joyce8/EMBER2024-capa huggingface dataset:
Function at 0x604c3c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x604ca2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00603c34
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00602af8
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x604c8c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x604ca9
lea eax, [ebp - 0x10]
call fcn.006039ec
ret

Function at 0x606c00
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x606c39
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00603adc
jmp 0x606c42
mov eax, ebx
mov edx, esi
call fcn.00603a40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x606c4c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x606c6d
mov al, byte [esp]
jmp 0x606c6f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x607da4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x607e08
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00603c34
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00605f24
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x607e0f
lea eax, [ebp - 0xc]
call fcn.006039ec
ret

Function at 0x608418
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc00
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.006039ec
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00603e60
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x400
jge 0x60845d
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00603adc
jmp 0x608476
mov edx, ebx
dec edx
mov eax, esi
call fcn.00603ef8
push ebx
mov eax, dword [esi]
call fcn.00603e60
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
add esp, 0x400
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x608c14
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
cmp al, 0
jne fcn.00608c14
ret
Function at 0x608c24
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
and eax, 0x70
mov dword [ebp - 4], eax
pop esi
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x608c40
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 2]
mov dword [ebp - 4], eax
pop esi
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x608df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00603e50
xor eax, eax
push ebp
push 0x608e7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00603c60
mov esi, eax
test esi, esi
jle 0x608e5d
mov ebx, 1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
sub eax, edi
sub eax, ebx
xor eax, edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dl, byte [ebp - 0xc]
call fcn.00603bb8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00603c68
mov eax, dword [ebp - 8]
inc ebx
dec esi
jne 0x608e2f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x608e82
lea eax, [ebp - 0x10]
call fcn.006039ec
lea eax, [ebp - 4]
call fcn.006039ec
ret

Function at 0x608e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00603e50
xor eax, eax
push ebp
push 0x608f05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00603c60
mov esi, eax
test esi, esi
jle 0x608ee4
mov ebx, 1
mov eax, dword [ebp - 4]
movzx edi, byte [eax + ebx - 1]
xor edi, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00603eb0
mov edx, edi
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x608ec7
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00603a40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x608f0c
lea eax, [ebp - 4]
call fcn.006039ec
ret
Function at 0x608f14
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
mov dword [esp + 8], edx
mov edx, dword [eax + 0x7c]
mov dword [esp + 0xc], edx
mov esi, dword [esp + 8]
add esi, ebx
mov ebp, dword [esi + 0x18]
dec ebp
test ebp, ebp
jb 0x608f9f
inc ebp
xor edi, edi
mov eax, dword [esi + 0x20]
add eax, ebx
mov edx, edi
shl edx, 2
add eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
add eax, ebx
push eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
jne 0x608f9b
mov eax, dword [esi + 0x24]
add eax, ebx
mov edx, edi
add edx, edx
add eax, edx
mov ax, word [eax]
add ax, 3
mov edx, dword [esi + 0x1c]
add edx, ebx
movzx eax, ax
shl eax, 2
add edx, eax
mov eax, edx
add ebx, dword [eax]
mov dword [esp + 4], ebx
jmp 0x608f9f
inc edi
dec ebp
jne 0x608f4a
mov eax, dword [esp + 4]
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0xdc0214
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdc021e
add al, ah
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0xdc0224
pop ebp
sub ebp, 0x10
sub ebp, 0x9c0214
jmp 0xdc023a
mov eax, 0x9c0214
add eax, ebp
add eax, 0x4c
mov ecx, 0x5e0
mov edx, 0xa9294116
xor byte [eax], dl
inc eax
dec ecx
jne 0xdc0251
jmp 0xdc0264
popfd
fistp dword [ebp + 0x16162a9f]
push ss
xchg edi, eax
xlatb
out dx, al
push ss
push ss
push ss
adc eax, 0x1612aedb
scasb al, byte es:[edi]
adc dl, byte [esi]
push ss
push ss
lodsb al, byte [esi]
push ss
push ss
push ss
loope 0xdc0274
adc eax, 0x1a979dde
push ss
push ss
push ss
adc eax, 0x729b46d3
xor ch, dl
lahf
adc dh, byte [edx]
jle 0xdc0216
invalid

Function at 0x118d000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x118d00a
jmp 0x118f00f
jmp fcn.00ddd420
Function at 0x5de911
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5de92c
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124a3b51]
pop edx
test eax, eax
je 0x5de9fe
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5de9ed
test dword [ebp - 0x2a8], 1
jne 0x5de9ed
and dword [ebp - 0x2a8], 0x100
jne 0x5de9ed
push esi
push edx
push 4
push esi
call dword [edx + 0x122d381c]
pop edx
pop esi
test eax, eax
je 0x5de990
jmp 0x5de9ed
cmp word [esi], 0x5a4d
jne 0x5de9ed
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5de9ed
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3b08]
pop edx
test eax, eax
je 0x5de9ed
lea eax, [ebp - 0x28c]
push eax
call fcn.005de86d
test eax, eax
jne 0x5de9e6
jmp 0x5de9ed
mov eax, esi
jmp 0x5de9fe
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5de92c
pop esi
leave
ret 4
Function at 0x404250
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 8]
xor al, al
test edx, edx
je 0x404280
push esi
nop word [eax + eax]
cmp dword [edx], 4
je 0x404278
mov ecx, dword [edx + 4]
sub ecx, 1
js 0x404278
mov esi, dword [edx + 8]
xor al, byte [esi + ecx]
sub ecx, 1
jns 0x404270
mov edx, dword [edx + 0x10]
test edx, edx
jne 0x404260
pop esi
ret

Function at 0x406150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push edi
xor bl, bl
mov dword [ebp - 4], eax
mov edi, dword [eax + 8]
test edi, edi
je 0x40619c
push esi
mov eax, dword [edi]
xor dl, dl
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x40618f
cmp dword [ecx], 4
je 0x406188
mov eax, dword [ecx + 4]
sub eax, 1
js 0x406188
mov esi, dword [ecx + 8]
xor dl, byte [esi + eax]
sub eax, 1
jns 0x406180
mov ecx, dword [ecx + 0x10]
test ecx, ecx
jne 0x406170
mov edi, dword [edi + 4]
xor bl, dl
test edi, edi
jne 0x406165
mov eax, dword [ebp - 4]
pop esi
movzx ecx, bl
mov dword [eax + 4], ecx
mov al, bl
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408980
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x7c], 1
xor esi, esi
test edi, edi
je 0x4089f5
push ebx
mov ebx, 0xff
nop dword [eax]
mov dword [ebp + esi*4 - 0x78], 1
mov ecx, esi
test esi, esi
je 0x4089d5
nop
mov eax, dword [ebp + ecx*4 - 0x7c]
xor edx, edx
movzx eax, byte [eax + 0x73f990]
add eax, esi
div ebx
movzx eax, byte [edx + 0x73fab0]
xor eax, dword [ebp + ecx*4 - 0x80]
mov dword [ebp + ecx*4 - 0x7c], eax
sub ecx, 1
jne 0x4089b0
mov eax, dword [ebp - 0x7c]
xor edx, edx
movzx eax, byte [eax + 0x73f990]
add eax, esi
inc esi
div ebx
movzx eax, byte [edx + 0x73fab0]
mov dword [ebp - 0x7c], eax
cmp esi, edi
jb 0x4089a0
pop ebx
lea ecx, [edi - 2]
xor edx, edx
mov eax, ecx
shl eax, 5
sub eax, ecx
lea ecx, [eax + 0x73f600]
nop word [eax + eax]
mov eax, dword [ebp + edx*4 - 0x7c]
mov al, byte [eax + 0x73f990]
mov byte [ecx + edx], al
inc edx
cmp edx, edi
jbe 0x408a10
mov byte [edi + 0x73fa8e], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x73f5f0], 0
push esi
mov esi, edx
mov dword [ebp - 0xc], ecx
jne 0x408a77
call fcn.004088f0
xorps xmm0, xmm0
mov dword [0x73faa8], 0
movups xmmword [0x73fa90], xmm0
mov byte [0x73faac], 0
movq qword [0x73faa0], xmm0
mov dword [0x73f5f0], 1
cmp esi, 0x1e
jbe 0x408a84
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push esi
push 0
push ebx
call fcn.0060b7a0
add esp, 0xc
cmp byte [esi + 0x73fa8e], 0
jne 0x408aa5
mov ecx, esi
call fcn.00408980
lea eax, [esi - 2]
xor edi, edi
mov edx, eax
mov dword [ebp - 8], edi
shl edx, 5
sub edx, eax
add edx, 0x73f600
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], edi
jbe 0x408b6e
mov dword [ebp - 0x18], 0xff
nop dword [eax]
mov eax, dword [ebp + 8]
movzx ecx, byte [edi + eax]
movzx eax, byte [ebx]
xor ecx, eax
mov al, byte [ecx + 0x73f990]
mov byte [ebp - 1], al
cmp al, 0xff
je 0x408b1f
mov ecx, 1
cmp esi, ecx
jbe 0x408b1f
movzx eax, al
lea edi, [esi - 1]
mov dword [ebp - 0x14], eax
add edi, edx
nop dword [eax]
movzx eax, byte [edi]
lea edi, [edi - 1]
add eax, dword [ebp - 0x14]
xor edx, edx
div dword [ebp - 0x18]
mov al, byte [edx + 0x73fab0]
xor byte [ecx + ebx], al
inc ecx
cmp ecx, esi
jb 0x408b00
mov edi, dword [ebp - 8]
lea eax, [esi - 1]
push eax
lea eax, [ebx + 1]
push eax
push ebx
call dword [0x6ec714]
mov cl, byte [ebp - 1]
add esp, 0xc
cmp cl, 0xff
je 0x408b59
mov eax, dword [ebp - 0x10]
xor edx, edx
movzx ecx, cl
movzx eax, byte [eax]
add eax, ecx
mov ecx, 0xff
div ecx
mov al, byte [edx + 0x73fab0]
mov byte [esi + ebx - 1], al
jmp 0x408b5e
mov byte [esi + ebx - 1], 0
mov edx, dword [ebp - 0x10]
inc edi
mov dword [ebp - 8], edi
cmp edi, dword [ebp - 0xc]
jb 0x408ad0
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408f80
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov dword [ebp - 4], edx
mov al, byte [ebx]
test al, al
je 0x408ffa
push esi
push edi
mov edi, dword [edx + 4]
mov esi, 0x34567890
nop
mov ecx, dword [edx]
lea ebx, [ebx + 1]
movsx eax, al
xor eax, dword [edx]
mov edx, dword [ebp + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edx], eax
movzx eax, al
add eax, edi
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [edx + 4], edi
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ecx + eax*4]
mov dword [edx + 8], esi
mov al, byte [ebx]
test al, al
jne 0x408fb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b630
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x100ac], ebx
je 0x40b6db
cmp dword [esi + 0x7c], ebx
jbe 0x40b6db
mov eax, 0xffffff5c
lea ebx, [esi + 0xa4]
sub eax, esi
mov dword [ebp - 4], eax
movzx eax, byte [ebx]
mov ecx, dword [esi + 0x100d0]
xor eax, ecx
mov edx, dword [esi + 0x100dc]
mov edi, dword [esi + 0x100d8]
movzx eax, al
and edi, 0xfffd
shr ecx, 8
or edi, 2
mov eax, dword [edx + eax*4]
xor eax, ecx
mov ecx, dword [esi + 0x100d8]
mov dword [esi + 0x100d0], eax
movzx eax, al
add eax, dword [esi + 0x100d4]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x100d4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edx + eax*4]
mov eax, edi
xor eax, 1
mov dword [esi + 0x100d8], ecx
imul eax, edi
shr eax, 8
xor byte [ebx], al
inc ebx
mov eax, dword [ebp - 4]
add eax, ebx
cmp eax, dword [esi + 0x7c]
jb 0x40b660
xor ebx, ebx
mov edi, dword [esi + 0x7c]
lea eax, [esi + 0xa4]
push edi
push eax
push dword [esi + 0x2c]
mov eax, dword [esi + 8]
push dword [esi + 0x1c]
call eax
add esp, 0x10
mov dword [esi + 0x7c], 0
or ecx, 0xffffffff
cmp eax, edi
cmovne ebx, ecx
add dword [esi + 0x100c0], edi
mov ecx, dword [esi + 0x48]
mov eax, ebx
adc dword [esi + 0x100c4], 0
add dword [esi + 0x100c8], ecx
pop edi
adc dword [esi + 0x100cc], 0
mov dword [esi + 0x48], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cb30
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ecx]
mov ebx, edx
mov edx, dword [ecx + 8]
mov eax, esi
xor eax, dword [ebp + 8]
movzx eax, al
shr esi, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebx + eax*4]
xor eax, esi
mov dword [ecx], eax
movzx eax, al
add eax, dword [ecx + 4]
imul eax, eax, 0x8088405
pop esi
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edx
shr edx, 8
movzx ecx, al
mov eax, dword [ebp - 4]
xor edx, dword [ebx + ecx*4]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cb80
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [edx], 0x12345678
mov dword [edx + 4], 0x23456789
mov dword [edx + 8], 0x34567890
mov dword [ebp - 4], edx
mov al, byte [ebx]
test al, al
je 0x40cbfa
push esi
push edi
mov edi, dword [edx + 4]
mov esi, 0x34567890
nop
mov ecx, dword [edx]
lea ebx, [ebx + 1]
movsx eax, al
xor eax, dword [edx]
mov edx, dword [ebp + 8]
movzx eax, al
shr ecx, 8
mov eax, dword [edx + eax*4]
mov edx, dword [ebp - 4]
xor eax, ecx
mov ecx, dword [ebp + 8]
mov dword [edx], eax
movzx eax, al
add eax, edi
imul edi, eax, 0x8088405
inc edi
mov eax, edi
mov dword [edx + 4], edi
shr eax, 0x18
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [ecx + eax*4]
mov dword [edx + 8], esi
mov al, byte [ebx]
test al, al
jne 0x40cbb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
nop
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x4114cf
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.0060aca0
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x41149f
sub eax, esi
jmp 0x4114a1
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x411490
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x4114c0
sub eax, esi
jmp 0x4114c2
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x4114b1
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x411603
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x4114fc
xor eax, eax
jmp 0x41154f
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x411519
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.00416850
jmp 0x411531
cmp eax, 2
jne 0x411537
mov edx, dword [ebx]
test edx, edx
jne 0x411528
xor eax, eax
jmp 0x411534
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.004124f0
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call fcn.0060aca0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x411577
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x41158b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x411450
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x411603
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x4115d3
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
mov dword [ebp - 8], ecx
push 0
push eax
call fcn.0060b7a0
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x411603
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
add eax, edx
push esi
push 0
push eax
call fcn.0060b7a0
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4124d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4124db
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004124f0
Function at 0x419228
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
lea ecx, [ebp - 0x1c]
call fcn.00417833
push ecx
mov ecx, esp
push 0x680c18
call fcn.004177e7
push ecx
mov esi, esp
push ecx
push esp
lea ecx, [ebp - 0x1c]
call fcn.00418c45
push esi
lea ecx, [ebp - 0x1c]
call fcn.00419083
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041934b
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
lea ecx, [esi - 0x10]
setne bl
call fcn.00419521
lea ecx, [ebp - 0x1c]
call fcn.00418dd0
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.00419521
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419dff
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.CMD5Checksum.0
push eax
call fcn.0060b7a0
and dword [esi + 0x48], 0
add esp, 0xc
and dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret

Function at 0x41acca
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 8
push 0
lea eax, [esi + 0x10]
push eax
call fcn.0060b7a0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret