joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6294e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x68803e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70c004]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
lea ebx, [esi + 0x7c]
push ebx
push ecx
push edx
mov ecx, esi
call fcn.006293e0
mov ebp, dword [esp + 0x34]
xor edi, edi
push ebp
push edi
lea ecx, [esi + 0x54]
mov dword [esp + 0x28], edi
mov dword [esi], vtable.CBaseRenderer.0
mov dword [esi + 0xc], vtable.CBaseRenderer.2.0
mov dword [esi + 0x10], vtable.CBaseRenderer.1.0
mov dword [esi + 0x50], edi
call fcn.0062c3d0
push ebp
push 1
lea ecx, [esi + 0x58]
mov byte [esp + 0x28], 1
call fcn.0062c3d0
push ebp
lea ecx, [esi + 0x5c]
push 1
mov byte [esp + 0x28], 2
call fcn.0062c3d0
push ebx
mov ebx, dword [0x6940a8]
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
call ebx
lea eax, [esi + 0x94]
push eax
call ebx
lea ecx, [esi + 0xc4]
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], 1
push ecx
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
call ebx
cmp dword [ebp], edi
jl 0x6295d7
mov edx, dword [esi + 0x5c]
push edx
call dword [0x694140]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10

Function at 0x62eff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x688404
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x70c004]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], vtable.SQNativeClosure.0
mov dword [esp + 0x14], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov ecx, 0x1000001
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], eax
mov ecx, dword [esp + 0x20]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x14], eax
add eax, 0x44
push esi
push eax
mov byte [esp + 0x1c], 4
mov dword [esi + 0x3c], ecx
call fcn.0063ab00
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8
Function at 0x634080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6887c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x70c004]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x10], 0x1000001
mov dword [esp + 0x14], ebx
mov eax, dword [esi + 0x78]
mov ecx, dword [eax + 0xc]
mov edi, dword [ecx + 0x24]
lea edx, [esi + 0x38]
push edx
mov ecx, esi
mov dword [esp + 0x2c], ebx
call fcn.00633080
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], 0x5000002
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov byte [esp + 0x2c], 1
call fcn.00633080
lea edx, [edi + 0xc]
push edx
mov ecx, esi
mov byte [esp + 0x2c], bl
call fcn.00633080
mov eax, dword [esp + 0x34]
cmp eax, ebx
jne 0x634113
mov eax, dword [esi + 0x78]
mov ecx, dword [eax]
push ecx
mov ecx, edi
call fcn.00631090
mov dword [esp + 0x18], 0x5000002
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x18]
push edx
mov ecx, esi
mov byte [esp + 0x2c], 2
call fcn.00633080
add edi, 0x14
push edi
mov ecx, esi
mov byte [esp + 0x2c], bl
call fcn.00633080
mov ecx, dword [esi + 0x30]
push ebx
lea eax, [esp + 0x14]
push eax
sub ecx, 5
push ecx
push 5
lea edx, [esi + 0x50]
push edx
mov ecx, esi
call fcn.00638240
push 5
mov ecx, esi
call fcn.00633010
or ecx, 0xffffffff
test dword [esp + 0x10], 0x8000000
mov dword [esp + 0x28], ecx
je 0x63418a
mov eax, dword [esp + 0x14]
add dword [eax + 4], ecx
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 4], ebx
ja 0x63418a
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x63a920
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
or ecx, 0x20
shr ecx, 5
mov eax, edx
cmp edx, ecx
jb 0x63a961
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea esp, [esp]
mov edi, eax
mov ebx, eax
shr ebx, 2
shl edi, 5
add edi, ebx
movsx bx, byte [esi]
movzx ebx, bx
add edi, ebx
sub edx, ecx
xor eax, edi
inc esi
cmp edx, ecx
jae 0x63a940
pop edi
pop esi
pop ebx
ret
Function at 0x63dff0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x689389
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70c004]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebx, ebx
mov dword [esi + 8], 0x1000001
mov dword [esi + 0xc], ebx
lea edi, [esi + 0x10]
mov ecx, edi
mov dword [esp + 0x28], ebx
call fcn.00646f30
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push esi
push 0x63d6b0
push eax
mov dword [esi + 0xb4], ebp
mov edx, dword [ebp + 0x80]
push ecx
push edx
mov ecx, edi
mov byte [esp + 0x3c], 2
call fcn.00646fb0
mov eax, dword [esp + 0x3c]
mov ecx, dword [ebp + 0x80]
push 0xffffffffffffffff
push eax
push ecx
call fcn.00630fa0
mov edi, eax
mov ebp, 0x8000010
mov edx, 1
add dword [edi + 4], edx
add esp, 0xc
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edi
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov dword [esi + 0xc], edi
mov dword [esi + 8], ebp
add dword [edi + 4], edx
mov byte [esp + 0x28], 3
test eax, 0x8000000
je 0x63e0c2
add dword [ecx + 4], 0xffffffff
jne 0x63e0c2
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
add dword [edi + 4], 0xffffffff
mov byte [esp + 0x28], 2
jne 0x63e0d6
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
mov cl, byte [esp + 0x44]
mov dl, byte [esp + 0x40]
mov byte [esi + 0x58], cl
mov byte [esi + 0x59], dl
mov dword [esi + 0x70], ebx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x18
Function at 0x6450d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x689820
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x70c004]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi + 0xdc]
push eax
push ecx
push edx
call fcn.00630fa0
mov ecx, 1
mov dword [esp + 0x1c], 0x8000010
mov dword [esp + 0x20], eax
add dword [eax + 4], ecx
add esp, 0xc
mov dword [esp + 0x20], 0
mov dword [esp + 8], 0x5000002
mov dword [esp + 0xc], ecx
mov byte [esp + 0x20], cl
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x84]
call fcn.006386a0
test dword [esp + 8], 0x8000000
mov byte [esp + 0x20], 0
je 0x645177
mov eax, dword [esp + 0xc]
dec dword [eax + 4]
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 4], 0
ja 0x645177
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esp + 0x20], 0xffffffff
test ecx, 0x8000000
je 0x6451ac
dec dword [eax + 4]
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 4], 0
ja 0x6451ac
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc
Function at 0x401b00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401b44
test esi, esi
je 0x401b44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b20
mov dword [esp], 0x407044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401e58
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401dbe
cmp eax, 4
jne 0x401de0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401dce
cmp edx, 4
je 0x401dce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d30
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp int.00401219
Function at 0x4010f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x15a4
mov ecx, 0x94
mov ebx, 0x6205
mov esi, 0x321c
lea ebx, [ebx]
mov eax, 0x92492493
imul edi
add edx, edi
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401110
mov edi, dword [ebp + 8]
test edi, edi
je 0x4011c5
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4011c5
cmp edi, eax
jae 0x4011c5
mov edx, 0x6d35
mov dword [ebp + 8], 0xb0
nop
cmp ecx, 0xb0
cmovg ecx, dword [ebp + 8]
dec edx
jne 0x401150
sub eax, edi
mov dword [ebp + 0xc], eax
mov ecx, 0x217c
mov eax, 0xb40b40b5
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401167
lea esp, [esp]
mov eax, 0x3e0f83e1
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401180
mov edx, dword [ebp + 0xc]
xor ecx, ecx
test edx, edx
je 0x4011b0
lea esp, [esp]
mov al, byte [ecx + edi + 1]
add al, 0x1b
xor byte [ecx + edi], al
inc ecx
cmp ecx, edx
jb 0x4011a0
mov edi, edi
mov eax, 0xb21642c9
imul esi
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4011b0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0xfc
mov ebx, 0x2e8
mov esi, 0x486f
mov ecx, 0x5f90
lea ebx, [ebx]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x401a60
mov eax, 0x42b0
mov edx, 0x3f
lea ecx, [ecx]
cmp edi, edx
cmovg edi, edx
dec eax
jne 0x401a80
jmp 0x401a90
mov eax, 0x81020409
imul ebx
add edx, ebx
sar edx, 6
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401a90
mov eax, 0x8c08c08d
imul esi
add edx, esi
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401aa5
mov eax, 0x70d0
nop
dec eax
jne 0x401ac0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea esp, [esp]
xor dword [esi + eax*4], edx
inc eax
cmp eax, 5
jb 0x401ad0
pop edi
pop esi
pop ebx
lea esp, [esp]
inc ecx
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*2]
add edx, edx
mov eax, ecx
sub eax, edx
jne 0x401afb
inc ecx
cmp ecx, 0x53e4
jl 0x401ae0
pop ebp
ret
Function at 0x402300
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
mov ecx, 0x51a7
xor edi, edi
mov dword [ebp - 4], 0x5787
mov ebx, 0x217c
mov edi, edi
mov eax, 0xea0ea0eb
imul ebx
add edx, ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x402320
mov eax, dword [ebp + 0xc]
mov ebx, esi
test eax, eax
je 0x4024a5
cmp dword [ebp + 0x10], ebx
jne 0x402350
cmp dword [ebp + 0x18], ebx
je 0x4024b8
mov edx, dword [eax + 0x3c]
add edx, eax
inc ebx
mov eax, ebx
and eax, 0x80000007
jns 0x402364
dec eax
or eax, 0xfffffff8
inc eax
jne 0x402367
inc ebx
cmp ebx, 0x18eb
jl 0x402355
nop
inc esi
mov eax, esi
and eax, 0x80000003
jns 0x40237f
dec eax
or eax, 0xfffffffc
inc eax
jne 0x402382
inc esi
cmp esi, 0x772e
jl 0x402370
mov ecx, 0x4a02
mov esi, 0xf4
mov eax, 0xdb
lea esp, [esp]
cmp eax, 0xf4
cmovg eax, esi
dec ecx
jne 0x4023a0
mov ebx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x4024b8
cmp dword [edx], 0x4550
jne 0x4024b8
mov eax, dword [edx + 0x7c]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4024b8
inc edi
mov eax, edi
and eax, 0x80000001
jns 0x4023e5
dec eax
or eax, 0xfffffffe
inc eax
jne 0x4023e8
inc edi
cmp edi, 0x1646
jl 0x4023d6
mov edi, dword [edx + 0x78]
add edi, ebx
mov ecx, 0x1581
lea ebx, [ebx]
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x402400
mov eax, dword [edi + 0x24]
mov edx, dword [ebp + 0x10]
mov ecx, dword [edi + 0x20]
add eax, ebx
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x1c]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, edx
add ecx, ebx
shr eax, 0x10
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x402460
xor esi, esi
cmp dword [edi + 0x18], esi
jbe 0x402460
mov eax, dword [ecx + esi*4]
add eax, ebx
push eax
push edx
call fcn.00402c30
add esp, 8
test eax, eax
jne 0x402480
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
inc esi
cmp esi, dword [edi + 0x18]
jb 0x402440
nop
mov eax, 0x5d9f7391
imul dword [ebp - 4]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 4], eax
jne 0x402460
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + esi*2]
mov ecx, dword [ecx + eax*4]
add ecx, ebx
cmp ecx, edi
jbe 0x40249c
mov eax, dword [ebp - 0x10]
add eax, edi
cmp ecx, eax
jb 0x4024b8
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x2fa0be83
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4024a5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
xor esi, esi
lea esp, [esp]
inc eax
mov ecx, eax
and ecx, 0x80000003
jns 0x402b00
dec ecx
or ecx, 0xfffffffc
inc ecx
jne 0x402b05
add eax, 2
cmp eax, 0x1209
jl 0x402af0
mov ebx, dword [ebp + 8]
inc byte [ebx + 0x127]
mov al, byte [ebx + 0x127]
mov byte [ebp + 0xb], al
mov edi, edi
inc edi
mov eax, 0x2aaaaaab
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
add ecx, ecx
mov eax, edi
sub eax, ecx
jne 0x402b3b
inc edi
cmp edi, 0x614
jl 0x402b20
movzx edx, byte [ebp + 0xb]
movzx ecx, byte [edx + ebx + 0xa]
movzx eax, byte [ebx + 0x11d]
add edx, ebx
add eax, ecx
movzx edi, al
mov byte [ebx + 0x11d], al
movzx eax, byte [edi + ebx + 0xa]
mov cl, byte [edx + 0xa]
mov byte [edx + 0xa], al
mov byte [edi + ebx + 0xa], cl
nop
inc esi
mov eax, esi
and eax, 0x80000001
jns 0x402b7f
dec eax
or eax, 0xfffffffe
inc eax
jne 0x402b82
inc esi
cmp esi, 0x1c84
jl 0x402b70
add cl, byte [edx + 0xa]
pop edi
movzx eax, cl
movzx ecx, byte [ebp + 0xc]
movzx eax, byte [eax + ebx + 0xa]
pop esi
xor eax, ecx
pop ebx
pop ebp
ret
Function at 0x40f7f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40f86d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call sub.rtl60.bpl__System__LStrSetLength_qqrv
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call sub.rtl60.bpl__System__LStrLen_qqrx17System_AnsiString
push eax
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrSetLength_qqrv
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040f6f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f874
lea eax, [ebp - 0xc]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x4173c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x417457
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x417470
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41745e
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x425088
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x4250ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x4250d7
push 3
push 0x4250f8
push 0x4250f8
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x4250fc
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4250f4
lea eax, [ebp - 8]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret