joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043d0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4c2014
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4043f2
shr eax, 1
xor eax, 0xedb88320
jmp 0x4043f4
shr eax, 1
dec edx
jne 0x4043e0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4043d9
mov byte [0x4c2414], 1
pop esi
pop ebx
ret

Function at 0x404410
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4c2414], 0
jne 0x404427
call fcn.004043d0
mov eax, edi
dec eax
test eax, eax
jl 0x40444f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c2014]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x404431
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x407164
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4071fe.0
jmp dword [ecx*4 + 0x407197]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4071c9
sub dl, 8
je 0x4071d8
jmp case.0x4071fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x406e34
jmp case.0x4071fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x406e88
jmp case.0x4071fe.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4071fe.0
movzx ecx, byte [ecx + 0x407205]
jmp dword [ecx*4 + 0x407216]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x406f28
jmp case.0x4071fe.0
cmp dl, 3
jne 0x407243
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x406f7c
jmp case.0x4071fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x406f38
jmp case.0x4071fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x406fc0
jmp case.0x4071fe.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x40726e
sub dl, 8
je 0x40727a
jmp case.0x4071fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x406fec
jmp case.0x4071fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x407050
jmp case.0x4071fe.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x407299
sub dl, 8
je 0x4072a5
jmp case.0x4071fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x407100
jmp case.0x4071fe.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x407128
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x407347
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00406370
test eax, eax
je 0x407347
mov eax, ebx
call fcn.00407350
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x4072e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x407350
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x407381
dec al
je 0x4073bc
dec al
je 0x407401
dec al
je 0x40746a
jmp 0x4074f4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4074f4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x407391
jmp 0x4074f4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4074f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4073cc
jmp 0x4074f4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4074f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x407430
xor ebp, ebp
jmp 0x407440
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x407449
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x407411
jmp 0x4074f4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4074f4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4074c3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00404458
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x40747e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40e16c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x40e19a
mov eax, ebx
call fcn.0040ec20
cmp dword [ebx + 0x40], 0
je 0x40e193
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x40e20b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x40e1fd
cmp dword [ebx + 8], 0
je 0x40e1bc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x40e1ce
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x40e1fd
cmp dword [ebx + 8], 0
je 0x40e1af
cmp eax, 3
je 0x40e1e1
dec eax
jne 0x40e1af
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x40e1af
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x40e1af
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x40e229
cmp dword [ebx + 0x14], 0xcc
je 0x40e229
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0040e234
pop ebx
ret

Function at 0x4221b8
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, ecx
mov edi, edx
mov ebx, eax
push 6
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
je 0x4221fa
mov eax, dword [sym.imp.rtl120.bpl__System_DebugHook]
cmp byte [eax], 0
je 0x4221ee
mov ecx, 0xb4c
mov edx, 0x422270
mov eax, 0x4222fc
call sub.rtl120.bpl__System__Assert_qqrx20System_UnicodeStringt1i
push 0x422340
call sub.kernel32.dll_OutputDebugStringW
jmp 0x42225a
mov eax, ebx
call fcn.0042214c
mov ebx, eax
push esp
push 5
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x42225a
mov byte [esp + 4], 0xe9
sub edi, ebx
sub edi, 5
mov dword [esp + 5], edi
lea eax, [esp + 0xc]
push eax
push 8
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
push esp
push 5
lea eax, [esp + 0xc]
push eax
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x10]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x422368
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp byte [esi], 0
je 0x4223f1
test ebx, ebx
je 0x4223f1
push 6
push ebx
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
je 0x4223b0
mov eax, dword [sym.imp.rtl120.bpl__System_DebugHook]
cmp byte [eax], 0
je 0x4223a4
mov ecx, 0xb72
mov edx, 0x422404
mov eax, 0x422490
call sub.rtl120.bpl__System__Assert_qqrx20System_UnicodeStringt1i
push 0x4224d4
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4223f1
mov eax, ebx
call fcn.0042214c
mov ebx, eax
test ebx, ebx
je 0x4223f1
lea eax, [esp + 4]
push eax
push 8
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
push esp
push 5
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
mov byte [esi], 0
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44442c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4445b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44468e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x444666
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebx + 8]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
push 0
push 0x1a
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebx + 4]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
lea edx, [ebp - 0x214]
xor eax, eax
call sub.rtl120.bpl__System_ParamStr_qqri
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x210]
lea eax, [ebx + 0xc]
call sub.rtl120.bpl__System__UStrAsg_qqrr20System_UnicodeStringx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x444670
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444695
lea eax, [ebp - 0x214]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x44775c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x447934
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4478ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_UpperCase_qqrx20System_UnicodeString
xor edx, edx
mov eax, 2
call fcn.00444a94
mov esi, eax
mov dword [ebp - 0x250], 0x22c
lea edx, [ebp - 0x250]
mov eax, esi
call fcn.00444ab4
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4478e7
lea eax, [ebp - 0x460]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x460]
lea edx, [ebp - 0x45c]
call sub.rtl120.bpl__Sysutils_ExtractFileName_qqrx20System_UnicodeString
mov eax, dword [ebp - 0x45c]
lea edx, [ebp - 0x18]
call sub.rtl120.bpl__Sysutils_UpperCase_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call sub.rtl120.bpl__System_Pos_qqrx20System_UnicodeStringt1
test eax, eax
jle 0x4478d4
mov eax, dword [ebp - 0x248]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x20]
mov ecx, 4
mov eax, edi
call fcn.004475fc
push 0x208
lea ecx, [ebp - 0x458]
mov edx, dword [ebp - 0x20]
mov eax, edi
call fcn.0044762c
test eax, eax
jne 0x447897
lea eax, [ebp - 0xc]
xor edx, edx
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
jmp 0x4478aa
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x458]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_CompareText_qqrx20System_UnicodeStringt1
test eax, eax
jne 0x4478d4
push 0
mov eax, dword [ebp - 0x248]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x250]
mov eax, esi
call fcn.00444ad4
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x447802
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447909
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44793b
lea eax, [ebp - 0x460]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0x18]
mov edx, 6
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x447948
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
xor ecx, ecx
push ebp
push 0x447a62
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x4479eb
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 8]
push ecx
push edx
push eax
call sub.shell32.dll_ShellExecuteW
mov ebx, eax
cmp ebx, 0x20
ja 0x4479e1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromPWChar_qqrr27System__AnsiStringT_us_i0__pbus
push dword [ebp - 0xc]
push 0x447a80
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov ecx, 0
call sub.rtl120.bpl__System__LStrFromPWChar_qqrr27System__AnsiStringT_us_i0__pbus
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call sub.rtl120.bpl__System__LStrCatN_qqrv
push 1
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UniqueStringA_qqrr27System__AnsiStringT_us_i0__
push eax
call sub.kernel32.dll_WinExec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x447a3f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447a69
lea eax, [ebp - 0x18]
mov edx, 4
call sub.rtl120.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__LStrClr_qqrpv
ret

Function at 0x447a84
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x447b05
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0x447b14
push 0x447b14
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
mov esi, eax
push esi
push 0x447b18
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
test bl, bl
jne 0x447aef
push 5
push 0x447b14
push esi
push 0x447b24
push 0x447b18
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x447b0c
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret

Function at 0x47258c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4725e6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00472580
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0046346c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00462fd0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4725ed
lea eax, [ebp - 4]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x486934
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004018d0
ret

Function at 0x48ad64
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x48adfe
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x48ad83
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x48ae14
dec edx
je 0x48ae49
jmp 0x48ae9a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x48ae9a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48af40
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x48af5f
add edx, 3
sar edx, 2
test edx, edx
jle 0x48b06d
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x48af94
je 0x48afd7
sub ecx, 0x2b
je 0x48afcd
sub ecx, 4
je 0x48afd2
dec ecx
sub ecx, 0xa
jb 0x48afbf
jmp 0x48afda
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x48afa6
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x48afb1
jmp 0x48afda
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x48afda
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x48afda
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x48afda
mov byte [eax], 0x3e
jmp 0x48afda
mov byte [eax], 0x3f
jmp 0x48afda
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x48af77
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x48b02b
cmp byte [esp + 7], 0xff
jne 0x48b02b
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x48b062
cmp dl, 0xff
je 0x48b062
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x48af6e
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x48be44
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x48be65
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x48be52
pop edi
pop esi
pop ebx
ret

Function at 0x48ce8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x48cee0
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x4bd3e8]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x4bd7e8]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x4bdbe8]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x4bdfe8]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x48ce9a
pop edi
pop esi
pop ebx
ret

Function at 0x491b5c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x491b82
shr edx, 1
xor edx, eax
jmp 0x491b84
shr edx, 1
inc ecx
jne 0x491b74
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x491b6d
pop edx
pop edi
pop esi
pop ebx
ret