joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010604
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10010627
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10010627
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10010631
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10010673
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100106d5
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100106d0
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100106bb
test dl, dl
je 0x100106b7
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100106bb
add ecx, 2
add eax, 2
test dl, dl
jne 0x1001069b
xor eax, eax
jmp 0x100106c0
sbb eax, eax
or eax, 1
test eax, eax
je 0x100106e1
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10010688
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10010773
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10010796
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10010796
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100107a0
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100107e2
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10010844
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x1001083f
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1001082a
test dl, dl
je 0x10010826
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1001082a
add ecx, 2
add eax, 2
test dl, dl
jne 0x1001080a
xor eax, eax
jmp 0x1001082f
sbb eax, eax
or eax, 1
test eax, eax
je 0x10010850
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100107f7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100108e2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10010905
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10010905
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1001090f
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10010951
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100109b3
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100109ae
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10010999
test dl, dl
je 0x10010995
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10010999
add ecx, 2
add eax, 2
test dl, dl
jne 0x10010979
xor eax, eax
jmp 0x1001099e
sbb eax, eax
or eax, 1
test eax, eax
je 0x100109bf
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10010966
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x10015b54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x10015b77
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10015c4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x10015c72
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10015e2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x10015e4e
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1001cc50
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x10038ddc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x1001cc63
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x1001cca4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x10038e84]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x1001ccd6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001ccda
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x1001cccb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x1001ccf8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001ccfc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x1001cced
xor ecx, ecx
mov eax, 0x10038dec
xor ebx, ebx
mov bl, byte [ecx + 0x10038e94]
cmp byte [esp + ebx + 0x14], 0
je 0x1001cd27
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x10038eac]
cmp byte [esp + ebx + 0x14], 0
je 0x1001cd3e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x1001cd0e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x1001cc97
lea edx, [esp + 0x84]
push edx
call fcn.1001cd80
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x1006b0e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1006b1ec
test eax, eax
je 0x1006b1ec
push esi
push edi
mov ecx, 0x10
mov esi, 0x10086018
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x1006b1d3
lea edi, [eax + 4]
jmp 0x1006b137
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1006b14c
mov dword [ebp - 4], 2
jmp 0x1006b16d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x1006b163
mov dword [ebp - 4], 1
jmp 0x1006b16d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x1006b1e3
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x1006b1a6
mov byte [ecx], 0x3d
jmp 0x1006b1b2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x1006b1bd
mov byte [ecx], 0x3d
jmp 0x1006b1c3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x1006b134
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10257460
Capabilities:
Encode data using xor

Disassembly:
push 0xcf18eeee
call fcn.1033e3b4
rcr byte [edi - 0x14], 0x52
test ebx, 0x88ad0201
xchg ebx, eax
xlatb
add eax, 0xe05e86ed
invalid
Function at 0x10001270
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10001000
Function at 0x100018b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.zlibwapi.dll_crc32_z

Function at 0x10001ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
mov eax, edi
call fcn.10001c40
test eax, eax
jne 0x10001e23
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x10001e23
push esi
mov esi, dword [edi + 0x1c]
mov eax, dword [esi + 0x18]
mov dword [ebp - 4], eax
cmp eax, 2
je 0x10001e16
cmp eax, 1
jne 0x10001ce6
cmp dword [esi + 4], 0x2a
jne 0x10001e16
cmp dword [esi + 0x74], 0
jne 0x10001e16
push ebx
mov ebx, dword [ebp + 0x10]
cmp eax, 1
jne 0x10001d0d
mov eax, dword [edi + 0x30]
push ebx
push ecx
push eax
call sym.zlibwapi.dll_adler32
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], 0
cmp ebx, dword [esi + 0x2c]
jb 0x10001d57
test eax, eax
jne 0x10001d4e
mov ecx, dword [esi + 0x4c]
mov edx, dword [esi + 0x44]
mov word [edx + ecx*2 - 2], ax
mov ecx, dword [esi + 0x4c]
lea edx, [ecx + ecx - 2]
push edx
push eax
mov eax, dword [esi + 0x44]
push eax
call fcn.100169a0
mov ecx, dword [ebp + 0xc]
add esp, 0xc
xor eax, eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x16b4], eax
mov eax, dword [esi + 0x2c]
sub ebx, eax
add ecx, ebx
mov ebx, eax
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [ebp + 0x10], eax
mov eax, esi
mov dword [ebp - 8], edx
mov dword [edi + 4], ebx
mov dword [edi], ecx
call fcn.10003150
cmp dword [esi + 0x74], 3
jb 0x10001dd5
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x6c]
sub eax, 2
mov dword [ebp + 0xc], eax
mov ecx, dword [esi + 0x38]
movzx eax, byte [ecx + edx + 2]
mov edi, dword [esi + 0x48]
mov ecx, dword [esi + 0x58]
mov ebx, dword [esi + 0x40]
shl edi, cl
mov ecx, dword [esi + 0x44]
xor eax, edi
and eax, dword [esi + 0x54]
mov edi, edx
and edi, dword [esi + 0x34]
mov dword [esi + 0x48], eax
mov ax, word [ecx + eax*2]
mov word [ebx + edi*2], ax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2], dx
inc edx
dec dword [ebp + 0xc]
jne 0x10001d80
mov eax, esi
mov dword [esi + 0x6c], edx
mov dword [esi + 0x74], 2
call fcn.10003150
cmp dword [esi + 0x74], 3
jae 0x10001d74
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x74]
add dword [esi + 0x6c], eax
mov ecx, dword [esi + 0x6c]
mov edx, dword [ebp - 8]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x16b4], eax
xor eax, eax
mov ecx, 2
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ecx
mov dword [esi + 0x60], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x68], eax
mov eax, dword [ebp - 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
pop ebx
mov dword [esi + 0x18], eax
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0xc
pop esi
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov dword [esi], 0
lea esp, [esp]
mov ecx, dword [esi]
mov eax, ebx
sub eax, ecx
cmp eax, 0x40000000
jbe 0x10004c12
mov eax, 0x40000000
add ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [edi + 0x14]
push ecx
call fcn.1001366d
add esp, 0xc
test eax, eax
jle 0x10004c2f
add dword [esi], eax
cmp dword [esi], ebx
jb 0x10004c00
test eax, eax
jns 0x10004c53
call fcn.10010b9f
mov edx, dword [eax]
push edx
call fcn.10010a3d
mov ebx, eax
add esp, 4
or eax, 0xffffffff
mov ecx, edi
call fcn.10004b20
or eax, 0xffffffff
pop ebx
pop ebp
ret
test eax, eax
jne 0x10004c5e
mov dword [edi + 0x40], 1
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10005bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esi, 0xc6975d88
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10005819
push eax
push esi
push dword [ebp + 8]
call fcn.100057ce
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10005819
push eax
push esi
push dword [ebp + 8]
call fcn.100057ce
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10005809
adc bh, byte [ebx + esi*2 + 0x7c9d88a7]
invalid
Function at 0x10005ec0
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x10005ec8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10005ee0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10005efe
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10005f5c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10005f43
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10005f4c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10005f56
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10005f38
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10005ec2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10005fa9
dec eax
je 0x10005fa0
sub eax, 3
je 0x10005f97
mov dword [ebp - 4], 0x40
jmp 0x10005fc6
mov dword [ebp - 4], 4
jmp 0x10005fac
mov dword [ebp - 4], 0x20
jmp 0x10005fac
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
invalid
test eax, eax
je 0x10005ff8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10005f78
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.10005809
fisubr dword [ecx + 0x75ff1944]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x10006004

Function at 0x10006cd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
dec ecx
dec ecx
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.10005809
push ss
out 0xa7, al
loopne 0x10006c84
test esp, edx
clc
invalid
Function at 0x1000d610
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret

Function at 0x1000d690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x10024bec]
inc eax
mov esi, ecx
mov dword [0x10024bec], eax
cmp eax, 1
jne 0x1000d6c2
push 0
call fcn.10011a6a
xor eax, 0xbb40e64e
push eax
call fcn.10011a37
add esp, 8
mov edx, dword [ebp + 8]
mov eax, edi
mov ecx, esi
call fcn.1000d650
mov dword [ebp - 0xc], 0
call fcn.10011a49
mov ebx, eax
sar ebx, 7
mov eax, esi
and ebx, 0xff
call fcn.1000d5f0
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.1000d610
xor bl, byte [ebp - 8]
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x18], bl
inc eax
mov dword [ebp - 0xc], eax
cmp eax, 0xa
jb 0x1000d6d5
mov edx, dword [ebp + 8]
mov eax, edi
mov ecx, esi
call fcn.1000d650
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
xor ebx, ebx
sub eax, ecx
mov dword [ebp - 0xc], eax
mov eax, esi
call fcn.1000d5f0
mov dword [ebp - 8], eax
movzx eax, byte [ebp + ebx - 0x18]
call fcn.1000d610
mov al, byte [ebp + ebx - 0x18]
mov edx, dword [ebp - 0xc]
xor al, byte [ebp - 8]
add edx, ebx
inc ebx
mov byte [ebp + edx - 0x18], al
cmp ebx, 0xa
jb 0x1000d722
mov eax, esi
call fcn.1000d5f0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov dword [ebp - 0xc], eax
and eax, 0xff
call fcn.1000d610
mov al, byte [ebp - 0xc]
xor al, byte [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov byte [ebx + ecx], al
mov eax, esi
call fcn.1000d5f0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
shr eax, 0x18
call fcn.1000d610
xor al, byte [ebp - 8]
mov edx, dword [ebp + 0xc]
pop edi
mov byte [ebx + edx + 1], al
pop esi
lea eax, [ebx + 2]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000eff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebx + 0x100ac], edi
je 0x1000f056
cmp dword [ebx + 0x7c], edi
jbe 0x1000f056
lea eax, [ebx + 0xa4]
mov dword [ebp - 4], eax
mov eax, 0xffffff5c
sub eax, ebx
lea esi, [ebx + 0x100d0]
mov dword [ebp - 0x10], eax
mov eax, esi
call fcn.1000d5f0
mov ecx, dword [ebp - 4]
mov edi, dword [ebx + 0x100dc]
mov dword [ebp - 0xc], eax
movzx eax, byte [ecx]
call fcn.1000d610
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0xc]
xor byte [eax], dl
mov ecx, dword [ebp - 0x10]
inc eax
add ecx, eax
mov dword [ebp - 4], eax
cmp ecx, dword [ebx + 0x7c]
jb 0x1000f023
xor edi, edi
mov esi, dword [ebx + 0x7c]
mov ecx, dword [ebx + 0x2c]
mov edx, dword [ebx + 0x1c]
push esi
lea eax, [ebx + 0xa4]
push eax
mov eax, dword [ebx + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, esi
je 0x1000f07c
mov dword [ebp - 8], 0xffffffff
add dword [ebx + 0x100c0], esi
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebp - 8]
adc dword [ebx + 0x100c4], edi
add dword [ebx + 0x100c8], ecx
mov dword [ebx + 0x48], edi
mov dword [ebx + 0x7c], edi
adc dword [ebx + 0x100cc], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10015cdc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10023a2c]
jne 0x10015ce6
repz ret
jmp fcn.10018be7