
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x38], 0xffffffff
mov byte [ebx + 0x3c], 0
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [ebx + 0x10]
mov dword [eax], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov edi, 0x5c5f78
mov esi, dword [ebp + 0xc]
mov dword [ebx + 0x40], esi
and esi, 1
mov dword [ebx], vtable.Poco::Base64DecoderBuf.0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov eax, dword [ecx]
mov dword [ebp - 4], 0
mov dword [ebp + 0xc], 0x5c6180
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, 0x5c6180
mov dword [ebx + 0x50], eax
mov eax, 0x5c6080
cmove eax, edi
mov dword [ebx + 0x54], eax
call fcn.004d80b0
test esi, esi
je 0x514623
cmp byte [0x5c6079], 0
jne 0x514661
or eax, 0xffffffff
mov ecx, 0x40
mov edi, 0x5c6080
rep stosd dword es:[edi], eax
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
movzx eax, byte [ecx + 0x58b3f0]
mov byte [eax + 0x5c6080], cl
inc ecx
cmp ecx, 0x40
jb 0x514600
mov byte [0x5c60bd], 0
mov byte [0x5c6079], 1
jmp 0x514661
cmp byte [0x5c6078], 0
jne 0x514661
or eax, 0xffffffff
mov ecx, 0x40
rep stosd dword es:[edi], eax
xor eax, eax
nop dword [eax + eax]
movzx ecx, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [ecx + 0x5c5f78], al
inc eax
cmp eax, 0x40
jb 0x514640
mov byte [0x5c5fb5], 0
mov byte [0x5c6078], 1
lea ecx, [ebp + 0xc]
call fcn.004db7f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5156e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541a47
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5be1ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x14], 0
je 0x51573b
mov dword [edi], 0x58b660
mov dword [edi + 0x50], 0x58b668
mov dword [edi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 8]
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [ebp + 0x14], esi
mov dword [edi + eax], vtable.Poco::MemoryIOS.0
call fcn.00414ac0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x38], edx
add ecx, edx
mov dword [esi], vtable.Poco::BasicMemoryStreamBuf_char__struct_std::char_traits_char__.0
sub ecx, edx
mov dword [eax], edx
mov eax, dword [esi + 0x1c]
mov dword [eax], edx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x40]
add edx, ecx
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
lea edx, [edi + 0x50]
mov dword [ebp - 4], 2
mov dword [ebp + 0x14], edx
mov eax, dword [edx]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edx - 4], eax
mov eax, dword [edx]
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, edx
call fcn.004154b0
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.Poco::MemoryInputStream.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + edi - 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x515810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541a97
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5be1ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0x14], 0
je 0x51586b
mov dword [edi], 0x58b678
mov dword [edi + 0x50], 0x58b680
mov dword [edi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [edi]
lea esi, [edi + 8]
mov ecx, esi
mov eax, dword [eax + 4]
mov dword [ebp + 0x14], esi
mov dword [edi + eax], vtable.Poco::MemoryIOS.0
call fcn.00414ac0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x38], edx
add ecx, edx
mov dword [esi], vtable.Poco::BasicMemoryStreamBuf_char__struct_std::char_traits_char__.0
sub ecx, edx
mov dword [eax], edx
mov eax, dword [esi + 0x1c]
mov dword [eax], edx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x40]
add edx, ecx
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
lea edx, [edi + 0x50]
mov dword [ebp - 4], 2
mov dword [ebp + 0x14], edx
mov eax, dword [edx]
push 0
push esi
mov eax, dword [eax + 4]
mov dword [edx + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call fcn.004154b0
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.Poco::MemoryOutputStream.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x515fb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d613
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5be1ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004e9ec0
lea ecx, [edi + 0x5c]
mov dword [edi], vtable.Poco::MD4Engine.0
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
mov byte [ebp - 4], 1
cmp eax, 0x10
jae 0x516018
push 0x10
call fcn.004e8dd0
push 0x58
lea esi, [edi + 4]
push 0
push esi
call fcn.004aeae0
add esp, 0xc
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov eax, edi
mov dword [esi], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x516070
Capabilities:
Hash data with md5

Disassembly:
push esi
push edi
mov edi, ecx
push 0x58
push 0
lea esi, [edi + 4]
mov dword [edi], vtable.Poco::MD4Engine.0
push esi
call fcn.004aeae0
add esp, 0xc
mov dword [edi + 0x18], 0
lea ecx, [edi + 0x5c]
mov dword [edi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
call fcn.004e8eb0
mov ecx, edi
pop edi
pop esi
jmp fcn.004e9ed0

Function at 0x5160d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
push 0x58
push 0
lea esi, [edi + 4]
mov dword [edi], vtable.Poco::MD4Engine.0
push esi
call fcn.004aeae0
add esp, 0xc
mov dword [edi + 0x18], 0
lea ecx, [edi + 0x5c]
mov dword [edi + 0x14], 0
mov dword [esi], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
call fcn.004e8eb0
mov ecx, edi
call fcn.004e9ed0
test byte [ebp + 8], 1
je 0x516136
push 0x68
push edi
call fcn.004951d7
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x516b30
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00516b40

Function at 0x516dc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x516dcc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00516de0
Function at 0x401dd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x21
push 0x35
push 0x4b
call dword [0x404340]
mov dword [0x404400], 0x44
push 0x4c
push 0xe0
call fcn.00401060
add esp, 8
mov dword [0x404060], 0x1003f
push 0x1a
push 0x94
call fcn.00401060
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00401cd0
add esp, 4
push 0x58
push 0x29
call fcn.00401090
add esp, 8
mov dword [ebp - 4], 0
jmp 0x401e3e
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x40403c]
xor eax, eax
mov ax, word [edx + 6]
cmp dword [ebp - 4], eax
jge 0x401ec7
push 0x47
push 0x50
call fcn.00401090
add esp, 8
mov ecx, dword [0x4046e0]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 4]
imul eax, eax, 0x28
add eax, dword [ebp + 8]
lea ecx, [eax + edx + 0xf8]
mov dword [0x404038], ecx
mov dword [ebp - 8], 0x44
mov edx, dword [ebp - 8]
push edx
call dword [0x4046f0]
push 0
mov eax, dword [0x404038]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [0x404038]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [0x40403c]
mov edx, dword [ecx + 0x34]
mov eax, dword [0x404038]
add edx, dword [eax + 0xc]
push edx
mov ecx, dword [0x404028]
push ecx
call dword [0x4044b4]
jmp 0x401e35
push 0x2d
push 0x29
push 0
call dword [0x40404c]
call fcn.00401d80
push 0x47
push 0xca
call fcn.00401060
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x402970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x10], 2
push str.jQvbm
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp - 8], 2
xor eax, eax
mov ax, word [0x404448]
push eax
xor ecx, ecx
mov cx, word [0x404444]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0xe97
cmp dword [ebp - 0xc], 0
je 0x402a4e
mov dword [ebp - 0x24], 5
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34], 0x20
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], 0x74
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], 0x5d
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x40435c], eax
mov dword [ebp - 0x3c], 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x20], 0x2d
mov eax, dword [ebp - 0x38]
mov dword [0x40433c], eax
mov dword [ebp - 0x30], 4
mov ecx, dword [0x40433c]
add ecx, dword [0x40435c]
mov byte [ecx], 0
mov dword [ebp - 0x28], 0x2b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402bd0
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov dword [ebp - 0x118], 0x34
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], 0x3f
mov ecx, dword [ebp + 8]
and ecx, 0xffff
push ecx
mov edx, dword [ebp + 0xc]
and edx, 0xffff
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], 1
cmp dword [ebp - 0x114], 0
je 0x402cf1
mov dword [ebp - 0x138], 3
push str.lMzOY
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp - 0x120], 0x5a0
mov eax, dword [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x140], 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x130], 0x548
mov ecx, dword [ebp - 0x114]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [0x40435c], eax
mov dword [ebp - 0x134], 0xd
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x128], 6
mov eax, dword [ebp - 0x13c]
mov dword [0x40433c], eax
mov dword [ebp - 0x12c], 9
mov ecx, dword [0x40433c]
add ecx, dword [0x40435c]
mov byte [ecx], 0
mov dword [ebp - 0x124], 0x1d
mov al, 1
jmp 0x402cfd
mov dword [ebp - 0x110], 4
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x402d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 8], 0x5b
mov eax, dword [ebp + 8]
mov dword [0x404054], eax
jmp 0x402d76
mov ecx, dword [0x404054]
add ecx, 1
mov dword [0x404054], ecx
cmp dword [0x404054], 0x65
jge 0x402ea5
mov dword [ebp - 0x10], 1
mov dword [0x4046f4], 0
jmp 0x402da5
mov edx, dword [0x4046f4]
add edx, 1
mov dword [0x4046f4], edx
cmp dword [0x4046f4], 0x1f4
jge 0x402e99
mov dword [ebp - 0x28], 0x3f
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0x402d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x24], 0xca8
xor eax, eax
mov al, byte [0x404058]
cmp eax, 1
jne 0x402e8d
mov dword [ebp - 0x38], 1
mov ecx, dword [0x40433c]
push ecx
call fcn.00401460
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x3c], 0x528
mov edx, dword [0x404448]
cmp edx, dword [0x404054]
jne 0x402e51
mov dword [ebp - 0x40], 0x7f
mov eax, dword [0x4046f4]
mov dword [0x404444], eax
mov dword [ebp - 0x48], 0x86
jmp 0x402eac
mov dword [ebp - 0x30], 0x13
mov ecx, dword [ebp - 0x34]
and ecx, 0x80000001
jns 0x402e68
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
jne 0x402e86
mov dword [ebp - 0x50], 2
mov edx, dword [0x404054]
mov dword [0x404448], edx
mov dword [ebp - 0x4c], 0x4c
mov dword [ebp - 0x2c], 0x47
mov dword [ebp - 0x14], 0x64
jmp 0x402d96
mov dword [ebp - 0xc], 0x87
jmp 0x402d67
mov dword [ebp - 4], 0x34
mov esp, ebp
pop ebp
ret
Function at 0xb12a3c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xb2a008], 0x8088405
inc edx
mov dword [ebx + 0xb2a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xb14fe8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0xb150c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00b134ec
test esi, esi
je 0xb1503a
mov eax, esi
and eax, 0xf
cdq
xor eax, edx
sub eax, edx
mov dl, byte [eax + 0xb2a0ac]
lea eax, [ebp - 4]
call fcn.00b136d4
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.00b13798
shr esi, 4
test esi, esi
jne 0xb1500f
cmp dword [ebx], 0
jne 0xb1505c
jmp 0xb1504f
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0xb150d8
call fcn.00b13798
mov eax, dword [ebx]
call fcn.00b1374c
cmp edi, eax
jg 0xb15041
jmp 0xb150ad
mov eax, dword [ebx]
call fcn.00b1374c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x2d
jne 0xb150a2
mov eax, dword [ebx]
call fcn.00b1374c
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.00b139ec
mov edx, ebx
mov ecx, 1
mov eax, 0xb150e4
call fcn.00b13a34
jmp 0xb150a2
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0xb150d8
call fcn.00b13798
mov eax, dword [ebx]
call fcn.00b1374c
cmp edi, eax
jg 0xb15094
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb150ca
lea eax, [ebp - 4]
call fcn.00b134ec
ret
Function at 0xb1d79c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0xb1d877
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00b134ec
test esi, esi
je 0xb1d7ee
mov eax, esi
and eax, 0xf
cdq
xor eax, edx
sub eax, edx
mov dl, byte [eax + 0xb2a254]
lea eax, [ebp - 4]
call fcn.00b136d4
mov edx, dword [ebp - 4]
mov ecx, dword [ebx]
mov eax, ebx
call fcn.00b13798
shr esi, 4
test esi, esi
jne 0xb1d7c3
cmp dword [ebx], 0
jne 0xb1d810
jmp 0xb1d803
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0xb1d88c
call fcn.00b13798
mov eax, dword [ebx]
call fcn.00b1374c
cmp edi, eax
jg 0xb1d7f5
jmp 0xb1d861
mov eax, dword [ebx]
call fcn.00b1374c
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x2d
jne 0xb1d856
mov eax, dword [ebx]
call fcn.00b1374c
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.00b139ec
mov edx, ebx
mov ecx, 1
mov eax, 0xb1d898
call fcn.00b13a34
jmp 0xb1d856
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0xb1d88c
call fcn.00b13798
mov eax, dword [ebx]
call fcn.00b1374c
cmp edi, eax
jg 0xb1d848
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb1d87e
lea eax, [ebp - 4]
call fcn.00b134ec
ret
Function at 0xb1f64c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.00b1f6d0
jae 0xb1f65b
xor ecx, ecx
call fcn.00b1f6d0
jae 0xb1f68a
xor eax, eax
call fcn.00b1f6d0
jae 0xb1f69a
mov bl, 2
inc ecx
mov al, 0x10
call fcn.00b1f6d0
adc al, al
jae 0xb1f67c
jne 0xb1f6c6
stosb byte es:[edi], al
jmp 0xb1f65e
call fcn.00b1f6dc
sub ecx, ebx
jne 0xb1f6a3
call fcn.00b1f6da
jmp 0xb1f6c2
lodsb al, byte [esi]
shr eax, 1
je 0xb1f6ec
adc ecx, ecx
jmp 0xb1f6bf
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00b1f6da
cmp eax, 0x7d00
jae 0xb1f6bf
cmp ah, 5
jae 0xb1f6c0
cmp eax, 0x7f
ja 0xb1f6c1
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb1f65e
popal
pop ebp
ret 8
Function at 0xb25e84
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00b1393c
xor eax, eax
push ebp
push 0xb26092
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00b1374c
cmp eax, 0x100
jge 0xb25ee1
lea ecx, [ebp - 0x124]
lea eax, [ebp - 4]
mov edx, pe_nt_image_headers32
call fcn.00b1db08
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 4]
call fcn.00b13584
mov eax, dword [ebp - 4]
call fcn.00b1374c
cmp eax, 0x100
jle 0xb25f06
lea eax, [ebp - 4]
push eax
mov ecx, pe_nt_image_headers32
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00b139ac
mov ebx, pe_nt_image_headers32
push 0x110
call fcn.00b14a2c
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x120]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00b12a1c
lea eax, [ebp - 4]
call fcn.00b139a4
mov edx, eax
lea eax, [ebp - 0x120]
mov ecx, pe_nt_image_headers32
call fcn.00b14fa0
mov eax, ebx
shr eax, 2
mov dword [ebp - 0x14], eax
test bl, 3
je 0xb25f5b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
ja 0xb25f68
mov dword [ebp - 0x14], 1
mov edi, 0xb7e15163
mov eax, dword [0xb2a300]
add eax, 2
add eax, eax
test eax, eax
jb 0xb25f98
inc eax
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [edx + ecx*4], edi
add edi, 0x9e3779b9
inc dword [ebp - 0x10]
dec eax
jne 0xb25f83
mov eax, dword [0xb2a300]
add eax, 2
mov edx, eax
add edx, edx
cmp edx, dword [ebp - 0x14]
jae 0xb25fb4
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*2]
mov dword [ebp - 0x18], eax
jmp 0xb25fbc
add eax, eax
lea eax, [eax + eax*2]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 0x18]
cmp eax, 1
jb 0xb2605b
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
lea edx, [esi + ebx]
add eax, edx
mov ebx, eax
mov eax, ebx
shl eax, 3
shr ebx, 0x1d
or eax, ebx
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [eax + edx*4], ebx
add esi, ebx
mov dword [ebp - 0x1c], esi
mov esi, dword [ebp + edi*4 - 0x120]
add esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
and ecx, 0x1f
mov eax, esi
shl eax, cl
mov ecx, 0x20
sub ecx, dword [ebp - 0x1c]
and ecx, 0x1f
shr esi, cl
or eax, esi
mov esi, eax
mov dword [ebp + edi*4 - 0x120], esi
mov eax, dword [ebp - 0x10]
inc eax
mov edx, dword [0xb2a300]
add edx, 2
add edx, edx
mov ecx, edx
xor edx, edx
div ecx
mov dword [ebp - 0x10], edx
lea eax, [edi + 1]
xor edx, edx
div dword [ebp - 0x14]
mov edi, edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0
jne 0xb25fd6
lea eax, [ebp - 0x120]
mov edx, pe_nt_image_headers32
call fcn.00b14fa8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb26099
lea eax, [ebp - 0x124]
call fcn.00b134ec
lea eax, [ebp - 4]
call fcn.00b134ec
ret