joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016e4
Capabilities:
Read file via mapping

Disassembly:
xor eax, eax
call fcn.00401658
mov dword [0x41a064], eax
cmp dword [0x41a064], 0
jbe 0x401726
push 0
push 0
push 0
push 4
mov eax, dword [0x41a064]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x41a068], eax
cmp dword [0x41a068], 0
je 0x401726
mov eax, dword [0x41a068]
mov eax, dword [eax]
mov dword [0x41a02c], eax
ret

Function at 0x401bc8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
add esp, 0xffffffb8
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x40
push pe_nt_image_headers32
mov ebx, sub.SYrtl70.bpl__System_Move_qqrpxvpvi
push ebx
call sub.kernel32.dll_VirtualProtect
mov eax, ebx
cmp byte [eax], 0xe9
je 0x401c50
cmp word [eax], 0x25ff
jne 0x401c03
mov byte [eax], 0xe9
mov eax, ebx
sub esi, eax
sub esi, 5
inc eax
mov dword [eax], esi
jmp 0x401c50
lea edx, [esp + 0x10]
mov eax, esi
mov ecx, 0x38
call sub.SYrtl70.bpl__System_Move_qqrpxvpvi
mov eax, esi
sub eax, ebx
add dword [esp + 0x1e], eax
add dword [esp + 0x24], eax
add dword [esp + 0x2f], eax
add dword [esp + 0x3e], eax
add dword [esp + 0x43], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
mov eax, sub.SYrtl70.bpl__System_Move_qqrpxvpvi
mov dword [esp + 4], eax
xor eax, eax
mov edx, dword [esp]
mov dl, byte [edx + eax]
mov ecx, dword [esp + 4]
mov byte [ecx + eax], dl
inc eax
cmp eax, 0x38
jne 0x401c3d
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x10]
push eax
push pe_nt_image_headers32
push sub.SYrtl70.bpl__System_Move_qqrpxvpvi
call sub.kernel32.dll_VirtualProtect
push 0x38
push sub.SYrtl70.bpl__System_Move_qqrpxvpvi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
add esp, 0x48
pop esi
pop ebx
ret

Function at 0x401ca4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x401cf8
lea eax, [esp + 4]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x401cf8
mov dword [esp], ebx
mov eax, dword [esp]
mov byte [eax], 0xe9
sub esi, ebx
sub esi, 5
mov eax, dword [esp]
mov dword [eax + 1], esi
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x401d70
Capabilities:
Read file via mapping

Disassembly:
push ebx
push ecx
xor eax, eax
mov dword [esp], eax
xor eax, eax
call fcn.00401990
mov dword [0x41a0a0], eax
cmp dword [0x41a0a0], 0
jbe 0x401db7
push 0
push 0
push 0
push 4
mov eax, dword [0x41a0a0]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x41a0a4], eax
cmp dword [0x41a0a4], 0
je 0x401db7
mov eax, dword [0x41a0a4]
mov eax, dword [eax]
mov dword [esp], eax
cmp dword [esp], 0
je 0x401f26
mov eax, dword [esp]
cmp dword [eax], 0
je 0x401dd3
mov eax, dword [esp]
mov eax, dword [eax]
call fcn.00401bc8
mov ebx, dword [esp]
cmp dword [ebx + 4], 0
je 0x401dee
mov eax, 0x401d00
call fcn.00401c84
mov edx, dword [ebx + 4]
call fcn.00401ca4
cmp dword [ebx + 8], 0
je 0x401e06
mov eax, 0x401d08
call fcn.00401c84
mov edx, dword [ebx + 8]
call fcn.00401ca4
cmp dword [ebx + 0xc], 0
je 0x401e1e
mov eax, 0x401d10
call fcn.00401c84
mov edx, dword [ebx + 0xc]
call fcn.00401ca4
cmp dword [ebx + 0x10], 0
je 0x401e36
mov eax, 0x401d18
call fcn.00401c84
mov edx, dword [ebx + 0x10]
call fcn.00401ca4
cmp dword [ebx + 0x14], 0
je 0x401e4e
mov eax, 0x401d20
call fcn.00401c84
mov edx, dword [ebx + 0x14]
call fcn.00401ca4
cmp dword [ebx + 0x18], 0
je 0x401e66
mov eax, 0x401d28
call fcn.00401c84
mov edx, dword [ebx + 0x18]
call fcn.00401ca4
cmp dword [ebx + 0x1c], 0
je 0x401e7e
mov eax, 0x401d30
call fcn.00401c84
mov edx, dword [ebx + 0x1c]
call fcn.00401ca4
cmp dword [ebx + 0x20], 0
je 0x401e96
mov eax, 0x401d38
call fcn.00401c84
mov edx, dword [ebx + 0x20]
call fcn.00401ca4
cmp dword [ebx + 0x24], 0
je 0x401eae
mov eax, 0x401d40
call fcn.00401c84
mov edx, dword [ebx + 0x24]
call fcn.00401ca4
cmp dword [ebx + 0x28], 0
je 0x401ec6
mov eax, 0x401d48
call fcn.00401c84
mov edx, dword [ebx + 0x28]
call fcn.00401ca4
cmp dword [ebx + 0x2c], 0
je 0x401ede
mov eax, 0x401d50
call fcn.00401c84
mov edx, dword [ebx + 0x2c]
call fcn.00401ca4
cmp dword [ebx + 0x30], 0
je 0x401ef6
mov eax, 0x401d58
call fcn.00401c84
mov edx, dword [ebx + 0x30]
call fcn.00401ca4
cmp dword [ebx + 0x34], 0
je 0x401f0e
mov eax, 0x401d60
call fcn.00401c84
mov edx, dword [ebx + 0x34]
call fcn.00401ca4
cmp dword [ebx + 0x38], 0
je 0x401f26
mov eax, 0x401d68
call fcn.00401c84
mov edx, dword [ebx + 0x38]
call fcn.00401ca4
pop edx
pop ebx
ret
Function at 0x40672c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4068d4
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x114]
xchg edx, eax
call sub.SYrtl70.bpl__Sysutils_StrPCopy_qqrpcx17System_AnsiString
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test bx, bx
jne 0x406793
mov eax, dword [ebp - 4]
call sub.SYrtl70.bpl__System__LStrClr_qqrpv
jmp 0x4068b6
xor eax, eax
push ebp
push 0x40689f
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
call sub.SYrtl70.bpl__System__GetMem_qqri
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40688e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
movzx eax, bx
push eax
push 0
lea eax, [ebp - 0x114]
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x4068e4
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x406878
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
call fcn.0040160c
movzx eax, ax
lea edx, [ebp - 0x118]
call sub.SYrtl70.bpl__Sysutils_IntToStr_qqri
push dword [ebp - 0x118]
push 0x4068f0
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 8]
movzx eax, word [eax + 8]
call sub.SYrtl70.bpl__Sysutils_IntToStr_qqri
push dword [ebp - 0x11c]
push 0x4068f0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
call fcn.0040160c
movzx eax, ax
lea edx, [ebp - 0x120]
call sub.SYrtl70.bpl__Sysutils_IntToStr_qqri
push dword [ebp - 0x120]
push 0x4068f0
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0xc]
call sub.SYrtl70.bpl__Sysutils_IntToStr_qqri
push dword [ebp - 0x124]
mov eax, dword [ebp - 4]
mov edx, 7
call sub.SYrtl70.bpl__System__LStrCatN_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406895
mov eax, dword [ebp - 0xc]
call sub.SYrtl70.bpl__System__FreeMem_qqrpv
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4068db
lea eax, [ebp - 0x124]
mov edx, 4
call sub.SYrtl70.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x406c54
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406d5b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10c]
mov eax, 0x406d70
call sub.SYrtl70.bpl__Sysutils_GetEnvironmentVariable_qqrx17System_AnsiString
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call sub.SYrtl70.bpl__Sysutils_Trim_qqrx17System_AnsiString
mov eax, dword [ebx]
mov edx, dword [sym.imp.SYrtl70.bpl__Sysutils_EmptyStr]
mov edx, dword [edx]
call sub.SYrtl70.bpl__System__LStrCmp_qqrv
je 0x406cd7
mov eax, dword [ebx]
call sub.SYrtl70.bpl__Sysutils_DirectoryExists_qqrx17System_AnsiString
test al, al
je 0x406cd7
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call sub.SYrtl70.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx17System_AnsiString
mov edx, dword [ebp - 0x110]
mov eax, ebx
call sub.SYrtl70.bpl__System__LStrAsg_qqrpvpxv
jmp 0x406d3d
lea eax, [ebp - 0x105]
xor ecx, ecx
mov edx, 0x105
call sub.SYrtl70.bpl__System__FillChar_qqrpvic
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x105]
call sub.SYrtl70.bpl__Sysutils_StrPas_qqrpxc
mov eax, dword [ebx]
call sub.SYrtl70.bpl__Sysutils_DirectoryExists_qqrx17System_AnsiString
test al, al
je 0x406d2e
lea edx, [ebp - 0x114]
mov eax, dword [ebx]
call sub.SYrtl70.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx17System_AnsiString
mov edx, dword [ebp - 0x114]
mov eax, ebx
call sub.SYrtl70.bpl__System__LStrAsg_qqrpvpxv
jmp 0x406d3d
mov eax, ebx
mov edx, dword [sym.imp.SYrtl70.bpl__Sysutils_EmptyStr]
mov edx, dword [edx]
call sub.SYrtl70.bpl__System__LStrAsg_qqrpvpxv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d62
lea eax, [ebp - 0x114]
mov edx, 3
call sub.SYrtl70.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x4093a0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0xc], eax
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x40952c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x110]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
jne 0x4093f9
mov ecx, 0x409548
mov dl, 1
mov eax, dword [sym.imp.SYrtl70.bpl__Sysutils_Exception_]
call sub.SYrtl70.bpl__Sysutils_Exception__bctr_qqrx17System_AnsiString
call sub.SYrtl70.bpl__System__RaiseExcept_qqrv
mov ebx, eax
test ebx, ebx
jns 0x409402
add ebx, 3
sar ebx, 2
mov dl, 1
mov eax, dword [sym.imp.SYrtl70.bpl__Classes_TStringList_]
call sub.SYrtl70.bpl__System_TObject__bctr_qqrv
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4094ef
push dword fs:[edx]
mov dword fs:[edx], esp
mov esi, ebx
dec esi
test esi, esi
jl 0x4094e5
inc esi
lea ebx, [ebp - 0x110]
lea eax, [ebp - 0x214]
xor ecx, ecx
mov edx, 0x104
call sub.SYrtl70.bpl__System__FillChar_qqrpvic
mov eax, edi
xor ecx, ecx
mov edx, 4
call sub.SYrtl70.bpl__System__FillChar_qqrpvic
mov edx, edi
mov eax, ebx
mov ecx, 4
call sub.SYrtl70.bpl__System_Move_qqrpxvpvi
mov byte [edi + 2], 0
lea edx, [ebp - 0xc]
mov eax, edi
call sub.SYrtl70.bpl__Sysutils_StrPas_qqrpxc
push 0x104
lea eax, [ebp - 0x214]
push eax
push edi
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
jbe 0x4094c5
lea edx, [ebp - 0x21c]
lea eax, [ebp - 0x214]
call sub.SYrtl70.bpl__Sysutils_StrPas_qqrpxc
push dword [ebp - 0x21c]
push 0x409570
push dword [ebp - 0xc]
lea eax, [ebp - 0x218]
mov edx, 3
call sub.SYrtl70.bpl__System__LStrCatN_qqrv
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4094db
mov ecx, 0x40957c
mov dl, 1
mov eax, dword [sym.imp.SYrtl70.bpl__Sysutils_Exception_]
call sub.SYrtl70.bpl__Sysutils_Exception__bctr_qqrx17System_AnsiString
call sub.SYrtl70.bpl__System__RaiseExcept_qqrv
add ebx, 4
dec esi
jne 0x409434
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409506
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409533
lea eax, [ebp - 0x21c]
mov edx, 2
call sub.SYrtl70.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
call sub.SYrtl70.bpl__System__LStrClr_qqrpv
ret

Function at 0x413478
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00401618
ret
Function at 0x4135a0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.SYrtl70.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4136ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.00413478
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call sub.SYrtl70.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4136cd
xor eax, eax
push ebp
push 0x4136c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4136af
xor eax, eax
push ebp
push 0x4136a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x413691
xor eax, eax
push ebp
push 0x41368a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004134ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413691
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4136af
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4136cd
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0041352c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4136f5
lea eax, [ebp - 4]
call sub.SYrtl70.bpl__System__LStrClr_qqrpv
ret
Function at 0x418dcc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd7c
xor ecx, ecx
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x278], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
lea eax, [ebp - 0x274]
mov edx, dword [sym.imp.SYrtl70.bpl___xp_19Sysutils_TSearchRec]
call sub.SYrtl70.bpl__System__InitializeRecord_qqrpvt1
xor eax, eax
push ebp
push 0x418fb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, 0x418fc8
call fcn.00406278
lea eax, [ebp - 0xc]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x119]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea eax, [ebp - 0x278]
lea edx, [ebp - 0x119]
mov ecx, 0x105
call sub.SYrtl70.bpl__System__LStrFromArray_qqrr17System_AnsiStringpci
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 0x10]
call sub.SYrtl70.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx17System_AnsiString
xor eax, eax
push ebp
push 0x418f70
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x27c]
mov ecx, 0x418ff4
mov edx, dword [ebp - 0x10]
call sub.SYrtl70.bpl__System__LStrCat3_qqrv
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x274]
mov edx, 0x3f
call sub.SYrtl70.bpl__Sysutils_FindFirst_qqrx17System_AnsiStringir19Sysutils_TSearchRec
test eax, eax
jne 0x418f57
lea eax, [ebp - 0x280]
mov ecx, dword [ebp - 0x268]
mov edx, dword [ebp - 0x10]
call sub.SYrtl70.bpl__System__LStrCat3_qqrv
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 0x14]
call fcn.00406900
lea edx, [ebp - 0x284]
mov eax, dword [ebp - 0x14]
call sub.SYrtl70.bpl__Sysutils_ExtractFileName_qqrx17System_AnsiString
mov eax, dword [ebp - 0x284]
mov edx, 0x419004
call sub.SYrtl70.bpl__Sysutils_AnsiSameText_qqrx17System_AnsiStringt1
test al, al
je 0x418f44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jne 0x418f44
xor eax, eax
push ebp
push 0x418f3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, byte [ebp - 5]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004187d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418f44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
ret
lea eax, [ebp - 0x274]
call sub.SYrtl70.bpl__Sysutils_FindNext_qqrr19Sysutils_TSearchRec
test eax, eax
je 0x418eaa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418f77
lea eax, [ebp - 0x274]
call sub.SYrtl70.bpl__Sysutils_FindClose_qqrr19Sysutils_TSearchRec
ret
Function at 0x4054b0
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x440e58], 2
jl 0x4054d5
movaps xmm0, xmmword [0x42f400]
movaps xmmword [0x439b70], xmm0
movaps xmm0, xmmword [0x42f3f0]
movaps xmmword [0x439b80], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.00405881
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x42f3d0]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x4054e3
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x405c15
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x405c47
test dl, 7
je 0x405c47
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x439b90]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x405c27
cmp esi, 8
jb 0x405cd7
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x439b90]
xor ecx, dword [eax*4 + 0x439f90]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43a390]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x43ab90]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x43af90]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43b390]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x43a790]
movzx eax, bl
xor ecx, dword [eax*4 + 0x43b790]
mov ebx, ecx
sub edi, 1
jne 0x405c56
pop edi
test esi, esi
je 0x405cf3
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x439b90]
inc edx
sub esi, 1
jne 0x405cdb
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x405e60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push 0x20
pop ebp
cmp dword [esi], 2
jne 0x405eb7
mov eax, dword [esi + 4]
push edi
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x4c]
push eax
push ebp
push dword [esp + 0x58]
call fcn.00406552
mov dword [esi + 4], ebx
mov edx, ebx
mov edi, ebx
movzx eax, byte [esp + edx + 0x10]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor edi, eax
inc edx
cmp edx, ebp
jb 0x405e9d
mov dword [esi + 4], edi
pop edi
cmp dword [esi], 3
jne 0x405ee3
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
add esi, 4
push eax
push ebp
push esi
push ebp
push dword [esp + 0x54]
call fcn.00406552
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0041d5b0
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x4062fb
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x264
push ebx
mov ebx, dword [esp + 0x280]
mov eax, ecx
mov dword [esp + 4], eax
cmp ebx, 0x18
ja 0x4064f7
push ebp
push esi
xor ebp, ebp
lea esi, [eax + 0x4b4]
push edi
mov edi, ebp
cmp dword [esi + 0x134], ebx
jne 0x40635f
push dword [esp + 0x27c]
mov ecx, esi
call fcn.0040d878
test al, al
je 0x40635f
push 0x10
push dword [esp + 0x288]
lea eax, [esi + 0x102]
push eax
call fcn.0041defa
add esp, 0xc
test eax, eax
je 0x406501
inc edi
add esi, 0x178
cmp edi, 4
jb 0x406325
mov esi, 0x200
lea eax, [esp + 0x74]
push esi
push eax
push dword [esp + 0x288]
call fcn.0041039b
xor eax, eax
mov ecx, ebx
inc eax
shl eax, cl
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
push 0x10
push dword [esp + 0x298]
lea eax, [esp + 0x8c]
push eax
call fcn.00421710
pop ecx
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0040676d
push esi
lea eax, [esp + 0x78]
push eax
call fcn.0040daa6
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x27c]
push 0x40
mov ecx, dword [edx + 0xa94]
lea ebx, [edx + 0x4b4]
mov eax, ecx
and eax, 3
imul eax, eax, 0x178
add ebx, eax
lea eax, [ecx + 1]
mov dword [edx + 0xa94], eax
mov edi, ebx
mov eax, dword [esp + 0x290]
pop ecx
mov dword [ebx + 0x134], eax
lea eax, [ebx + 0x102]
rep movsd dword es:[edi], dword [esi]
push 0x10
push dword [esp + 0x288]
push eax
movsw word es:[edi], word [esi]
call fcn.0041d5b0
push 0x20
pop edi
push edi
lea eax, [esp + 0x24]
push eax
lea esi, [ebx + 0x112]
push esi
call fcn.0041d5b0
push edi
lea eax, [esp + 0x50]
push eax
lea eax, [ebx + 0x138]
push eax
call fcn.0041d5b0
push edi
lea eax, [esp + 0x7c]
push eax
lea eax, [ebx + 0x158]
push eax
call fcn.0041d5b0
add esp, 0x30
push ebp
push 1
push edi
push esi
call fcn.0040d9b1
cmp dword [esp + 0x290], ebp
je 0x406485
push edi
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x298]
call fcn.0041d5b0
add esp, 0xc
mov esi, dword [esp + 0x294]
test esi, esi
je 0x4064b8
push 8
push ebp
push esi
call fcn.0041d450
add esp, 0xc
mov al, byte [esp + ebp + 0x34]
mov ecx, ebp
and ecx, 7
xor byte [ecx + esi], al
inc ebp
cmp ebp, edi
jb 0x40649c
push edi
lea eax, [esp + 0x38]
push eax
call fcn.0040daa6
cmp dword [esp + 0x288], 0
je 0x4064e9
push dword [esp + 0x288]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push 0x100
push eax
push dword [esp + 0x284]
add ecx, 0xa9c
call fcn.0040cf4c
push edi
lea eax, [esp + 0x18]
push eax
call fcn.0040daa6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x264
ret 0x20
push 0x20
pop edi
push edi
lea eax, [esi + 0x112]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041d5b0
add esp, 0xc
lea eax, [esp + 0x14]
push ebp
push ebp
push edi
push eax
call fcn.0040d9b1
push edi
lea eax, [esi + 0x138]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041d5b0
push edi
lea eax, [esi + 0x158]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.0041d5b0
add esp, 0x18
jmp 0x406467