joyce8/EMBER2024-capa huggingface dataset:
Function at 0x22e3b93
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [ebp - 4], eax
pushfd
mov byte [esp + 4], cl
pushfd
xchg dword [esp + 8], eax
lea eax, [esp + 0x4b6abea5]
mov dword [esp + 4], 0
bswap eax
lahf
movzx ax, bl
lea eax, sym.imp.kernel32.dll_LocalAlloc_2
pushal
call fcn.023689a5
add byte [eax], al
inc esi
imul ebp, dword [esi + 0x64], 0x6f736552
jne 0x1d03984
arpl word [ebp + 0x45], sp
js 0x1d03958
add ch, dh
sbb dword [ebx], 0xffffff84
outsd dx, dword [esi]
invalid
std
adc byte [edx - 0xd7ab7d0], dl
add ah, 0xf3
dec eax
ja 0x1d039c6
loop 0x1d039c6
xor eax, 0x851063b6
cmp dh, byte [ebx - 0x22c92d9]
and ebx, dword [ebp - 0x35]
loope 0x1d039de
xchg ecx, eax
push edi
dec ecx
inc dword [ecx]
das
pop ebp
ret
pop ebx
pop ecx
out 0xe5, eax
push ds
leave
mov edi, ebp
or al, 0x93
in al, dx
hlt
dec ebp
je 0x1d03a2b
inc esi
imul ebp, dword [ebp + 0x42], 0x737469
add byte [eax], al
push edx
insd dword es:[edi], dx
outsd dx, dword [esi]
jbe 0x1d03a40
dec ebp
outsb dx, byte gs:[esi]
jne fcn.01d039e0
ret 0x5c58
push eax
add ebp, dword [ebx - 0x4d]
dec esp
sbb byte [0xd94668e6], 9
imul byte [edx + 0x4682523e]
xchg edx, eax
ret 0x28ae
pushal
pushal
mov dword [esp + 0x3c], eax
push dword [esp + 8]
mov dword [esp + 0x3c], 0
lahf
movzx ax, cl
lea eax, sym.imp.kernel32.dll_LocalAlloc_2
pushfd
mov dword [esp + 0x3c], 0x22e8a95
mov byte [esp], 0x36
push dword [eax]
pop dword [esp + 0x38]
mov byte [esp + 8], 0xb
push dword [esp + 0x38]
ret 0x3c
setbe al
pop eax
lea eax, sym.imp.kernel32.dll_LocalAlloc_2
pushal
mov byte [esp + 0x1c], cl
pushfd
mov dword [esp + 0x3c], 0x2364200
call fcn.01d09c3f
add byte [eax], al
dec edi
jo 0x1f04acc
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add dh, bh
iretd
jb 0x1f04b1b
jne 0x1f04b3c
jmp 0x1d040d3
adc dword [edx], 0x45e5c2a5
adc dword [eax + eax*8 - 0x7173a18d], esp
mov al, 0x25
rol byte [esi + 0x14cbad0f], 1
mov ah, 0x7a
inc eax
inc edx
jne 0x1f04b51
xor dword [esp + esi*8 + 0xf], ebp
fsub qword [edi + 0x3c]
call fcn.022e8a1b
add byte [eax], al
dec ecx
insd dword es:[edi], dx
popal
dec esp
imul esi, dword [ebx + 0x74], 0x7465535f
inc esp
jb 0x22e3c0b
inc ebx
jne 0x22e3c20
jae 0x22e3c1f
jb 0x22e3bfb
insd dword es:[edi], dx
popal
add byte gs:[bx + si], al
add byte [ecx + 0x73], cl
inc edx
popal
push edx
popal
push eax
je 0x22e3c37
add byte [eax], al
add byte [ebx + 0x72], al
popal
je 0x22e3c33
inc edx
imul esi, dword [ebp + ebp*2 + 0x61], 0xd1f50070
cmc
shl eax, 1
pushal
push 0xc578aa95
mov byte [esp], bl
pushfd
lea esp, [esp + 0x30]
je 0x22e550b
pushal
lea esp, [esp + 0x20]
jnp 0x1d038d6
pushfd
mov word [esp], 0x4ee6
and al, 0xe6
dec esi
mov dword [ebp - 4], eax
mov byte [esp], ah
pushal
mov word [esp], si
lea esp, [esp + 0x24]
and al, 0x24
jns 0x1f04b06
push eax
pushfd
pushal
mov dword [esp + 0x20], 0
jmp 0x1f04a45
and cl, byte [esi]
push cs
ret 0xfff
pop esp
ljmp 0xd4e9
and al, 8
Function at 0x22e3c87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x30]
jne 0x1d0606a
movzx ax, dl
mov byte [edi - 1], 0
movzx ax, al
setb al
movzx eax, bl
movsx eax, al
push ebx
setb al
movsx ax, cl
movzx eax, al
movzx eax, al
lea eax, [0x22e9d4a]
push ecx
pushfd
jmp 0x22ea3dd
push esi
mov dword [esp + 8], 0x1d0410f
push dword [esp + 4]
call fcn.022e946b
pushal
or eax, eax
push ecx
pushfd
lea esp, [esp + 0x30]
je 0x22e550b
mov bl, al
lea ebx, [edi + 0xca668a7]
not bl
mov ebx, eax
movzx ax, dl
movsx ax, bl
lea eax, [ebp - 8]
jmp 0x22ea05d

Function at 0x22e5cec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [ebp + 8]
mov byte [esp + 0xc], bh
lea esp, [esp + 0x34]
call fcn.01f049f0
push 0xc367016b
push ebx
mov byte [esp], dh
push 0xdb653b37
lea esp, [esp + 0xc]
jne 0x22e62a2
pushfd
mov eax, dword [edx + 8]
push ecx
pushal
lea esp, [esp + 0x28]
jmp fcn.022e5512
Function at 0x22e8a95
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ebx, 0xb0890bfd
xor al, al
pushal
cmp cx, 0x6d29
repne scasb al, byte es:[edi]
pushfd
lea esp, [esp + 0x28]
jne 0x22e5e2d
shrd si, si, cl
mov ecx, edi
bsf si, di
or si, cx
adc si, 0x7677
sub ecx, ebx
push 0xc128d79
clc
pushfd
or si, 0x8ae9
lea esi, [esp + 8]
mov word [esp + 4], 0xe8cf
mov byte [esp], 0x47
test al, 0xbf
stc
sub edi, 4
test ah, al
jmp 0x1d08504
call 0x1d7c071
test eax, 0x758c7b7
pop ss
jge 0x1d06075
lea ebx, [ebp + 0x7b]
cmp dword [edi + 0x7f0b6c02], edx
and esi, dword [ebx + 0x14]
ret
sub edi, 4
cmp ax, dx
push edi
pushal
test bh, 0x81
push dword [edi]
pop dword [esp + 0x40]
pushfd
cmc
cmp edi, ebx
pushfd
push dword [esp + 0x10]
lea esp, [esp + 0x4c]
ja 0x1d0803c
ja 0x2364f04
inc al
add al, cl
xor al, 0x1e
sub ebx, edi
or di, di
bsr di, ax
sub di, di
add ebx, esp
bts di, 0xf
add al, dl
stc
mov edi, ebx
pushfd
dec al
or al, cl
mov al, 0x2e
push esp
cmc
repne scasb al, byte es:[edi]
push 0xcf6ed143
lea esp, [esp + 0xc]
jne 0x1d0606a
pushal
lahf
mov byte [edi - 1], 0
lahf
push 0xdd190519
mov dword [esp + 0x20], ebx
push dword [esp + 4]
lea eax, [0x22e9d4a]
call fcn.022ea021
scasb al, byte es:[edi]
shr byte [esi + edi*8], cl
popfd
mov cl, 0xe7
fcom dword [ecx + 0x4580027d]
pop ss
pop ds
xor dh, cl
sub eax, 0x289a7ce2
dec cx
ficom word [eax]
invalid
jmp 0x22e8a4e
push dword [edi]
pop dword [esp + 4]
mov byte [esp], 0x3b
pushfd
mov byte [esp], 0x82
cmp edi, ebx
pushal
lea esp, [esp + 0x28]
ja 0x2364f04
ror al, cl
sub ebx, edi
sbb di, di
movzx di, dl
add ebx, esp
test bh, dl
dec di
rcl al, cl
mov edi, ebx
sub al, dh
and al, 0x11
adc al, 0x45
setae al
mov al, 0x2e
cmp si, si
clc
push esi
cmc
repne scasb al, byte es:[edi]
push ebp
lea esp, [esp + 8]
jne 0x1d0606a
lea eax, [edx*8 + 0x4a337f32]
movzx eax, dl
mov byte [edi - 1], 0
pushfd
mov dword [esp], ebx
movsx eax, al
setge ah
mov ax, 0x2ab8
bswap ax
lea eax, [0x22e9d4a]
pushfd
call fcn.022e3b93
mov esp, 0x8a409f1b
insd dword es:[edi], dx
pop ss
cwde
dec edx
xchg byte [0x4fc3b4d3], ch
shl dword [edi + 3], cl
aam 0x1a
cmp al, 0xbb
or esi, dword [esi + edi + 0x6e8842c4]
cmp al, 0xc7
das
mov ebx, 0x3bd4594f
scasd eax, dword es:[edi]
sbb dh, 0x91
popfd
imul dword [ecx]
pop edi
invalid
push 0x28399c7d
lea esp, [esp + 4]
ja 0x2364f04
shl al, 5
sub ebx, edi
neg di
push 0x4f551452
xor di, bx
shr di, cl
add esp, 4
add ebx, esp
btc di, si
and di, 0x41b4
clc
shrd di, cx, 5
mov edi, ebx
clc
shr al, 5
or al, cl
mov al, 0x2e
test ebp, ecx
call fcn.023665ec
pushfd
push 0x9072ee65
jmp 0x22ea3ef
pushal
jmp 0x1d074bd

Function at 0x22e9fe7
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push 0x20878ad
pushal
lea esp, [esp + 0x2c]
jne 0x22e550b
clc
mov ecx, dword [ebx]
test bh, al
jmp 0x22e4979
cmc
or ecx, ecx
push esi
lea esp, [esp + 4]
ja 0x22e65f0
je 0x22e550b
movsx dx, dl
mov dx, bx
not si
movsx edx, cl
lea edx, [ebx + 4]
xchg esi, edi
movzx si, bl
not di
pushal
movzx esi, word [edx + 0x1a]
not edi
lea esi, [esi + edx + 0x1c]
call fcn.01d08663
jmp 0x1d7bebd
Function at 0x2364632
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov al, byte [0xaadddcb9]
xor ebx, dword [edx + 0x10792bfc]
fdiv dword [ebx]
and eax, 0x521a05
pop ecx
fisubr word [eax]
invalid
jno 0x1f04563
add al, 0x24
or eax, 0xc62ec9fd
add al, 0x24
int3
mov ah, al
call fcn.022e50ba
xchg esi, eax
bound esp, qword [ecx]
pop ebp
leave
and dword [ebx + 0x54], esp
jle 0x1f04629
jae 0x1f04637
xor byte [edi + 0x18], ah
pop esi
in al, 0x2e
test byte [ebx], dl
cmp ebx, dword [ebx + ebx*4 - 0x45d08e08]
mov bh, 0xf1
loop 0x1f0459a
pop edi
cld
jne 0x1f04635
xor ebp, dword [ebp - 0x12]
imul ecx, esp, 0x29
inc eax
pop eax
jecxz 0x1f0465f
mov dh, 0x18
mov bh, 9
sbb edi, dword [ebx + 0x29]
push cs
pop edi
shl byte [ebp + 0x74808203], 1
sbb al, byte [ebx + 0x45995ea6]
or dword [ebp + 0x56aa8215], esi
outsb dx, byte [esi]
insb byte es:[edi], dx
fstp st(5)
pop edx
mov eax, 0x74a6b316
sub eax, 0x1d6210d6
pop ecx
invalid
loope 0x1f04672
out 0x18, al
cmpsd dword [esi], dword es:[edi]
sub ebx, edi
jmp 0xd189af82
out dx, eax
sbb edi, dword [eax + 0x42beccc7]
call dword [ecx]
loope 0x1f046a3
lodsd eax, dword [esi]
imul ebx, dword [esi - 0x3b], 0xffffffd4
in al, dx
mov esp, 0x564ed0f3
xor edx, dword [esi]
inc edi
cmp byte [ebx], dh
mov esi, 0x5485ada6
xor edi, dword [esi + 0x5485ada6]
dec ecx
fnstcw word [esi]
bound eax, qword [edx - 0x35e981fd]
mov dh, 0xef
loop 0x1f046ad
xlatb
test dl, al
jge 0x1f04645
invalid
add byte [eax], 0x9f
rcr ah, 1
or eax, 0xd366e589
rol byte [ebx - 0x127be714], 0x66
rcr eax, 4
movzx cx, al
mov ecx, edi
lea esp, [esp + 4]
mov al, ah
not al
ror al, cl
mov al, byte [ecx]
stc
jmp 0x1f045d5

Function at 0x2366222
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
je 0x22e5e2d
pushfd
and si, ax
btc si, 0xf
test bh, bh
jmp 0x22e5e4a

Function at 0x2368c67
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or ecx, ecx
mov dword [esp + 4], 0x793b408d
push dword [esp]
mov dword [esp + 8], eax
mov byte [esp], ch
lea esp, [esp + 0xc]
je 0x22e550b
xchg si, dx
not esi
movzx si, dl
lea edx, [ebx + 4]
pushfd
bswap esi
movsx si, al
call fcn.02365c76
mov al, 0xae
scasb al, byte es:[edi]
sub dl, bl
push eax
fiadd dword [edx]
add dword [ecx], 0xffffffc8
and al, 0xbc
sbb ah, byte [edi + 0x3bd4f25c]
jg 0x2368cd1
push 0x35
mov esi, 0x354be58
arpl word [edi - 0x9b321b0], bp
pushfd
sbb ch, al
add cl, byte [eax + 0x6c3c44a4]
cmp al, 0x74
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
leave
xchg ebx, eax
loopne 0x2368c9e
adc byte [ecx + 0x67839bcb], al
push cs
or ebx, 0xe67839b
adc byte [edi], ch
ret 0xaada

Function at 0x401c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x401c20
lcall 0x5de5, 0x8b10c483
jmp loc.007f06c4
Function at 0x41305b
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
xor ebx, ebx
xor eax, eax
mov eax, 0x413079
inc byte [eax]
inc eax
cmp eax, 0x413287
jne 0x413064
inc ebx
cmp ebx, 0x18b11
jne 0x41305f
xor edi, ebx
nop
nop
nop
mov eax, dword [esp]
xor ax, ax
push 0xffff
push 0x5d7574b6
push 0x71e40722
push 0x15f8ef80
push 0xd66358ec
mov edi, esp
cmp word [eax], 0x5a4d
jne 0x4130b7
mov edx, dword [eax + 0x3c]
cmp edx, 0x1000
ja 0x4130b7
cmp word [eax + edx], 0x4550
je 0x4130be
sub eax, 0x10000
jmp 0x41309d
push eax
mov esi, dword [eax + edx + 0x78]
add esi, eax
add esi, 0x18
xchg ebx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
push eax
add eax, ebx
push eax
lodsd eax, dword [esi]
push eax
mov ebp, esp
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov esi, dword [ebp + 4]
mov esi, dword [esi]
add esi, ebx
xor eax, eax
push eax
ror eax, 7
xor dword [esp], eax
lodsb al, byte [esi]
test al, al
jne 0x4130e5
pop eax
push edi
cmp dword [edi], 0xffff
je 0x413103
cmp eax, dword [edi]
je 0x41310d
add edi, 4
jmp 0x4130f2
pop edi
add dword [ebp + 4], 4
inc edx
loop 0x4130db
jmp 0x413139
shl edx, 1
mov ecx, dword [ebp]
add ecx, ebx
add ecx, edx
mov ecx, dword [ecx]
and ecx, 0xffff
mov edx, dword [ebp + 0xc]
add edx, ebx
shl ecx, 2
add edx, ecx
mov edx, dword [edx]
add edx, ebx
mov dword [edi], edx
mov ecx, dword [ebp + 8]
add ecx, ebx
mov dword [ebp + 4], ecx
pop edi
jmp 0x4130d6
sub edi, 4
mov esp, edi
mov ebx, dword [esp + 8]
mov edi, esp
sub edi, 4
push edi
push 0x40
push 0x1000
push 0x400000
call ebx
mov eax, 0x4001ac
mov dword [eax], 0x11000
mov eax, 0x4001b0
mov dword [eax], 0x1148
mov edx, 0x400204
mov esi, dword [edx + 0xc]
add esi, 0x400000
pushal
mov edi, esp
sub edi, 4
push edi
push 0x40
push dword [edx + 8]
push esi
call ebx
popal
mov edi, 0x413287
call fcn.004131b2
mov ecx, dword [esi]
mov edi, esi
mov esi, 0x413287
rep movsb byte es:[edi], byte [esi]
add edx, 0x28
cmp edx, 0x40027c
jb 0x413171
mov eax, 0x40511c
call eax
ret
Function at 0x40ba9c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x20]
add ecx, 0x4cacdf14
xor ecx, edx
ror dword [ecx - 0x74f3dbb4], 1
dec esp
and al, 0xc
add cl, 0x77
mov edx, dword [esp]
mov byte [esp + edx + 0x20], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x86
jb 0x40ba4e
mov dword [esp + 0xc], 0x3a9838e8
mov dword [esp + 0x10], 0x268c24ab
mov word [esp + 0x14], 0x2027
mov dword [esp + 0x16], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xd
ja 0x40baf1
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
add al, 0x8b
push esp
and al, 4
movzx edx, byte [esp + edx + 0xc]
add ecx, 0xa3a3294b
xor ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x8c
mov edx, dword [esp + 4]
mov byte [esp + edx + 0xc], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
or dword [esi], 4
jmp 0x40bb6a
push cs
jb 0x40bac1
invalid
invalid

Function at 0x41e5c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop ds
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x41e5b8
Function at 0x43dfec
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
adc al, 0x8b
dec esp
and al, 4
rol ecx, 0xb
mov eax, dword [esp]
rol eax, 0xa
mov dword [esp], eax
mov edx, dword [esp + 0xc]
add ecx, edx
mov dword [esp + 4], ecx
not eax
or eax, dword [esp + 8]
xor eax, ecx
mov edi, edx
add edi, dword [esp + 0x40]
mov ecx, dword [esp + 0x14]
rol ecx, 0xd
add eax, edi
add eax, 0xa953fd4e
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x5c]
add ecx, edx
rol esi, 0xa
mov eax, ecx
xor eax, ebx
and eax, esi
xor eax, ebx
add edx, dword [esp + 0x48]
add edx, eax
add edx, 0x5c4dd124
rol edx, 0xb
add edx, ebp
rol ebx, 0xa
mov eax, ecx
not eax
or eax, edx
xor eax, ebx
add ebp, dword [esp + 0x34]
add ebp, eax
add ebp, 0x3a8103f3
fidiv word [eax + 0x6d]
rol ebp, 9
add ebp, esi
rol ecx, 0xa
mov dword [esp + 0x14], ecx
mov eax, edx
not eax
or eax, ebp
xor eax, ecx
add esi, dword [esp + 0x3c]
lea edi, [eax + esi]
add edi, 0x3a8103f3
fidiv word [eax + 0x6d]
mov ecx, dword [esp + 0x18]
rol ecx, 6
mov eax, dword [esp + 8]
rol eax, 0xa
mov dword [esp + 8], eax
mov esi, dword [esp + 0x10]
add ecx, esi
mov dword [esp + 0x18], ecx
not eax
or eax, dword [esp + 4]
xor eax, ecx
mov ecx, esi
add ecx, dword [esp + 0x1c]
rol edi, 7
lea esi, [eax + ecx]
add esi, 0xa953fd4e
add edi, ebx
rol edx, 0xa
mov eax, ebp
not eax
or dword [esi], ecx
add al, 0xeb
js 0x43e0fd
rol byte [ebx], 1
pop esp
and al, 0x24
add ebx, eax
add ebx, 0x6d703ef3
rol ebx, 0xf
mov eax, dword [esp + 0x14]
add ebx, eax
rol ebp, 0xa
mov ecx, edi
not ecx
or ecx, ebx
xor ecx, ebp
add eax, dword [esp + 0x4c]
add eax, ecx
add eax, 0x6d703ef3
rol eax, 0xb
add eax, edx
rol edi, 0xa
mov ecx, ebx
not ecx
or ecx, eax
xor ecx, edi
add edx, dword [esp + 0x40]
add ecx, edx
add ecx, 0x3a8103f3
fidiv word [eax + 0x6d]
rol esi, 8
mov edx, dword [esp + 4]
rol edx, 0xa
mov dword [esp + 4], edx
add esi, dword [esp]
mov dword [esp + 0x10], esi
not edx
or edx, dword [esp + 0x18]
xor edx, esi
mov esi, dword [esp]
add esi, dword [esp + 0x48]
rol ecx, 8
add edx, esi
add edx, 0xa953fd4e
mov dword [esp + 0xc], edx
add ecx, ebp
rol ebx, 0xa
mov edx, eax
not edx
or edx, ecx
xor edx, ebx
add ebp, dword [esp + 0x30]
add edx, ebp
add edx, 0x6d703ef3
rol edx, 6
add edx, edi
rol eax, 0xa
mov dword [esp], eax
mov esi, ecx
not esi
or esi, edx
xor esi, eax
add edi, dword [esp + 0x44]
add esi, edi
add esi, 0x6d703ef3
rol esi, 6
add esi, ebx
rol ecx, 0xa
mov edi, edx
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x30f11169
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5cca7a00
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10771058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.107711a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1077107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1077106a
add dl, dl
jne 0x10771089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x107710dc
xor eax, eax
add dl, dl
jne 0x10771096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1077117d
add dl, dl
jne 0x107710a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107710b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107710bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107710c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x107710d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10771075
mov eax, 1
add dl, dl
jne 0x107710ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x107710f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x107710e1
sub eax, ebx
mov ebx, 1
jne 0x10771128
mov ecx, 1
add dl, dl
jne 0x1077110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10771119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10771105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10771075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1077113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1077114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10771136
cmp eax, 0x7d00
jae 0x1077116d
cmp eax, 0x500
jb 0x10771168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10771075
cmp eax, 0x7f
ja 0x10771170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10771075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1077119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10771075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x40192c
Capabilities:
Accept command line arguments

Disassembly:
in al, dx
adc byte [ebx + 0x33530845], cl
fist dword [esi + 0x57]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov edi, ebx
test eax, eax
je 0x4019eb
cmp word [eax], bx
je 0x4019eb
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x4019a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x20f
push str.engine.cpp
call fcn.004300d9
push str.Failed_to_get_command_line.
push esi
call fcn.00430a57
pop ecx
pop ecx
jmp 0x401a48
mov esi, ebx
cmp dword [ebp - 0x10], ebx
jle 0x4019eb

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x431ece
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
xor ebx, ebx
push 0x44
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004267c0
xor eax, eax
cmp dword [ebp + 0xc], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x43b580
cmovne eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push str.__ls___ls
push eax
call fcn.00433cea
mov esi, eax
add esp, 0x1c
test esi, esi
js 0x431f80
mov cx, word [ebp + 0x10]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x58], 0x44
push dword [ebp + 8]
mov word [ebp - 0x28], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x431f75
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0xa9
push str.procutil.cpp
call fcn.004300d9
jmp 0x431f80
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], ebx
mov dword [eax], ecx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], ebx
je 0x431f93
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x431fa0
push dword [ebp - 0x14]
call edi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 4], ebx
je 0x431fad
push dword [ebp - 4]
call fcn.004380ab
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x436186
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4560d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, 0x11c
push ebx
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004267c0
mov eax, dword [0x457f4c]
add esp, 0xc
test eax, eax
jne 0x436266
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx ecx, word [ebp - 0xc]
movzx eax, word [ebp - 0xa]
shl ecx, 0x10
push 4
or ecx, eax
pop edx
mov dword [0x457f50], ecx
cmp dword [ebp - 0x11c], edx
jne 0x4361fc
xor eax, eax
inc eax
jmp 0x436261
cmp dword [ebp - 0x11c], 5
jne 0x436227
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x436213
push 2
jmp 0x436260
cmp ecx, 1
jne 0x43621c
push 3
jmp 0x436260
push 9
pop eax
cmp ecx, 2
cmove eax, edx
jmp 0x436261
cmp dword [ebp - 0x11c], 6
jne 0x43625e
cmp dword [ebp - 0x118], 0
jne 0x436247
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 5
jmp 0x436261
cmp dword [ebp - 0x118], 1
jne 0x43625e
xor eax, eax
cmp byte [ebp - 6], 1
setne al
add eax, 7
jmp 0x436261
push 9
pop eax
mov dword [0x457f4c], eax
mov ecx, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [0x457f50]
mov dword [edi], eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004267af
leave
ret 8
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219