joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x1001380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [eax]
call dword [sym.imp.msvcrt.dll__wsplitpath]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 1
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x80000000
call edi
test eax, eax
je 0x10013cb
xor eax, eax
jmp 0x1001475
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], eax
call esi
cmp dword [ebp - 0xc], ebx
je 0x10013ff
xor eax, eax
jmp 0x1001474
lea eax, [ebp - 4]
push eax
push 1
push ebx
lea eax, [ebp - 0x410]
push eax
push 0x80000000
call edi
test eax, eax
jne 0x10013fb
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
push 0x1001124
push dword [ebp - 4]
call edi
test eax, eax
je 0x1001434
push dword [ebp - 4]
call esi
jmp 0x10013fb
lea eax, [ebp - 8]
push eax
mov edi, 0x10031d8
push edi
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call esi
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0xc], ebx
jne 0x10013fb
mov eax, dword [ebp - 8]
mov word [eax*2 + 0x10031d8], bx
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x54fd8b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x54fdc3
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x54fdb1
mov al, 1
jmp 0x54fe22
cmp dword [ebx + 0x54], ecx
jne 0x54fdba
mov al, 2
jmp 0x54fe22
cmp dword [ebx + 0x7c], ecx
jne 0x54fe22
mov al, 3
jmp 0x54fe22
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x54fdd8
mov al, 4
jmp 0x54fe22
cmp ecx, 5
jne 0x54fdf8
cmp ebx, 0
jne 0x54fde6
mov al, 5
jmp 0x54fe22
cmp ebx, 1
jne 0x54fdef
mov al, 6
jmp 0x54fe22
cmp ebx, 2
jne 0x54fdf8
mov al, 7
jmp 0x54fe22
cmp ecx, 6
jne 0x54fe20
cmp ebx, 0
jne 0x54fe06
mov al, 8
jmp 0x54fe22
cmp ebx, 1
jne 0x54fe0d
mov al, 9
cmp ebx, 2
jne 0x54fe14
mov al, 0xa
cmp ebx, 3
jne 0x54fe1b
mov al, 0xb
cmp ebx, 4
jne 0x54fe22
mov al, 0xc
pop ebx
leave
ret
Function at 0x100023e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ebp, edi
je 0x100024dc
mov ebx, dword [eax + 0x1c]
test ebx, ebx
je 0x100024dc
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100024dc
mov ecx, dword [ebx + 0x18]
cmp ecx, 2
je 0x100024dc
cmp ecx, 1
jne 0x10002428
cmp dword [ebx + 4], 0x2a
jne 0x100024dc
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x10002441
mov eax, dword [eax + 0x30]
push edi
push esi
push eax
call sym.zlibwapi.dll_adler32
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x30], eax
cmp edi, 3
jb 0x100024d3
mov eax, dword [ebx + 0x24]
add eax, 0xfffffefa
cmp edi, eax
jbe 0x1000245c
mov ebp, eax
sub edi, ebp
add esi, edi
mov edi, dword [ebx + 0x30]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x64], ebp
mov dword [ebx + 0x54], ebp
movzx eax, byte [edx]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
xor edx, edx
lea esi, [ebp - 3]
mov edi, dword [ebx + 0x40]
mov ecx, dword [ebx + 0x50]
mov eax, dword [ebx + 0x30]
movzx eax, byte [eax + edx + 2]
mov ebp, dword [ebx + 0x2c]
shl edi, cl
mov ecx, dword [ebx + 0x4c]
xor eax, edi
and eax, ecx
mov ecx, dword [ebx + 0x3c]
mov dword [ebx + 0x40], eax
mov ax, word [ecx + eax*2]
mov edi, edx
and edi, ebp
mov ebp, dword [ebx + 0x38]
mov word [ebp + edi*2], ax
mov ecx, dword [ebx + 0x40]
mov eax, dword [ebx + 0x3c]
mov word [eax + ecx*2], dx
inc edx
cmp edx, esi
jbe 0x10002494
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
ret 0xc

Function at 0x100041d0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10004229
cmp byte [esi + 0x5c], 0x77
jne 0x10004229
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x10004215
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call sub.CRTDLL.dll_fwrite
add esp, 0x10
cmp eax, 0x4000
je 0x1000420e
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x10], 0x4000
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push esi
call sym.zlibwapi.dll_deflateParams
pop esi
ret 0xc
mov eax, 0xfffffffe
pop esi
ret 0xc
Function at 0x10004240
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1000424b
or eax, 0xffffffff
ret
mov eax, dword [esi + 4]
test eax, eax
jne 0x10004299
call sub.CRTDLL.dll__errno
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call sub.CRTDLL.dll_fread
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x10004294
mov edx, dword [esi + 0x40]
mov dword [esi + 0x3c], 1
mov cl, byte [edx + 0xc]
or eax, 0xffffffff
test cl, 0x20
je 0x100042a6
mov dword [esi + 0x38], eax
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
dec dword [esi + 4]
mov eax, dword [esi]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret

Function at 0x100042b0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
cmp edi, 2
jae 0x10004320
test edi, edi
je 0x100042c9
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov dl, byte [eax]
mov byte [ecx], dl
call sub.CRTDLL.dll__errno
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, edi
push eax
mov eax, dword [esi + 0x44]
mov edx, 0x4000
sar edx, cl
add eax, edi
push edx
push 1
push eax
call sub.CRTDLL.dll_fread
add esp, 0x10
test eax, eax
jne 0x10004306
mov ecx, dword [esi + 0x40]
test byte [ecx + 0xc], 0x20
je 0x10004306
mov dword [esi + 0x38], 0xffffffff
mov edx, dword [esi + 4]
add edx, eax
mov eax, edx
cmp eax, 2
mov dword [esi + 4], edx
mov edx, dword [esi + 0x44]
mov dword [esi], edx
jae 0x10004320
pop edi
mov dword [esi + 0x58], eax
pop esi
ret
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x100043fc
cmp byte [eax + 1], 0x8b
jne 0x100043fc
mov ecx, dword [esi + 4]
add ecx, 0xfffffffe
add eax, 2
push ebx
mov dword [esi + 4], ecx
mov dword [esi], eax
call fcn.10004240
mov edi, eax
call fcn.10004240
cmp edi, 8
mov ebx, eax
jne 0x100043f1
test bl, 0xe0
jne 0x100043f1
mov edi, 6
lea esp, [esp]
call fcn.10004240
dec edi
jne 0x10004370
test bl, 4
je 0x100043a1
call fcn.10004240
mov edi, eax
call fcn.10004240
shl eax, 8
add edi, eax
mov edi, edi
mov eax, edi
dec edi
test eax, eax
je 0x100043a1
call fcn.10004240
cmp eax, 0xffffffff
jne 0x10004390
test bl, 8
je 0x100043b4
call fcn.10004240
test eax, eax
je 0x100043b4
cmp eax, 0xffffffff
jne 0x100043a6
test bl, 0x10
je 0x100043ce
lea esp, [esp]
call fcn.10004240
test eax, eax
je 0x100043ce
cmp eax, 0xffffffff
jne 0x100043c0
test bl, 2
je 0x100043e0
mov edi, 2
call fcn.10004240
dec edi
jne 0x100043d8
mov ecx, dword [esi + 0x3c]
neg ecx
sbb ecx, ecx
pop ebx
and ecx, 0xfffffffd
pop edi
mov dword [esi + 0x38], ecx
pop esi
ret
pop ebx
pop edi
mov dword [esi + 0x38], 0xfffffffd
pop esi
ret
pop edi
mov dword [esi + 0x58], 1
pop esi
ret
Function at 0x10004520
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100045e1
cmp byte [esi + 0x5c], 0x77
jne 0x100045e1
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
test edi, edi
mov dword [esi], ebp
mov dword [esi + 4], edi
je 0x100045c6
lea ebx, [ebx]
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x1000457b
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x48]
push ecx
push 0x4000
push 1
push eax
mov dword [esi + 0xc], eax
call sub.CRTDLL.dll_fwrite
add esp, 0x10
cmp eax, 0x4000
jne 0x100045bf
mov dword [esi + 0x10], eax
mov edx, dword [esi + 4]
mov eax, dword [esi + 0x64]
add eax, edx
mov edx, dword [esi + 0x68]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x10]
push 0
add edx, eax
push esi
mov dword [esi + 0x68], edx
call sym.zlibwapi.dll_deflate
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x64]
sub edx, ecx
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x64], edx
mov edx, dword [esi + 0x10]
sub ecx, edx
test eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x68], ecx
jne 0x100045c6
mov eax, dword [esi + 4]
test eax, eax
jne 0x10004550
jmp 0x100045c6
mov dword [esi + 0x38], 0xffffffff
mov eax, dword [esi + 0x4c]
push edi
push ebp
push eax
call sym.zlibwapi.dll_crc32
mov ecx, dword [esi + 4]
mov dword [esi + 0x4c], eax
mov eax, edi
pop edi
pop ebp
sub eax, ecx
pop esi
ret 0xc
mov eax, 0xfffffffe
pop esi
ret 0xc

Function at 0x100046c0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x10004781
cmp byte [esi + 0x5c], 0x77
jne 0x10004781
mov dword [esi + 4], ebx
push edi
lea esp, [esp]
mov eax, dword [esi + 0x10]
mov edi, 0x4000
sub edi, eax
je 0x10004710
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x48]
push eax
push edi
push 1
push ecx
call sub.CRTDLL.dll_fwrite
add esp, 0x10
cmp eax, edi
jne 0x10004777
mov edx, dword [esi + 0x48]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], 0x4000
test ebx, ebx
jne 0x10004767
mov ebx, dword [esi + 0x68]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x10]
push ecx
add ebx, eax
push esi
mov dword [esi + 0x68], ebx
call sym.zlibwapi.dll_deflate
mov ebx, dword [esi + 0x68]
mov ecx, dword [esi + 0x10]
sub ebx, ecx
test edi, edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x68], ebx
jne 0x10004744
cmp eax, 0xfffffffb
jne 0x10004744
mov dword [esi + 0x38], edi
test ecx, ecx
jne 0x10004752
cmp dword [esi + 0x38], 1
je 0x10004752
xor ebx, ebx
jmp 0x10004757
mov ebx, 1
mov eax, dword [esi + 0x38]
test eax, eax
je 0x100046e0
cmp eax, 1
je 0x100046e0
mov esi, dword [esi + 0x38]
mov eax, esi
dec eax
neg eax
sbb eax, eax
pop edi
and eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
pop edi
mov dword [esi + 0x38], eax
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret
Function at 0x100052c0
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
push ebx
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x1000612c
mov ebx, dword [eax + 0x1c]
cmp ebx, ebp
je 0x1000612c
mov dword [eax + 0x18], ebp
mov dword [ebx], 0xb
mov dword [ebx + 4], ebp
mov dword [ebx + 0x24], ebp
mov ecx, dword [eax]
cmp ecx, ebp
push esi
push edi
mov dword [esp + 0x14], ecx
je 0x100052fe
mov esi, dword [eax + 4]
jmp 0x10005300
xor esi, esi
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
sub eax, 0xb
cmp eax, 0x10
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x1c], ecx
ja 0x100060c8
jmp 0x10005330
movzx edx, byte [eax + 0x10006158]
jmp dword [edx*4 + 0x1000613c]
mov ebp, 0xfffffffe
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], ecx
mov eax, ebp
pop ebp
pop ebx
add esp, 0x20
ret 0x14
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x20
ret 0x14

Function at 0x10007a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.100075b7
push eax
push esi
push dword [ebp + 8]
call fcn.1000756c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.100075a7
mov byte [edi], dl
in eax, dx
push es
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.100075a7
mov dh, 0x96
pop ebp
out 0x8d, al
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid
Function at 0x10007c60
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10007c7e
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10007c9c
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10007cfa
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10007ce1
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10007cea
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10007cf4
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10007cd6
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe fcn.10007c60
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10007d47
dec eax
je 0x10007d3e
sub eax, 3
je 0x10007d35
mov dword [ebp - 4], 0x40
jmp 0x10007d64
mov dword [ebp - 4], 4
jmp 0x10007d4a
mov dword [ebp - 4], 0x20
jmp 0x10007d4a
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10007d96
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10007d16
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100075a7
arpl cx, dx
popal
mov ah, 0xff
jne 0x10007da1
push 1
push esi
call edi
mov eax, esi
jmp 0x10007da2
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
je 0x1000829b
cmp dword [ebp - 0x398], 0
je 0x10008465
cmp dword [ebp + 0xc], 1
je 0x10008465
cmp dword [ebp + 0xc], 8
jne 0x1000842d
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.100075b7
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000756c
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.100075a7
out 0xf7, al
push edx
invalid
call fcn.100075a7
jmp 0x90657888
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10007585
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
call dword [edx]
Function at 0x10009fe0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [esi]
mov ecx, edx
xor ecx, eax
and ecx, 0xff
mov ecx, dword [edi + ecx*4]
shr edx, 8
xor ecx, edx
mov edx, dword [esi + 4]
mov dword [esi], ecx
and ecx, 0xff
add ecx, edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
push ebx
and ecx, 0xff
mov ebx, dword [edi + ecx*4]
shr edx, 8
xor edx, ebx
mov dword [esi + 8], edx
pop ebx
ret
Function at 0x1000b4b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, eax
xor eax, eax
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov al, byte [esi]
test al, al
je 0x1000b517
push ebx
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov eax, dword [edi + eax*4]
shr ecx, 8
xor eax, ecx
mov ecx, dword [edx + 4]
mov dword [edx], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
mov ebx, dword [edi + eax*4]
shr ecx, 8
xor ecx, ebx
inc esi
mov dword [edx + 8], ecx
mov al, byte [esi]
test al, al
jne 0x1000b4d0
pop ebx
pop esi
ret
Function at 0x1000bf70
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esi + 0x4090]
test eax, eax
je 0x1000c02f
mov eax, dword [esi + 0x6c]
test eax, eax
jbe 0x1000c02f
push ebx
push ebp
mov ebx, 0xffffff78
push edi
lea edi, [esi + 0x88]
sub ebx, esi
lea esp, [esp]
mov ecx, dword [esi + 0x4094]
mov ebp, dword [esi + 0x40a0]
mov edx, dword [esi + 0x409c]
xor eax, eax
mov al, byte [edi]
and edx, 0xfffd
or edx, 2
xor eax, ecx
and eax, 0xff
mov eax, dword [ebp + eax*4]
shr ecx, 8
xor eax, ecx
mov ecx, dword [esi + 0x4098]
mov dword [esi + 0x4094], eax
and eax, 0xff
add eax, ecx
mov ecx, dword [esi + 0x409c]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x4098], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [ebp + eax*4]
mov dword [esi + 0x409c], ecx
mov ecx, edx
xor ecx, 1
imul ecx, edx
mov dl, byte [edi]
shr ecx, 8
xor dl, cl
mov byte [edi], dl
mov eax, dword [esi + 0x6c]
inc edi
lea edx, [ebx + edi]
cmp edx, eax
jb 0x1000bfa0
pop edi
pop ebp
pop ebx
mov eax, dword [esi + 0x6c]
mov edx, dword [esi + 0x20]
push eax
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x88]
push ecx
push edx
push eax
call dword [esi + 8]
mov ecx, dword [esi + 0x6c]
add esp, 0x10
cmp eax, ecx
mov dword [esi + 0x6c], 0
je 0x1000c05a
or eax, 0xffffffff
ret
xor eax, eax
ret