joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90a2706
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.090cb1b9
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a278b
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.090cb1b9
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a27a2
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a27fe
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a27f1
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.090cb1b9
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.090cb1b9
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x90a2897
sub dword [ebp - 0x13d8], 1
jne 0x90a288d
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x90a27da
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90a2d18
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.090cb1b9
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2d9d
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.090cb1b9
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2db4
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2e10
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2e03
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.090cb1b9
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.090cb1b9
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2eac
sub dword [ebp - 0x13d8], 1
jne 0x90a2ea2
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2dec
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90c4770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d4bd2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.090cb1b9
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.090cb1b9
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09009307
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.090cb1b9
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x90c4820
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.090cb1b9
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x90c499a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x90c4891
xor eax, eax
jmp 0x90c48be
cmp eax, ecx
jb 0x90c489c
mov eax, 0x8000
jmp 0x90c48be
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x90c4881
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.090198a7
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901e58a
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x280
mov dword [ebp - 0xb2c], eax
call fcn.090cb1b9
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x90c492a
push esi
mov ecx, eax
call fcn.090cb1b9
mov edx, eax
jmp 0x90c492c
xor edx, edx
movsd xmm1, qword [ebx + 0x10]
xorps xmm0, xmm0
mov eax, dword [ebx + 0xc]
mulsd xmm1, qword [0x90e7a70]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
comisd xmm0, xmm1
mov dword [edx + 0x70], ecx
mov dword [edx + 0x74], eax
jbe 0x90c495a
subsd xmm1, qword [0x90dd3d8]
jmp 0x90c4962
addsd xmm1, qword [0x90dd3d8]
cvttsd2si eax, xmm1
lea edi, [edx + 0x7a]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x78], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.090cb1b9
int3
Function at 0x1004e9af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1004e9be
pop dword [ebp - 0x14]
mov eax, 0xc11c444f
sub eax, 0xb1175a91
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x5d1ff2ce
sub dword [ebp - 0x24], 0xecdad83
mov dword [ebp - 0x20], 0x8087be72
sub dword [ebp - 0x20], 0x4e54722d
mov dword [ebp - 0x1c], 0x635f13dc
sub dword [ebp - 0x1c], 0x1712cfae
mov dword [ebp - 0x18], 0xbb4f1e93
sub dword [ebp - 0x18], 0xbb4f1e93
lea eax, [ebp - 0x24]
push eax
mov eax, 0x3a59a5f4
sub eax, 0x2a5135c0
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xe6f0de5
sub dword [ebp - 0x24], 0x99fca48f
mov dword [ebp - 0x20], 0x9c501ff9
sub dword [ebp - 0x20], 0x5ae3be84
mov dword [ebp - 0x1c], 0xac2e572e
sub dword [ebp - 0x1c], 0x48beeac2
mov dword [ebp - 0x18], 0x275f8423
add dword [ebp - 0x18], 0xd8a07bdd
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x2db3f93
add eax, 0xd2d3091
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3a8cf
push 0
call eax
mov ecx, 0x2b1d6064
sub ecx, 0x2b1d23a9
mov ebx, eax
mov esi, 0xe44db59c
add esi, 0x2bbdda64
add esi, dword [ebp - 0x14]
mov edi, 0xc597f65a
sub dword [ebp - 8], eax
mov edx, dword [esi]
mov dword [ebp - 0xc], 0x9b167e43
sub edx, edi
add dword [ebp - 0xc], ecx
mov dword [ebx], edx
xor dword [ebp - 4], 0x4fdc4582
add ebx, 4
add esi, 0xd580dee0
add esi, 0x2a7f2124
loop 0x1004eada
add eax, 0x411cf4fc
add eax, 0xbee3f0c3
mov ebx, eax
add eax, 0x78355937
add eax, 0x87caa6ce
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1006ffd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push esi
push edi
call fcn.1006e8e4
mov edi, dword [esp + 0x38]
push eax
push edi
call sub.glib_lite.dll_Ordinal_413
mov esi, eax
pop ecx
pop ecx
mov eax, dword [esi + 0x74]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x1006fffb
xor eax, eax
jmp 0x10070184
cmp eax, dword [esi + 0x1f0]
je 0x1006fff4
push ebx
push ebp
lea ebx, [esi + 0xc]
push ebx
call sub.glib_lite.dll_Ordinal_213
pop ecx
jmp 0x10070014
lea ebx, [esi + 0xc]
push dword [esp + 0x44]
push edi
call fcn.1002a825
pop ecx
pop ecx
test eax, eax
jne 0x10070175
push ebx
call sub.glib_lite.dll_Ordinal_212
mov eax, dword [esi + 0x1f8]
mov ebx, dword [eax]
mov ebp, dword [eax + 4]
lea eax, [esi + 0xc]
push eax
call sub.glib_lite.dll_Ordinal_213
push edi
call fcn.1002b710
add esp, 0xc
cmp ebp, edx
jb 0x1007005b
ja 0x10070055
cmp ebx, eax
jbe 0x1007005b
sub ebx, eax
sbb ebp, edx
jmp 0x1007006c
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
push ebp
push ebx
push edi
call fcn.1002d6cd
add esp, 0x10
mov dword [esp + 0x10], eax
cmp eax, 4
je 0x1007009b
cmp dword [edi + 0x168], 0
jne 0x10070175
cmp eax, 2
je 0x10070011
call fcn.10083a8f
push eax
push dword [esi + 0x1f0]
call sub.glib_lite.dll_Ordinal_413
push eax
call fcn.10083a5e
add esp, 0xc
push edx
push eax
call fcn.10083a8f
push eax
push dword [esi + 0x1f0]
call sub.glib_lite.dll_Ordinal_413
pop ecx
pop ecx
push eax
call fcn.10083975
mov dword [esp + 0x24], eax
lea eax, [esi + 0xc]
push eax
mov dword [esp + 0x24], edx
call sub.glib_lite.dll_Ordinal_212
mov edi, dword [esi + 0x78]
add esp, 0x10
add edi, ebx
mov ebx, dword [esi + 0x7c]
adc ebx, ebp
cmp dword [esp + 0x10], 1
jne 0x100700fd
add edi, dword [esp + 0x24]
adc ebx, dword [esp + 0x28]
push esi
call fcn.1006e427
lea eax, [esp + 0x30]
xor ebp, ebp
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
push ebp
push dword [esi + 0x1f0]
call fcn.10030026
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x58]
push dword [esp + 0x58]
push ebx
push edi
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esi + 0x1f0]
call fcn.1004e9af
mov eax, dword [esi + 0x1f8]
add esp, 0x3c
cmp dword [eax + 8], ebp
jne 0x10070160
push dword [esp + 0x20]
push dword [esi + 0x1f0]
call fcn.10030542
pop ecx
pop ecx
push esi
call fcn.1006f830
push 3
push esi
call fcn.1006de9e
add esp, 0xc
xor eax, eax
jmp 0x10070182
lea eax, [esi + 0xc]
push eax
call sub.glib_lite.dll_Ordinal_212
pop ecx
push 0xfffffffffffffffe
pop eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10041f9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10041fab
pop dword [ebp - 0xc]
mov eax, 0xa141531a
add eax, 0x6ec2cc91
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x602839a6
add dword [ebp - 0x1c], 0xee2a0ba5
mov dword [ebp - 0x18], 0xa9599a58
add dword [ebp - 0x18], 0x88d9b1ed
mov dword [ebp - 0x14], 0xd7b84e44
add dword [ebp - 0x14], 0x7493f5ea
mov dword [ebp - 0x10], 0xb574abad
add dword [ebp - 0x10], 0x4a8b5453
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xbddb7505
sub eax, 0xadd574f5
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xc3725631
add dword [ebp - 0x1c], 0xb1001325
mov dword [ebp - 0x18], 0x7e218548
sub dword [ebp - 0x18], 0x3cb523d3
mov dword [ebp - 0x14], 0x3210f3e7
sub dword [ebp - 0x14], 0xcea1877b
mov dword [ebp - 0x10], 0x22204018
sub dword [ebp - 0x10], 0x22204018
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xf0b8d73e
add eax, 0x1f4d28d6
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x55ec6
push 0
call eax
mov ecx, 0xbab85dea
add ecx, 0x4547ea96
mov edx, eax
mov ebx, 0x8f8aba1e
sub ebx, 0x7f81fe1e
add ebx, dword [ebp - 0xc]
mov edi, 0xd435c92c
mov esi, dword [ebx]
xor dword [ebp - 4], eax
add esi, edi
sub dword [ebp - 4], eax
mov dword [edx], esi
sub dword [ebp - 8], ebx
add edx, 0x7d2a8743
add edx, 0x82d578c1
add ebx, 0x46ac0657
sub ebx, 0x46ac0653
loop 0x100420c7
add eax, 0x114d3
mov ebx, eax
add eax, 5
mov ecx, 0x6ef90c2c
sub ecx, 0x5ef90c2c
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401658
Capabilities:
Encode data using xor

Disassembly:
push 0x40204c
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0xc8ed69c], dh
test byte [edi - 0x50], al
jb 0x401666
aad 0xeb
salc
cmp dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x72], dl
outsd dx, dword [esi]
push 0x65
arpl word [ecx + esi], si
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
int3
Function at 0x402b40
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x49b044], 0x8088405
inc edx
mov dword [0x49b044], edx
mul edx
mov eax, edx
ret

Function at 0x41608c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x416092
ret

Function at 0x44a5cc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x498bb8
test edx, edx
jne 0x44a5dc
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x44a6a4
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x44a5e8
test ecx, ecx
je 0x44a6c3
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x44a6a8
xor eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x4524f4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004526b0
mov ebx, eax
mov eax, esi
call fcn.0045244c
mov edi, eax
dec edi
test edi, edi
jl 0x45252a
inc edi
mov eax, dword [esi + 8]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov eax, ebx
xor ecx, ecx
call fcn.00402b20
add ebx, dword [esi + 8]
dec edi
jne 0x452511
pop edi
pop esi
pop ebx
ret
Function at 0x471bd4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x471cc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebx + 0x24]
mov esi, dword [edi + 0x68]
mov edx, dword [edi + 0x64]
mov eax, dword [0x49aa34]
mov eax, dword [eax]
call fcn.004631d0
mov edx, dword [eax + 0x14]
imul edx, esi
mov eax, dword [0x49aa9c]
mov eax, dword [eax]
call fcn.0047d518
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x64]
mov eax, dword [0x49aa9c]
mov eax, dword [eax]
mov ecx, esi
call fcn.0047d058
mov byte [ebx + 0xc], 3
mov eax, dword [ebx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x20]
mov eax, dword [0x49abdc]
mov eax, dword [eax]
mov edx, dword [ebx + 0x38]
call fcn.0045d404
mov esi, eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x20]
mov ecx, dword [ebx + 0x50]
mov edx, 1
call fcn.00403f54
mov eax, dword [ebp - 4]
push eax
push 0
push 1
mov ecx, 8
mov edx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x14]
mov esi, dword [eax]
call dword [esi + 0x34]
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x20]
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x64]
mov eax, ebx
call fcn.004713e4
mov eax, dword [ebx + 0x1c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x471c97
mov byte [eax], 0
mov eax, dword [ebx + 0x24]
xor edx, edx
mov dword [eax + 0x64], edx
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [ebx + 0x44], 0x1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471cc8
lea eax, [ebp - 4]
call fcn.00403acc
ret

Function at 0x4802f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.0045a754
mov esi, edi
mov dword [ebx + 0x10], esi
mov eax, dword [0x49ace0]
mov eax, dword [eax]
mov edx, esi
call fcn.0045f988
mov eax, dword [eax + 0xc]
call fcn.0045a8e4
mov ebp, eax
dec ebp
test ebp, ebp
jl 0x48038e
inc ebp
xor esi, esi
lea edx, [esi + 1]
mov eax, ebx
call fcn.0045a788
mov eax, dword [0x49ace0]
mov eax, dword [eax]
mov edx, dword [ebx + 0x10]
call fcn.0045f988
mov eax, dword [eax + 0xc]
mov edx, esi
call fcn.0045f68c
mov edi, eax
mov edx, esi
mov eax, ebx
call fcn.00480270
mov edx, dword [edi + 0xc]
call fcn.0047f44c
mov edx, esi
mov eax, ebx
call fcn.00480270
mov edx, dword [edi + 0x10]
mov dword [eax + 0x4c], edx
mov edx, esi
mov eax, ebx
call fcn.00480270
mov edx, dword [edi + 0x14]
mov dword [eax + 0x50], edx
mov edx, esi
mov eax, ebx
call fcn.00480270
mov dl, byte [edi + 0x18]
xor dl, 1
mov byte [eax + 0xc], dl
inc esi
dec ebp
jne 0x480324
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48ecec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x30]
xor eax, eax
push ebp
push 0x48ee8e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x10]
mov edx, dword [ebp - 4]
call fcn.00403b20
mov dword [ebp - 8], esi
fild dword [ebp - 8]
fstp qword [ebx + 0x18]
wait
mov dword [ebp - 8], edi
fild dword [ebp - 8]
fstp qword [ebx + 0x20]
wait
mov dword [ebp - 8], esi
fild dword [ebp - 8]
fstp qword [ebx + 0x28]
wait
mov dword [ebp - 8], edi
fild dword [ebp - 8]
fstp qword [ebx + 0x30]
wait
mov al, byte [ebp + 0x2c]
mov byte [ebx + 0x38], al
fild dword [ebp + 0x28]
fstp qword [ebx + 0x40]
wait
fild dword [ebp + 0x24]
fstp qword [ebx + 0x48]
wait
mov al, byte [ebp + 0x20]
mov byte [ebx + 0x50], al
fild dword [ebp + 0x1c]
fstp qword [ebx + 0x58]
wait
fild dword [ebp + 0x18]
fstp qword [ebx + 0x60]
wait
fild dword [ebp + 0x14]
fstp qword [ebx + 0x68]
wait
fild dword [ebp + 0x10]
fstp qword [ebx + 0x70]
wait
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x78], eax
fild dword [ebp + 8]
fstp qword [ebx + 0x80]
wait
cmp dword [ebx + 0x78], 0
jne 0x48ed9f
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x84], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x88], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x8c], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x90], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x94], eax
fld qword [ebx + 0x40]
call fcn.004029b8
mov dword [ebx + 0x98], eax
fld qword [ebx + 0x48]
call fcn.004029b8
mov dword [ebx + 0x9c], eax
fld qword [ebx + 0x58]
call fcn.004029b8
mov dword [ebx + 0xa0], eax
fld qword [ebx + 0x60]
call fcn.004029b8
mov dword [ebx + 0xa4], eax
fld qword [ebx + 0x68]
call fcn.004029b8
mov dword [ebx + 0xa8], eax
fld qword [ebx + 0x70]
call fcn.004029b8
mov dword [ebx + 0xac], eax
fld qword [ebx + 0x80]
call fcn.004029b8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0xb8], eax
mov dword [ebx + 0xbc], eax
xor eax, eax
mov dword [ebx + 0xc0], eax
push 2
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [0x49af5c]
mov edx, 0x48eea8
mov eax, dword [ebx + 0x10]
call fcn.00459904
mov edx, dword [ebp - 0xc]
mov cl, 1
mov eax, dword [ebx + 0xc]
call fcn.00451e28
mov eax, dword [ebx + 0xc]
mov dl, byte [ebx + 0x50]
mov byte [eax + 0x610], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ee95
lea eax, [ebp - 0xc]
call fcn.00403acc
ret