joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shl eax, 4
add eax, ebx
lea eax, [ebx + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x493b48
mov eax, 0xa0100002
jmp 0x493c01
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 5], al
mov byte [ebp - 0x1f], 4
mov cl, byte [ebp - 5]
mov byte [ebp - 0x1e], cl
mov al, byte [ebp - 5]
xor al, 0
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1b], al
lea ecx, [ebp - 0x20]
mov dl, byte [ecx + 0x18]
push edx
mov edx, 5
push dword [ecx + edx*4]
dec edx
jns 0x493b90
call fcn.0049392c
mov byte [ebp - 8], al
mov eax, ebx
shl eax, 4
add esp, 0x1c
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496618
pop ecx
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.004933b4
mov dword [ebp - 4], eax
mov eax, ebx
shl eax, 4
add esp, 0xc
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496630
pop ecx
xor ecx, ecx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x36]
mov bl, byte [eax]
xor bl, byte [ebp - 5]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 8
jl 0x493bef
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x493c08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x493c31
mov eax, 0xa0100002
jmp 0x493cd6
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov ebx, eax
push 0x19
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.cc3260mt.dll__memset
mov byte [ebp - 0x1b], 0xa
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x16]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x12
jl 0x493c69
lea ecx, [ebp - 0x1c]
mov dl, byte [ecx + 0x18]
push edx
mov edx, 5
push dword [ecx + edx*4]
dec edx
jns 0x493c7e
call fcn.0049392c
mov byte [ebp - 4], al
mov eax, esi
shl eax, 4
add esp, 0x1c
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496618
pop ecx
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x1c]
push ecx
push esi
call fcn.004933b4
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496630
pop ecx
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x493f9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x493fc9
mov eax, 0xa0100002
jmp 0x4940d0
cmp edi, 0x1f0
jle 0x493fdb
mov eax, 0xa0100004
jmp 0x4940d0
mov edx, edi
and edx, 0x8000000f
jns 0x493fea
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x493ff8
mov eax, 0xa0100004
jmp 0x4940d0
test edi, edi
jge 0x494006
mov eax, 0xa0100004
jmp 0x4940d0
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1b], 0x10
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1a], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
mov byte [ebp - 0x19], al
xor dl, bl
mov byte [ebp - 0x18], dl
xor cl, bl
mov byte [ebp - 0x17], cl
push 0x10
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x16]
push eax
push edx
call sub.cc3260mt.dll__memcpy
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x16]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x10
jl 0x494063
lea eax, [ebp - 0x1c]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x494078
call fcn.0049392c
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5c8d32
push edx
call fcn.00496618
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.004933b4
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496630
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4940dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x494109
mov eax, 0xa0100002
jmp 0x49421d
cmp edi, 0x1f0
jle 0x49411b
mov eax, 0xa0100004
jmp 0x49421d
mov edx, edi
and edx, 0x8000000f
jns 0x49412a
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x494138
mov eax, 0xa0100004
jmp 0x49421d
test edi, edi
jge 0x494146
mov eax, 0xa0100004
jmp 0x49421d
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1f], 0xf
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1e], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
xor dl, bl
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
xor cl, bl
mov byte [ebp - 0x1b], cl
xor edx, edx
lea eax, [ebp - 0x1a]
mov ecx, ebx
xor cl, 0
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x12
jl 0x494191
lea edx, [ebp - 0x20]
mov al, byte [edx + 0x18]
push eax
mov eax, 5
push dword [edx + eax*4]
dec eax
jns 0x4941ab
call fcn.0049392c
mov ecx, esi
add esp, 0x1c
shl ecx, 4
mov byte [ebp - 8], al
add ecx, esi
lea ecx, [esi + ecx*8]
add ecx, ecx
add ecx, 0x5c8d32
push ecx
call fcn.00496618
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x20]
push edx
push esi
call fcn.004933b4
mov ecx, esi
add esp, 0xc
shl ecx, 4
mov dword [ebp - 4], eax
add ecx, esi
lea ecx, [esi + ecx*8]
add ecx, ecx
add ecx, 0x5c8d32
push ecx
call fcn.00496630
mov eax, dword [ebp + 0x14]
pop ecx
xor esi, esi
mov edx, eax
lea eax, [ebp - 0x36]
mov cl, byte [eax]
inc eax
xor cl, bl
inc esi
mov byte [edx], cl
inc edx
cmp esi, 0x10
jl 0x49420c
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4944d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
mov ebx, dword [ebp + 8]
mov eax, ebx
shl eax, 4
add eax, ebx
lea eax, [ebx + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x4944fc
mov eax, 0xa0100002
jmp 0x4945b5
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 5], al
mov byte [ebp - 0x1f], 0xd
mov cl, byte [ebp - 5]
mov byte [ebp - 0x1e], cl
mov al, byte [ebp - 5]
xor al, 0
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], al
mov byte [ebp - 0x1b], al
lea ecx, [ebp - 0x20]
mov dl, byte [ecx + 0x18]
push edx
mov edx, 5
push dword [ecx + edx*4]
dec edx
jns 0x494544
call fcn.0049392c
mov byte [ebp - 8], al
mov eax, ebx
shl eax, 4
add esp, 0x1c
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496618
pop ecx
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
push ecx
push ebx
call fcn.004933b4
mov dword [ebp - 4], eax
mov eax, ebx
shl eax, 4
add esp, 0xc
add eax, ebx
lea eax, [ebx + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496630
pop ecx
xor ecx, ecx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x36]
mov bl, byte [eax]
xor bl, byte [ebp - 5]
mov byte [edx], bl
inc ecx
inc edx
inc eax
cmp ecx, 0x10
jl 0x4945a3
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x494768
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x494792
mov eax, 0xa0100002
jmp 0x494848
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov ebx, eax
mov byte [ebp - 0x1b], 0xe
mov byte [ebp - 0x1a], bl
mov eax, ebx
xor al, 0
mov byte [ebp - 0x19], al
mov byte [ebp - 0x18], al
mov byte [ebp - 0x17], al
xor edx, edx
lea eax, [ebp - 0x16]
mov ecx, ebx
xor cl, 0
mov byte [eax], cl
inc edx
inc eax
cmp edx, 0x12
jl 0x4947ce
lea eax, [ebp - 0x1c]
mov dl, byte [eax + 0x18]
push edx
mov edx, 5
push dword [eax + edx*4]
dec edx
jns 0x4947e8
call fcn.0049392c
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5c8d32
push edx
call fcn.00496618
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.004933b4
mov edi, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496630
mov edx, dword [ebp + 0xc]
mov eax, edi
xor bl, byte [ebp - 0x32]
pop ecx
mov byte [edx], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x494854
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x494881
mov eax, 0xa0100002
jmp 0x494988
cmp edi, 0x1f0
jle 0x494893
mov eax, 0xa0100004
jmp 0x494988
mov edx, edi
and edx, 0x8000000f
jns 0x4948a2
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x4948b0
mov eax, 0xa0100004
jmp 0x494988
test edi, edi
jge 0x4948be
mov eax, 0xa0100004
jmp 0x494988
push 0x19
push 0
lea edx, [ebp - 0x1c]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1b], 3
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1a], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
mov byte [ebp - 0x19], al
xor dl, bl
mov byte [ebp - 0x18], dl
xor cl, bl
mov byte [ebp - 0x17], cl
push 0x10
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x16]
push eax
push edx
call sub.cc3260mt.dll__memcpy
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x16]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x10
jl 0x49491b
lea eax, [ebp - 0x1c]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x494930
call fcn.0049392c
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 4], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5c8d32
push edx
call fcn.00496618
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x38]
push ecx
push eax
push esi
call fcn.004933b4
mov ebx, eax
mov eax, esi
shl eax, 4
add esp, 0xc
add eax, esi
lea eax, [esi + eax*8]
add eax, eax
add eax, 0x5c8d32
push eax
call fcn.00496630
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x494994
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, esi
shl eax, 4
add eax, esi
lea eax, [esi + eax*8]
cmp dword [eax*2 + 0x5c8d24], 0
jne 0x4949c1
mov eax, 0xa0100002
jmp 0x494ad0
cmp edi, 0x1f0
jle 0x4949d3
mov eax, 0xa0100004
jmp 0x494ad0
mov edx, edi
and edx, 0x8000000f
jns 0x4949e2
dec edx
or edx, 0xfffffff0
inc edx
test edx, edx
je 0x4949f0
mov eax, 0xa0100004
jmp 0x494ad0
test edi, edi
jge 0x4949fe
mov eax, 0xa0100004
jmp 0x494ad0
push 0x19
push 0
lea edx, [ebp - 0x20]
push edx
call sub.cc3260mt.dll__memset
add esp, 0xc
call sub.kernel32.dll_GetTickCount
push eax
call sub.cc3260mt.dll__srand
pop ecx
call sub.cc3260mt.dll__rand
mov byte [ebp - 0x1f], 2
mov ebx, eax
mov edx, edi
mov byte [ebp - 0x1e], bl
mov ecx, edi
mov al, byte [ebp + 0xc]
and cl, 0xff
sar edx, 8
xor al, bl
xor dl, bl
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
xor cl, bl
mov byte [ebp - 0x1b], cl
xor edx, edx
lea eax, [ebp - 0x1a]
xor byte [eax], bl
inc edx
inc eax
cmp edx, 0x12
jl 0x494a49
lea eax, [ebp - 0x20]
mov cl, byte [eax + 0x18]
push ecx
mov ecx, 5
push dword [eax + ecx*4]
dec ecx
jns 0x494a5e
call fcn.0049392c
mov edx, esi
add esp, 0x1c
shl edx, 4
mov byte [ebp - 8], al
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5c8d32
push edx
call fcn.00496618
pop ecx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x3c]
push ecx
push eax
push esi
call fcn.004933b4
mov edx, esi
add esp, 0xc
shl edx, 4
mov dword [ebp - 4], eax
add edx, esi
lea edx, [esi + edx*8]
add edx, edx
add edx, 0x5c8d32
push edx
call fcn.00496630
mov eax, dword [ebp + 0x14]
xor esi, esi
mov edx, eax
lea eax, [ebp - 0x36]
pop ecx
mov cl, byte [eax]
inc eax
xor cl, bl
inc esi
mov byte [edx], cl
inc edx
cmp esi, 0x10
jl 0x494abf
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x497124
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, 0x5cd0fc
lea esi, [ebp - 0x24]
mov eax, 0x5bd250
call fcn.0051a22c
dec dword [esi + 0x1c]
dec dword [esi + 0x1c]
lea eax, [ebx + 0x70]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x64]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x60]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x5c]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x58]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x54]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x4c]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x40]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x3c]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x38]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x34]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x30]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x2c]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x28]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x24]
mov edx, 2
call fcn.0051a5cc
dec dword [esi + 0x1c]
lea eax, [ebx + 0x20]
mov edx, 2
call fcn.0051a5cc
mov ecx, dword [esi]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x497250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov ebx, 0x5cd0fc
mov eax, 0x5bd2e4
call fcn.0051a22c
xor edx, edx
xor ecx, ecx
mov dword [ebx], edx
mov dword [ebx + 8], ecx
xor eax, eax
mov edx, 0x5bd258
mov dword [ebx + 0xc], eax
lea eax, [ebp - 4]
mov word [ebp - 0x20], 8
call fcn.0051a3a8
inc dword [ebp - 0x14]
lea edx, [ebp - 4]
lea eax, [ebx + 0x28]
call fcn.0051a5fc
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0051a5cc
mov word [ebp - 0x20], 0x14
mov edx, 0x5bd259
lea eax, [ebp - 8]
call fcn.0051a3a8
inc dword [ebp - 0x14]
lea edx, [ebp - 8]
lea eax, [ebx + 0x2c]
call fcn.0051a5fc
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0051a5cc
mov word [ebp - 0x20], 0x20
mov edx, 0x5bd25a
lea eax, [ebp - 0xc]
call fcn.0051a3a8
inc dword [ebp - 0x14]
lea edx, [ebp - 0xc]
lea eax, [ebx + 0x30]
call fcn.0051a5fc
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0051a5cc
mov ecx, dword [ebp - 0x30]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d1c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x49d296
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x49d2a8
lea edi, [ebp - 0x2c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov esi, eax
inc esi
mov dword [ebp - 0xc], 1
xor edi, edi
jmp 0x49d277
mov dl, byte [esi]
cmp dl, 0x27
je 0x49d21c
cmp dl, byte [ebp - 5]
jne 0x49d221
xor bl, 1
jmp 0x49d273
test bl, bl
jne 0x49d273
mov al, byte [esi]
and eax, 0xff
bt dword [ebp - 0x2c], eax
jae 0x49d273
cmp byte [ebp + 8], 0
je 0x49d24a
mov al, byte [esi]
sub al, 0x3a
je 0x49d273
add al, 0xfe
sub al, 3
jb 0x49d273
mov edi, dword [ebp - 0xc]
inc edi
jmp 0x49d273
cmp byte [esi], 0x3a
jne 0x49d269
mov al, byte [esi - 1]
sub al, 0x20
je 0x49d264
add al, 0xf8
sub al, 2
jb 0x49d264
sub al, 2
je 0x49d264
sub al, 0x11
jne 0x49d273
mov edi, dword [ebp - 0xc]
jmp 0x49d273
cmp byte [esi + 1], 0x3a
jne 0x49d273
mov edi, dword [ebp - 0xc]
inc edi
inc esi
inc dword [ebp - 0xc]
test edi, edi
jne 0x49d280
cmp byte [esi], 0
jne 0x49d210
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d29d
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x4a7238
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a72b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x108]
push eax
push 0x100
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x108]
mov ecx, 0x100
call sub.rtl60.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov edx, dword [ebp - 0x10c]
mov eax, dword [ebp - 8]
mov ecx, 0x4a72c4
call sub.rtl60.bpl__System__LStrCat3_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a72b7
lea eax, [ebp - 0x10c]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x4cdfd8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 8]
lea edx, [ebp - 0x210]
push edx
call sub.user32.dll_wvsprintfA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x208
jl 0x4ce026
push 0x10e
push 0x5beebd
push 0x5beea2
call fcn.004b4398
add esp, 0xc
cmp eax, 2
jne 0x4ce026
call sub.kernel32.dll_DebugBreak
lea ecx, [ebp - 0x210]
push ecx
call sub.kernel32.dll_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x4e2790
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e28a4
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4e286a
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call sub.rtl60.bpl__System__FillChar_qqrpvic
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0xc], 1
mov eax, esi
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
mov edi, eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push edi
call sub.wininet.dll_InternetCrackUrlA
mov eax, dword [ebp - 0x30]
add eax, 0xfffffffd
sub eax, 2
jb 0x4e2833
mov dword [ebp - 0x44], esi
mov byte [ebp - 0x40], 0xb
lea eax, [ebp - 0x44]
push eax
push 0
lea edx, [ebp - 0x48]
mov eax, dword [0x5c83d4]
call sub.rtl60.bpl__System_LoadResString_qqrp20System_TResStringRec
mov ecx, dword [ebp - 0x48]
mov dl, 1
mov eax, dword [sym.imp.rtl60.bpl__Sysutils_Exception_]
call sub.rtl60.bpl__Sysutils_Exception__bctr_qqrx17System_AnsiStringpx14System_TVarRecxi
call sub.rtl60.bpl__System__RaiseExcept_qqrv
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x58], eax
movzx eax, word [ebp - 0x24]
mov dword [ebx + 0x54], eax
lea eax, [ebx + 0x4c]
push eax
mov edx, dword [ebp - 0x2c]
sub edx, edi
inc edx
mov ecx, dword [ebp - 0x28]
mov eax, esi
call sub.rtl60.bpl__System__LStrCopy_qqrv
lea eax, [ebx + 0x50]
push eax
mov edx, dword [ebp - 0x10]
sub edx, edi
inc edx
mov ecx, dword [ebp - 0xc]
mov eax, esi
call sub.rtl60.bpl__System__LStrCopy_qqrv
jmp 0x4e2884
xor eax, eax
mov dword [ebx + 0x54], eax
lea eax, [ebx + 0x4c]
call sub.rtl60.bpl__System__LStrClr_qqrpv
lea eax, [ebx + 0x50]
call sub.rtl60.bpl__System__LStrClr_qqrpv
xor eax, eax
mov dword [ebx + 0x58], eax
lea eax, [ebx + 0x3c]
mov edx, esi
call sub.rtl60.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e28ab
lea eax, [ebp - 0x48]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x4e2a38
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
test dl, dl
je 0x4e2b5e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x39], 0
jne 0x4e2b95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
test eax, eax
jle 0x4e2a6d
mov ebx, 3
jmp 0x4e2a6f
xor ebx, ebx
push 0
call sub.wininet.dll_InternetAttemptConnect
test eax, eax
je 0x4e2a7f
call sub.rtl60.bpl__Sysutils_Abort_qqrv
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.wininet.dll_InternetOpenA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x64], esi
test esi, esi
setne dl
xor dl, 1
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004e25a8
xor eax, eax
push ebp
push 0x4e2b3e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
push 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
push eax
call sub.wininet.dll_InternetConnectA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x68], ebx
test ebx, ebx
setne dl
xor dl, 1
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004e25a8
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e2b95
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x4e2b6e
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x68], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
test eax, eax
je 0x4e2b86
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x64], edx
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret