joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ab430
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fe9ee
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10002920
mov edi, eax
test edi, edi
je 0x100ab589
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1010452c]
mov ecx, edi
call esi
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 0xc]
push eax
push dword [ebx + 0x44]
mov dword [ebp - 0x14], 1
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100ab569
mov esi, dword [ebp - 0x10]
cmp esi, 0xa00000
ja 0x100ab593
shr esi, 1
sub esi, 1
js 0x100ab57f
mov eax, dword [edi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x100ab505
push esi
mov ecx, edi
lfence
call fcn.100638f0
mov ecx, dword [edi]
cmp esi, dword [ecx - 8]
jg 0x100ab57f
mov dword [ecx - 0xc], esi
xor edx, edx
mov eax, dword [edi]
push edx
mov word [eax + esi*2], dx
lea eax, [ebp - 0x10]
push eax
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebx + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov ecx, dword [edi]
mov esi, eax
test ecx, ecx
je 0x100ab546
push dword [ecx - 8]
push ecx
call fcn.100638f0
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x100ab57f
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x100ab57f
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
test esi, esi
jne 0x100ab569
push esi
push 0x1010644c
mov ecx, edi
call fcn.100638f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.100638f0
push 0x80004005
call fcn.100638f0
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100638f0
push 0x1013fb60
lea eax, [ebp - 0x20]
push eax
call fcn.100638f0
int3
Function at 0x100ab5b0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fea1d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 8]
lea esi, [eax + 0x14]
mov eax, dword [esi + 4]
sub eax, dword [esi]
add edi, eax
mov dword [ebp - 0x1c], eax
cmp edi, 0xa00000
jg 0x100ab6d7
lfence
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
mov byte [ebp - 0xd], 0
cmp edi, ecx
jae 0x100ab615
lea eax, [edx + edi]
mov dword [esi + 4], eax
jmp 0x100ab646
jbe 0x100ab646
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x100ab631
lea eax, [ebp - 0xd]
mov ecx, esi
push eax
push edi
lfence
call fcn.100638f0
jmp 0x100ab646
sub edi, ecx
je 0x100ab643
push edi
push 0
push ebx
call fcn.100075c0
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add eax, edi
push ecx
push dword [ebp + 8]
mov dword [ebp - 0x14], 0
push eax
mov eax, dword [ebp - 0x18]
push dword [eax + 0x44]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x100ab6f2
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
add edi, dword [ebp - 0x14]
cmp edi, ecx
jae 0x100ab688
lea eax, [edx + edi]
mov dword [esi + 4], eax
jmp 0x100ab6b9
jbe 0x100ab6b9
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x100ab6a4
lea eax, [ebp - 0xd]
mov ecx, esi
push eax
push edi
lfence
call fcn.100638f0
jmp 0x100ab6b9
sub edi, ecx
je 0x100ab6b6
push edi
push 0
push ebx
call fcn.100075c0
add esp, 0xc
add ebx, edi
mov dword [esi + 4], ebx
mov ecx, dword [ebp - 0x18]
push 0xa
call fcn.100638f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa10024
lea ecx, [ebp - 0x28]
call fcn.100638f0
push 0x1013fb60
lea eax, [ebp - 0x28]
push eax
call fcn.100638f0
push 0x1010644c
lea ecx, [ebp - 0x1c]
call fcn.100638f0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100638f0
push 0x10140a54
lea eax, [ebp - 0x30]
push eax
call fcn.100638f0
int3
Function at 0x100abb80
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100feaad
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
mov dword [ebx + 4], ebx
call fcn.1004d2a0
test eax, eax
jne 0x100abbbd
xor edi, edi
jmp 0x100abbc7
lea ecx, [ebx + 0x30]
call fcn.1004d2a0
mov edi, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x30]
call fcn.100638f0
mov esi, dword [eax]
mov ecx, 0x1015c6a0
movzx eax, byte [ebx + 0x3d]
push eax
mov dword [ebp - 4], 0
call fcn.100638f0
push 0
push 0
push 3
push 0
push 0
push edi
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, dword [ebp - 0x10]
mov dword [ebx + 0x48], eax
add ecx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100abc32
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1010452c]
mov ecx, edi
call esi
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x100abc65
push 0x100ac440
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
cmp eax, 0xffffffff
je 0x100abc99
push 2
mov ecx, ebx
call fcn.100638f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1010644c
lea ecx, [ebp - 0x10]
call fcn.100638f0
mov esi, eax
mov dword [ebp - 4], 1
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.100638f0
push 0x10140a54
lea eax, [ebp - 0x28]
push eax
call fcn.100638f0
push 0x1010644c
lea ecx, [ebp - 0x14]
call fcn.100638f0
mov esi, eax
mov dword [ebp - 4], 2
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x3c]
call fcn.100638f0
push 0x10140a54
lea eax, [ebp - 0x3c]
push eax
call fcn.100638f0
int3
Function at 0x100abfe0
Capabilities:
Query remote server for available data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fe9ad
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [esi + 0x4c]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x100ac031
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100ac061
mov edx, dword [esi + 0x18]
sub edx, dword [esi + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax]
cmp ecx, eax
jb 0x100ac0b0
cmp ecx, edx
jb 0x100ac0b0
test eax, eax
je 0x100ac051
cmp ecx, 0xa00000
ja 0x100ac095
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x1010644c
lea ecx, [ebp - 0x14]
call fcn.100638f0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x34]
call fcn.100638f0
push 0x10140a54
lea eax, [ebp - 0x34]
push eax
call fcn.100638f0
push 0xcaa10024
lea ecx, [ebp - 0x20]
call fcn.100638f0
push 0x1013fb60
lea eax, [ebp - 0x20]
push eax
call fcn.100638f0
push 0xcaa82f9b
lea ecx, [ebp - 0x2c]
call fcn.100638f0
push 0x1013fb60
lea eax, [ebp - 0x2c]
push eax
call fcn.100638f0
int3

Function at 0x100ac250
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100feb0d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x101530b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 0x18]
sub esi, dword [ebx + 0x14]
mov ecx, dword [ebp + 8]
lea eax, [esi + ecx]
cmp eax, esi
jl 0x100ac2f6
cmp eax, ecx
jl 0x100ac2f6
cmp eax, 0xa00000
jg 0x100ac2fd
push eax
lea ecx, [ebx + 0x14]
lfence
call fcn.100638f0
mov eax, dword [ebx + 0x14]
lea ecx, [ebx + 0x40]
push ecx
push dword [ebp + 8]
add eax, esi
push eax
push dword [ebx + 0x4c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x100ac2c8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100ac318
lfence
mov eax, dword [ebx + 0x40]
lea ecx, [ebx + 0x14]
add eax, esi
push eax
call fcn.100638f0
push 0xa
mov ecx, ebx
call fcn.100638f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0xcaa82f9c
jmp 0x100ac302
push 0xcaa10024
lea ecx, [ebp - 0x1c]
call fcn.100638f0
push 0x1013fb60
lea eax, [ebp - 0x1c]
push eax
call fcn.100638f0
push 0x1010644c
lea ecx, [ebp - 0x10]
call fcn.100638f0
mov esi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.kernel32.dll_GetLastError]
push esi
push eax
lea ecx, [ebp - 0x30]
call fcn.100638f0
push 0x10140a54
lea eax, [ebp - 0x30]
push eax
call fcn.100638f0
int3
Function at 0x10007800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000780f
pop dword [ebp - 0x50]
mov eax, 0xcefd10e1
sub eax, 0xbefc98d2
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x2b886cfc
sub dword [ebp - 0x60], 0xdd3627b1
mov dword [ebp - 0x5c], 0x906afafa
add dword [ebp - 0x5c], 0xa1c8514b
mov dword [ebp - 0x58], 0xfcf72776
sub dword [ebp - 0x58], 0xb0aae348
mov dword [ebp - 0x54], 0x497962f3
sub dword [ebp - 0x54], 0x497962f3
lea eax, [ebp - 0x60]
push eax
mov eax, 0xd298ff41
add eax, 0x3d6b20f3
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x35d181d7
sub dword [ebp - 0x60], 0xc15f1881
mov dword [ebp - 0x5c], 0x277ee81e
add dword [ebp - 0x5c], 0x19ed7957
mov dword [ebp - 0x58], 0x2bdf1de8
add dword [ebp - 0x58], 0x37904e84
mov dword [ebp - 0x54], 0x3a26728b
sub dword [ebp - 0x54], 0x3a26728b
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x1f3ad931
add eax, 0xf0c9471b
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x4510e
push 0
call eax
mov ecx, 0x3f07
xor esi, esi
add esi, eax
mov edi, 0x10057e00
add edi, dword [ebp - 0x50]
mov ebx, 0xbefdec3f
xor dword [ebp - 0xc], edx
mov edx, dword [edi]
mov dword [ebp - 0x44], 0xd44128f4
xor edx, ebx
xor dword [ebp - 0x10], edx
mov dword [esi], edx
add dword [ebp - 0x40], 0x4ef53348
add esi, 0x220bebed
add esi, 0xddf41417
add edi, 0x980a5420
add edi, 0x67f5abe4
loop 0x10007921
add eax, 0x2b815f28
sub eax, 0x2b807039
mov ebx, eax
add eax, 0xb2e86bc7
add eax, 0x4d17943e
mov ecx, 0xafdb8125
sub ecx, 0x9fdb8125
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10007800
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.10007800
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10007800
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x4ad05056
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x4ad05178
call fcn.4ad0162f
xor edi, edi
push edi
call dword [0x4ad01144]
cmp word [eax], 0x5a4d
jne 0x4ad05169
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ad05169
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
jne 0x4ad19012
cmp dword [ecx + 0x74], 0xe
jbe 0x4ad05169
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [0x4ad01080]
pop ecx
or dword [0x4ad2fa50], 0xffffffff
or dword [0x4ad2fa4c], 0xffffffff
call dword [section..text]
mov ecx, dword [0x4ad34888]
mov dword [eax], ecx
call dword [0x4ad01004]
mov ecx, dword [0x4ad34884]
mov dword [eax], ecx
mov eax, dword [0x4ad01008]
mov eax, dword [eax]
mov dword [0x4ad2fa54], eax
call fcn.4ad04fe0
cmp dword [0x4ad34878], edi
je 0x4ad19037
call fcn.4ad05194
push 0x4ad34870
push 0x4ad3486c
call fcn.4ad05189
mov eax, dword [0x4ad34880]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x4ad3487c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x4ad01014]
mov dword [ebp - 0x34], eax
push 0x4ad34868
push 0x4ad34860
call fcn.4ad05189
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x4ad01018]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.4ad03ff1
jmp 0x4ad19048
mov dword [ebp - 0x1c], edi
jmp 0x4ad050ae
cmp eax, 0x20b
jne 0x4ad05169
cmp dword [ecx + 0x84], 0xe
jbe 0x4ad05169
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4ad050a8
push fcn.4ad04fe0
call dword [0x4ad0100c]
pop ecx
jmp 0x4ad05101
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x4ad1905c
push esi
call dword [0x4ad01070]
call dword [0x4ad0101c]
jmp 0x4ad1909b
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.4ad01447
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x98b008], 0x8088405
inc edx
mov dword [ebx + 0x98b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f05c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x96f54a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ab
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
jmp 0x41f0ca
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f13c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f125
test esi, esi
jbe 0x41f13c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f117
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f13c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0f4
jmp 0x41f13c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f13c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x96f551
ret