joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009d3a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100d2170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0x1c]
xor edx, edx
sub ebx, 6
push esi
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edx
cmp ebx, edx
jle 0x1009d3d2
mov esi, dword [ebp + 0xc]
mov ecx, ebx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x1009d419
mov dword [ebp - 0x2c], 8
nop
mov esi, dword [ebp - 0x28]
cmp esi, dword [eax + 0x1c]
ja 0x1009d419
cmp ecx, ebx
jge 0x1009d407
lea esp, [esp]
cmp edx, 4
jge 0x1009d40a
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp + ecx*4 - 0x24]
add esi, edx
inc ecx
inc edx
mov dword [eax + esi*4], edi
cmp ecx, ebx
jl 0x1009d3f0
cmp edx, 4
jne 0x1009d415
inc dword [ebp - 0x28]
add dword [ebp - 0x2c], 4
xor edx, edx
cmp ecx, ebx
jl 0x1009d3e0
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax + 0x1c]
ja 0x1009d55a
mov esi, 0x100d7938
jmp 0x1009d433
mov esi, dword [ebp - 0x34]
movzx ecx, byte [ebp + ebx*4 - 0x27]
mov al, byte [ebp - 0x24]
xor al, byte [ecx + 0x100d4738]
add esi, 4
mov byte [ebp - 0x24], al
movzx ecx, byte [ebp + ebx*4 - 0x26]
movzx ecx, byte [ecx + 0x100d4738]
xor byte [ebp - 0x23], cl
movzx ecx, byte [ebp + ebx*4 - 0x25]
movzx ecx, byte [ecx + 0x100d4738]
xor byte [ebp - 0x22], cl
movzx ecx, byte [ebp + ebx*4 - 0x28]
xor al, byte [esi - 4]
movzx ecx, byte [ecx + 0x100d4738]
xor byte [ebp - 0x21], cl
mov byte [ebp - 0x24], al
mov dword [ebp - 0x34], esi
mov eax, 1
cmp ebx, 8
je 0x1009d4a0
cmp ebx, eax
jle 0x1009d4fe
jmp 0x1009d490
mov ecx, dword [ebp + eax*4 - 0x28]
xor dword [ebp + eax*4 - 0x24], ecx
inc eax
cmp eax, ebx
jl 0x1009d490
jmp 0x1009d4fe
mov ecx, dword [ebp + eax*4 - 0x28]
xor dword [ebp + eax*4 - 0x24], ecx
inc eax
cmp eax, 4
jl 0x1009d4a0
movzx eax, byte [ebp - 0x18]
movzx ecx, byte [eax + 0x100d4738]
movzx eax, byte [ebp - 0x17]
xor byte [ebp - 0x14], cl
movzx ecx, byte [eax + 0x100d4738]
movzx eax, byte [ebp - 0x16]
xor byte [ebp - 0x13], cl
movzx ecx, byte [eax + 0x100d4738]
movzx eax, byte [ebp - 0x15]
xor byte [ebp - 0x12], cl
movzx ecx, byte [eax + 0x100d4738]
xor byte [ebp - 0x11], cl
mov eax, 5
jmp 0x1009d4f0
mov ecx, dword [ebp + eax*4 - 0x28]
xor dword [ebp + eax*4 - 0x24], ecx
inc eax
cmp eax, 8
jl 0x1009d4f0
xor eax, eax
test ebx, ebx
jle 0x1009d54b
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx*4 + 8]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
cmp esi, dword [ecx + 0x1c]
ja 0x1009d54e
cmp eax, ebx
jge 0x1009d537
cmp edx, 4
jge 0x1009d53a
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp + eax*4 - 0x24]
add esi, edx
inc eax
inc edx
mov dword [ecx + esi*4], edi
cmp eax, ebx
jl 0x1009d520
cmp edx, 4
jne 0x1009d545
inc dword [ebp - 0x28]
add dword [ebp - 0x2c], 4
xor edx, edx
cmp eax, ebx
jl 0x1009d511
jmp 0x1009d54e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ecx + 0x1c]
jbe 0x1009d430
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a3aa6
mov esp, ebp
pop ebp
ret
Function at 0x1009d570
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 1
cmp dword [edx + 0x1c], ecx
jbe 0x1009d65a
push esi
lea eax, [edx + 0x32]
push edi
jmp 0x1009d590
movzx esi, byte [eax + 1]
mov esi, dword [esi*4 + 0x100d7538]
movzx edi, byte [eax - 1]
xor esi, dword [edi*4 + 0x100d6d38]
movzx edi, byte [eax]
xor esi, dword [edi*4 + 0x100d7138]
movzx edi, byte [eax - 2]
xor esi, dword [edi*4 + 0x100d6938]
inc ecx
mov dword [eax - 2], esi
movzx esi, byte [eax + 5]
mov esi, dword [esi*4 + 0x100d7538]
movzx edi, byte [eax + 4]
xor esi, dword [edi*4 + 0x100d7138]
movzx edi, byte [eax + 3]
xor esi, dword [edi*4 + 0x100d6d38]
movzx edi, byte [eax + 2]
xor esi, dword [edi*4 + 0x100d6938]
add eax, 0x10
mov dword [eax - 0xe], esi
movzx esi, byte [eax - 7]
mov esi, dword [esi*4 + 0x100d7538]
movzx edi, byte [eax - 8]
xor esi, dword [edi*4 + 0x100d7138]
movzx edi, byte [eax - 9]
xor esi, dword [edi*4 + 0x100d6d38]
movzx edi, byte [eax - 0xa]
xor esi, dword [edi*4 + 0x100d6938]
mov dword [eax - 0xa], esi
movzx esi, byte [eax - 3]
movzx edi, byte [eax - 4]
mov esi, dword [esi*4 + 0x100d7538]
xor esi, dword [edi*4 + 0x100d7138]
movzx edi, byte [eax - 5]
xor esi, dword [edi*4 + 0x100d6d38]
movzx edi, byte [eax - 6]
xor esi, dword [edi*4 + 0x100d6938]
mov dword [eax - 6], esi
cmp ecx, dword [edx + 0x1c]
jb 0x1009d590
pop edi
pop esi
ret
Function at 0x1009e660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x100d2170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x108], eax
xor esi, esi
mov edi, ecx
xor eax, eax
jmp 0x1009e690
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, 0x100
jl 0x1009e690
xor edx, edx
xor eax, eax
jmp 0x1009e6b0
movzx ecx, byte [ebp + eax - 0x104]
mov ebx, eax
and ebx, 0x8000000f
jns 0x1009e6c7
dec ebx
or ebx, 0xfffffff0
inc ebx
movzx ebx, byte [ebx + edi]
add ebx, ecx
add edx, ebx
and edx, 0x800000ff
jns 0x1009e6df
dec edx
or edx, 0xffffff00
inc edx
mov bl, byte [ebp + edx - 0x104]
mov byte [ebp + eax - 0x104], bl
inc eax
mov byte [ebp + edx - 0x104], cl
cmp eax, 0x100
jl 0x1009e6b0
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp - 0x108], 0x20
mov edi, esi
inc esi
and esi, 0x800000ff
jns 0x1009e724
dec esi
or esi, 0xffffff00
inc esi
movzx eax, byte [ebp + esi - 0x104]
add edi, eax
and edi, 0x800000ff
jns 0x1009e73e
dec edi
or edi, 0xffffff00
inc edi
mov bl, byte [ebp + edi - 0x104]
mov byte [ebp + esi - 0x104], bl
mov byte [ebp + edi - 0x104], al
movzx ebx, byte [ebp + esi - 0x104]
add ebx, eax
and ebx, 0x800000ff
jns 0x1009e76d
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x104]
xor al, byte [edx + ecx]
inc ecx
dec dword [ebp - 0x108]
mov byte [ecx - 1], al
jne 0x1009e713
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a3aa6
mov esp, ebp
pop ebp
ret
Function at 0x1009e7a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x100d2170]
xor eax, ebp
mov dword [ebp - 4], eax
inc ecx
push ebx
mov ebx, edx
mov eax, 0x4f7a09cd
imul ecx
imul ecx, ecx, 0x9ef4
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x7fffff07
sub ecx, eax
push esi
jns 0x1009e7dc
add ecx, 0x7fffff07
mov edx, ecx
sar edx, 8
mov byte [ebp - 0x13], dl
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x12], al
mov edx, ecx
sar edx, 0x18
mov byte [ebp - 0x11], dl
mov eax, 0x4f7a09cd
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ebp - 0x14], cl
imul eax, eax, 0x7fffff07
imul ecx, ecx, 0x9ef4
sub ecx, eax
jns 0x1009e81e
add ecx, 0x7fffff07
mov edx, ecx
sar edx, 8
mov byte [ebp - 0xf], dl
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0xe], al
mov edx, ecx
sar edx, 0x18
mov byte [ebp - 0xd], dl
mov eax, 0x4f7a09cd
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ebp - 0x10], cl
imul eax, eax, 0x7fffff07
imul ecx, ecx, 0x9ef4
sub ecx, eax
jns 0x1009e860
add ecx, 0x7fffff07
mov edx, ecx
sar edx, 8
mov byte [ebp - 0xb], dl
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0xa], al
mov edx, ecx
sar edx, 0x18
mov byte [ebp - 9], dl
mov eax, 0x4f7a09cd
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ebp - 0xc], cl
imul eax, eax, 0x7fffff07
imul ecx, ecx, 0x9ef4
sub ecx, eax
jns 0x1009e8a2
add ecx, 0x7fffff07
mov eax, ecx
mov edx, ecx
sar eax, 0x10
mov byte [ebp - 8], cl
sar ecx, 0x18
mov byte [ebp - 6], al
xor eax, eax
mov byte [ebp - 5], cl
lea ecx, [ebp - 0x14]
sar edx, 8
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
push 0x10
push ecx
lea eax, [ebp - 0x70]
mov byte [ebp - 7], dl
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
call fcn.1009dec0
add esp, 8
lea esi, [ebp - 0x70]
call fcn.1009de10
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100a3aa6
mov esp, ebp
pop ebp
ret
Function at 0x1009e910
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100d2170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x8c], edx
xor edx, edx
mov dword [ebp - 0x90], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
push ebx
sete dl
push esi
push 0x18
mov dword [ebp - 8], 0x546c4173
mov dword [ebp - 0x88], 0x67452301
mov dword [ebp - 0x84], 0xefcdab89
mov dword [ebp - 0x80], 0x98badcfe
mov dword [ebp - 0x94], edx
mov edx, dword [eax]
mov dword [ebp - 0x1c], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x18], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], edx
mov edx, eax
sar edx, 8
mov byte [ebp - 0xc], al
mov byte [ebp - 0xb], dl
mov edx, eax
sar eax, 0x18
mov byte [ebp - 9], al
lea eax, [ebp - 0x1c]
sar edx, 0x10
push eax
lea eax, [ebp - 0x88]
mov byte [ebp - 0xa], dl
mov dword [ebp - 0x7c], 0x10325476
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
call fcn.1009dec0
lea esi, [ebp - 0x88]
lea ebx, [ebp - 0x14]
call fcn.1009de10
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x2c]
call fcn.1009e7a0
mov ecx, dword [ebp - 0x94]
mov esi, dword [edi + 0x2c]
push ecx
lea ecx, [ebp - 0x2c]
mov edx, ebx
call fcn.1009ccd0
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x8c]
add eax, eax
add eax, eax
add esp, 0xc
add eax, eax
cmp dword [ebp + 0xc], 0
push edx
je 0x1009ea1f
mov ecx, dword [edi + 0x2c]
push ecx
mov ecx, dword [ebp - 0x90]
call fcn.1009cdb0
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a3aa6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x90]
push ecx
mov ecx, dword [edi + 0x2c]
call fcn.1009d0b0
mov ecx, dword [ebp - 4]
add esp, 8
pop esi
xor ecx, ebp
pop ebx
call fcn.100a3aa6
mov esp, ebp
pop ebp
ret
Function at 0x1009ebe0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
mov eax, dword [0x100d2170]
xor eax, esp
mov dword [esp + 0xc0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, edx
mov dword [esp + 0xc], eax
xor edi, edi
xor eax, eax
cmp esi, 0x20
jle 0x1009ec14
mov esi, 0x20
cmp esi, edi
jle 0x1009ec2c
push esi
push ecx
lea edx, [esp + 0xb4]
push edx
call fcn.100aace0
add esp, 0xc
mov eax, esi
xor ecx, ecx
cmp eax, 0x20
jge 0x1009ec4c
cmp ecx, 0x20
jge 0x1009ec4c
mov dl, byte [ecx + 0x100d79b4]
mov byte [esp + eax + 0xac], dl
inc eax
inc ecx
cmp eax, 0x20
jl 0x1009ec33
xor eax, eax
cmp eax, 0x20
jge 0x1009ec63
mov cl, byte [eax + 0x100d79b4]
mov byte [esp + eax + 0x7c], cl
inc eax
cmp eax, 0x20
jl 0x1009ec53
lea edx, [esp + 0x7c]
push 0x20
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.1009dec0
add esp, 8
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.1009de10
mov edi, 0x32
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x6c]
push 0x10
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.1009dec0
add esp, 8
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.1009de10
dec edi
jne 0x1009ecb0
mov ecx, 8
lea esi, [esp + 0xac]
lea edi, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor ebx, ebx
xor eax, eax
jmp 0x1009ed20
mov cl, byte [esp + eax + 0x6c]
xor cl, bl
mov byte [esp + eax + 0x9c], cl
inc eax
cmp eax, 0x10
jl 0x1009ed20
lea edx, [esp + 0x7c]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0xa4]
call fcn.1009e660
inc ebx
add esp, 8
cmp ebx, 0x14
jl 0x1009ed13
lea ecx, [esp + 0xac]
push 0x20
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call fcn.1009dec0
lea edx, [esp + 0x84]
push 0x20
push edx
lea eax, [esp + 0x20]
call fcn.1009dec0
add esp, 0x10
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.1009de10
mov edi, 0x32
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x6c]
push 0x10
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.1009dec0
add esp, 8
lea esi, [esp + 0x10]
lea ebx, [esp + 0x6c]
call fcn.1009de10
dec edi
jne 0x1009edb3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov dword [eax], ecx
mov ecx, dword [esp + 0x74]
pop edi
mov dword [eax + 4], edx
mov edx, dword [esp + 0x74]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0xc8]
pop esi
pop ebx
xor ecx, esp
mov dword [eax + 0xc], edx
call fcn.100a3aa6
mov esp, ebp
pop ebp
ret
Function at 0x100a3aa6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100d2170]
jne 0x100a3ab0
repz ret
jmp fcn.100a52f4

Function at 0x100a6c5e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100a5d47
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
test dword [edx + 0x21fffffc], ebx
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27

Function at 0x100a6cbd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.100a5d47
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
test dword [edx + 0x21fffffc], ebx
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27

Function at 0x100a7de5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call [ecx + 0x50]
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.100a5d2e
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
inc dword [eax]
Function at 0x100a7f2b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ch, 0x7c
stc
invalid
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.100a5d69
jle 0x100a7f57
scasb al, byte es:[edi]
jp 0x100a7ec6
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.100a5d69
int1
pop esp
into
mov eax, 0x8b348b49
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x100a7f56
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x100a7f56
call fcn.100a5d69
in eax, dx
adc edx, ecx
inc ebx
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.100a5d69
jg 0x100a7f78
js 0x100a7ff9
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.100a6569
invalid
sar bh, 0xff
add esp, 0x10
mov eax, dword [esi + 0xd4]
cmp eax, 0x100d2818
je 0x100a8027
cmp dword [eax + 0xb4], ebx
jne 0x100a8027
push eax
call fcn.100aa779
push dword [esi + 0xd4]
call fcn.100a401d
pop ecx
pop ecx
lea edi, [esi + 0x50]
mov dword [ebp + 8], 6
cmp dword [edi - 8], 0x100d2814
je 0x100a804b
mov eax, dword [edi]
cmp eax, ebx
je 0x100a804b
cmp dword [eax], ebx
jne 0x100a804b
push eax
call fcn.100a401d
pop ecx
cmp dword [edi - 4], ebx
je 0x100a8062
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x100a8062
cmp dword [eax], ebx
jne 0x100a8062
push eax
call fcn.100a401d
pop ecx
add edi, 0x10
dec dword [ebp + 8]
jne 0x100a8031
push esi
call fcn.100a401d
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xb90108
Capabilities:
Decompress data using aplib

Disassembly:
call 0xb90258
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb9012e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb9011a
add dl, dl
jne 0xb90139
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb9018c
xor eax, eax
add dl, dl
jne 0xb90146
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb9022d
add dl, dl
jne 0xb90155
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb90160
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb9016b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb90176
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb90182
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb90125
mov eax, 1
add dl, dl
jne 0xb9019a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb901a5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb90191
sub eax, ebx
mov ebx, 1
jne 0xb901d8
mov ecx, 1
add dl, dl
jne 0xb901be
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb901c9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb901b5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb90125
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb901ef
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb901fa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb901e6
cmp eax, 0x7d00
jae 0xb9021d
cmp eax, 0x500
jb 0xb90218
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb90125
cmp eax, 0x7f
ja 0xb90220
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb90125
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb9024e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb90125
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401a80
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x4064d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4064f1
mov eax, 0xff
call fcn.00401a80
xor byte [esi], al
inc esi
dec ebx
jne 0x4064e1
invalid
pop esi
pop ebx
ret
Function at 0x40f37f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x40f553
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x4377a0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x40f553
test cl, 0x48
je 0x40f3ea
cmp byte [eax + 5], 0xa
je 0x40f3ea
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f43c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x40f424
call fcn.004082c1
mov dword [eax], 9
call fcn.004082ca
mov dword [eax], esi
jmp 0x40f434
cmp eax, 0x6d
je 0x40f553
push eax
call fcn.004082d3
pop ecx
or eax, 0xffffffff
jmp 0x40f555
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x40f54e
test eax, eax
je 0x40f463
cmp byte [ebx], 0xa
jne 0x40f463
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40f46c
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x40f548
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x40f538
cmp al, 0xd
je 0x40f49e
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x40f52a
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x40f4b8
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x40f4b3
add dword [ebp + 0x10], 2
jmp 0x40f50c
mov dword [ebp + 0x10], eax
jmp 0x40f526
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f4e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40f526
cmp dword [ebp - 0xc], 0
je 0x40f526
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40f501
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40f50c
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40f529
cmp ebx, dword [ebp + 0xc]
jne 0x40f511
cmp byte [ebp - 1], 0xa
jne 0x40f511
mov byte [ebx], 0xa
jmp 0x40f529
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040f605
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x40f52a
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x40f482
jmp 0x40f548
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x40f548
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x40f555
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret