joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4085d0
Capabilities:
Print debug messages

Disassembly:
push 0x868
mov eax, 0x42774c
call fcn.0041afbc
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
lea eax, [ebp + eax - 0x814]
xor ebx, ebx
cmp byte [eax], 0xa
jne 0x408611
mov byte [eax], bl
call fcn.00408ee5
add eax, 0x204
push eax
lea ecx, [ebp - 0x83c]
call fcn.004010a4
mov dword [ebp - 4], ebx
call fcn.00408ee5
cmp byte [eax + 0x230], bl
je 0x4086bd
call fcn.00408ee5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x18]
test eax, eax
jne 0x408657
call fcn.00408ee5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
call fcn.00408ee5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
test eax, eax
je 0x4086bd
call fcn.00408ee5
mov edx, dword [eax]
lea ecx, [ebp - 0x814]
push ecx
push ebx
push 0x180
mov ecx, eax
call dword [edx + 0x1c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call esi
call fcn.00408ee5
mov edx, dword [eax]
push ebx
push ebx
push 0x18b
mov ecx, eax
call dword [edx + 0x1c]
push eax
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x4086bd
call fcn.00408ee5
mov edx, dword [eax]
push ebx
dec edi
push edi
push 0x186
mov ecx, eax
call dword [edx + 0x1c]
push eax
call esi
call fcn.00408ee5
cmp byte [eax + 0x231], bl
je 0x408791
call fcn.00408ee5
mov ecx, eax
call fcn.004087f3
push 0x42f7ac
lea ecx, [ebp - 0x874]
call fcn.004032b4
mov esi, eax
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 1
call fcn.004032b4
push esi
push eax
lea eax, [ebp - 0x830]
push eax
mov byte [ebp - 4], 2
call fcn.00402c36
add esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x408722
mov eax, dword [eax + 4]
jmp 0x408725
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x830]
call fcn.0040313e
push ebx
push esi
lea ecx, [ebp - 0x858]
call fcn.0040313e
push ebx
push esi
lea ecx, [ebp - 0x874]
mov byte [ebp - 4], bl
call fcn.0040313e
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x830]
call fcn.004032b4
lea eax, [ebp - 0x830]
push eax
push ecx
mov byte [ebp - 4], 3
call fcn.00408ee5
pop ecx
mov ecx, eax
call fcn.00408dd8
push ebx
push esi
lea ecx, [ebp - 0x830]
call fcn.0040313e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x83c]
call fcn.004010f9
call fcn.0041b03f
ret
Function at 0x409097
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ecx + 8]
push esi
xor esi, esi
cmp ecx, esi
jne 0x4090b0
cmp edi, esi
je 0x4090ac
mov dword [edi], esi
xor eax, eax
jmp 0x4090ed
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
jb 0x4090c1
mov eax, dword [eax + 4]
jmp 0x4090c4
add eax, 4
lea edx, [ebp - 8]
push edx
push esi
lea edx, [ebp - 4]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4090e1
mov dword [ebp - 4], esi
xor eax, eax
jmp 0x4090e4
mov eax, dword [ebp - 8]
cmp edi, esi
je 0x4090ea
mov dword [edi], eax
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x4090f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push dword [ebp + 8]
mov esi, eax
mov ebx, ecx
call fcn.00404e45
cmp dword [ebx + 8], 0
jne 0x40910c
xor al, al
jmp 0x409122
push edi
lea edi, [ebp - 4]
mov eax, esi
mov ecx, ebx
call fcn.00409097
cmp dword [ebp - 4], 0
jne 0x409128
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebp - 4]
call fcn.004141cc
cmp dword [esi + 0x18], 0x10
pop ecx
mov edi, eax
jb 0x40913e
mov esi, dword [esi + 4]
jmp 0x409141
add esi, 4
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0
push esi
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x409165
xor bl, bl
push edi
call fcn.0041aaca
pop ecx
mov al, bl
jmp 0x409121
mov ecx, dword [ebp + 8]
push edi
call fcn.00403291
mov bl, 1
jmp 0x40915a
Function at 0x4197af
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4360c8]
jne 0x4197b9
repz ret
jmp fcn.0041e05c

Function at 0x42417f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041c7d5
and dword [ebp - 4], 0
cmp dword [0x440b3c], 0
mov ebx, eax
jne 0x424230
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4242e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42df40
push edi
call esi
test eax, eax
je 0x4242e1
push eax
call fcn.0041c763
mov dword [esp], 0x42df30
push edi
mov dword [0x440b3c], eax
call esi
push eax
call fcn.0041c763
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x440b40], eax
call esi
push eax
call fcn.0041c763
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x440b44], eax
call esi
push eax
call fcn.0041c763
pop ecx
mov dword [0x440b4c], eax
test eax, eax
je 0x424230
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041c763
pop ecx
mov dword [0x440b48], eax
mov eax, dword [0x440b48]
cmp eax, ebx
je 0x424288
cmp dword [0x440b4c], ebx
je 0x424288
push eax
call fcn.0041c7de
push dword [0x440b4c]
mov esi, eax
call fcn.0041c7de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424288
test edi, edi
je 0x424288
call esi
test eax, eax
je 0x42427f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42427f
test byte [ebp - 0xc], 1
jne 0x424288
or dword [ebp + 0x10], 0x200000
jmp 0x4242c1
mov eax, dword [0x440b40]
cmp eax, ebx
je 0x4242c1
push eax
call fcn.0041c7de
pop ecx
test eax, eax
je 0x4242c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4242c1
mov eax, dword [0x440b44]
cmp eax, ebx
je 0x4242c1
push eax
call fcn.0041c7de
pop ecx
test eax, eax
je 0x4242c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x440b3c]
call fcn.0041c7de
pop ecx
test eax, eax
je 0x4242e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4242e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xc85432
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword ds:[eax + 0x3c]
mov edx, eax
push dword ds:[ecx + edx + 0x78]
push edx
pop edx
pop eax
add eax, edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0xc85460
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx + 0x18]
jae 0xc85513
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov cl, byte [eax]
mov byte [ebp - 0x19], cl
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx]
jne 0xc854cd
cmp byte [ebp - 0x19], 0
je 0xc854c4
mov eax, dword [ebp - 0x18]
mov cl, byte [eax + 1]
mov byte [ebp - 0x1a], cl
mov edx, dword [ebp - 0x14]
cmp cl, byte [edx + 1]
jne 0xc854cd
add dword [ebp - 0x18], 2
add dword [ebp - 0x14], 2
cmp byte [ebp - 0x1a], 0
jne 0xc85490
mov dword [ebp - 0x20], 0
jmp 0xc854d5
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0xc8550e
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dx, word [eax + ecx*2]
mov word [ebp - 0x10], dx
mov eax, dword [ebp - 4]
mov ecx, dword ds:[eax + 0x1c]
add ecx, dword [ebp + 8]
movzx edx, word [ebp - 0x10]
mov eax, dword ds:[ecx + edx*4]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
jmp 0xc85457
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000cc2f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101621e8]
jne 0x1000cc39
repz ret
jmp fcn.1000f5e0

Function at 0x1001011f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000c635
and dword [ebp - 4], 0
cmp dword [0x10163948], 0
mov ebx, eax
jne 0x100101d0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10010281
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10010281
push eax
call fcn.1000c5c3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10163948], eax
call esi
push eax
call fcn.1000c5c3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1016394c], eax
call esi
push eax
call fcn.1000c5c3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10163950], eax
call esi
push eax
call fcn.1000c5c3
pop ecx
mov dword [0x10163958], eax
test eax, eax
je 0x100101d0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000c5c3
pop ecx
mov dword [0x10163954], eax
mov eax, dword [0x10163954]
cmp eax, ebx
je 0x10010228
cmp dword [0x10163958], ebx
je 0x10010228
push eax
call fcn.1000c63e
push dword [0x10163958]
mov esi, eax
call fcn.1000c63e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10010228
test edi, edi
je 0x10010228
call esi
test eax, eax
je 0x1001021f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001021f
test byte [ebp - 0xc], 1
jne 0x10010228
or dword [ebp + 0x10], 0x200000
jmp 0x10010261
mov eax, dword [0x1016394c]
cmp eax, ebx
je 0x10010261
push eax
call fcn.1000c63e
pop ecx
test eax, eax
je 0x10010261
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10010261
mov eax, dword [0x10163950]
cmp eax, ebx
je 0x10010261
push eax
call fcn.1000c63e
pop ecx
test eax, eax
je 0x10010261
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10163948]
call fcn.1000c63e
pop ecx
test eax, eax
je 0x10010281
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10010283
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10011a20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [fcn.10011a20]
mov dword [0x10161dc4], 0x2ba
mov dword [ebp - 8], eax
mov eax, dword [0x10161dc4]
sub eax, 0x19bc
mov dword [0x10161dc8], eax
jmp 0x10011a52
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10011ab9
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10011a7a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0x4550
je 0x10011a4a
jmp 0x10011a7a
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov eax, dword [0x10161dc8]
add eax, 0x9fc
mov dword [0x10161dc4], eax
jmp 0x10011a9b
mov al, 1
test al, 1
jne 0x10011a52
jmp 0x10011aa3
mov eax, dword [0x10161dc4]
add eax, 0x31f
mov dword [0x10161dc8], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0xc
pop ebp
ret
Function at 0x10012390
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 4
call fcn.1000a0d0
mov eax, esp
mov dword [0x10161dc4], 0x9d2
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [0x10161dc4], 0x2420
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x10012496
jmp 0x1001257a
jmp 0x1001257f
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [0x10161dc4], 0x433
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
movzx eax, word [eax + edx*2]
cmp eax, 0
je 0x100124b1
jmp 0x100124b6
mov dword [0x10161dc4], 0x568
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
movzx eax, word [eax + edx*2 - 0x1a]
cmp eax, 0x6c
je 0x100124cd
jmp 0x10012583
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
movzx ecx, word [edx + ecx*2 - 0x14]
cmp ecx, 0x64
je 0x1001251f
jmp 0x100123eb
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
movzx eax, word [eax + edx*2 - 0x10]
cmp eax, 0x6c
je 0x1001253d
jmp 0x1001257a
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
add ecx, 1
mov dword [eax], ecx
jmp 0x10012496
jmp 0x100123eb
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x104
jl 0x100123f7
jmp 0x1001241d
jmp 0x1001241d
mov eax, dword [0x10161dc4]
sub eax, 0x20d9
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x10161dc8], eax
jmp 0x10012482
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
shl edx, 1
add eax, edx
add eax, 0xffffffe8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax]
cmp ecx, 0x6f
jne 0x10012581
mov dword [0x10161dc4], 0x23ba
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + ecx*2 - 0x16]
cmp ecx, 0x61
je 0x10012444
jmp 0x1001257f
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
movzx ecx, word [edx + ecx*2 - 0x12]
cmp ecx, 0x64
je 0x10012465
jmp 0x10012491
mov eax, dword [0x10161dc8]
add eax, 0x1815
mov dword [0x10161dc8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
movzx eax, word [eax + edx*2 - 0xe]
cmp eax, 0x6c
jne 0x100123e6
mov dword [0x10161dc4], 0x263b
mov dword [ebp - 4], 1
jmp 0x100123f0
jmp 0x10012491
jmp 0x10012581
jmp 0x10012583
mov dword [0x10161dc8], 0x18b8
mov dword [ebp - 4], 0
jmp 0x100123f0
Function at 0x407d60
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a39d0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4f8008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0xf01ff
call dword [0x4a93c4]
push eax
call dword [0x4a9054]
test eax, eax
jne 0x407dbc
xor esi, esi
jmp 0x407f00
test edi, edi
mov dword [ebp - 0x14], 0
lea esi, [ebp - 0x14]
xorps xmm0, xmm0
cmovne esi, edi
movlpd qword [ebp - 0x20], xmm0
push 0x94
mov dword [ebp - 0x24], esi
mov dword [esi], 0x94
call fcn.004769ab
mov edi, eax
mov dword [ebp - 0x1c], 0x94
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 1
push dword [esi]
call fcn.004769ab
push dword [esi]
mov ebx, eax
push 0
push edi
call fcn.00491bb0
mov esi, dword [0x4a9050]
lea eax, [edi + 4]
add esp, 0x14
mov dword [edi], 9
push eax
push str.SeRestorePrivilege
push 0
call esi
lea eax, [edi + 0x10]
push eax
push str.SeBackupPrivilege
push 0
call esi
lea eax, [edi + 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call esi
lea eax, [edi + 0x28]
push eax
push str.SeSecurityPrivilege
push 0
call esi
lea eax, [edi + 0x34]
push eax
push str.SeTakeOwnershipPrivilege
push 0
call esi
lea eax, [edi + 0x40]
push eax
push str.SeImpersonatePrivilege
push 0
call esi
lea eax, [edi + 0x4c]
push eax
push str.SeSystemProfilePrivilege
push 0
call esi
lea eax, [edi + 0x58]
push eax
push str.SeShutdownPrivilege
push 0
call esi
lea eax, [edi + 0x64]
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call esi
lea eax, [edi + 0x70]
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
call esi
lea eax, [edi + 0x7c]
push eax
push str.SeTcbPrivilege
push 0
call esi
lea eax, [edi + 0x88]
push eax
push str.SeTrustedCredManAccessPrivilege
push 0
call esi
lea eax, [edi + 0xc]
mov ecx, 0xc
nop
mov dword [eax], 2
lea eax, [eax + 0xc]
sub ecx, 1
jne 0x407ec0
mov eax, dword [ebp - 0x24]
push eax
push ebx
push dword [eax]
push edi
push ecx
push dword [ebp - 0x18]
call dword [0x4a904c]
test eax, eax
jne 0x407ef5
xor esi, esi
test ebx, ebx
je 0x407ef7
push ebx
call fcn.004769a6
add esp, 4
jmp 0x407ef7
mov esi, ebx
push edi
call fcn.004769a6
add esp, 4
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xffffffff
je 0x407f13
test ecx, ecx
je 0x407f13
push ecx
call dword [0x4a940c]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00476957
mov esp, ebp
pop ebp
ret
Function at 0x4213d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a49bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f8008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
lea ecx, [esi + 0x30]
mov dword [esi], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xff000000
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x20], 0xfff0f0ff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xc
mov dword [esi + 0x2c], 0
call fcn.00415e00
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push dword [ebp + 0x18]
mov dword [ebp - 4], 0
mov ecx, esi
push dword [ebp + 0x14]
mov dword [esi + 0x298], 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004214a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x424ee0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
mov ecx, dword [edi + 8]
movzx eax, al
shr esi, 8
mov eax, dword [eax*4 + 0x4cfd38]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
mov dword [edi + 8], ecx
pop edi
pop esi
ret
Function at 0x426c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x426c5b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x426d17
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
sub edi, 1
jne 0x426c70
pop edi
test esi, esi
je 0x426d3a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4cfd38]
sub esi, 1
jne 0x426d20
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x429ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x90
mov dword [ebp - 4], edx
mov ebx, ecx
call fcn.00476976
mov esi, eax
add esp, 4
mov dword [ebp - 8], esi
mov dword [esi], 0
lea ecx, [esi + 0x54]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x4c], 0
call fcn.00401930
lea ecx, [esi + 0x60]
call fcn.00401930
lea ecx, [esi + 0x6c]
call fcn.00401930
lea ecx, [esi + 0x78]
call fcn.00401930
lea ecx, [esi + 0x84]
call fcn.00401930
push 0x44
push 0
push esi
call fcn.00491bb0
add esp, 0xc
lea ecx, [esi + 0x6c]
push ebx
call fcn.00401a00
push dword [ebp - 4]
mov ebx, dword [ebp + 8]
lea ecx, [esi + 0x60]
mov dword [esi + 0x24], ebx
call fcn.00401a00
lea ecx, [esi + 0x60]
call fcn.00401b50
test eax, eax
je 0x429fd7
lea ecx, [esi + 0x60]
call fcn.00403870
push dword [ebp + 0x10]
lea ecx, [esi + 0x78]
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.00401a00
push 0x4cb4e0
lea ecx, [esi + 0x84]
call fcn.00401a00
push 0
push 0
push esi
push 0x42a070
push 0
push 0
call dword [0x4a93c0]
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x42a02e
push ecx
mov ecx, esi
call fcn.00429e60
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test bl, 1
je 0x42a061
xor edx, edx
mov ecx, eax
call fcn.00413360
test al, al
je 0x42a061
mov edi, dword [0x4a9344]
call fcn.004042f0
test al, al
jne 0x42a053
push 5
call edi
mov ecx, dword [esi + 0x3c]
xor edx, edx
call fcn.00413360
test al, al
jne 0x42a046
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x42bfd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a50bb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f8008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00401930
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
call fcn.00401930
lea ecx, [esi + 0x30]
call fcn.00404ea0
lea ecx, [esi + 0x34]
call fcn.00404ea0
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 3
call fcn.0042bf20
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 4
call fcn.0042bf20
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 5
call fcn.0042bf20
lea ecx, [esi + 0x78]
call fcn.00401930
lea ecx, [esi + 0x84]
call fcn.00401930
mov dword [esi + 0x98], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
lea ecx, [esi + 0x9c]
call fcn.00404ea0
lea ecx, [esi + 0xa0]
call fcn.00404ea0
mov dword [esi + 0xa4], 0
push ecx
mov ecx, esi
mov byte [ebp - 4], 0xc
call fcn.0042c200
mov dword [esi + 0x1c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42c0d0
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a50e0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4f8008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0xc]
call fcn.00401b50
cmp eax, 6
jle 0x42c115
lea ecx, [edi + 0xc]
call fcn.00401c90
push eax
lea ecx, [edi + 0x34]
call fcn.00407050
mov eax, dword [edi + 0xa4]
test eax, eax
je 0x42c128
push eax
call fcn.00480390
add esp, 4
lea ecx, [edi + 0xa0]
mov dword [edi + 0xa4], 0
call fcn.0042b4f0
lea ecx, [edi + 0x9c]
call fcn.0042b4f0
mov eax, dword [edi + 0x98]
test eax, eax
je 0x42c181
push fcn.00401ad0
lea esi, [eax - 4]
mov dword [ebp - 4], 0
push dword [esi]
push 0xc
push eax
call fcn.00476cfc
mov eax, dword [esi]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.004769b4
add esp, 8
lea ecx, [edi + 0x84]
call fcn.00401ad0
lea ecx, [edi + 0x78]
call fcn.00401ad0
mov eax, dword [edi + 0x70]
test eax, eax
je 0x42c1a4
push eax
call fcn.004769a6
add esp, 4
mov eax, dword [edi + 0x5c]
test eax, eax
je 0x42c1b4
push eax
call fcn.004769a6
add esp, 4
mov eax, dword [edi + 0x48]
test eax, eax
je 0x42c1c4
push eax
call fcn.004769a6
add esp, 4
lea ecx, [edi + 0x34]
call fcn.00406410
lea ecx, [edi + 0x30]
call fcn.00406410
lea ecx, [edi + 0xc]
call fcn.00401ad0
mov ecx, edi
call fcn.00401ad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret